Section 6.

Project Requirements 203

Redundant communication line interface equipment shall be tested by periodically retrieving

data over these lines and checking for the ability to communicate with the redundant channel for
any errors.
Designated backup server(s) and associated auxiliary memories shall be automatically tested for
proper operation to ensure they are ready if needed for a failure over contingency. Any failure
to perform diagnostic functions correctly shall cause an alarm to be issued.
2.7.6.3 Data Exchange Utilities
Facility of data export and import between this system and external systems shall be provided
through web services.
2.7.6.4 Other Utility Services
AMI Application management shall include the following utility services:
a) Loading and storage of information from labelled portable media storage units as dictated
by the requirements of this specification.
b) Preparation of .pdf output for the displays/reports available in the AMI Application system.
It should also be possible to export all the reports to any MS-Office format.
c) Displays and Reports for Web server -The AMISP shall provide utilities for preparing
displays and reports suitable for Web publishing. These utilities shall be used to generate,
all required displays and reports from the system displays and reports, automatically(without
requiring rebuilding).
d) Online access to user and system manuals for all software products (e.g., OperatingSystem
and Relational Database Software) and AMI applications shall be provided with computer
system
e) Antivirus Software - All computers and firewalls shall be provided with the latest antivirus
software as on date of supply. The antivirus software shall have the capability of having its
virus definitions updated from time to time. The AMISP shall be responsible for the
maintenance & update of the antivirus software during the contract period.
f) Software Upgrade-The AMISP shall be responsible for the maintenance & update of the
patches and signatures of operating system, applications (AMI Applications) system and
Web based System up to the contract period.
g) Automated patch management and anti-virus tools shall be provided to expedite the
distributions of patches and virus definitions to the system using an orchestration facility.
These tools should consider the possibility to use standardized configurations for IT resources.
2.7.7 Cyber Security General Guidance
Cyber security governance problems are unique as well as evolving therefore, they cannot be dealt
with a traditional approach. For establishing secure and resilient Smart Meter systems, a
standardized cybersecurity framework should be adopted by the AMISP in consultation with the
Utility and relevant stakeholders. The key elements of the cyber security framework mustinclude:
a) Differentiation of stakeholders into broad categories to aid in proper distribution of
responsibilities among stakeholders and avoid overlapping

203
Section 6. Project Requirements 204

b) Defined set of responsibilities for each stakeholder group. As a result, the decision-making
process is streamlined, and proper management hierarchy is established for handling the
reported cyber-attacks. The roles and responsibilities are divided into two groups:
i. Cyber strategy and governance: The responsibilities under this group relates to the
policy and decision-making aspects of cyber security framework
ii. Cyber security risk, operations and compliance: This group comprises of
responsibilities relating to the operational parts of implementing cyber security policies
c) Standardization of security practices and abundant guidance from knowledge bodies while
implementing security controls and processes. There are multiple global security standards
and Indian standards that are relevant in context of underlying technologies used in smart
meters:
i. National Institute of Standards and Technology (NIST) has developed a framework for
Cyber Physical Systems (CPS). The Framework provides a taxonomy and organization
of analysis that allow the complex process of studying, designing, and evolving CPS to
be orderly and sufficiently encompassing.
ii. Department of Electronics and Information Technology (DeitY), Government of India
has developed a National Cyber Security Policy. It aims at protecting the public and
private infrastructure from cyber- attacks. The policy also intends to safeguard
"information, such as personal information (of web users), financial and banking
information
d) Cyber security incident management: The ISO/IEC Standard 27035 outlines a five-step
process for security incident management, including:
i. Prepare for handling incidents.
ii. Identify potential security incidents through monitoring and report all incidents.
iii. Assess identified incidents to determine the appropriate next steps for mitigating the
risk.
iv. Respond to the incident by containing, investigating, and resolving it
v. Learn and document key takeaways from every incident
Notwithstanding the measures suggested above, the following guidelines/strategies shall be taken
care of by the AMISP for making the entire AMI system including the NOMC immune to Cyber
Attacks.
a) All the Hardware, OS and application software shall be hardened.
b) Application, scanning and hardware scanning tools shall be provided to identify vulnerability
& security threats.
c) Data shall be encrypted at system/device/technology level.
d) Network Zoning shall be implemented as per the proposed architecture. However, the AMISP
may suggest other methods of network architecture without compromising thesecurity of the
System.
e) Internal user shall be allowed to access all adjacent zones. However, they will not have access
to remote network zone.
f) While procuring cyber security items testing must be done and the system must be secure by
design.
g) Residual information risk shall be calculated by AMISP and same shall be submitted to the
Utility for approval.
h) All default user id & passwords shall be changed.
i) All log in/out and cable plugs in/ out shall also be logged in Central Syslog server.

