Resources Categories

Back

INDUSTRY FACT FILE · SMART CITIES, WATER & URBAN UTILITIES

Main Products and Services in Smart Cities, Water and Urban Utilities

What India's smart city SPVs, municipal bodies, water utilities and urban services operators deliver, the plant, field, command centre and citizen systems behind each service, and where those systems create cybersecurity and compliance exposure.

In this document

1. How cities and utilities fund and deliver their services

2. Services by body type

3. The operational layer: plants, SCADA, field devices and command centres

4. The citizen and data layer: portals, ERP, payments and city data platforms

5. The systems behind the products and services

6. Trends that change the attack surface

7. Mapping operations to Codec Networks engagements

1. How cities and utilities fund and deliver their services

Revenue stream	How it works	Security relevance
Property tax and civic charges	Assessment, billing and collection through counters, portals and apps	Citizen data; collection continuity; payment integrations
Water and sewerage charges	Metered and flat-rate billing, smart metering, connections	Billing integrity; meter data; plant uptime
Grants and mission funding	Central and state scheme funds for capital projects and O&M	Scheme conditions; audit evidence; project data
User charges and concessions	Parking, transit, lighting, advertising and PPP revenue shares	Concessionaire systems; user data; revenue reconciliation
Surveillance and safe-city services	Camera networks, analytics and command centres for police and traffic	Footage and recognition data; lawful access; uptime
Data and platform services	City data platforms, IUDX exchanges, dashboards for departments	API security; data governance; cloud configuration

2. Services by body type

Body type	Main services	Key systems
Smart city SPVs	ICCC operations, smart infrastructure O&M, data platforms	ICCC software, VMS, analytics, dashboards, IoT platforms, GIS
Municipal corporations	Tax, licences, certificates, sanitation, grievances	E-governance portals, municipal ERP, payment gateways, mobile apps
Water supply boards	Treatment, pumping, distribution, billing	SCADA, PLCs, HMIs, telemetry, smart meters, billing systems
Wastewater operators	Sewage and effluent treatment, pumping, reuse	Plant SCADA, pumping station RTUs, lab systems, compliance reporting
Safe-city and ICCC operators	Surveillance, traffic enforcement, emergency response	Cameras, VMS, ANPR, facial recognition, dispatch and dial-112 links
Urban services concessionaires	Parking, lighting, metering, transit technology	Streetlight controllers, parking sensors, AFC, cellular gateways, cloud platforms

3. The operational layer: plants, SCADA, field devices and command centres

A city's water system runs on supervisory control and data acquisition (SCADA) software, programmable logic controllers (PLCs) and human-machine interfaces (HMIs) at treatment plants and pumping stations, with remote terminal units and radios reporting flows, pressures and levels from across the distribution network. Chemical dosing, filtration and pumping are controlled by set-points; alarms and interlocks catch excursions. Sewage treatment plants and pumping stations use the same building blocks, often with fewer staff and older equipment.

On the streets sit cameras, adaptive traffic signals, smart streetlights, parking sensors, environmental sensors and smart meters, connected by fibre, Wi-Fi or cellular gateways. The integrated command and control centre fuses these feeds through video management, analytics, GIS and dashboard platforms, usually built and operated by a master system integrator under an O&M contract. Many plants and field systems still run on unsupported operating systems, default credentials and remote-desktop tools installed for contractor convenience—the conditions behind Oldsmar and Aliquippa.

4. The citizen and data layer: portals, ERP, payments and city data platforms

Above the operational layer sit the systems citizens touch. Municipal e-governance platforms and ERP run property tax, trade licences, birth and death certificates, building permissions and grievances; water boards run billing and connection systems; payment gateways and UPI integrations collect revenue; and mobile apps extend all of this to phones. These systems hold identity, property and payment data for millions of residents and are, by design, exposed to the internet.

