Resources Categories
INDUSTRY FACT FILE · SMART CITIES, WATER & URBAN UTILITIES
Industry Overview: Smart Cities, Water and Urban Utilities in India
Who runs India's smart cities, command centres, water and wastewater systems and urban services, the obligations that apply, who buys cybersecurity and why each type of body needs a distinct approach.
|
In this document 1. Why smart city and urban utility cybersecurity matters now 2. The ecosystem at a glance 3. Categories of smart city, water and urban utility bodies 4. The policy, regulatory and standards framework at a glance 5. Government, public-sector and private participants 6. Who buys cybersecurity inside a city or utility 7. Why each type of body needs a different approach 8. How Codec Networks works with cities and utilities |
|
Sector scope Sector: smart city SPVs and integrated command and control centres, municipal corporations and councils, water supply and sewerage boards, wastewater operators and urban services platforms (parking, lighting, surveillance, transit). Primary service proposition: integrated command centre security, SCADA and IoT testing, surveillance privacy and a 24x7 city SOC. City gas, power distribution and metro rail have separate fact files. |
1. Why smart city and urban utility cybersecurity matters now
Roughly 37 per cent of Indians now live in towns and cities, served by more than 4,000 statutory urban local bodies. In a decade, central missions have digitised how those cities run. The Smart Cities Mission, launched in June 2015, selected 100 cities whose special purpose vehicles delivered more than 8,000 projects worth about ₹1.64 lakh crore—95 per cent complete by July 2025—including an integrated command and control centre (ICCC) in every one of the 100 cities. AMRUT 2.0, launched in October 2021, aims at universal water supply across all statutory towns and sewerage in 500 cities, and the National Urban Digital Mission and India Urban Data Exchange, launched in February 2021, are building shared data platforms across cities.
|
100 Smart cities with operational integrated command and control centres (MoHUA) |
11,100 ppm Lye set-point an intruder dialled in at the Oldsmar water plant (2021) |
~70% Of inspected US water systems failed cyber standards (EPA, 2024) |
6 hours To report cyber incidents to CERT-In |
The result is a connected public estate: water and sewage treatment plants and pumping stations run on SCADA, PLCs and telemetry; streets carry cameras, adaptive traffic signals, smart streetlights, sensors and smart meters; ICCCs fuse video, traffic, utilities and emergency dashboards; and citizens pay property tax and water bills, file grievances and book services through portals and apps. Most of it was built by master system integrators and is operated by contractors and concessionaires who hold remote access, and, with the Smart Cities Mission's financial closure in March 2025, cities and SPVs now own the operations and maintenance—and the cyber risk—of what was built.
The incidents are real and physical. In February 2021 an intruder used remote-desktop software to raise the sodium hydroxide set-point at the Oldsmar, Florida water plant from 100 to 11,100 parts per million before an operator intervened. In November 2023 the Municipal Water Authority of Aliquippa, Pennsylvania lost control of a booster station when an Iran-affiliated group compromised an internet-exposed Unitronics PLC with a default password. In May 2024 the US EPA warned that about 70 per cent of water systems it had inspected failed basic cyber standards, including default passwords. In India, ransomware encrypted Pimpri-Chinchwad's smart city servers in February 2021, locked Goa's river flood-monitoring system during the June 2022 monsoon, and in December 2023 corrupted Madhya Pradesh's e-Nagarpalika portal serving 413 towns, forcing recovery from tape backups.
The obligations are layered. CERT-In's Directions require six-hour incident reporting and 180-day logs from government organisations and bodies corporate alike; CERT-In's June 2023 guidelines set baseline controls—a designated CISO, asset inventories, access control, third-party and cloud security—for government entities and their agencies; and its 2025 audit guidelines expect risk-based independent audits that include OT/ICS. Systems notified as protected systems fall under NCIIPC; CCTV cameras sold in India must meet MeitY's essential security requirements from April 2025; and the DPDP Act and Rules will govern citizen, commuter and surveillance data from May 2027, subject to the exemptions the Act allows for notified state instrumentalities. Lenders, auditors and state governments increasingly ask cities to evidence all of this.
|
Key takeaway In cities and utilities, cybersecurity is public safety, service continuity and public trust in one. Plants, command centres, field devices, the vendors who reach them and the portals citizens depend on must be protected together. |
2. The ecosystem at a glance
Figure 1: India's smart cities, water and urban utilities ecosystem.
