INDUSTRY FACT FILE · FMCG, FOOD & BEVERAGES

Cybersecurity FAQs for FMCG, Food and Beverages

Forty frequently asked questions and answers in five categories, written for Boards, CISOs, supply chain and plant heads, quality and food safety, sales and trade marketing, D2C, procurement and finance teams.

In this document 1.  Category 1: Cyber risk, governance and strategy 2.  Category 2: Regulation, standards and retailer requirements 3.  Category 3: Plants, cold chains, partners and food safety 4.  Category 4: Distributors, channels and consumer data 5.  Category 5: SOC, incidents and resilience

Audience: Boards, MDs, CFOs and CISOs

Q1. Why are FMCG, food and beverage companies targeted?

Because a day of stopped orders is lost shelf space visible to retailers and consumers, which makes ransomware pay; because schemes and payments move large sums through portals and email; and because loyalty apps hold millions of consumer profiles that fraudsters monetise quickly.

Q2. What are the biggest risks for an Indian consumer goods company?

Ransomware that stops ERP and order processing while lines keep running; distributor scheme fraud through portals; plant lines and cold rooms reached through flat networks, IoT or vendors; co-packer and 3PL outages; consumer app breaches under DPDP; and slow detection that misses CERT-In's six-hour window.

Q3. Which incidents should the Board know about?

JBS (2021) halted meat plants and paid US$11 million; Dole (February 2023) shut North American plants after ransomware; Clorox (2023) suffered shortages and US$49 million in costs; Americold (2023) saw about 30 per cent of facilities hit; United Natural Foods (June 2025) disrupted grocery deliveries; Haldiram's (2020) reported Maze ransomware in India.

Q4. Is this an IT problem or a business problem?

A business problem. Losses come from empty shelves, leaked schemes, spoiled stock, recalls and consumer scams rather than from technology alone. Sales, supply chain, quality, marketing and finance must own their controls, with IT enabling them and the Board accountable.

Q5. What should the Board review each quarter?

Order and dispatch dependencies on IT and backup test results, scheme and claims analytics, plant and cold-chain segmentation status, partner assessments, consumer app testing, incidents and near misses, audit findings and SOC coverage.

Q6. Who should own OT security across plants and co-packers?

The CISO or CIO jointly with supply chain and plant leadership, with a named owner at each plant and co-packer, a single inventory of control and IoT assets and a group standard based on IEC 62443.

Q7. How should we prioritise investment?

Make ERP and order processing recoverable, segment plants and IoT from IT, test distributor platforms and apps, verify payments, assess critical partners, protect consumer data and build monitoring that reaches every plant and depot—in that order.

Q8. How can Codec Networks help?

Codec Networks provides IEC 62443-aligned plant OT assessments, distributor portal, app and API testing, supply chain assurance, 24x7 IT/OT SOC with fraud analytics, resilience programmes, DPDP programmes and crisis exercises with sales, plant and supply chain leadership.

Audience: Compliance, company secretarial, quality and CISO offices

Q9. Do CERT-In Directions apply to food and consumer goods companies?

Yes. They apply to bodies corporate generally, including manufacturers, distributors and platform operators. Cyber incidents must be reported within six hours of noticing them and ICT logs retained for 180 days in India.

Q10. What do CERT-In's 2025 audit guidelines expect?

Risk-based, independent cyber audits covering IT, OT/ICS, cloud and applications, with closure of findings—so plant systems, distributor platforms and consumer apps belong in the audit scope.

Q11. What must listed companies disclose?

Under SEBI's LODR Regulations, listed entities disclose cyber security incidents, breaches and loss of data in the quarterly corporate governance report, and material events as required.

Q12. How does food safety regulation interact with cybersecurity?

The FSS Act 2006 and FSSAI rely on licences, batch, lab and traceability records and recall capability. They do not prescribe cyber controls, but the integrity and availability of the systems holding those records become food safety matters when they are tampered with or unavailable.

Q13. Does DPDP apply to a food company?

Yes. Consumer, loyalty, distributor, farmer, member and worker personal data are in scope, and brands with apps hold large consumer datasets. Most obligations under the DPDP Rules take effect in May 2027.

Q14. What do retailers and quick-commerce platforms expect?

Increasingly, security questionnaires, secure EDI and API integrations, incident notification and sometimes independent assessment reports or ISO 27001 certification as a condition of listing or integration.

Q15. Does PCI DSS apply to our D2C channel?

If you accept card payments on your site or app, yes—PCI DSS v4.0.1 applies to the systems and scripts in scope even when a payment gateway is used; scope depends on how checkout is built.

Q16. Can Codec Networks audit us?

Yes. Codec Networks is CERT-In empanelled and performs IT/OT audits, IEC 62443, ISO 27001 and PCI DSS gap assessments and retailer and insurer evidence support.

Audience: Supply chain, plant, quality, engineering and procurement teams

Q17. How should IT and plant networks be separated?

Use a zone-and-conduit model from IEC 62443: a plant DMZ, no dual-homed systems, controlled data flows to MES and ERP, isolated IoT and utility zones and the ability to run and dispatch from a fallback if IT is down.

Q18. How do we assess lines without disrupting production?

Passive asset discovery, configuration and architecture reviews, and any active testing planned in changeovers or maintenance windows with operations and quality—never unplanned scanning of running lines.

Q19. How should cold-chain IoT be secured?

