Resources Categories
INDUSTRY FACT FILE · TEXTILES, APPAREL & CONSUMER MANUFACTURING
Industry Overview: Textiles, Apparel and Consumer Manufacturing in India
Who spins, weaves, sews and makes India's textiles, garments, footwear and consumer goods, the obligations that apply, who buys cybersecurity and why each type of company needs a distinct approach.
|
In this document 1. Why textiles, apparel and consumer manufacturing cybersecurity matters now 2. The ecosystem at a glance 3. Categories of textile, apparel and consumer manufacturing companies 4. The regulatory, standards and buyer framework at a glance 5. Government, industry and private participants 6. Who buys cybersecurity inside a textile, apparel or consumer goods company 7. Why each type of company needs a different approach 8. How Codec Networks works with textile, apparel and consumer manufacturers |
|
Sector scope Sector: textile mills, spinning and weaving, processing and job-work units, garment and home textile exporters, footwear makers, consumer products manufacturers, brand owners' supply chains and D2C arms. Primary service proposition: ERP and e-commerce security, IP protection, SOC, privacy and supplier assurance. Retail and e-commerce platforms, FMCG, manufacturing and logistics have separate fact files. |
1. Why textiles, apparel and consumer manufacturing cybersecurity matters now
India's textile and apparel sector is the country's second-largest employer after agriculture, with more than 45 million people employed directly according to the Ministry of Textiles, and it stretches from cotton and man-made fibre spinning through weaving, knitting, dyeing and printing to garment and home textile exporters supplying global brands. Around it sit the world's second-largest footwear industry, producing roughly 2.6 billion pairs a year, and a broad consumer manufacturing base making home, personal care and lifestyle products for Indian and international markets. Government policy is pushing scale and value: a ₹10,683 crore production-linked incentive for man-made fibre apparel, fabrics and technical textiles, seven PM MITRA mega textile parks with a ₹4,445 crore outlay, and a stated ambition of a US$350 billion textile industry by 2030.
|
45 mn+ People directly employed in India's textile sector (Ministry of Textiles) |
₹10,683 cr PLI outlay for MMF apparel, MMF fabrics and technical textiles |
2nd Largest footwear producer in the world, about 2.6 billion pairs a year |
6 hours To report cyber incidents to CERT-In |
The business now runs on connected systems. ERP schedules production, raises GST e-invoices and prepares export documents; PLM and shared cloud folders hold designs, tech packs and costings; buyer portals and EDI carry purchase orders and compliance records; automated cutting, knitting and sewing lines connect to the plant network; and brands and their D2C arms sell through websites, apps, marketplaces and loyalty programmes that hold consumer data. Global buyers add their own layer: vendor codes of conduct, security questionnaires and audits before and during contracts. Each system and each connection is a path an attacker can use.
The consequences are visible in public incidents. In December 2023, VF Corporation—owner of Vans, The North Face and other brands—disclosed a cyber incident that disrupted order fulfilment and retail replenishment and, in a later filing, exposed personal data of about 35.5 million consumers. In May 2022, a ransomware attack on Hanesbrands limited its ability to fill orders for about three weeks and cost roughly US$100 million in net sales in a single quarter. In June 2024, Levi Strauss notified 72,231 customers after a credential-stuffing attack on its website; in May 2025, Adidas reported a consumer data breach that originated at a third-party customer service provider. IBM X-Force has ranked manufacturing the most attacked industry for five consecutive years. Indian exporters and brands share the same platforms, buyers and exposure.
In India the obligations are cross-sector but real. CERT-In's Directions require cyber incidents to be reported within six hours and ICT logs to be retained for 180 days; CERT-In's July 2025 audit policy guidelines expect risk-based, independent cyber audits; listed textile and apparel groups must disclose cyber incidents in the quarterly corporate governance report under SEBI's LODR Regulations; and the DPDP Act and Rules will govern consumer, loyalty, employee and worker data, with most obligations from May 2027. Sector and product rules add a second layer—GST e-invoicing above ₹5 crore turnover since August 2023, BIS Quality Control Orders on footwear since August 2024, Legal Metrology declarations on consumer packs—and exporters face buyer security requirements and, for connected consumer products sold in the EU, the Cyber Resilience Act's reporting duties from September 2026.
|
Key takeaway In textiles, apparel and consumer manufacturing, cybersecurity is shipment continuity, design protection, payment integrity, consumer trust and buyer confidence in one. The factory, the ERP and documents that ship from it, the designs it builds from, the suppliers behind it and the channels in front of it must be protected together. |
2. The ecosystem at a glance
Figure 1: India's textiles, apparel and consumer manufacturing ecosystem.
