INDUSTRY FACT FILE · CHEMICALS, FERTILIZERS & PROCESS INDUSTRIES

Cybersecurity FAQs for Chemicals, Fertilizers and Process Industries

Forty frequently asked questions and answers in five categories, written for Boards, CISOs, plant and operations heads, process safety, instrumentation, R&D, dealer network and procurement teams.

In this document 1.  Category 1: Cyber risk, governance and strategy 2.  Category 2: Regulation, safety and compliance 3.  Category 3: Plants, safety systems and vendors 4.  Category 4: SOC, incidents and resilience 5.  Category 5: Dealers, data, formulations and suppliers

Audience: Boards, CMDs, MDs, CFOs and CISOs

Q1. Why are chemical and fertilizer plants cyber targets?

They run hazardous continuous processes that cannot stop cheaply, hold valuable formulations, carry strategic importance and depend on vendors and contractors—attracting ransomware groups, state actors, competitors and fraudsters alike.

Q2. Which incidents should the Board know about?

TRITON (2017) targeted a petrochemical plant's safety system; LockerGoga (2019) hit chemical makers Hexion and Momentive; Clop ransomware (2020) encrypted about 1,000 devices and halted Symrise; Brenntag (2021) paid US$4.4 million after data theft.

Q3. What are the biggest risks for an Indian chemical or fertilizer company?

Ransomware halting plants or ERP, set-point and safety system tampering, vendor and contractor access to the DCS, subsidy and dispatch disruption in season, theft of formulations and weak plant monitoring.

Q4. Why link cybersecurity and process safety?

Attacks on control and safety systems can create hazardous conditions, so cyber risk belongs inside process safety management alongside IEC 61511 and the Factories Act duties.

Q5. What should the Board review each quarter?

OT and SIS risks, vendor and contractor access, ERP and subsidy continuity, backup test results, incidents, audit findings, SOC coverage and exercise outcomes.

Q6. Who should own OT security?

The CISO jointly with plant operations, instrumentation and process safety leadership, with a single OT asset inventory per plant.

Q7. How should we prioritise investment?

Isolate safety systems, broker vendor access, segment IT from OT, make ERP, integrations and DCS configurations recoverable, control contractors and media, and build plant monitoring—in that order.

Q8. How can Codec Networks help?

Codec Networks provides OT risk assessments, safety system security reviews, segmentation and vendor access design, recovery and subsidy continuity planning, dealer portal and LIMS testing, IT/OT SOC and crisis exercises.

Audience: Compliance, HSE, company secretarial and CISO offices

Q9. Do CERT-In Directions apply to us?

Yes. Cyber incidents must be reported within six hours and ICT logs kept for 180 days in India. CERT-In's 2025 audit guidelines expect independent audits covering OT/ICS.

Q10. How do safety laws relate to cybersecurity?

The Factories Act, MSIHC Rules, Chemical Accidents Rules and PESO licensing impose continuous safety duties; a cyber incident that upsets the process or disables safety systems engages those duties and their investigation powers.

Q11. Does the Fertiliser (Control) Order create cyber obligations?

Not directly, but fertilizer pricing, distribution and subsidy depend on ERP, dispatch and Aadhaar-authenticated PoS data—so the integrity and continuity of those systems is a regulatory and revenue matter.

Q12. Does NCIIPC apply to our plant?

Only if your systems are notified as protected systems or critical information infrastructure, which is more likely for fertilizer PSUs and strategic enterprises. Good practice aligns with NCIIPC guidance regardless.

Q13. What must listed companies disclose?

Under SEBI's LODR Regulations, listed entities disclose cyber security incidents, breaches and loss of data in the quarterly corporate governance report.

Q14. Does DPDP apply to a chemical company?

Yes. Farmer, dealer, distributor, employee and contractor data are in scope; most obligations under the DPDP Rules take effect in May 2027.

Q15. Which standards should we align to?

IEC 62443 for industrial automation security, IEC 61511 for functional safety and ISO/IEC 27001 for the management system; together they answer most regulator and customer questions.

Q16. Can Codec Networks audit us?

Yes. Codec Networks is CERT-In empanelled and performs IT/OT audits, IEC 62443 and ISO 27001 gap assessments and customer audit support.

Audience: Operations, instrumentation, process safety and maintenance teams

Q17. How should IT and OT be separated?

Use IEC 62443 zones and conduits: a plant DMZ, no dual-homed systems, controlled historian and MES flows, and the ability to run the plant without IT.

Q18. How do we assess OT safely?

