Resources Categories
INDUSTRY FACT FILE · OIL, GAS & PETROCHEMICALS
Applicable Cybersecurity Services and Codec Networks Bundles for Oil and Gas
How Codec Networks services and bundled service models help oil, gas and petrochemical companies resolve their threats and meet CERT-In, NCIIPC and safety-aligned expectations.
|
In this document 1. Our approach 2. Mapping threats to services 3. Codec Networks service catalogue for the sector 4. Codec Networks bundles for the sector 5. Sector programmes built from the bundles 6. Packages: Foundation, Assurance and Continuous Resilience 7. Regulatory requirement-to-bundle mapping 8. Threat-to-bundle coverage matrix 9. Delivery methodology and deliverables 10. Why Codec Networks 11. Annex: indicative commercial ranges |
1. Our approach
Oil and gas needs assurance that respects process safety. Codec Networks works on four principles:
- Safety first: plan OT work with operations and process safety teams.
- Strong boundaries: IT/OT and control/safety separation.
- Control third parties: contractors and vendors are the most common way in.
- Rehearse the crisis: joint exercises with operations, safety and leadership.
2. Mapping threats to services
The table maps the 18 threats identified in Document 4 of this set to the Codec Networks services that help mitigate them.
|
Threat / challenge |
Applicable Codec Networks services |
Intended outcome |
|
Ransomware shutdowns |
Dependency mapping, segmentation, backup testing |
Operations that can continue |
|
SIS tampering |
SIS security review, engineering workstation controls |
Protected safety layer |
|
Pipeline SCADA compromise |
SCADA and RTU assessments |
Hardened pipeline control |
|
Third-party access |
Third-party access programme |
Controlled contractor and vendor access |
|
Destructive malware |
PAM, offline backups, EDR |
Recoverable estates |
|
Espionage |
Threat hunting, data protection |
Protected exploration and process data |
|
Phishing |
Phishing simulation, MFA |
Fewer compromised accounts |
|
Legacy OT |
Compensating controls, segmentation |
Reduced exposure |
|
Flat networks |
Architecture review and DMZ design |
Segmented plants |
|
Remote connectivity |
Remote and offshore link review |
Secure remote sites |
|
Retail fraud |
Station automation and payment testing |
Protected retail revenue |
|
Measurement manipulation |
Data integrity review |
Trustworthy measurements |
|
Supply-chain compromise |
OEM and update security assessments |
Trusted vendors |
|
BEC |
BEC simulation, payment controls |
Reduced fraud |
|
Removable media |
Scanning kiosks, media controls |
Clean media |
|
Insider misuse |
Access reviews, monitoring |
Accountable access |
|
Weak OT detection |
IT/OT SOC, playbooks |
Reliable 6-hour reporting |
|
OT recovery failure |
OT backup and restart drills |
Proven recovery |
3. Codec Networks service catalogue for the sector
|
Service line |
Sector-relevant services |
|
Security Vulnerability Assessment & Penetration Testing |
IT and OT assessments, DCS, SCADA, RTU and terminal automation reviews using safety-aware methods |
|
Industrial & infrastructure security |
IT/OT architecture, segmentation, DMZ, remote access and IEC 62443-aligned assessments |
|
Safety system security |
SIS isolation, engineering workstation and change management reviews |
|
Information security audit & compliance |
CERT-In-aligned IT/OT audits, NCIIPC-aligned controls, ISO/IEC 27001 |
|
Third-party risk management |
Contractor, vendor, OEM and dealer assessments; turnaround access controls |
|
24/7 Managed SOC & threat monitoring |
IT and OT monitoring, industrial protocol detection, threat hunting |
|
Cyber forensics |
OT and destructive-malware incident investigations |
|
Offensive security & simulation |
OT crisis tabletops, joint drills, red teaming |
|
Application & payment security |
Retail automation, billing, trading and payment testing; consumer data protection |
4. Codec Networks bundles for the sector
Eleven of the twelve bundles in the Codec Networks Bundled Service Models apply directly to oil, gas and petrochemical companies; the Global Cyber Back-Office SPV Program (Bundle 12) is offered separately for international clients.
Figure 6: Codec Networks bundles applied to the sector.
