In force
CERT-In Directions: Six-hour incident reporting
Listed cyber incidents reported to CERT-In within six hours; ICT logs retained and clocks synchronised.
Energy & Utilities
Meter, outage and asset data that engineers can act on.
What we would build for distribution companies, renewable energy developers and gas distribution companies: integration on a common network model, meter data platforms with consumer consent built in, knowledge for line crews, and IT/OT security ready for six-hour reporting to CERT-In.
For State distribution companies, renewable energy developers and city gas distribution companies, and for Indian groups with energy assets in Europe.
28 April 2022
Six-hour reporting to CERT-In
Listed cyber incidents go to CERT-In within six hours of being noticed, and ICT logs must be retained.
SourceCERT-In Directions under s. 70B(6) IT Act (opens external site)
May 2027
DPDP duties for consumer data
Notice, security safeguards and breach intimation apply to the personal data of consumers that utilities hold digitally.
2 December 2027
EU AI Act and critical infrastructure
In the EU, AI used as a safety component in electricity, gas or heating supply becomes high-risk under the 2026 amendment.
What is changing for Indian utilities and developers
Connections outpace network build-out
Rooftop solar, renewable parks, storage and EV charging ask for capacity faster than feeders and substations can be reinforced. In the EU, the 2024 market reform turned flexibility assessments and published connection capacity into duties for system operators; an Indian distribution company faces the same data question without that statute.
Flexibility depends on meter data
Smart meters, feeder monitoring and forecasts are what make demand response and storage usable on a distribution network. The EU Electricity Directive shows where this leads: metering data shared under access rules between operators, suppliers and aggregators.
SourceDirective (EU) 2019/944
Control systems sit inside incident law
CERT-In’s Directions require listed cyber incidents to be reported within six hours, so control-room and IT teams need one incident process. IEC 62443 gives engineers a common language for zones and conduits, and in the EU, NIS2 treats energy as a sector of high criticality.
Networks age, and so does know-how
Many feeders and substations were built decades ago, and the engineers who know their quirks are retiring. Asset decisions need condition data, maintenance history and that experience together, searchable by the line staff who come next.
Problems we are asked to solve
- The problem
GIS, SCADA, asset registers and billing each describe the network in their own way.
What we would doIntegration on the IEC Common Information Model (IEC 61970 and 61968) over an event backbone, so planning, operations and billing share one network model rather than swapping files overnight.
- The problem
Requests to connect rooftop solar and EV chargers wait because nobody can say where capacity remains.
What we would doA data product that combines meter data, SCADA readings and the connection pipeline into load and congestion forecasts per feeder, each figure stated with its accuracy and assumptions.
- The problem
Smart meter data arrives in volumes, and under consent and access rules, that billing systems were never built for.
What we would doA meter data platform that validates, stores and serves interval data, with consent records, role-based access and logs designed against the DPDP Rules for consumers’ personal data.
- The problem
Each new feed from the control network to IT opens another path for attackers.
What we would doIT/OT architecture with zones and conduits per IEC 62443, one-way transfer where the risk warrants it, central identity and the logs on which a six-hour report to CERT-In depends.
- The problem
Line crews search drawings, procedures and work history across several systems.
What we would doA knowledge assistant for line crews and control room staff over procedures, asset records, inspection reports and past work orders, naming document and revision. It advises only: switching orders always come from the control room.
- The problem
Call centres are swamped during outages, tariff revisions and connection peaks.
What we would doService assistance that answers outage, connection and bill questions from source systems and passes anything consequential to staff, plus document intelligence that checks connection applications and installer certificates before an engineer sees them.
Grid IT/OT reference design
Control levels stay as they are. Above the zone boundary, an integration layer built on CIM and events exposes operational data to analytics, knowledge and reporting services.
Illustrative example
Operational data leaves the control zone at one point, the integration layer, and serves every service above it.
Read the diagram as text
From the top: the enterprise layer (ERP, asset management, consumer billing); grid operations (ADMS or EMS, outage and work management, meter head-end); supervisory control (SCADA and IEC 61850 substation automation); control and protection (RTUs, IEDs, relays); and primary equipment (lines, transformers, switchgear, generation, storage).
An IEC 62443 zone boundary separates the enterprise layer from everything beneath it.
Levels 1 to 4 send data to an integration layer built on CIM and events. It feeds a platform for grid, meter and asset data, which supports load, congestion and asset health analytics, a knowledge assistant for line crews and the control room, and regulatory and market reporting.
The control room decides
Analytics and assistants only read. Switching, setpoints and protection settings remain with the ADMS or SCADA and the engineer on duty.
Segmented networks
Segmentation per IEC 62443, with documented conduits and one-way transfer out of the control zone where the risk calls for it.
