Resources Categories
INDUSTRY FACT FILE · AUTOMOTIVE & MOBILITY
Industry Overview: Automotive and Mobility in India
Who designs, builds, sells, charges and operates India's vehicles, the obligations that apply, who buys cybersecurity and why each type of company needs a distinct approach.
|
In this document 1. Why automotive cybersecurity matters now 2. The ecosystem at a glance 3. Categories of automotive and mobility companies 4. The regulatory, standards and customer framework at a glance 5. Government, public-sector and private participants 6. Who buys cybersecurity inside an automotive company 7. Why each type of company needs a different approach 8. How Codec Networks works with automotive and mobility companies |
|
Sector scope Sector: vehicle OEMs, tier-1 and tier-2 component suppliers, EV and battery manufacturers, charging networks, dealers and mobility platforms, fleet and telematics providers. Primary service proposition: vehicle network testing, embedded security, OTA update reviews and charging API and cloud security. General manufacturing, logistics and insurance have separate fact files. |
1. Why automotive cybersecurity matters now
India is one of the world's largest automotive markets. In FY2024-25 passenger vehicle sales reached a record 4.3 million units and two-wheeler sales 19.6 million, with exports growing faster still. Government policy is pushing the industry up the value chain: the Production Linked Incentive scheme for automobiles and components (₹25,938 crore), the PLI for advanced chemistry cell batteries (₹18,100 crore) and the PM E-DRIVE scheme for electric vehicles and charging (₹10,900 crore). Behind the OEMs sit thousands of component suppliers, a growing EV and battery ecosystem, charging networks, dealer groups, engineering-services firms and fleet and mobility platforms.
|
5 weeks Jaguar Land Rover's production halted by a cyberattack (2025) |
15,000 Dealerships disrupted by the CDK Global ransomware attack (2024) |
14 plants Toyota plants halted by one supplier's incident (2022) |
Oct 2026 Proposed first AIS 189/190 compliance date (draft CMVR rules) |
The vehicle itself has become a connected computer. Telematics units, companion apps, over-the-air (OTA) updates, dealer portals and cloud back-ends link every car to the internet; charging networks run on OCPP back-ends and payment systems; and fleets depend on telematics that can locate and even immobilise vehicles. Plants run on PLCs, robots and MES fed by ERP, and just-in-time supply means a supplier's outage stops the line within hours.
The incidents of the last four years define the stakes. In March 2022, a cyber incident at one parts supplier halted all 14 of Toyota's Japanese plants. In June 2024, ransomware at CDK Global, a dealer-software provider, put about 15,000 North American dealerships on paper for two weeks, with losses estimated at up to a billion dollars. In September 2025, a cyberattack halted Jaguar Land Rover's global production for about five weeks; the UK's Cyber Monitoring Centre estimated the economic cost at £1.9 billion, affecting more than 5,000 businesses, and the UK government provided a £1.5 billion loan guarantee. Security researchers have repeatedly shown that companion-app and dealer-portal API flaws can let strangers locate, unlock and start vehicles.
Regulation is catching up. India's AIS 189 (Cyber Security Management System) and AIS 190 (Software Update Management System), aligned with UN Regulations R155 and R156, are moving into type approval: MoRTH's 2026 draft notification proposes phased mandatory compliance under the Central Motor Vehicle Rules from October 2026, and leading OEMs have already obtained ARAI certification. CERT-In's Directions require six-hour incident reporting and its 2025 audit guidelines expect independent audits covering OT; listed companies disclose cyber incidents quarterly under SEBI's LODR; the DPDP Act and Rules will govern customer, vehicle and driver data from May 2027; and global OEM customers demand TISAX, ISO/SAE 21434 and, for connected products sold in the EU, Cyber Resilience Act compliance.
|
Key takeaway Automotive cybersecurity now spans the plant, the supply chain, the dealer, the charger and the car itself. Protecting production, data and the vehicle together is becoming a condition of type approval and of every OEM contract. |
2. The ecosystem at a glance
Figure 1: India's automotive and mobility ecosystem.
