INDUSTRY FACT FILE · PHARMACEUTICALS & LIFE SCIENCES

Cybersecurity FAQs for Pharmaceuticals and Life Sciences

Forty frequently asked questions and answers in five categories, written for leadership, CISOs, quality, plant, R&D and clinical teams.

In this document 1.  Category 1: Cyber risk, governance and strategy 2.  Category 2: Regulation, GMP and compliance 3.  Category 3: Plants, OT and laboratories 4.  Category 4: Research, clinical data and IP 5.  Category 5: SOC, incidents, vendors and cloud

Audience: Boards, CEOs, CIOs and CISOs

Q1. Why is pharma a cyber target?

It combines valuable IP, regulated data and plants whose downtime creates pressure to pay ransoms.

Q2. What are the biggest risks?

Ransomware into plant OT, IP theft and espionage, insider exfiltration, data integrity failures, clinical data leakage and partner compromise.

Q3. Which incidents illustrate the risk?

NotPetya disrupted a major global drugmaker in 2017, a leading Indian pharma company suffered a cyberattack in 2020, and governments warned of state-backed targeting of vaccine research.

Q4. Why does cybersecurity matter to quality?

Attacks and weak controls can alter or destroy GMP records, creating data integrity and inspection issues.

Q5. What should leadership review?

OT risk, data integrity findings, IP protection, incidents, partner risks and SOC performance.

Q6. Who should own cybersecurity?

The CISO with the CIO, working closely with quality, engineering, R&D and clinical leadership.

Q7. How should we prioritise investment?

Segment IT from OT, fix data integrity basics, protect research data and monitor 24x7.

Q8. How can Codec Networks help?

Codec Networks provides OT security, data integrity reviews, IP protection, clinical data privacy, vendor assessments and managed SOC.

Audience: Quality, compliance and regulatory affairs teams

Q9. What is Revised Schedule M?

The updated good manufacturing practice requirements under the Drugs and Cosmetics Rules, covering quality systems, risk management and computerised systems.

Q10. When did MSMEs have to comply?

Under an extension, MSME manufacturers were required to comply by 31 December 2025; confirm current status with CDSCO.

Q11. What do export markets require?

Rules such as US FDA 21 CFR Part 11 and EU GMP Annex 11 cover electronic records, signatures and computerised systems.

Q12. What do clinical trial rules require?

The New Drugs and Clinical Trials Rules, 2019 and ICMR guidelines govern approval, conduct, records and participant protection.

Q13. Do CERT-In Directions apply?

Yes. Cyber incidents must be reported within six hours and ICT logs kept for 180 days in India.

Q14. How does DPDP apply?

Trial participant, patient and employee personal data require safeguards; most DPDP obligations take effect in May 2027.

Q15. Is data integrity a security issue?

Yes. Unique access, audit trails and change control are both GMP requirements and security controls.

Q16. Can Codec Networks support inspections?

Codec Networks provides security and data integrity reviews and evidence that support inspection readiness.

Audience: Plant, engineering, QC and IT teams

Q17. How should IT and OT be separated?

Use a DMZ between IT and OT, remove dual-homed systems and control every data flow between them.

Q18. How do we assess OT safely?

Use passive discovery and careful, planned testing with plant teams, avoiding disruption to production.

Q19. How should vendor access to OT be managed?

Through brokered, time-bound, monitored sessions with named accounts and MFA.

Q20. What about legacy instruments and HMIs?

Segment them, restrict access, monitor traffic and plan replacements with vendors.

Q21. How should lab systems be secured?

Unique accounts, role-based access, enabled and reviewed audit trails, controlled configurations and backups.

Q22. Should batch records be backed up offline?

Yes, along with OT configurations, so production can be restored after ransomware.

Q23. How do we monitor OT?

Use OT-aware monitoring that understands industrial protocols and alerts on unusual changes.

Q24. How should cold-chain monitoring be protected?

Secure monitoring devices and platforms and verify the integrity of temperature data.

Audience: R&D, clinical operations and privacy teams

Q25. How do we protect research IP?

Classify research data, restrict access, monitor exports and uploads, and review leavers' activity.

Q26. How do we detect insider exfiltration?

Use DLP and behaviour analytics to flag unusual access, downloads and transfers.

Q27. How should collaboration with partners be secured?

Use governed platforms, phishing-resistant MFA, least-privilege sharing and partner security assessments.

Q28. How should clinical platforms be tested?

Test EDC, CTMS, eTMF and trial apps for access control, data exposure and integrity.

Q29. How should sponsors oversee CROs?

Assess CRO security before contracting, include security clauses and review periodically.

Q30. Should trial data be stored locally?

Avoid it; keep data in validated systems and enforce encryption on any endpoint that holds it.

Q31. What about decentralised trials?

Apps, wearables and remote visits add data flows that need privacy and security review.

Q32. How do we handle espionage threats?

Use threat intelligence and hunting focused on known tradecraft against research organisations.

Audience: SOC, procurement, cloud and incident response teams

Q33. Do pharma companies need a SOC?

Yes. Monitoring of IT and OT is essential for early detection and six-hour reporting.

Q34. What should incident playbooks include?

Production and quality impact assessment, containment, evidence preservation, CERT-In reporting and partner and regulator communication.

Q35. How long must logs be retained?

CERT-In requires ICT logs for a rolling 180 days within India; GMP record retention rules also apply.

Q36. Should we run OT exercises?

Yes—tabletop exercises with plant, quality and leadership teams on ransomware scenarios.

Q37. How should cloud quality systems be assessed?

Review configuration, access, vendor controls and data integrity features.

Q38. How do we prevent BEC in procurement?

Verify supplier bank changes by call-back and require maker-checker approvals.

Q39. What AI risks apply in pharma?

Data leakage from research AI tools and integrity of AI-assisted quality decisions; govern and validate AI use.

Q40. How can we start with Codec Networks?

Begin with a scoping call on your sites, systems and partners; Codec Networks will propose a GMP-aware assessment plan.

Contact Codec Networks Pvt. Ltd. New Delhi: 507, 5th Floor, New Delhi House, Barakhamba Road, Connaught Place, New Delhi – 110001 Gurugram: 707, 7th Floor, Silverton Tower, Golf Course Extension Road, Sector 50, Gurugram – 122018, Haryana Landline: 011 430 496 96 | 011 437 522 99   Mobile: +91 99716 76124 | +91 88007 88220 | +91 88003 31124 Email: mktg@codecnetworks.com   Web: www.codecnetworks.com

Note: These FAQs provide general guidance as of October 2026 and do not constitute legal or regulatory advice. Confirm obligations against the official instruments.