3. Categories of smart city, water and urban utility bodies
|
Category |
Who they are |
Typical ownership |
Key regulatory basis |
|
Smart city SPVs |
City-level companies that built and now operate ICCCs, smart infrastructure and data platforms under the Smart Cities Mission |
Companies owned by the state and the urban local body |
Companies Act; CERT-In Directions; CERT-In government-entity guidelines where applicable; DPDP |
|
Municipal corporations and councils |
Civic services, property tax, water billing, sanitation, e-governance portals and apps |
Elected urban local bodies under state municipal Acts |
State municipal Acts; CERT-In; CERT-In government-entity guidelines; DPDP |
|
Water supply and sewerage boards |
Treatment plants, pumping, distribution, sewerage and billing for cities |
State parastatals and municipal departments |
State water Acts; CERT-In; NCIIPC where notified; BIS drinking-water standards |
|
Wastewater and treatment operators |
STPs, common effluent plants, reuse and pumping under PPP or O&M contracts |
Private operators and concessionaires |
Environmental consents; contract clauses; CERT-In |
|
ICCC and safe-city operators |
Command centres, surveillance, video analytics and emergency dashboards |
SPVs, police departments, integrators under O&M |
CERT-In; MeitY CCTV requirements; DPDP; police and state rules |
|
Urban services concessionaires |
Parking, street lighting, smart metering, waste and transit technology |
Private concessionaires and PPP operators |
Concession agreements; CERT-In; DPDP for commuter and user data |
|
State missions and data platforms |
State urban departments, state data centres, IUDX and city data platforms |
State governments, NIC, academic partners |
CERT-In government-entity guidelines; MeitY cloud and data policies; DPDP |
4. The policy, regulatory and standards framework at a glance
|
Instrument or expectation |
What it means for cities and utilities |
|
CERT-In Directions (28 April 2022) |
Cyber incidents reported within six hours of noticing them; ICT logs kept for a rolling 180 days in India; clock synchronisation; designated point of contact—applicable to government organisations and bodies corporate |
|
CERT-In guidelines for government entities (30 June 2023) |
Baseline security controls for ministries, departments, their agencies and public enterprises: designated CISO, asset inventory, access management, application, data, third-party and cloud security, and continuity planning |
|
CERT-In audit policy guidelines (25 July 2025) |
Risk-based, independent cyber audits covering IT, OT/ICS, cloud and applications, with closure of findings |
|
NCIIPC (IT Act Section 70A) |
Protection of systems notified as protected systems or critical information infrastructure; water, city and emergency systems may be notified by their owning government |
|
DPDP Act 2023 and DPDP Rules 2025 |
Notices, safeguards, retention limits and breach intimation for citizen, commuter, employee and surveillance data; most obligations from May 2027; the Act allows exemptions for notified state instrumentalities |
|
MeitY essential requirements for CCTV (in effect 9 April 2025) |
CCTV cameras under the Compulsory Registration Order must meet security requirements tested by STQC—relevant to safe-city and ICCC procurement |
|
Urban missions, lenders and contracts |
Smart Cities Mission and AMRUT 2.0 scheme conditions, multilateral lender requirements, concession and O&M contract clauses; IEC 62443 and ISO/IEC 27001 as the standards of reference |
|
How these apply Applicability depends on whether a body is a government entity, a company or a private operator, on state law and on any NCIIPC notifications. Summaries here are not legal advice; confirm against the official instruments and your contracts. |
5. Government, public-sector and private participants
- The Ministry of Housing and Urban Affairs runs the Smart Cities Mission, AMRUT 2.0, SBM-Urban 2.0 and the National Urban Digital Mission; the Ministry of Jal Shakti leads national water programmes.
- State urban development departments, water boards and state data centres fund, operate and host city systems; NIC hosts many government applications.