204
Section 6. Project Requirements 205

j) Penetration & Vulnerability assessment test from CERT-IN certified auditors during SAT &
Operations and Maintenance period.
k) Auditing by third party during SAT and annually during operations and maintenance period
shall be in the scope of AMISP.
l) As the computer system in NOMC has access to external environment the AMISP shall
document and implement Cyber Security Policy/Plan in association with the Utility to secure
the system.
m) Latest Cyber Security Guidelines issued by CERT-In specified at http://www.cert-in.org.in/,

use in the power Supply System and Network in the country to check for any kind of embedded
malware /trojans/ cyber threat and for adherence to Indian Standards
No. No.9/16/2016-Trans-Part(2) published by Ministry of Power, Government of India dated
18 November 2020 and amended from time to time) or any other competent authority shall be
followed.
n) AMISP shall adhere with the appropriate security algorithm for encryption and decryption as
per established cyber security guidelines. For smooth functioning of the entire system, it is
essential that the AMISP shall provide in the form of a document enough details of such
algorithm including the mechanism of security key generation to the Utility. In case of
proprietary or secret mechanism, the same shall be kept in a secured escrow account.
2.7.8 Data Privacy
AMISP should describe ensure that the system is compliant with the applicable provisions of the

2011 (IT Data

Protection requirements. In this regard, the general elements of the data privacy framework may
include:
a) The Utility shall be the sole custodian of the Smart Meter data. The AMISP and its contracted
vendors will have limited need basis access to the data. In case of pre-mature termination or
at the end of contract, the AMISP and the contracted vendors should relinquish all access to
the data and transfer the same to the Utility.
b) which
details out all the policies, practices, processes and technologies employed to manage,and
process the Smart Meter data in a secure manner. This should also include the details on
methods of anonymization applied to the personal Smart Meter data based on data types
defined below:
i. Aggregated Data: No identification individually and at neighborhood level unless
explicitly required to report
ii. Anonymized Data: A data set which has individual Smart Meter data but without any
personally identifiable information like consumer name, account number, address etc.
iii. Personal Data: A data set with Smart Meter data tagged with personally identifiable
information.
c) AMI system should enable the Utility to get the consumer consent on sharing and processing
of Smart Meter data based on following criteria
i. Consumer consent not required
1) If any type of Smart Meter data is processed by the Utility or a third party on behalf
of Utility for the purpose of generating bills, identifying theft, network planning,
load forecasting or any related activities that can enable the Utility to fulfil its duty
as a licensee.

205
Section 6. Project Requirements 206

2) If any type of Smart Meter data is requested by the law enforcement agencies.
3) If aggregated or anonymized data is shared with not-for-profit academics, policy
research, civil society entities for research that can benefit the sector in general.
ii. Opt-out consumer consent
1) If any type of smart meter data is shared with or processed by any third-party
commercial entity to provide services other than as enabled by regulation. In this
case, the AMI system should enable the Utility to conduct the following consumer
consent process
Consumer should be notified and given a time to opt-out
Consumer should have the right to change his/her option through the app/web
account/direct communication to Utility.
d) AMI system should enable following Data sharing protocol
i. Data should be shared by providing finite and secure access to the system. The access
can be modified or terminated as need be.
ii. Sharing of part/full database shall be subject to review and consent of Utility.
e) All data sharing shall be recorded and periodically submitted to utility for review / regulatory
requirement
f) AMISP should have a data breach response plan and should communicate to the utility and
consumers in case of any data breach from AMI system
g) AMISP is responsible to conduct 3rd party data privacy audit at least once every year based
on evaluation criteria pre-identified by the Utility in consultation with data experts. The audit
report should be made available to Utility. AMISP to take necessary actions on audit
observations in consultation with the utility.

206