INDUSTRY FACT FILE · MANUFACTURING & INDUSTRIAL PRODUCTION

Cybersecurity FAQs for Manufacturing and Industrial Production

Forty frequently asked questions and answers in five categories, written for Boards, CISOs, plant heads, automation engineers, R&D, procurement and finance teams.

In this document 1.  Category 1: Cyber risk, governance and strategy 2.  Category 2: Regulation, standards and customer requirements 3.  Category 3: Plant floor, OT and Industry 4.0 4.  Category 4: SOC, incidents and ransomware resilience 5.  Category 5: Suppliers, ERP, designs and data

Audience: Boards, MDs, CFOs and CISOs

Q1. Why is manufacturing the most attacked industry?

Because downtime is expensive and visible, which makes ransomware pay; because designs and customer data are valuable to competitors and states; and because plants run on legacy, connected systems that are hard to patch. IBM X-Force has ranked manufacturing the most attacked industry for five consecutive years.

Q2. What are the biggest risks for an Indian manufacturer?

Ransomware that stops ERP, MES or the plant; a supplier's incident halting just-in-time lines; OEM remote-maintenance access nobody controls; theft of designs and recipes; flat networks between office and plant; and slow detection that misses CERT-In's six-hour window.

Q3. Which incidents should the Board know about?

Norsk Hydro (2019) ran plants manually for weeks after ransomware; Toyota (2022) halted 14 plants after one supplier's incident; Clorox (2023) reported about US$49 million in direct costs and months of manual order processing; an Indian engineering-services company disclosed a ransomware incident in early 2025.

Q4. Is this an IT problem or a plant problem?

Both. Most stoppages begin in IT—ERP, email, file servers—and reach the plant through flat networks or dependencies. Cybersecurity must be owned jointly by IT, operations and engineering, with the Board accountable.

Q5. What should the Board review each quarter?

Plant and ERP dependencies, backup and recovery test results, OEM and supplier access, critical supplier assessments, incidents and near misses, audit findings, SOC coverage and exercise outcomes.

Q6. Who should own OT security?

The CISO or CIO jointly with plant operations and automation or maintenance leadership, with clear responsibility for each plant and a single inventory of OT assets.

Q7. How should we prioritise investment?

Map what the plant depends on, segment IT from OT, make ERP and PLC programs recoverable, control vendor and supplier access, protect design data and build monitoring that covers the plant—in that order.

Q8. How can Codec Networks help?

Codec Networks provides IEC 62443-aligned OT assessments, segmentation and remote access design, ransomware resilience reviews, ERP and portal testing, supplier cyber risk programmes, 24x7 IT/OT SOC and crisis exercises.

Audience: Compliance, company secretarial, sales and CISO offices

Q9. Do CERT-In Directions apply to manufacturers?

Yes. They apply to bodies corporate generally. Cyber incidents must be reported within six hours of noticing them and ICT logs retained for 180 days in India.

Q10. What do CERT-In's 2025 audit guidelines expect?

Risk-based, independent cyber audits covering IT, OT/ICS, cloud and applications, with closure of findings—so plant systems belong in the audit scope.

Q11. What must listed manufacturers disclose?

Under SEBI's LODR Regulations, listed entities disclose cyber security incidents, breaches and loss of data in the quarterly corporate governance report, and material events as required.

Q12. Does NCIIPC apply to our plant?

Only if your systems are notified as protected systems or critical information infrastructure, which is more likely for strategic and public enterprises. Most private plants are not notified, but good practice aligns with NCIIPC guidance.

Q13. Does DPDP apply to a factory?

Yes. Employee, contractor, dealer, distributor and consumer personal data are in scope. Most obligations under the DPDP Rules take effect in May 2027.

Q14. What is the EU Cyber Resilience Act and does it affect us?

If you sell products with digital elements—connected machinery, controllers, devices—in the EU, the CRA requires secure design, vulnerability handling and reporting of actively exploited vulnerabilities and severe incidents (from September 2026), with full application in December 2027.

Q15. Which standards should we align to?

IEC 62443 for industrial automation security and ISO/IEC 27001 for the management system. Together they answer most OEM, EU and US customer questionnaires.

Q16. Can Codec Networks audit us?

Yes. Codec Networks is CERT-In empanelled and performs IT/OT audits, IEC 62443 and ISO 27001 gap assessments and customer audit support.

Audience: Plant heads, automation, maintenance and engineering teams

Q17. How should IT and OT be separated?

Use a zone-and-conduit model from IEC 62443: a plant DMZ, no dual-homed systems, controlled data flows to ERP and MES, and the ability to run the plant if IT is down.

Q18. How do we assess OT without disrupting production?

Passive asset discovery, configuration and architecture reviews, and any active testing planned in maintenance windows with operations—never unplanned scanning of PLCs.