|
Bundle |
Name |
Sector-relevant scope |
Best suited for |
Key deliverables |
|
B1 |
Cyber Assessment & VAPT Assurance Program |
IT, OT, SCADA, DCS and SIS assessments |
All operators |
Assessment reports and closure tracker |
|
B2 |
Application, API & DevSecOps Security Program |
Retail, billing, trading and portal testing |
Marketing, retail and CGD companies |
Application risk report |
|
B3 |
Cloud, Infrastructure & Zero Trust Security Program |
IT/OT segmentation, DMZ and remote access |
All operators |
Architecture review |
|
B4 |
Regulatory Cybersecurity Audit & Compliance Assurance Program |
CERT-In and NCIIPC-aligned audits |
All operators |
Audit report, gap matrix |
|
B5 |
GRC, ISO, SOC 2 & Cyber Maturity Program |
IEC 62443, ISO 27001 and crisis plans |
Operators formalising OT security |
Maturity scorecard, crisis plan |
|
B6 |
Data Privacy, DPDPA & Data Protection Program |
Consumer data protection for retail, LPG and CGD |
Consumer-facing companies ahead of May 2027 |
Privacy gap assessment |
|
B7 |
Managed SOC, MDR & Continuous Threat Monitoring Program |
24x7 IT/OT SOC with threat hunting |
Large operators |
SOC reports, MTTD/MTTR |
|
B8 |
Digital Forensics, Incident Response & Malware RCA Program |
OT incident response and reporting |
Any operator facing an incident |
Forensic report and RCA |
|
B9 |
Third-Party Risk Management & Supply Chain Cyber Risk Program |
Contractor, vendor and OEM assessments |
All operators |
Vendor risk assessments |
|
B10 |
Cyber Simulation, Awareness, Tabletop & Crisis Readiness Program |
OT crisis exercises and joint drills |
Leadership, operations and safety teams |
Exercise reports |
|
B11 |
Emerging Technology, AI, Web3 & Future Security Program |
Digital refinery and IIoT security |
Operators adopting digital initiatives |
Risk assessment |
5. Sector programmes built from the bundles
Codec Networks packages the catalogue bundles into six oil and gas programmes.
|
Programme |
Built from bundles |
Challenges addressed |
|
OT Security Programme |
B1, B3 |
DCS, SCADA, segmentation and remote access |
|
Safety System Assurance |
B1, B5 |
SIS isolation and engineering controls |
|
Third-Party Access Programme |
B9, B3 |
Contractors, vendors and turnarounds |
|
IT/OT SOC & Hunting |
B7, B8 |
Detection, response and 6-hour reporting |
|
Operational Resilience |
B10, B3 |
Dependency mapping, backups and drills |
|
Retail & Consumer Security |
B2, B6 |
Station automation, payments and consumer data |
6. Packages: Foundation, Assurance and Continuous Resilience
|
Package element |
Foundation |
Assurance |
Continuous Resilience |
|
Typical organisation |
City gas, terminals and distributors |
Pipelines and mid-sized operators |
Refineries, petrochemicals and E&P majors |
|
Testing |
B1: SCADA and retail assessment |
B1: pipeline SCADA and RTU assessment |
B1 + B10: continuous OT testing and red teaming |
|
Audit and GRC |
B5: policy and crisis plan |
B4: annual independent audit |
B4 + B5 + B9: programme, SIS and vendor assurance |
|
Cloud and privacy |
B3: remote access and segmentation |
B3 + B9: third-party access programme |
B3 + B6 + B11: segmentation, consumer data and IIoT |
|
Monitoring and response |
IR retainer (B8) |
B7: IT/OT SOC + B8 |
B7: SOC with threat hunting + B8 |
|
Reporting |
Compliance checklist |
CISO and management reporting |
Board and regulator reporting |
7. Regulatory requirement-to-bundle mapping
|
Requirement (source) |
How Codec Networks helps |
Bundle |
|
Cyber incidents to CERT-In within six hours; 180-day logs (CERT-In Directions) |
IT/OT SOC, IR retainer and reporting support |
B7, B8 |
|
Risk-based independent cyber audits including OT/ICS (CERT-In audit guidelines, 2025) |
Independent IT/OT audits |
B4, B1 |
|
Protection of notified critical information infrastructure (NCIIPC) |
CII-aligned assessments and controls |
B4, B3 |
|
Pipeline and city gas integrity standards (PNGRB) |
SCADA and integrity-aligned security reviews |
B1 |
|
Installation safety standards (OISD) |
SIS and OT security reviews |
B1, B5 |
|
Consumer personal data (DPDP) |
DPDPA programme |
B6 |
|
Card payments at fuel stations (PCI DSS) |
Retail payment security review |
B2, B5 |
|
Contractor and vendor obligations (contracts) |
Third-party access programme |
B9 |
|
Auditor eligibility and independence Where a regulator, standard or contract requires CERT-In empanelled or independent auditors, Codec Networks—CERT-In empanelled for information security auditing services—confirms eligibility and independence in each proposal. |
8. Threat-to-bundle coverage matrix
|
Threat / challenge |
Primary bundle |
Supporting bundles |
|
Ransomware shutdowns |
B3 |
B7, B10 |
|
SIS tampering |
B1 |
B7 |
|
Pipeline SCADA |
B1 |
B7 |
|
Third-party access |
B9 |
B3 |
|
Destructive malware |
B3 |
B8, B10 |
|
Espionage |
B7 |
B6 |
|
Phishing |
B10 |
B7 |
|
Legacy OT |
B3 |
B1 |
|
Flat networks |
B3 |
B1 |
|
Remote connectivity |
B3 |
B1 |
|
Retail fraud |
B2 |
B7 |
|
Measurement manipulation |
B2 |
B7 |
|
Supply chain |
B9 |
B1 |
|
BEC |
B10 |
B7 |
|
Removable media |
B3 |
B7 |
|
Insider misuse |
B7 |
B3 |
|
Weak OT detection |
B7 |
B8 |
|
OT recovery failure |
B10 |
B3 |
“Primary” and “supporting” indicate suggested combinations, not guaranteed mitigation or complete coverage.