3. Categories of automotive and mobility companies
|
Category |
Who they are |
Typical ownership |
Key regulatory basis |
|
Vehicle OEMs |
Passenger vehicles, commercial vehicles, two- and three-wheelers, tractors; design, assembly and sales networks |
Listed Indian groups, global OEM subsidiaries, joint ventures |
CMVR and AIS 189/190; CERT-In; SEBI LODR (listed); DPDP; UN R155/R156 for exports |
|
Tier-1 and tier-2 component suppliers |
Electronics, ECUs, powertrain, castings, interiors, software and systems |
Listed and private companies, many MSMEs |
CERT-In; OEM requirements incl. TISAX and ISO/SAE 21434; DPDP |
|
EV and battery manufacturers |
Electric two-, three- and four-wheelers, buses, cells, packs and battery management systems |
Start-ups, OEM EV arms, PLI-ACC beneficiaries |
AIS 156 battery safety; AIS 189/190; CERT-In; PLI conditions |
|
Charging networks |
Charge point operators, charging hardware makers, roaming and payment platforms |
Private CPOs, PSU energy companies, DISCOM ventures |
Ministry of Power charging guidelines; BIS charging standards; PCI DSS for payments; CERT-In; DPDP |
|
Dealers and distribution |
Dealer groups, dealer management system providers, finance and registration integrations |
Private dealer groups, SaaS providers |
CERT-In; DPDP; OEM dealer standards; Vahan/Sarathi integrations |
|
Mobility platforms |
Ride-hailing, car subscription, leasing, parking and mobility apps |
Private platforms |
CERT-In; DPDP; consumer protection; payment rules |
|
Fleet and telematics providers |
Fleet management, vehicle tracking (AIS 140), logistics and public transport technology |
Private technology companies, state transport bodies |
AIS 140 for tracking devices; CERT-In; DPDP; customer contracts |
|
Engineering services |
Automotive ER&D, embedded software and testing partners |
Listed and private ER&D companies |
CERT-In; OEM contracts; TISAX; ISO/SAE 21434 |
4. The regulatory, standards and customer framework at a glance
|
Instrument or expectation |
What it means for automotive and mobility companies |
|
AIS 189 and AIS 190 under CMVR (draft MoRTH notification, 2026) |
A certified Cyber Security Management System and Software Update Management System as conditions of type approval for M, N and T category vehicles with ECUs; proposed phasing from October 2026 for new Level 3+ automated models, with OTA-enabled vehicles following; aligned with UN R155 and R156 |
|
CERT-In Directions (28 April 2022) |
Cyber incidents reported within six hours; ICT logs kept for 180 days in India; applies to OEMs, suppliers, dealers and platforms alike |
|
CERT-In audit policy guidelines (25 July 2025) |
Risk-based, independent cyber audits covering IT, OT/ICS, cloud and applications |
|
SEBI LODR Regulations (listed companies) |
Cyber incidents and data loss disclosed in the quarterly corporate governance report; Board accountability for risk |
|
DPDP Act 2023 and DPDP Rules 2025 |
Safeguards, consent and breach intimation for customer, vehicle, location, driver, dealer and employee data; most obligations from May 2027 |
|
Ministry of Power EV charging guidelines and BIS standards |
Technical and operational requirements for public charging infrastructure; payment flows fall under PCI DSS |
|
Global customer and export requirements |
UN R155/R156 for vehicles sold in adopting markets; ISO/SAE 21434 engineering practice; TISAX for suppliers to German and other OEMs; EU Cyber Resilience Act for connected products (reporting from September 2026); US and EU supply-chain clauses |
|
How these apply AIS 189/190 obligations depend on vehicle category, automation level and the final gazette notification; other obligations depend on listing status, products, customers and export markets. Confirm against the official instruments and your contracts. |
5. Government, public-sector and private participants
- MoRTH sets vehicle rules under the Motor Vehicles Act and CMVR; ARAI, ICAT and other test agencies certify compliance, including AIS 189 and AIS 190.
- The Ministry of Heavy Industries runs the automotive and ACC PLI schemes and PM E-DRIVE; the Ministry of Power and BIS set charging-infrastructure guidelines and standards.
