INDUSTRY FACT FILE · AUTOMOTIVE & MOBILITY

Cybersecurity FAQs for Automotive and Mobility

Forty frequently asked questions and answers in five categories, written for Boards, CISOs, product cybersecurity and homologation teams, plant heads, connected-services, charging, dealer and fleet teams.

In this document 1.  Category 1: Cyber risk, governance and strategy 2.  Category 2: Regulation, standards and customer requirements 3.  Category 3: Vehicles, OTA, charging and connected services 4.  Category 4: Plants, suppliers, dealers and resilience 5.  Category 5: Data, dealers, fleets and privacy

Audience: Boards, MDs, CFOs and CISOs

Q1. Why is automotive such a target?

Plants, suppliers and dealers cannot stop without immediate loss, which makes ransomware pay; apps, dealers and fleets hold customer and location data at scale; and flaws in connected-car systems reach the vehicle itself.

Q2. Which incidents should the Board know about?

Jaguar Land Rover (2025): global production halted for about five weeks, estimated UK economic cost £1.9 billion. CDK Global (2024): about 15,000 dealerships on paper for two weeks. Toyota (2022): 14 plants halted by one supplier's incident.

Q3. What are the biggest risks for an Indian automotive company?

Ransomware across plants and the ecosystem, supplier and platform outages, app and API flaws that reach vehicles, OTA and software supply-chain compromise, charging backend attacks, customer and driver data theft, and slow detection.

Q4. Is this an IT, plant or product problem?

All three. The JLR shutdown was an IT incident that stopped plants; app flaws are product incidents that affect customers; cybersecurity must be owned jointly by IT, manufacturing and product engineering with Board accountability.

Q5. What should the Board review each quarter?

Plant and dealer dependencies, backup test results, supplier and platform assessments, vehicle vulnerability and OTA status, AIS 189/190 readiness, incidents, audit findings, SOC coverage and exercise outcomes.

Q6. Who should own vehicle cybersecurity?

A product cybersecurity function reporting to engineering leadership, working with the CISO, homologation and connected-services teams, with the CSMS defined by AIS 189.

Q7. How should we prioritise investment?

Segment plants from IT and make them recoverable; test apps, APIs and OTA for vehicle-reaching flaws; control suppliers, dealers and vendors; protect customer and vehicle data; build monitoring across plants and the vehicle cloud.

Q8. How can Codec Networks help?

Codec Networks provides AIS 189/190 readiness, vehicle and OTA testing, plant OT assessments and segmentation, app, API, charging and cloud testing, supplier and dealer risk programmes, 24x7 IT/OT SOC and crisis exercises.

Audience: Compliance, homologation, sales and CISO offices

Q9. What are AIS 189 and AIS 190?

Indian Automotive Industry Standards for a vehicle Cyber Security Management System (AIS 189) and a Software Update Management System (AIS 190), aligned with UN Regulations R155 and R156, covering M, N and T category vehicles with ECUs.

Q10. When do they become mandatory?

MoRTH's 2026 draft notification proposes phased compliance under CMVR from October 2026 for new Level 3+ automated models, with existing models and OTA-enabled vehicles following; confirm the final gazette notification.

Q11. Do CERT-In Directions apply to us?

Yes, to OEMs, suppliers, dealers and platforms alike: incidents reported within six hours and ICT logs kept for 180 days in India. CERT-In's 2025 audit guidelines expect independent audits that include OT.

Q12. What must listed companies disclose?

Under SEBI's LODR Regulations, listed OEMs and suppliers disclose cyber security incidents, breaches and loss of data in the quarterly corporate governance report.

Q13. Does DPDP apply to vehicle data?

Yes, where vehicle, location, driver or customer data identifies a person—telematics, apps, dealer records, finance and fleet data are in scope. Most obligations take effect in May 2027.

Q14. What do OEM customers and export markets require?

ISO/SAE 21434 engineering practice, TISAX for suppliers to German and other OEMs, UN R155/R156 for vehicles in adopting markets, the EU Cyber Resilience Act for connected products and security clauses in contracts.

Q15. Which standards should we align to?

ISO/SAE 21434 for the vehicle, IEC 62443 for plants, ISO/IEC 27001 for the management system and PCI DSS for payments; together they answer most regulator and customer questions.

Q16. Can Codec Networks audit us?

Yes. Codec Networks is CERT-In empanelled and performs IT/OT audits, AIS 189/190 readiness assessments, ISO 27001 and TISAX gap assessments and OEM audit support.

Audience: Product cybersecurity, connected-services, charging and engineering teams

Q17. How do we assess a vehicle platform?

Start with a threat analysis and risk assessment per ISO/SAE 21434, then test in-vehicle networks, ECUs, telematics units, diagnostic interfaces and the cloud services they talk to.

Q18. What should we test in our companion app?

Authentication, vehicle binding and ownership transfer, authorisation across app and dealer APIs, command rate limits, session handling and the cloud back-end—these are where vehicle-reaching flaws appear.

