Resources Categories
INDUSTRY FACT FILE · MARITIME, PORTS & SHIPPING
Industry Overview: Maritime, Ports and Shipping in India
Who runs India's ports, terminals, ships, shipyards and waterways, the international, sector and cyber obligations that apply, who buys cybersecurity and why each type of operator needs a distinct approach.
|
In this document 1. Why maritime and port cybersecurity matters now 2. The ecosystem at a glance 3. Categories of maritime, port and shipping organisations 4. The international, sector and cyber framework at a glance 5. Government, public-sector and private participants 6. Who buys cybersecurity inside a port or shipping company 7. Why each type of operator needs a different approach 8. How Codec Networks works with ports and shipping companies |
|
Sector scope Sector: major and non-major ports, terminal operators, shipping lines and ship managers, shipyards, inland waterways and coastal shipping, port services and port community systems. Primary service proposition: port IT/OT security, cargo platform testing, remote access controls, SOC and recovery. Logistics, aviation and railways have separate fact files. |
1. Why maritime and port cybersecurity matters now
About 95 per cent of India's trade by volume and around 70 per cent by value moves by sea. The country's twelve major ports handled a record 915 million tonnes of cargo in 2025-26, with more than 200 non-major ports under state maritime boards adding to the total, and cargo on national waterways reached 145.5 million tonnes in 2024-25. The Sagarmala programme, launched in 2015, counts 845 projects worth about ₹6.06 lakh crore, and 2025 brought new primary legislation—the Indian Ports Act and the Merchant Shipping Act—replacing laws from 1908 and 1958. Terminals are increasingly run by private operators under concessions, several of which belong to listed groups.
|
95% Share of India's trade by volume carried by sea |
915 MT Cargo handled by major ports in 2025-26 |
30,000 Containers stranded by the 2023 DP World Australia incident |
6 hours To report cyber incidents to CERT-In |
These are heavy, software-driven operations. Quay cranes, rubber-tyred gantries, automated gates, conveyors and SCADA move cargo; terminal operating systems decide where every container sits; the Port Community System PCS 1x, launched in December 2018, links ports, customs, shipping lines, forwarders and transporters; and ships navigate with ECDIS, GNSS and AIS while engine and cargo control run on networked automation. OEMs, integrators and satcom providers maintain much of this remotely. When the cargo system fails, cranes may still work but nobody knows where the boxes are, gates close, trucks queue and ships divert.
The incidents are well documented. NotPetya in June 2017 cost Maersk an estimated US$250–300 million and forced it to reinstall 45,000 PCs and 4,000 servers in ten days. In July 2023 ransomware halted container operations at Japan's Port of Nagoya for two days. In November 2023 DP World Australia disconnected its four container terminals after an intrusion, leaving about 30,000 containers stranded. In August 2024 the Port of Seattle refused a ransom after a Rhysida attack that disrupted airport and marina systems. In May 2020 a cyber attack on Iran's Shahid Rajaee port caused road and shipping queues for days. In India, a suspected ransomware incident at a Jawaharlal Nehru Port container terminal in 2022 forced vessel diversions, and GNSS interference in the Gulf and Red Sea has drawn repeated UKMTO advisories in 2025.
Obligations now reach ships and ports alike. The IMO's Resolution MSC.428(98) requires cyber risk to be addressed in ship safety management systems, verified at Document of Compliance audits since 1 January 2021, and DG Shipping applied it to Indian-flag ships by circular; the IACS Unified Requirements E26 and E27 apply to new ships contracted from 1 July 2024. Port facilities are assessed and planned under the ISPS Code with DG Shipping as designated authority and new Merchant Shipping security rules in 2024. Transport is a notified critical sector for NCIIPC; CERT-In requires six-hour incident reporting, 180-day logs and risk-based independent audits that include OT; listed operators disclose incidents quarterly; and the DPDP Act and Rules will govern customer, crew, driver and visitor data from May 2027.
|
Key takeaway In ports and shipping, cybersecurity is trade continuity, safety and licence to operate in one. Terminal OT, the vendors who reach it, the cargo platforms that release goods and the ships that call must be protected together. |
2. The ecosystem at a glance
Figure 1: India's maritime, ports and shipping ecosystem.