- MeitY and CERT-In set cyber obligations and government-entity guidelines; NCIIPC protects notified systems; MeitY's CCTV essential requirements govern cameras.
- Smart city SPVs, municipal corporations and police departments own ICCCs, surveillance and civic platforms.
- Master system integrators, SCADA and IoT OEMs, O&M contractors and concessionaires built and operate most of the estate.
- Multilateral lenders, CAG and state auditors and municipal bond investors increasingly scrutinise operational and cyber resilience.
6. Who buys cybersecurity inside a city or utility
|
Stakeholder |
What they care about |
What they buy |
|
Municipal commissioner and SPV CEO |
Service continuity, public safety, audit findings, public trust |
Board advisory, resilience programmes, crisis exercises |
|
City CIO, IT head and CISO |
ICCC, portals, data platforms, CERT-In obligations |
Audits, assessments, SOC, GRC programmes |
|
Water board engineers and plant operators |
Plant safety, pumping continuity, telemetry integrity |
SCADA assessments, segmentation, playbooks |
|
ICCC and safe-city heads |
Camera uptime, analytics, lawful access |
ICCC and VMS testing, surveillance governance |
|
Traffic, transit and lighting units |
Signals, parking, streetlights, concessions |
Field device and IoT assessments |
|
Revenue, tax and billing teams |
Collections, portals, payment integrations |
Portal testing, payment fraud controls |
|
Procurement and contracts |
MSI, O&M and concessionaire obligations |
Third-party risk programmes, contract clauses |
|
State missions and data cells |
Data platforms, IUDX, hosting |
Cloud and data platform assessments, DPDP |
7. Why each type of body needs a different approach
|
Body type |
Highest-consequence risk |
Starting point for assurance |
|
Smart city SPV |
ICCC takeover or ransomware blinding the city |
ICCC assessment, segmentation, MSI access controls, backups |
|
Municipal corporation |
Citizen portal and ERP ransomware in collection season |
Portal testing, backups, DPDP, SOC |
|
Water supply board |
Set-point or pump manipulation at a plant |
SCADA assessment, remote access removal, OT monitoring |
|
Wastewater operator |
Pumping station telemetry suppression and overflows |
Telemetry and field device review, alarms, segmentation |
|
Safe-city or ICCC operator |
Surveillance data misuse and camera exposure |
VMS and analytics assessment, surveillance governance |
|
Urban services concessionaire |
IoT gateways hijacked and user data exposed |
IoT assessment, isolation, device management |
|
State mission or data platform |
Platform misconfiguration exposing many cities |
Cloud posture, API testing, government-entity gap assessment |
8. How Codec Networks works with cities and utilities
Codec Networks is a CERT-In empanelled information security auditing organisation certified to ISO 9001:2015, ISO/IEC 27001:2022 and ISO/IEC 20000-1:2018. For cities and utilities we deliver ICCC, VMS and data platform assessments, SCADA, PLC and field device testing using plant-aware methods, segmentation and vendor access design, surveillance governance aligned to DPDP and MeitY requirements, citizen portal and payment testing, CERT-In and government-entity guideline audits, a 24x7 city SOC and crisis exercises with plant, ICCC and civic teams—connected from finding to closure.
Talk to Codec Networks
|
Contact Codec Networks Pvt. Ltd. New Delhi: 507, 5th Floor, New Delhi House, Barakhamba Road, Connaught Place, New Delhi – 110001 Gurugram: 707, 7th Floor, Silverton Tower, Golf Course Extension Road, Sector 50, Gurugram – 122018, Haryana Landline: 011 430 496 96 | 011 437 522 99 Mobile: +91 99716 76124 | +91 88007 88220 | +91 88003 31124 Email: mktg@codecnetworks.com Web: www.codecnetworks.com |
Note: This document is general industry guidance based on public information available as of October 2026. It is not legal, safety or regulatory advice. Obligations differ by legal status (government entity, body corporate, SPV or concessionaire), state law, scheme conditions and contracts; confirm them against the official CERT-In, MeitY, NCIIPC, MoHUA, state and DPDP instruments and your contracts.