3. Categories of textile, apparel and consumer manufacturing companies
|
Category |
Who they are |
Typical ownership |
Key regulatory basis |
|
Spinning and weaving mills |
Cotton and MMF yarn, woven and knitted fabric, technical textiles, PLI beneficiaries |
Listed and private textile groups, cooperative mills |
CERT-In; SEBI LODR (listed); PLI scheme conditions; DPDP |
|
Processing and job-work units |
Dyeing, printing, finishing, embroidery, trims and packaging on job-work |
Mostly private MSMEs and clusters |
CERT-In; GST and e-invoicing; buyer and customer requirements |
|
Garment and home textile exporters |
Apparel, made-ups and home textiles for global brands and retailers |
Private exporters and listed groups |
CERT-In; SEBI LODR (listed); buyer vendor codes and questionnaires; customs and GST |
|
Footwear manufacturers |
Leather and non-leather footwear for domestic brands and export |
Private and listed manufacturers, clusters |
CERT-In; BIS footwear QCOs; buyer requirements; DPDP |
|
Consumer products manufacturers |
Home, personal care, lifestyle and household goods, often for brand owners |
Private and listed manufacturers, contract manufacturers |
CERT-In; Legal Metrology; BIS standards; brand contracts; EU CRA where connected |
|
Brand owners and licensees |
Design, sourcing, marketing and sale of own or licensed brands |
Listed and private brand companies |
CERT-In; SEBI LODR (listed); DPDP; Consumer Protection Act; trademark law |
|
D2C and e-commerce arms |
Brand websites, apps, marketplace stores, loyalty programmes |
Units of manufacturers and brands |
CERT-In; DPDP; PCI DSS; Consumer Protection (E-Commerce) Rules |
4. The regulatory, standards and buyer framework at a glance
|
Instrument or expectation |
What it means for manufacturers and brands |
|
CERT-In Directions (28 April 2022) |
Cyber incidents reported within six hours of noticing them; ICT logs kept for a rolling 180 days in India; clock synchronisation; designated point of contact |
|
CERT-In audit policy guidelines (25 July 2025) |
Risk-based, independent cyber audits covering IT, OT, cloud and applications, with findings closure—ERP, plant systems and e-commerce belong in scope |
|
SEBI LODR Regulations (listed companies) |
Cyber security incidents, breaches and loss of data disclosed in the quarterly corporate governance report since July 2023; Board responsibility for risk management |
|
DPDP Act 2023 and DPDP Rules 2025 |
Safeguards, notices, consent and breach intimation for consumer, loyalty, employee and worker personal data; most obligations from May 2027 |
|
GST, customs and e-invoicing |
E-invoicing through the Invoice Registration Portal for businesses above ₹5 crore turnover since 1 August 2023; e-way bills; export documentation through customs systems—integrity and availability of these flows is a business requirement |
|
Product and consumer rules |
BIS Quality Control Orders for footwear in force from 1 August 2024; Legal Metrology (Packaged Commodities) Rules 2011 declarations on consumer packs; Consumer Protection Act 2019 and its e-commerce rules for D2C sales |
|
Buyer and export requirements |
Brand vendor codes, security questionnaires and audits; PCI DSS v4.0.1 for card payments on D2C channels; EU Cyber Resilience Act for connected consumer products (reporting from September 2026, full application December 2027); ISO/IEC 27001 as the common language |
|
How these apply Most Indian cyber obligations are cross-sector and depend on size and listing status; product rules depend on what you make; buyer requirements depend on whom you sell to. Social and environmental audit schemes used by brands are not cyber audits. Confirm against the official instruments and your contracts. |
5. Government, industry and private participants
- The Ministry of Textiles and DPIIT drive sector policy—PLI for textiles, PM MITRA parks, technical textiles and ease of doing business; MeitY and CERT-In set cyber obligations.