A single network model
CIM is the shared vocabulary of GIS, operations, planning and billing, so a change to the network is recorded once.
Forecasts that state their error
Load, congestion and asset health models publish their error, and where the data is too thin for a forecast, we tell you.
Indian and European dates for grid and utility systems
Indian incident and data protection rules sit next to the EU cybersecurity, market and resilience rules that European operators follow. State regulations and EU network codes add dates of their own.
In force
DPDP Act: Data protection law published
Consumers’ personal data held digitally, billing and meter records among it, comes under one national law.
In force
EU electricity market design: EU market reform in force
Flexibility assessments, flexible connection agreements, energy sharing and a choice of contracts for customers.
In force
NIS2: Member State NIS2 laws take effect
Electricity, gas, hydrogen, oil and district heating in the EU come within scope.
In force
EU electricity market design: Deadline to transpose most of the Directive
In force
EU demand response: ACER proposes a demand response network code
Market access for smaller flexibility providers and closer coordination between distribution and transmission operators; adoption by the Commission comes next.
In force
EU metering data access: Member States report their metering data practices
Each describes how its procedure maps onto the EU reference model.
In force
European Grids Package: Commission tables the European Grids Package
Proposals on grid planning and permitting, with guidance on connecting users on time.
In force
CER Directive: Critical entities named in the EU
Named entities then assess their risks and take resilience measures.
In force
EU hydrogen and gas package: Gas Directive transposition deadline
Shared rules for the EU markets in renewable gas, natural gas and hydrogen.
Position on 6 November 2026
Ahead
AI Act: High-risk duties take effect
Covers AI used as a safety component in electricity, gas or heating supply in the EU, under the 2026 amendment.
European reference points for Indian utilities
These EU instruments bind European grid operators and utilities, not Indian ones. They show where grid data, security and AI rules are heading, and Indian groups with energy assets or customers in the EU meet them directly.
Planning orientation only, not legal or regulatory advice; State regulations and EU network codes add requirements of their own. Indian rules as they stood on 6 November 2026; EU dates checked on 12 October 2026.
- NIS2 for energyScopeEU instrument
Classes energy as highly critical, from producers and suppliers to network operators, aggregators, storage, charging points, district heating, oil, gas and hydrogen, with duties for risk management, incident reporting and supplier security.
How it affects youThe Indian counterpart is CERT-In’s six-hour reporting. Under either regime OT security and incident handling need evidence rather than policy, and we build access control, logging and incident data into platforms from the first release.
SourceDirective (EU) 2022/2555, EUR-Lex (opens external site)
- Network code on cybersecurityScopeEU instrument
Delegated Regulation (EU) 2024/1366 sets sector rules for the cybersecurity of cross-border electricity flows in Europe: recurring risk assessments at Union, regional and national level, the identification of high-impact and critical-impact entities, and minimum and advanced controls for them and their supply chains.
How it affects youRelevant to Indian suppliers of grid equipment or software to European operators. We document architecture, components and controls so that they map onto the buyer’s risk assessment.
SourceDelegated Regulation (EU) 2024/1366, EUR-Lex (opens external site)
- Electricity market design reformScopeEU instrument
Regulation (EU) 2024/1747 and Directive (EU) 2024/1711 amend the EU electricity market rules: national flexibility assessments built on system operator data, flexible connection agreements, and connection capacity published in fine spatial detail. Customers gain energy sharing and a choice between fixed-price and dynamic contracts.
How it affects youFlexibility, connection capacity and tariff choice turn into data products. For a utility in India or in Europe, we build the forecasting, publication and settlement flows behind them.
SourceRegulation (EU) 2024/1747, EUR-Lex (opens external site)
- Smart metering and data accessScopeEU instrument
The EU Electricity Directive sets functional requirements for smart meters and demands secure data management with non-discriminatory access to metering data. Implementing Regulation (EU) 2023/1162 adds interoperability rules and access procedures.
How it affects youIn India, meter and billing data linked to a consumer is digital personal data under the DPDP Act, with Data Fiduciary duties from May 2027. We design consent records, standard interfaces and access logs accordingly.
SourceDirective (EU) 2019/944, EUR-Lex (opens external site)
- REMITScopeEU instrument
The EU regulation on wholesale energy market integrity prohibits market manipulation and insider trading and requires inside information to be disclosed and transactions reported to ACER. The 2024 amendment added inside information platforms, a notice for algorithmic trading and stronger investigation powers for ACER.
How it affects youThis matters to Indian developers and traders active on European wholesale markets. Outage and capacity data in operational systems can be inside information, so we design disclosure and reporting flows to be prompt and traceable.
SourceRegulation (EU) No 1227/2011, EUR-Lex (opens external site)
- Critical Entities Resilience DirectiveScopeEU instrument
Covers the physical and organisational resilience of critical entities in the EU, energy included. Member States name those entities by 17 July 2026, after which each assesses its risks and takes technical, security and organisational measures.
