Resources Categories
INDUSTRY FACT FILE · OIL, GAS & PETROCHEMICALS
Market Landscape and the Drivers of Cybersecurity Demand in Oil and Gas
The business, technology, regulatory, legal and statutory forces that create cybersecurity, audit and assurance work for oil, gas and petrochemical companies.
|
In this document 1. Market landscape 2. Business drivers 3. Technology drivers 4. Regulatory drivers: CERT-In, NCIIPC, PNGRB and OISD 5. Legal and statutory drivers 6. How the drivers differ by organisation type 7. What this means for buyers and for Codec Networks |
1. Market landscape
India's oil and gas sector is anchored by large public-sector companies across upstream, refining, pipelines and marketing, alongside major private refiners, international upstream partners and fast-growing city gas distributors. Energy security, safety and continuity make cybersecurity a Board-level issue, reinforced by CERT-In obligations and critical infrastructure protection.
|
6 hours Incident reporting to CERT-In |
180 days ICT log retention in India |
Jul 2025 CERT-In audit policy guidelines |
May 2027 Most DPDP obligations take effect |
|
Market segment |
Landscape and buying behaviour |
Cybersecurity opportunity |
|
Integrated PSUs and private majors |
Refining, pipelines, marketing at scale |
Programme-level OT security, SOC, red teaming |
|
Upstream operators |
Remote and offshore assets |
Remote access, PAM, destructive-malware resilience |
|
City gas distributors |
Rapidly expanding networks |
SCADA, metering and remote access reviews |
|
Retail and LPG networks |
Thousands of outlets |
Retail automation and payment security |
2. Business drivers
|
Business driver |
Buying trigger |
Relevant services |
|
Process safety |
Cyber incidents can create safety hazards |
SIS and OT security |
|
Supply continuity |
Shutdowns affect regional fuel supply |
Dependency mapping and resilience |
|
Revenue protection |
Retail fraud and inventory manipulation |
Retail and measurement integrity |
|
Insurance |
Insurers scrutinise OT cyber controls |
Control validation |
|
Reputation |
Major incidents attract national attention |
Incident readiness and exercises |
3. Technology drivers
|
Technology driver |
Exposure created |
Codec Networks opportunity |
|
DCS and SIS |
Tampering with control and safety logic |
OT and SIS assessments |
|
Pipeline SCADA |
Remote site compromise |
SCADA and RTU assessments |
|
Contractor access |
Malware during turnarounds |
Third-party access programmes |
|
Retail automation |
Fleet-wide manipulation |
Retail system testing |
|
Corporate IT |
Ransomware and wipers |
EDR, PAM, backups, SOC |
Figure 3: The four groups of drivers behind cybersecurity spending in oil and gas.
4. Regulatory drivers: CERT-In, NCIIPC, PNGRB and OISD
|
Instrument |
Key requirements |
|
CERT-In Directions (2022) |
Six-hour incident reporting; 180-day ICT logs in India |
|
CERT-In audit policy guidelines (July 2025) |
Risk-based, independent audits covering IT and OT/ICS |
|
NCIIPC (IT Act Section 70A) |
Protection of notified critical information infrastructure in the energy sector |
|
PNGRB Act 2006 and regulations |
Technical, safety and integrity standards for pipelines and city gas |
|
OISD standards |
Safety standards for installations, which OT and safety system security supports |
|
Confirm applicability Obligations depend on assets, licences and any NCIIPC notifications. Confirm against the official instruments. |
Figure 4: Regulatory and standards timeline shaping oil and gas cybersecurity, as of October 2026.
5. Legal and statutory drivers
|
Law or obligation |
Relevance |
Demand created |
|
IT Act, 2000 and CERT-In Directions |
Incident reporting and CII protection |
SOC, logging and audits |
|
PNGRB Act, 2006 |
Regulation of pipelines and city gas |
Integrity and safety-aligned controls |
|
Petroleum and explosives safety rules |
Safety of storage and installations |
Safety system protection |
|
DPDP Act, 2023 and Rules, 2025 |
Consumer data in retail, LPG and CGD |
Privacy programmes |
|
Contracts |
EPC, OEM, contractor and dealer agreements |
Third-party security obligations |
6. How the drivers differ by organisation type
|
Organisation type |
Dominant business drivers |
Dominant technology drivers |
Principal regulatory drivers |
|
Upstream |
Production continuity |
Remote and offshore OT |
CERT-In, NCIIPC, upstream rules |
|
Pipelines and CGD |
Supply continuity |
SCADA and RTUs |
PNGRB, CERT-In, NCIIPC |
|
Refining and petrochemicals |
Safety, margins |
DCS and SIS |
OISD, CERT-In, NCIIPC |
|
Retail and LPG |
Revenue, consumer trust |
Station automation, payments |
DPDP, PCI DSS, CERT-In |
7. What this means for buyers and for Codec Networks
|
Customer buying need |
Recommended offering |
Natural recurring engagement |
|
“Would IT ransomware force a shutdown?” |
OT dependency mapping and segmentation |
Annual resilience testing |
|
“Are our safety systems isolated?” |
SIS security review |
Periodic reviews |
|
“Contractors flood the plant during turnarounds.” |
Third-party access programme |
Per-turnaround controls |
|
“We need 24x7 OT monitoring.” |
IT/OT SOC |
Continuous monitoring |
|
“We need an independent cyber audit.” |
CERT-In-aligned IT/OT audit |
Annual audits |
Talk to Codec Networks
|
Contact Codec Networks Pvt. Ltd. New Delhi: 507, 5th Floor, New Delhi House, Barakhamba Road, Connaught Place, New Delhi – 110001 Gurugram: 707, 7th Floor, Silverton Tower, Golf Course Extension Road, Sector 50, Gurugram – 122018, Haryana Landline: 011 430 496 96 | 011 437 522 99 Mobile: +91 99716 76124 | +91 88007 88220 | +91 88003 31124 Email: mktg@codecnetworks.com Web: www.codecnetworks.com |
Note: This document is general industry guidance based on public information available as of October 2026. It is not legal or safety advice. Confirm obligations against the official CERT-In, NCIIPC, PNGRB, OISD and MoPNG instruments and any notifications applicable to your systems.