9. Delivery methodology and deliverables
Figure 7: The Codec Networks delivery methodology.
Typical deliverables include IT/OT and SCADA assessment reports with retests, an OT dependency and segmentation review, a safety system security review, a third-party access programme, a CERT-In-aligned audit report, a crisis plan and exercise reports, and IT/OT SOC reporting.
10. Why Codec Networks
- CERT-In empanelled for information security auditing services, and empanelled with NICSI for application audit and compliance services (start-up category).
- Certified to ISO 9001:2015, ISO/IEC 27001:2022 and ISO/IEC 20000-1:2018.
- Full stack: VAPT, regulatory audit, managed SOC, forensics, privacy and Board advisory from one partner, so findings, monitoring and closure stay connected.
- Oil and gas depth: DCS, SCADA, SIS, terminals and retail automation assessed with safety-aware methods.
- Recognised frameworks and tools: OWASP ASVS/MASVS and API Top 10, MITRE ATT&CK, NIST CSF, ISO 27001 and PCI DSS; tools such as Burp Suite, Nessus, Metasploit, Prowler and leading SIEM/EDR platforms.
- Certified people: CEH, OSCP, CPENT, CISA, ISO 27001 LA/LI, CHFI, CTIA and ECIH professionals.
Annex: Indicative commercial ranges
For internal sales reference only—remove this annex before sharing externally. Ranges are taken from the Codec Networks Bundled Service Models and are subject to scoping, asset counts, frequency and service levels.
|
Bundle |
Package examples and indicative ranges |
|
B1 VAPT Assurance |
Essential ₹1.5–5 lakh; Professional ₹5–15 lakh; Enterprise ₹15–40 lakh; Annual retainer ₹25 lakh–₹1.5 crore |
|
B2 AppSec & DevSecOps |
API Quick Check ₹2–6 lakh; AppSec Professional ₹8–20 lakh; DevSecOps Maturity ₹12–35 lakh; Secure SDLC retainer ₹3–15 lakh/month |
|
B3 Cloud & Zero Trust |
Cloud Essential ₹3–8 lakh; Professional ₹8–25 lakh; Enterprise ₹25–75 lakh; Continuous assurance ₹2–10 lakh/month |
|
B4 Regulatory Audit |
Gap review ₹5–15 lakh; Full regulatory audit ₹15–50 lakh; Multi-framework audit ₹30 lakh–₹1.25 crore; Annual retainer ₹3–20 lakh/month |
|
B5 GRC, ISO, SOC 2 |
ISO readiness ₹5–15 lakh; ISO implementation ₹15–45 lakh; SOC 2 readiness ₹15–60 lakh; GRC retainer ₹2–12 lakh/month |
|
B6 Privacy & DPDPA |
Quick assessment ₹3–10 lakh; Implementation ₹10–40 lakh; DPO-as-a-Service ₹2–8 lakh/month; Privacy retainer ₹3–15 lakh/month |
|
B7 Managed SOC |
Starter ₹2–5 lakh/month; Professional ₹5–15 lakh/month; Enterprise ₹15–50 lakh/month; co-managed per FTE/shift |
|
B8 Forensics & IR |
Triage ₹3–15 lakh; Full investigation ₹15–75 lakh; Ransomware response ₹25 lakh–₹1.5 crore; IR retainer ₹5–50 lakh/year |
|
B9 TPRM |
₹25,000–₹2 lakh per vendor; batch pricing for 50–500 vendors; retainer ₹3–25 lakh/month |
|
B10 Simulation & Tabletop |
Awareness ₹1–5 lakh; Phishing simulation ₹2–10 lakh; Tabletop ₹5–20 lakh; Cyber war-game ₹15–75 lakh; Annual retainer ₹10 lakh–₹1 crore/year |
|
B11 Emerging Tech |
AI/LLM risk review ₹5–25 lakh; Smart contract audit ₹5–50 lakh; Emerging tech retainer ₹5–25 lakh/month |
Talk to Codec Networks
|
Contact Codec Networks Pvt. Ltd. New Delhi: 507, 5th Floor, New Delhi House, Barakhamba Road, Connaught Place, New Delhi – 110001 Gurugram: 707, 7th Floor, Silverton Tower, Golf Course Extension Road, Sector 50, Gurugram – 122018, Haryana Landline: 011 430 496 96 | 011 437 522 99 Mobile: +91 99716 76124 | +91 88007 88220 | +91 88003 31124 Email: mktg@codecnetworks.com Web: www.codecnetworks.com |
Note: Service scope, deliverables, monitoring coverage and service levels are confirmed during engagement scoping. Services support risk reduction and assurance but do not guarantee prevention of all cyber incidents or regulatory compliance. Regulatory references are summaries; confirm against the official instruments applicable to each entity.