- CBIC administers GST, e-invoicing and customs; BIS sets product standards and QCOs; the Department of Consumer Affairs administers Legal Metrology and consumer protection; SEBI governs listed-company disclosure.
- Export promotion councils and industry associations (apparel, textiles, footwear, leather) coordinate exporters and buyer engagement.
- Listed textile, apparel and footwear groups lead integrated and branded manufacturing; private exporters and clusters supply global brands.
- Global brands and retailers set vendor codes, security questionnaires and audit requirements for Indian suppliers.
- Machine OEMs, ERP, PLM and e-commerce platform vendors build and maintain the systems factories and brands depend on.
6. Who buys cybersecurity inside a textile, apparel or consumer goods company
|
Stakeholder |
What they care about |
What they buy |
|
Board, MD and CFO |
Shipment continuity, payment integrity, disclosure, buyer relationships |
Board advisory, resilience programmes, crisis exercises |
|
CIO, CISO and IT heads |
ERP, cloud, e-commerce and plant security; audits; buyer questionnaires |
Audits, assessments, SOC, GRC programmes |
|
Merchandising and export heads |
Buyer compliance, documents, on-time shipment |
Questionnaire readiness, document integrity controls |
|
Design and product development |
Protection of designs, tech packs and samples |
DLP, PLM access reviews, contractor controls |
|
Finance and treasury |
Export proceeds, supplier payments, BEC |
Payment controls, BEC simulation, SOC |
|
E-commerce and marketing |
D2C sites, apps, loyalty, consumer trust |
Web, API and app testing, bot controls, privacy |
|
Sourcing and vendor management |
Job-worker and supplier reliability |
Supplier assurance programmes |
7. Why each type of company needs a different approach
|
Company type |
Highest-consequence risk |
Starting point for assurance |
|
Spinning and weaving mills |
Ransomware across ERP and plant systems in a capital-intensive, thin-margin business |
IT and plant assessment, segmentation, backup testing |
|
Processing and job-work units |
Being the supplier whose outage stops customers' lines |
Baseline assessment, backups, customer evidence |
|
Garment and home textile exporters |
Shipment stoppage, export proceeds diversion, buyer data leaks |
ERP and document integrity, BEC controls, questionnaire readiness |
|
Footwear manufacturers |
Design and last theft; buyer compliance; QCO records |
IP protection, PLM access reviews, assessment |
|
Consumer products manufacturers |
Brand contract breaches and connected-product flaws |
Assessment, product security, supplier assurance |
|
Brand owners and licensees |
Brand abuse, consumer data, marketplace and D2C fraud |
Web and app testing, brand monitoring, DPDP programme |
|
D2C and e-commerce arms |
Account takeover, skimming, payment and loyalty fraud |
Continuous testing, bot controls, PCI DSS, SOC |
8. How Codec Networks works with textile, apparel and consumer manufacturers
Codec Networks is a CERT-In empanelled information security auditing organisation certified to ISO 9001:2015, ISO/IEC 27001:2022 and ISO/IEC 20000-1:2018. For textile, apparel and consumer manufacturers we deliver ERP, PLM and e-commerce security testing, IP protection programmes for designs and costings, BEC and payment diversion controls, 24x7 SOC across plants, offices and cloud, DPDP programmes for consumer and worker data, supplier assurance for job-workers and tier-2 suppliers, and buyer questionnaire and ISO 27001 readiness—connected from finding to closure and planned around the shipment calendar.
Talk to Codec Networks
|
Contact Codec Networks Pvt. Ltd. New Delhi: 507, 5th Floor, New Delhi House, Barakhamba Road, Connaught Place, New Delhi – 110001 Gurugram: 707, 7th Floor, Silverton Tower, Golf Course Extension Road, Sector 50, Gurugram – 122018, Haryana Landline: 011 430 496 96 | 011 437 522 99 Mobile: +91 99716 76124 | +91 88007 88220 | +91 88003 31124 Email: mktg@codecnetworks.com Web: www.codecnetworks.com |
Note: This document is general industry guidance based on public information available as of October 2026. It is not legal, tax or regulatory advice. Obligations differ by company size, listing status, products, buyers, channels and export markets; confirm them against the official CERT-In, MeitY, SEBI, CBIC, BIS, Consumer Affairs and EU instruments and your buyer contracts.