India Tightens Cybersecurity Regulations for Banks and Power Infrastructure

India has significantly strengthened its cybersecurity landscape with new mandates targeting critical sectors. The Reserve Bank of India issued updated cybersecurity directions on July 31, 2026, for commercial banks, while the Central Electricity Authority has published the Cyber Security in Power Sector Regulations, 2026. These regulations impose strict obligations on power generation, transmission, and grid dispatch infrastructure, requiring the establishment of 24x7 Information Security Divisions and mandatory IT/OT isolation to prevent cross-system breaches.

The new rules introduce rigorous operational requirements, including a strict 6-hour incident reporting timeline for power sector entities. Furthermore, the IT Rules 2026 have set stringent compliance timelines for digital platforms, requiring action on unlawful or harmful content within three hours. These measures are designed to enhance national resilience against cyber threats, ensuring that critical infrastructure and digital services can withstand and respond to sophisticated attacks in an increasingly digitized economy.

The regulatory push is accompanied by strong growth in IT spending. Gartner forecasts India's IT services spending to grow by 11.1% in 2026, driven by enterprise investments in infrastructure as a service and application modernization. Additionally, software spending is projected to reach $24.7 billion, a 17.6% increase, fueled by rising demand for AI-enabled software solutions. As companies invest in compliance and modernization, the Indian IT sector is poised for significant expansion, balancing regulatory adherence with technological innovation to support the country's digital growth.