3. Categories of maritime, port and shipping organisations
|
Category |
Who they are |
Typical ownership |
Key regulatory basis |
|
Major port authorities |
Twelve major ports under the Union government, operating berths and granting terminal concessions |
Central government port authorities |
Major Port Authorities Act; Indian Ports Act 2025; ISPS; NCIIPC where notified; CERT-In |
|
Non-major ports |
Over 200 ports under state maritime boards, several large private ports |
State governments, private developers, listed groups |
Indian Ports Act 2025; state maritime board rules; ISPS; CERT-In; SEBI LODR (listed) |
|
Terminal operators |
Container, bulk, liquid and Ro-Ro terminals under concessions |
Global and Indian operators, PPP concessionaires |
Concession agreements; ISPS; CERT-In; customer contracts |
|
Shipping lines, owners and managers |
Container, tanker, bulk, offshore and coastal fleets; technical and crew management |
Indian and global companies, PSU and private |
Merchant Shipping Act 2025; IMO ISM/MSC.428(98); flag and class; CERT-In |
|
Shipyards and repair yards |
Shipbuilding, repair, offshore and naval work |
PSU and private yards |
Customer and defence contracts; CERT-In; export controls |
|
Inland waterways and coastal operators |
Barge, Ro-Ro and coastal services on national waterways |
IWAI, state and private operators |
Inland Vessels Act; IWAI rules; CERT-In |
|
Port services |
Pilotage, towage, dredging, bunkering, surveying |
Public and private providers |
Port and DGS rules; contracts; CERT-In |
|
Trade and platform providers |
PCS 1x, TOS vendors, logistics platforms, customs brokers |
IPA, private vendors |
Customer contracts; DPDP as processors; CERT-In |
4. The international, sector and cyber framework at a glance
|
Instrument or expectation |
What it means for ports and shipping companies |
|
CERT-In Directions (28 April 2022) |
Cyber incidents reported within six hours of noticing them; ICT logs kept for a rolling 180 days in India |
|
CERT-In audit policy guidelines (25 July 2025) |
Risk-based, independent cyber audits covering IT, OT/ICS, cloud and applications |
|
IMO Resolution MSC.428(98) and MSC-FAL.1/Circ.3; DG Shipping circular (2017) |
Cyber risks addressed in the ship's safety management system under the ISM Code, verified at Document of Compliance audits from 1 January 2021; applied to Indian-flag ships by DG Shipping |
|
IACS Unified Requirements E26 and E27 |
Cyber resilience of ships and of on-board systems and equipment for new ships contracted for construction on or after 1 July 2024, verified by classification societies |
|
ISPS Code; Merchant Shipping (Ships and Port Facility Security) Rules 2024 |
Port facility security assessments and plans under DG Shipping as designated authority—cyber elements increasingly expected within them |
|
Indian Ports Act 2025; Merchant Shipping Act 2025 |
New primary legislation replacing the 1908 and 1958 Acts, with rules being notified in phases |
|
NCIIPC (IT Act Section 70A) |
Transport is a notified critical sector; systems notified as protected systems carry protection and CISO reporting duties |
|
SEBI LODR; DPDP Act 2023 and Rules 2025 |
Quarterly cyber incident disclosure for listed operators; customer, crew, driver and visitor data safeguards from May 2027 |
|
How these apply Ship obligations depend on flag, class and vessel type; port obligations on category, concession and ISPS status; cyber obligations are cross-sector and depend on listing status and notifications. Confirm against the official instruments and your contracts. |
5. Government, public-sector and private participants
- The Ministry of Ports, Shipping and Waterways sets policy and runs Sagarmala; DG Shipping is the maritime administration, ISPS designated authority and flag-state regulator; major port authorities and state maritime boards govern ports.
- The Indian Ports Association runs PCS 1x; IWAI develops national waterways; CBIC runs customs systems that ports and forwarders integrate with.