City data platforms, the India Urban Data Exchange and state data centres aggregate feeds from departments and devices for analytics, planning and open data. Dashboards and APIs give departments, researchers and start-ups access. Hosting ranges from NIC and state data centres to commercial cloud, so identity, configuration and API security determine whether a single weakness exposes one department or every city on the platform.

Highest-risk moments

Mission handover when integrators leave and cities inherit systems with default settings, contractor remote-desktop sessions into plant HMIs, O&M renewals that change who holds credentials, tax and billing seasons when portals peak, new IoT and smart-metering roll-outs connected to existing networks, and surveillance data exports by contractors are where city and utility incidents typically begin or escalate.

5. The systems behind the products and services

Title: Figure 2: Where cyber risk sits across city and utility operations. - Description: Figure 2: Where cyber risk sits across city and utility operations.

Figure 2: Where cyber risk sits across city and utility operations.

Product / service	Systems that deliver it	Key cyber and compliance touchpoints
Water and wastewater plants	SCADA, PLCs, HMIs, dosing and pumping control, historians	SCADA assessment, remote access removal, set-point limits, OT monitoring
Distribution and telemetry	RTUs, radios, flow and pressure sensors, smart meters	Telemetry integrity, device credentials, network isolation
Field and street systems	Cameras, traffic signals, streetlights, parking, gateways	IoT and field device assessment, isolation, firmware management
Command centre	ICCC software, VMS, analytics, dispatch, dashboards	Platform assessment, segmentation, MSI access brokering, backups
City data platforms	IUDX, GIS, data lakes, APIs, cloud and state data centres	Cloud posture, API testing, data governance
Citizen services	Portals, apps, municipal ERP, billing, payment gateways	Application testing, backups, payment controls, DPDP

6. Trends that change the attack surface

Trend	What is changing	Security implication
Post-mission O&M	Cities and SPVs take over systems built by integrators under the Smart Cities Mission	Ownership of credentials, access and patching must transfer with the systems
Water security programmes	AMRUT 2.0 and smart metering extend SCADA and telemetry to more towns	More plants and devices connected with thin local teams
Video analytics and recognition	ANPR, facial recognition and AI analytics on city camera networks	Surveillance governance, DPDP and lawful-access controls
City data platforms	IUDX, open data and cross-department dashboards	API and data governance become city-wide risks
Digital payments and apps	UPI, gateways and apps for tax, water and services	Citizen-facing application and payment security
Regulatory formalisation	CERT-In government-entity guidelines, audit guidelines, DPDP, CCTV requirements	Evidence-based assurance expected by auditors and lenders

7. Mapping operations to Codec Networks engagements

If the body operates…	Recommended starting engagement
Water or sewage plants and pumping stations	SCADA and HMI assessment, remote access removal, set-point and alarm review, OT monitoring
An ICCC, VMS or safe-city camera network	ICCC and VMS assessment, segmentation, MSI access brokering, surveillance governance
Citizen portals, apps and municipal ERP	Application and payment testing, backup validation, DPDP programme
Smart streetlights, meters, signals or parking	IoT and gateway assessment, isolation, device credential and firmware management
City data platforms or state hosting	Cloud posture, API testing, data governance, government-entity gap assessment
Integrators, O&M contractors and concessionaires	Third-party risk programme, contract clauses, handover security checks

Talk to Codec Networks

Contact

Codec Networks Pvt. Ltd.

New Delhi: 507, 5th Floor, New Delhi House, Barakhamba Road, Connaught Place, New Delhi – 110001

Gurugram: 707, 7th Floor, Silverton Tower, Golf Course Extension Road, Sector 50, Gurugram – 122018, Haryana

Landline: 011 430 496 96 | 011 437 522 99 Mobile: +91 99716 76124 | +91 88007 88220 | +91 88003 31124

Email: mktg@codecnetworks.com Web: www.codecnetworks.com

Note: Descriptions are general and based on public information available as of October 2026. Systems and exposures differ by city, utility and contract.