How it affects youContinuity planning covers cyber and physical events alike. The systems we build come with mapped dependencies and recovery paths that have actually been tested.
SourceDirective (EU) 2022/2557, EUR-Lex (opens external site)
- AI Act and critical infrastructureScopeEU instrument
AI meant as a safety component in managing and operating the supply of water, gas, heating or electricity is high-risk under Annex III, with duties from 2 December 2027 under the 2026 amendment. An Indian provider is covered where its system’s output is used in the EU.
How it affects youEach use case is classified at the start. A tool that advises an engineer is documented very differently from one that acts on the network; the latter stays out of scope unless the high-risk route is planned and budgeted.
SourceRegulation (EU) 2024/1689, EUR-Lex (opens external site)
Illustrative use cases
Illustrative exampleProcedures and asset history for line crews
Crews get the procedure, the asset history and the relevant drawings, each with its source. Switching remains under control room authority.
Rooftop solar connection applications
Applications, single-line diagrams and installer certificates read and checked for completeness; an engineer reviews every exception.
Outage and bill questions at peak load
Consumers get the current outage status and answers about their bill from source systems; staff handle complaints and payment difficulties.
Billing system behind APIs
An older billing and consumer system wrapped in documented APIs and replaced process by process, while meter reading and collection continue.
Substation inspections to work orders
Thermography and inspection reports for substations and feeders read, matched to the asset and proposed as maintenance orders for an engineer to confirm.
Platforms for utilities and developers
SAP
Gold PartnerSAP S/4HANA Utilities for billing and collection at distribution companies, with SAP asset management for networks, substations and generating plants.
Salesforce
Summit PartnerConnection requests, consumer service and field service for utilities and renewable developers, linked to billing and the customer information system.
Odoo
Gold PartnerProjects, field service, inventory and invoicing for rooftop solar installers, energy service companies and smaller producers, with GST e-invoicing where it applies.
Partner tiers shown are FromNine’s own. Product names belong to their respective owners.
India
Indian networks, European reference points
Indian distribution companies and renewable developers work under CERT-In’s six-hour reporting and, for consumer data, the DPDP Act and Rules, with Data Fiduciary duties from May 2027. Smart metering, rooftop solar and EV charging are multiplying the data each network produces.
European rules such as NIS2, the network code on cybersecurity and the market design reform do not bind Indian utilities, but they show where grid data and OT security requirements are heading. We build integration and data platforms on international standards such as CIM and IEC 62443, so the same architecture holds wherever a group operates.
- CERT-In Directions 2022CERT-In Directions of 28 April 2022 under s. 70B(6) of the IT Act: reporting of listed cyber incidents within 6 hours, log retention, time synchronisation (opens external site)
- DPDP Act 2023Digital Personal Data Protection Act, 2023, also covering processing outside India connected with offering goods or services to Data Principals in India (opens external site)
- DPDP Rules 2025Digital Personal Data Protection Rules, 2025, brought into force in three steps over eighteen months (opens external site)
- NIS2NIS2 Directive (EU) 2022/2555 (opens external site)
- EU AI ActArtificial Intelligence Act, Regulation (EU) 2024/1689 (opens external site)
Frequently asked questions
Could your software ever switch our network?
No. By default, analytics and assistants only read operational data. Switching, setpoints and protection settings stay with the ADMS or SCADA and the engineers accountable for them, under your change control.
Do you use the Common Information Model?
Yes: IEC 61970 and IEC 61968 for network and asset data, and IEC 62325 where market messages are involved. Systems with formats of their own are mapped to CIM in the integration layer.
How do you treat smart meter data and privacy?
Interval data shows how a household lives, so we treat consumer meter data as personal data under the DPDP Act: purpose limitation, role-based access, consent where it is the basis, pseudonymisation for analysis and fixed retention, with logs kept for at least one year as the DPDP Rules require from May 2027.
Can you forecast congestion or equipment failure?
Sometimes. It depends on metering coverage, history and how the network is run. We test before promising, publish measured accuracy and uncertainty, and suggest rule-based methods where a model would not hold up.
How do you support incident reporting to CERT-In as a supplier?
Our information security management system is ISO/IEC 27001 certified. We agree security requirements and incident notification in the contract so that you can report within six hours, use least-privilege and logged access to your environments, and document our components for your supplier risk assessment. For European utilities, the same evidence serves NIS2.
Must we replace our billing system?
No. We integrate first and modernise in steps: APIs around the existing system, then process by process where it pays, with reconciliation until the old path is retired.
Discuss your network or utility programme
Integrating network data, preparing consumer meter data for the DPDP Rules or securing IT/OT data flows? Begin with one division, one process or one data flow.