OT SECURITY

SECURING THE GRID’S CONTROL SYSTEMS

Inverters, battery storage, SCADA and the controllers behind them are now regulated security assets in India. Station Zero tests them on an isolated testbed, never on live plants, so OEMs, generators and investors can prove they are ready.

START A CONVERSATION
WHY NOW

Binding power-sector cyber rules from 1 April 2027

The CEA (Cyber Security in Power Sector) Regulations, 2026 replace voluntary guidelines with binding obligations across generation, transmission, distribution, load dispatch and storage, including generators, captive plants and storage above 50 MW.

ISOLATION
OT physically separated from the internet and corporate IT.
REMOTE OPERATIONS
Run from within India over a dedicated, isolated channel.
PRE-COMMISSIONING
Audits and VAPT before new critical systems go live.
6-HOUR REPORTING
Incidents reported to CSIRT-Power and CERT-In within six hours.
TRUSTED SUPPLY CHAIN
OT from trusted sources; vendor-caused breaches can trigger action.
DATA AND PEOPLE
Sensitive data encrypted and kept in India; mandatory training and qualified security leads.
WHAT WE OFFER

From the controller to the boardroom

01

CONTROLLER-LEVEL TESTBED

PLCs, RTUs, protocol gateways, and inverter and battery-storage controllers on an isolated testbed, physically separate from our AI and SOC networks.

02

INVERTER AND BESS FIRMWARE ANALYSIS

Firmware analysis and SBOMs for inverters and battery controllers sold in India, so weaknesses are found before your buyers find them.

03

PRE-COMMISSIONING TESTING

Testing of equipment and plant designs in the lab before go-live, working alongside empanelled auditors for formal audits.

04

SECURE REMOTE OPERATIONS

Design and review of in-India, isolated remote-access channels for OEMs that service plants, with logging and monitoring built in.

05

REGULATORY READINESS

Gap assessments and evidence packs against the CEA regulations, CERT-In requirements and a recognised OT security standard.

06

INCIDENT READINESS

Six-hour reporting playbooks and incident exercises rehearsed on a replica of your control environment.

07

OT SECURITY TRAINING

Hands-on training for plant and vendor staff, and a pipeline of engineers for new security divisions.

08

INVESTOR OT DILIGENCE

One OT-readiness scorecard across plants and shortlisted equipment, before acquisition and across a portfolio.

OUR GROUND RULES
No active testing on live plants
We test on the lab testbed and replicas. On operating sites we use passive methods only.
Coordinated disclosure
Findings go to the OEM, and to CERT-In where appropriate, under an agreed process.
Compliance, not circumvention
We help vendors meet trusted-source rules, never work around them.
Sealed research data
Vulnerability data stays air-gapped and is never released publicly.

WHO WE WORK WITH

Foreign inverter, battery-storage, SCADA and automation OEMs selling into India
Private generators and IPPs above 50 MW
Infrastructure and renewables investors
Indian OEMs exporting to the EU
START A CONVERSATION

READY BEFORE APRIL 2027.

Tell us what equipment you supply or operate in India and when it goes live. We’ll come back with a proposed scope.

[CONTACT EMAIL]
Xavier Institute of Engineering, Mahim, Mumbai
[ENGAGEMENT NOTE: e.g. commercial assessments delivered through Starkfleet Advisory]