- CERT-In and NCIIPC handle incident response and critical infrastructure; SEBI governs listed-company disclosure; MeitY administers DPDP.
- The IMO and IACS classification societies, including the Indian Register of Shipping, set and verify ship cyber requirements.
- Terminal operators, shipping lines, ship managers and shipyards run the sector's operations; PSU and private shipping companies own the Indian-flag fleet.
- Crane, TOS, navigation and automation OEMs, integrators, satcom providers and dredging contractors build and maintain the estate, often remotely.
6. Who buys cybersecurity inside a port or shipping company
|
Stakeholder |
What they care about |
What they buy |
|
Board, chairman, MD and CEO |
Trade continuity, safety, concession and disclosure duties |
Board advisory, resilience programmes, crisis exercises |
|
CISO and CIO |
IT and OT security, audits, customer questionnaires |
Audits, assessments, SOC, GRC programmes |
|
Terminal and operations heads |
Berth productivity, yard visibility, gate throughput |
OT assessments, segmentation, continuity playbooks |
|
Engineering and maintenance |
Cranes, PLCs, SCADA, OEM support |
OEM access controls, OT monitoring |
|
Marine and fleet management |
Ship safety, ISM compliance, class surveys |
Ship cyber risk assessments, UR E26/E27 readiness |
|
Commercial and customer service |
Portals, delivery orders, billing |
Platform testing, fraud controls |
|
Security (PFSO) and compliance |
ISPS plans, DGS audits, CERT-In |
Cyber in PFSA/PFSP, audit readiness |
|
Procurement and legal |
Vendor, concession and charter risk; DPDP |
Third-party programmes, privacy programmes |
7. Why each type of operator needs a different approach
|
Organisation type |
Highest-consequence risk |
Starting point for assurance |
|
Major port authority |
Multi-terminal outage from shared systems or PCS integration |
CII-aligned controls, port-wide segmentation, SOC |
|
Private or listed port group |
Group-wide ransomware and quarterly disclosure |
Group OT programme, recovery, Board reporting |
|
Terminal operator |
TOS and crane compromise stopping the terminal |
TOS resilience, OT assessment, OEM access controls |
|
Shipping line or ship manager |
Fleet-wide IT outage; ship system or navigation compromise |
Fleet SOC, ship cyber risk assessments, bridge drills |
|
Shipyard |
Design and customer data theft by state actors |
Data classification, subcontractor access, hunting |
|
Waterway or port service operator |
Being the weak link for port customers |
Baseline assessment, questionnaire readiness |
8. How Codec Networks works with ports and shipping companies
Codec Networks is a CERT-In empanelled information security auditing organisation certified to ISO 9001:2015, ISO/IEC 27001:2022 and ISO/IEC 20000-1:2018. For ports and shipping companies we deliver terminal and marine OT assessments using safety-aware methods, TOS, PCS 1x and portal testing, OEM and ship-to-shore remote access programmes, recovery planning with tested restore times, ship cyber risk assessments aligned to MSC.428(98) and IACS UR E26/E27, 24x7 IT/OT SOC, DPDP programmes and port crisis exercises—connected from finding to closure.
Talk to Codec Networks
|
Contact Codec Networks Pvt. Ltd. New Delhi: 507, 5th Floor, New Delhi House, Barakhamba Road, Connaught Place, New Delhi – 110001 Gurugram: 707, 7th Floor, Silverton Tower, Golf Course Extension Road, Sector 50, Gurugram – 122018, Haryana Landline: 011 430 496 96 | 011 437 522 99 Mobile: +91 99716 76124 | +91 88007 88220 | +91 88003 31124 Email: mktg@codecnetworks.com Web: www.codecnetworks.com |
Note: This document is general industry guidance based on public information available as of October 2026. It is not legal, safety or regulatory advice. Obligations differ by port category, ownership, flag, vessel type, listing status, systems notified as critical information infrastructure and contracts; confirm them against the official CERT-In, MeitY, NCIIPC, MoPSW, DG Shipping, IMO, IACS and SEBI instruments and your contracts.