- CERT-In and NCIIPC handle incident response and critical infrastructure; SEBI governs listed-company disclosure; MeitY administers DPDP.
- Listed Indian OEMs, global OEM subsidiaries and joint ventures lead vehicle production; tier-1 majors and MSME suppliers form the component base.
- EV start-ups, battery makers, charge point operators and PSU energy companies are building the electric ecosystem.
- Dealer groups, DMS and telematics vendors, mobility platforms and engineering-services firms connect the industry to customers and the road.
6. Who buys cybersecurity inside an automotive company
|
Stakeholder |
What they care about |
What they buy |
|
Board, MD and CFO |
Production continuity, brand and safety, disclosure, insurance |
Board advisory, resilience programmes, crisis exercises |
|
CISO and CIO |
Enterprise and plant security, audits, OEM questionnaires |
Audits, assessments, SOC, GRC programmes |
|
Product cybersecurity and homologation heads |
AIS 189/190, UN R155/R156, TARA, OTA |
CSMS/SUMS readiness, vehicle and OTA testing |
|
Plant heads and manufacturing engineering |
Line uptime, OEM robot and PLC vendors |
OT assessments, segmentation, playbooks |
|
Connected services and app product owners |
App, API and cloud security, customer trust |
App, API and cloud testing, threat modelling |
|
Charging operations and payments |
Charger uptime, OCPP, PCI DSS |
Backend and charger assessments, payment security |
|
Supply chain, dealer network and after-sales |
Supplier and dealer resilience, data handling |
Supplier and dealer risk programmes |
|
Fleet and telematics operations |
Vehicle tracking, driver data, immobiliser safety |
Platform security, DPDP, command authorisation |
7. Why each type of company needs a different approach
|
Company type |
Highest-consequence risk |
Starting point for assurance |
|
Vehicle OEM |
Plant-wide ransomware and vehicle-reaching app or API flaws |
Segmentation and resilience; CSMS/SUMS and API testing |
|
Component supplier |
Being the supplier that stops the OEM; OEM audit failure |
Baseline assessment, backups, TISAX readiness |
|
EV and battery maker |
BMS, firmware and OTA weaknesses; plant exposure |
Embedded and OTA security, plant OT review |
|
Charging network |
Backend takeover, charger abuse, payment data |
OCPP and backend assessment, PCI alignment |
|
Dealer or DMS provider |
Platform outage and customer data theft |
SaaS assurance, DPDP, manual playbooks |
|
Mobility platform |
Account takeover, payment and location data |
App and API testing, fraud controls, privacy |
|
Fleet and telematics provider |
Data exposure and unsafe remote commands |
Cloud and API security, command authorisation |
8. How Codec Networks works with automotive and mobility companies
Codec Networks is a CERT-In empanelled information security auditing organisation certified to ISO 9001:2015, ISO/IEC 27001:2022 and ISO/IEC 20000-1:2018. For automotive and mobility companies we deliver vehicle network and ECU testing with threat analysis and risk assessment per ISO/SAE 21434, embedded, firmware and OTA pipeline reviews aligned to AIS 189 and AIS 190, production-aware plant OT assessments and segmentation, companion app, dealer portal, charging backend and cloud API testing, supplier and dealer risk programmes, 24x7 IT/OT SOC and crisis exercises—connected from finding to closure.
Talk to Codec Networks
|
Contact Codec Networks Pvt. Ltd. New Delhi: 507, 5th Floor, New Delhi House, Barakhamba Road, Connaught Place, New Delhi – 110001 Gurugram: 707, 7th Floor, Silverton Tower, Golf Course Extension Road, Sector 50, Gurugram – 122018, Haryana Landline: 011 430 496 96 | 011 437 522 99 Mobile: +91 99716 76124 | +91 88007 88220 | +91 88003 31124 Email: mktg@codecnetworks.com Web: www.codecnetworks.com |
Note: This document is general industry guidance based on public information available as of October 2026. It is not legal, safety or regulatory advice. AIS 189 and AIS 190 timelines are taken from MoRTH's draft notification and may change; confirm all obligations against the official MoRTH, CERT-In, MeitY, SEBI and UNECE instruments and your OEM contracts.