Q19. What about PLCs and HMIs that cannot be patched?

Segment them, restrict access, remove internet paths, monitor traffic and plan upgrades with the OEM; compensating controls are expected where patching is impossible.

Q20. How should OEM remote maintenance work?

Through a brokered gateway with MFA, named accounts, approval per session, time limits and recording—never standing VPNs with shared passwords.

Q21. How do we secure an Industry 4.0 or IIoT project?

Assess devices and gateways before go-live, isolate them in their own zone behind a DMZ, change default credentials, manage firmware and monitor continuously.

Q22. Should robots and CNC machines be in scope?

Yes. Robot controllers and CNC machines run networked operating systems and software; they need the same inventory, segmentation and access control as PLCs.

Q23. How should engineering laptops and USB media be handled?

Dedicated, hardened engineering laptops; scanning kiosks for media; no personal devices on plant networks; and controls on OEM engineers' devices during visits.

Q24. How do we protect machine safety systems?

Isolate safety PLCs and interlocks, control program mode physically, monitor engineering changes and integrate cyber risk into machine safety reviews.

Audience: SOC, IT infrastructure, incident response and plant teams

Q25. Do manufacturers need an OT SOC?

Yes, if the plant matters to revenue. Monitoring IT alone misses the plant; an IT/OT SOC sees remote sessions, engineering activity and industrial protocols as well as endpoints and email.

Q26. What should the SOC monitor in a plant?

Plant network traffic and industrial protocols, engineering workstations, remote-access sessions, MES and historian servers, IIoT gateways and the IT systems the plant depends on.

Q27. Why map the plant's dependencies on IT?

To know in advance which processes stop when ERP, MES, licensing servers or Active Directory are unavailable—and to design workarounds before an incident.

Q28. What should an incident playbook include?

Containment that keeps the plant safe, decisions on running manually, CERT-In reporting within six hours, customer and insurer notification, SEBI disclosure if listed, and communication.

Q29. How should backups be designed?

Immutable or offline backups of ERP, MES, file servers, PLC programs, robot and CNC configurations and engineering projects, with regular restore tests and documented restart sequences.

Q30. Should we run exercises?

Yes—annual tabletop exercises with leadership and plant teams using ransomware and supplier-outage scenarios, plus technical restore drills.

Q31. How quickly can a plant recover from ransomware?

With segmented networks, tested backups and manual-operation playbooks, days; without them, weeks—as public cases show.

Q32. When should forensics be engaged?

As soon as compromise is suspected, with investigators who understand plant systems, to preserve evidence, establish root cause and support reporting and insurance claims.

Audience: Procurement, finance, R&D, IT and privacy teams

Q33. How do we manage supplier cyber risk?

Identify single-source and just-in-time suppliers, assess their security, add security and incident-notification clauses to contracts, hold buffers for critical parts and run joint exercises.

Q34. Our OEM customer sent a security questionnaire—what now?

Treat it as an audit: map questions to ISO 27001 and IEC 62443 controls, close gaps and build an evidence pack you can reuse for every customer.

Q35. How should ERP be secured?

Harden configuration and roles, enforce MFA, control master-data and payment changes, segment ERP from the plant, back it up immutably and monitor for anomalies.

Q36. How do we stop payment diversion fraud?

Verify supplier bank-account changes by call-back, require dual approval, monitor for look-alike domains and train finance teams with BEC simulations.

Q37. How do we protect designs and recipes?

Classify design data, restrict PLM and CAD access to need, block personal cloud uploads, monitor downloads and enforce leaver procedures on the last working day.

Q38. How should we secure connected products?

Build security into development, test firmware and APIs before release, manage vulnerabilities and updates, and prepare for EU CRA reporting if you sell in Europe.

Q39. How does DPDP affect a manufacturer?

You hold personal data of employees, contractors, dealers and consumers; DPDP requires notices, safeguards, retention limits and breach intimation—build the programme before May 2027.

Q40. How can we start with Codec Networks?

Begin with a scoping call on your plants, ERP, suppliers and customers; Codec Networks will propose a production-aware assessment and assurance plan.

Contact Codec Networks Pvt. Ltd. New Delhi: 507, 5th Floor, New Delhi House, Barakhamba Road, Connaught Place, New Delhi – 110001 Gurugram: 707, 7th Floor, Silverton Tower, Golf Course Extension Road, Sector 50, Gurugram – 122018, Haryana Landline: 011 430 496 96 | 011 437 522 99   Mobile: +91 99716 76124 | +91 88007 88220 | +91 88003 31124 Email: mktg@codecnetworks.com   Web: www.codecnetworks.com

Note: These FAQs provide general guidance as of October 2026 and do not constitute legal, safety or regulatory advice. Confirm obligations against the official instruments and your customer contracts.