Q19. How should OTA updates be secured?

Protect build pipelines and signing keys, maintain SBOMs, validate updates on the vehicle, control rollout and rollback, and document it all as the SUMS that AIS 190 requires.

Q20. How do we secure charging networks?

Harden the CPO backend with MFA and segmentation, assess OCPP implementations and charger firmware, use unique charger credentials, align payment flows with PCI DSS and monitor charger commands.

Q21. What about battery management systems?

Test BMS firmware and interfaces, protect calibration and safety parameters, and treat BMS updates as part of the SUMS.

Q22. Should we run a vulnerability disclosure programme?

Yes. Researchers find vehicle flaws regularly; a clear disclosure channel and a vehicle-affecting incident playbook turn findings into fixes rather than headlines.

Q23. How do we handle telematics and fleet commands?

Authorise and log every remote command, rate-limit immobilisation and geofence functions, require step-up approval for safety-relevant actions and monitor for anomalies.

Q24. What about keyless entry and relay theft?

Test key fob, passive entry and diagnostic-port security, enable motion-sensing and distance checks where supported, and include theft scenarios in the TARA.

Audience: Plant heads, supply chain, dealer network, SOC and IT teams

Q25. How should plants be separated from IT?

Use IEC 62443 zones and conduits: a plant DMZ, no dual-homed systems, controlled flows to ERP and MES, and the ability to keep building if corporate IT is down.

Q26. How do we assess plant OT without disrupting production?

Passive asset discovery, configuration and architecture reviews, and any active testing in planned windows agreed with manufacturing—never unplanned scanning of robots or PLCs.

Q27. How should robot and PLC vendors' remote access work?

Through a brokered gateway with MFA, named accounts, approval per session, time limits and recording—never standing VPNs with shared passwords.

Q28. How do we manage supplier cyber risk?

Tier suppliers by criticality, assess the ones that can stop lines, put security and incident-notification clauses in contracts, hold buffers for single-source parts and exercise outages together.

Q29. How do we assess our DMS or telematics provider?

Review their security controls, backups, incident history and exit plan; require notification and recovery commitments in contracts; and keep manual playbooks for dealers.

Q30. How should backups be designed?

Immutable or offline backups of ERP, MES, dealer systems, PLC and robot programs and vehicle-cloud data, with regular restore tests and documented restart sequences.

Q31. Do we need an OT SOC?

Yes, if plants and connected services matter to revenue: an IT/OT SOC sees plant traffic, remote sessions, vehicle commands and charger activity as well as endpoints and email.

Q32. Should we run exercises?

Yes—annual tabletop exercises with leadership, plants, suppliers and dealers using ransomware, supplier-outage and vehicle-vulnerability scenarios, plus technical restore drills.

Audience: Dealer network, finance, mobility, fleet, privacy and IT teams

Q33. What personal data does an automotive company hold?

Customer identity, finance and insurance records, vehicle and location data, app accounts, driver and employee data and dealer records—all within DPDP scope.

Q34. How do we protect dealer customer data?

Minimise what dealers hold, enforce access control and MFA on DMS and CRM, encrypt and monitor exports, and include dealers in the DPDP programme.

Q35. How do we stop payment diversion fraud?

Verify supplier and dealer bank-account changes by call-back, require dual approval, monitor for look-alike domains and train finance teams with BEC simulations.

Q36. How should fleet and mobility platforms handle location data?

Collect only what the service needs, define retention, secure APIs and keys, restrict access and give drivers and customers the notices and rights DPDP requires.

Q37. Can usage-based insurance and data services continue under DPDP?

Yes, with lawful basis, clear notices, consent where required, purpose limitation and security safeguards built into the data pipeline.

Q38. How do we secure our cloud platforms?

Review identity and permissions, secrets and API keys, storage exposure, logging and tenant configuration, and monitor continuously.

Q39. What if a researcher reports a vehicle vulnerability?

Acknowledge, triage with product engineering, fix and release through the SUMS, notify customers and regulators as required, and record it for CSMS field monitoring.

Q40. How can we start with Codec Networks?

Begin with a scoping call on your vehicles, plants, platforms and partners; Codec Networks will propose a production-aware assessment and assurance plan.

Contact Codec Networks Pvt. Ltd. New Delhi: 507, 5th Floor, New Delhi House, Barakhamba Road, Connaught Place, New Delhi – 110001 Gurugram: 707, 7th Floor, Silverton Tower, Golf Course Extension Road, Sector 50, Gurugram – 122018, Haryana Landline: 011 430 496 96 | 011 437 522 99   Mobile: +91 99716 76124 | +91 88007 88220 | +91 88003 31124 Email: mktg@codecnetworks.com   Web: www.codecnetworks.com

Note: These FAQs provide general guidance as of October 2026 and do not constitute legal, safety or regulatory advice. AIS 189/190 dates follow MoRTH's draft notification; confirm all obligations against the official instruments and your OEM contracts.