Inventory every gateway and tracker, change default credentials, isolate them in their own zone behind a DMZ, remove direct internet exposure, manage firmware, make temperature records tamper-evident and monitor continuously.

Q20. How should OEM and integrator remote access work?

Through a brokered gateway with MFA, named accounts, approval per session, time limits and recording—never standing VPNs or shared passwords into line or refrigeration controls.

Q21. How do we manage co-packer and 3PL cyber risk?

Tier partners by criticality, assess their security proportionately, add security and incident-notification clauses, test integrations, hold buffers or alternates for critical products and run joint exercises.

Q22. How do we protect recipes, batch and lab records?

Classify them, restrict access to need, enforce segregation of duties on approvals, keep tamper-evident logs, back up LIMS and recipe systems immutably and monitor changes.

Q23. How do we stop supplier, farmer and distributor payment fraud?

Verify bank-detail changes by call-back, require dual approval, monitor vendor master-data changes in ERP, enforce MFA on mailboxes and train procurement and finance with BEC simulations.

Q24. Should utilities like refrigeration and boilers be in scope?

Yes. A refrigeration or boiler trip spoils stock and stops lines; utility controls need the same segmentation, access control and monitoring as the main process.

Audience: Sales, trade marketing, D2C, marketing and privacy teams

Q25. How do distributor portals get abused?

Through weak API authorisation that lets one distributor see or edit another's data, shared logins, unreviewed approval limits and scheme logic that can be gamed—often with insider help—so claims drift upwards for quarters.

Q26. How should a DMS or sales app be secured?

Test it as an internet-facing application and API, enforce named accounts with MFA, apply approval limits and segregation of duties, run analytics on claims and secondary sales and review distributor access regularly.

Q27. What about retailer EDI and quick-commerce APIs?

Treat them as production integrations: tested, authenticated, monitored and covered by contracts that specify security and incident notification on both sides.

Q28. What consumer data falls under DPDP?

Names, contact details, addresses, purchase and reward histories, device identifiers and preferences from loyalty apps, D2C stores and CRM. DPDP requires notices, consent where applicable, safeguards, retention limits and breach intimation.

Q29. Our loyalty app was built by an agency—is it our risk?

Yes. You remain responsible for the data. Require security standards in agency contracts, test the app and every API before launch and each release, minimise data collected and review the agency's access and hosting.

Q30. How do we handle counterfeits and fake schemes online?

Monitor domains, marketplaces and social platforms for impersonation and fake distributor appointments, use takedown procedures, educate the trade and consumers and feed intelligence to the SOC and legal teams.

Q31. How do we prepare for a festive or promotion peak?

Test platforms beforehand, scale bot controls, freeze risky changes, brief the SOC on expected patterns, verify scheme and payment controls and rehearse fraud and outage responses.

Q32. How can we start with Codec Networks?

Begin with a scoping call on your plants, systems, distributors, partners and channels; Codec Networks will propose a production-aware assessment and assurance plan.

Audience: SOC, IT infrastructure, incident response and plant teams

Q33. Do consumer goods companies need an IT/OT SOC?

Yes, if plants and the trade matter to revenue. An IT/OT SOC monitors plants, depots, cloud, distributor platforms and email around the clock, applies fraud analytics and supports six-hour reporting.

Q34. What should the SOC monitor in this sector?

Endpoints and email for ransomware and BEC, identity and mailbox rules, ERP and DMS access and claims anomalies, plant network traffic and OEM sessions, IoT gateways, loyalty app APIs and look-alike domains.

Q35. Why map order and dispatch dependencies on IT?

To know in advance which processes stop when ERP, order management, label printing or Active Directory are unavailable—and to design manual workarounds that keep distributors served.

Q36. What should an incident playbook include?

Containment that keeps food safe and lines running where possible, manual order and dispatch decisions, CERT-In reporting within six hours, FSSAI engagement where records are affected, retailer and partner notification, SEBI disclosure if listed and DPDP intimation.

Q37. How should backups be designed?

Immutable or offline backups of ERP, order management, DMS, LIMS and recipe systems, PLC and line configurations and file shares, with regular restore tests and documented restart sequences per plant.

Q38. Should we run exercises?

Yes—annual tabletop exercises with leadership, plant, sales and supply chain teams using ransomware, scheme fraud, cold-chain and recall scenarios, plus technical restore drills and joint drills with key partners.

Q39. How quickly can a plant recover from ransomware?

With segmented networks, tested backups and manual dispatch playbooks, days; without them, weeks of shortages—as Clorox's months of manual order processing show.

Q40. When should forensics be engaged?

As soon as compromise, fraud or record tampering is suspected, to preserve evidence, establish root cause and support CERT-In reporting, FSSAI and retailer communication, insurance claims and recovery of funds.

Contact Codec Networks Pvt. Ltd. New Delhi: 507, 5th Floor, New Delhi House, Barakhamba Road, Connaught Place, New Delhi – 110001 Gurugram: 707, 7th Floor, Silverton Tower, Golf Course Extension Road, Sector 50, Gurugram – 122018, Haryana Landline: 011 430 496 96 | 011 437 522 99   Mobile: +91 99716 76124 | +91 88007 88220 | +91 88003 31124 Email: mktg@codecnetworks.com   Web: www.codecnetworks.com

Note: These FAQs provide general guidance as of October 2026 and do not constitute legal, food safety or regulatory advice. Confirm obligations against the official instruments and your retailer and partner contracts.