Passive discovery, offline configuration and architecture reviews, and any active testing planned in maintenance windows with operations and safety teams—never unplanned scanning of controllers.

Q19. How should safety instrumented systems be protected?

Isolate SIS networks, keep controllers in run mode with physical key control, restrict and monitor engineering workstations and manage changes strictly.

Q20. How should vendor remote access work?

Brokered, time-bound sessions with MFA, named accounts, approval per request and recording—never standing VPNs with shared passwords.

Q21. How should contractors be managed during turnarounds?

Scan and control devices, provide segmented temporary access, use named accounts, control USB media through kiosks and remove access afterwards.

Q22. What about legacy DCS and HMIs?

Segment, restrict access, monitor and plan upgrades with the vendor; compensating controls are expected where patching is impossible.

Q23. How do we secure tank farms and loading?

Assess gauging, loading and utilities automation, verify the integrity of level and flow data and monitor for anomalies.

Q24. How do we secure digital plant and IIoT projects?

Assess gateways and analytics connections before go-live, isolate them in their own zone behind a DMZ, change default credentials and monitor continuously.

Audience: SOC, IT infrastructure, incident response and operations teams

Q25. Do chemical companies need an OT SOC?

Yes. Monitoring IT and OT 24x7 is essential for early detection, safe containment and six-hour reporting.

Q26. What should the SOC monitor?

Plant networks and industrial protocols, engineering workstation activity, remote sessions, historians, ERP and integration servers and threat intelligence.

Q27. Why map the plant's dependencies on IT?

To know whether production, dispatch and subsidy reconciliation can continue safely and commercially if IT is unavailable.

Q28. What should incident playbooks include?

Safety decisions, containment, manual operation, CERT-In reporting, safety-regulator and Department of Fertilizers engagement, disclosure and communication.

Q29. How should backups be designed?

Immutable or offline backups of ERP, integrations, LIMS, DCS configurations and logic, with regular restore tests and documented safe-restart sequences.

Q30. Should we run joint drills?

Yes—with operations, process safety, dealer and subsidy teams and leadership, using ransomware and safety-system scenarios.

Q31. How quickly can a plant recover from ransomware?

With segmented networks, tested backups and manual playbooks, days; without them, weeks—as Symrise and others experienced.

Q32. When should forensics be engaged?

As soon as OT compromise or destructive malware is suspected, with OT-aware investigators who can preserve evidence and support regulators and insurers.

Audience: Marketing, dealer network, R&D, privacy and procurement teams

Q33. How do we secure dealer portals and payments?

Test portals and payment flows, enforce MFA, verify bank-detail changes by call-back with dual approval, and monitor invoice and master-data changes.

Q34. How do we protect subsidy and PoS data flows?

Secure and monitor ERP-to-DBT integrations, keep tested backups, plan manual reconciliation and treat the integration as a revenue-critical system.

Q35. How do we protect formulations and process know-how?

Classify recipe and process data, restrict formulation system and LIMS access to need, block personal cloud uploads, monitor exports and enforce contractor offboarding.

Q36. How do we keep LIMS and quality data trustworthy?

Control access and changes, keep audit trails, protect instruments' connections and include LIMS in backups and monitoring.

Q37. How does DPDP affect a fertilizer or agrochemical company?

Farmer, dealer and employee data—including data collected through apps and PoS—require notices, safeguards, retention limits and breach intimation from May 2027.

Q38. How should we assess suppliers and logistics partners?

Tier them by criticality, assess security and incident history, add security and notification clauses to contracts and review access to your systems.

Q39. Our customer is auditing our security—what now?

Map the questionnaire to ISO 27001 and IEC 62443 controls, close gaps and build an evidence pack you can reuse for every customer.

Q40. How can we start with Codec Networks?

Begin with a scoping call on your plants, control systems, vendors and business systems; Codec Networks will propose a safety-aware assessment and assurance plan.

Contact Codec Networks Pvt. Ltd. New Delhi: 507, 5th Floor, New Delhi House, Barakhamba Road, Connaught Place, New Delhi – 110001 Gurugram: 707, 7th Floor, Silverton Tower, Golf Course Extension Road, Sector 50, Gurugram – 122018, Haryana Landline: 011 430 496 96 | 011 437 522 99   Mobile: +91 99716 76124 | +91 88007 88220 | +91 88003 31124 Email: mktg@codecnetworks.com   Web: www.codecnetworks.com

Note: These FAQs provide general guidance as of October 2026 and do not constitute legal, safety or regulatory advice. Confirm obligations against the official instruments applicable to your plants, products and licences.