Resources Categories

Back

INDUSTRY FACT FILE · AUTOMOTIVE & MOBILITY

Applicable Cybersecurity Services and Codec Networks Bundles for Automotive and Mobility

How Codec Networks services and bundled service models help OEMs, suppliers, EV makers, charging networks, dealers and mobility companies resolve their threats and meet AIS 189/190, CERT-In, SEBI, DPDP and OEM expectations.

In this document

1. Our approach

2. Mapping threats to services

3. Codec Networks service catalogue for the sector

4. Codec Networks bundles for the sector

5. Sector programmes built from the bundles

6. Packages: Foundation, Assurance and Continuous Resilience

7. Regulatory requirement-to-bundle mapping

8. Threat-to-bundle coverage matrix

9. Delivery methodology and deliverables

10. Why Codec Networks

11. Annex: indicative commercial ranges

1. Our approach

Automotive needs assurance that spans the plant, the ecosystem and the vehicle. Codec Networks works on four principles:

Production first: plant-floor work planned with manufacturing and automation teams; passive first, active by agreement.
Vehicle first: every app, API, OTA and telematics function assessed for its ability to reach the car.
Ecosystem thinking: suppliers, dealers, platforms and vendors are inside the perimeter.
Evidence for homologation and customers: findings mapped to AIS 189/190, ISO/SAE 21434, TISAX and ISO 27001.

2. Mapping threats to services

The table maps the 18 threats identified in Document 4 of this set to the Codec Networks services that help mitigate them.

Threat / challenge	Applicable Codec Networks services	Intended outcome
Ransomware halting plants	Segmentation, backup and restore testing, EDR validation, identity monitoring	Plants that keep running
Supplier outage	Supplier cyber risk programme, contract clauses, buffer planning	Resilient supply
Dealer platform outage	SaaS and DMS assurance, manual playbooks	Dealers that keep selling
Remote vehicle access via apps/APIs	App, API and vehicle-to-cloud testing, command monitoring	Vehicles that cannot be hijacked
OTA and software supply chain	OTA pipeline, signing and SBOM reviews; SUMS readiness	Trusted updates
Charging backend and OCPP	Backend, OCPP and charger assessments, PCI alignment	Chargers that stay up
IP theft	Data classification, DLP, PLM and toolchain access reviews	Protected designs
Vendor remote access abuse	Remote access brokering, vendor assessments	Controlled vendor access
Flat IT/OT networks	Zone-and-conduit design, plant DMZ	Contained plants
Phishing	Phishing simulation, MFA, awareness	Fewer compromised accounts
BEC	Payment and master-data controls, BEC simulation	Reduced fraud
Customer and driver data theft	DPDP programme, cloud and app security	Protected data
Telematics and GPS manipulation	Command authorisation, device and platform testing	Safe remote commands
Keyless and relay theft	Vehicle access system testing, TARA	Harder-to-steal vehicles
Counterfeit parts and firmware	Supply-chain and firmware integrity reviews	Trusted components
Cloud and SaaS misconfiguration	Cloud posture, secrets and identity review	Hardened platforms
Weak OT detection	IT/OT SOC with vehicle-cloud monitoring, playbooks	Reliable 6-hour reporting
Backup and recovery failure	Backup review, PLC and robot program backups, restart drills	Proven recovery

3. Codec Networks service catalogue for the sector

Service line	Sector-relevant services
Security Vulnerability Assessment & Penetration Testing	In-vehicle network, ECU and telematics testing; plant OT, charger and backend assessments; app, API and portal testing
Vehicle cybersecurity engineering	Threat analysis and risk assessment (TARA) per ISO/SAE 21434; CSMS and SUMS readiness for AIS 189/190 and UN R155/R156
Embedded, firmware & OTA security	Secure boot, firmware, BMS and charger firmware reviews; OTA pipeline, signing and SBOM assessments
Industrial & infrastructure security	IEC 62443-aligned plant assessments, segmentation, vendor remote access, ransomware resilience
Application, cloud & payment security	Companion apps, dealer portals, DMS, telematics and charging cloud; PCI DSS alignment
Information security audit & compliance	CERT-In-aligned IT/OT audits, ISO/IEC 27001, TISAX readiness, SEBI disclosure support
Third-party and supply-chain risk	Tier-n supplier, DMS, telematics and automation vendor assessments; contract clauses
Data privacy & protection	DPDP programmes for customer, vehicle, location, driver and dealer data
24/7 Managed SOC & threat monitoring	Plant, enterprise and vehicle-cloud monitoring; anomalous vehicle and charger command detection
Cyber forensics, incident response & simulation	Plant, dealer and vehicle incident investigation; ecosystem crisis exercises; 6-hour reporting support

4. Codec Networks bundles for the sector

Eleven of the twelve bundles in the Codec Networks Bundled Service Models apply directly to automotive and mobility companies; the Global Cyber Back-Office SPV Program (Bundle 12) is offered separately for international clients.

Title: Figure 6: Codec Networks bundles applied to the sector. - Description: Figure 6: Codec Networks bundles applied to the sector.

Figure 6: Codec Networks bundles applied to the sector.

Bundle	Name	Sector-relevant scope	Best suited for	Key deliverables
B1	Cyber Assessment & VAPT Assurance Program	Plant OT, in-vehicle, telematics, charger and backend testing	All companies	Assessment reports, retests and closure tracker
B2	Application, API & DevSecOps Security Program	Companion apps, dealer portals, DMS, OTA and telematics APIs	OEMs, EV makers, platforms, charging networks	Application and API risk reports, SBOMs
B3	Cloud, Infrastructure & Zero Trust Security Program	IT/OT segmentation, vendor remote access, vehicle-cloud posture	OEMs, suppliers, platforms	Architecture review and remediation roadmap
B4	Regulatory Cybersecurity Audit & Compliance Assurance Program	CERT-In-aligned audits, AIS 189/190 readiness, SEBI support	OEMs, listed suppliers	Audit report, gap matrix, CSMS/SUMS evidence
B5	GRC, ISO, SOC 2 & Cyber Maturity Program	ISO/SAE 21434, TISAX, ISO 27001, PCI DSS readiness	Suppliers, charging networks, exporters	Maturity scorecard, policies, evidence packs
B6	Data Privacy, DPDPA & Data Protection Program	Customer, vehicle, driver and dealer data protection	Dealers, platforms, OEMs, fleets	Privacy gap assessment and roadmap
B7	Managed SOC, MDR & Continuous Threat Monitoring Program	24x7 plant, enterprise and vehicle-cloud SOC	OEMs, tier-1s, platforms	SOC reports, MTTD/MTTR
B8	Digital Forensics, Incident Response & Malware RCA Program	Plant, dealer and vehicle incident response	Any company facing an incident	Forensic report, RCA, reporting support
B9	Third-Party Risk Management & Supply Chain Cyber Risk Program	Supplier, DMS, telematics and vendor assessments	OEMs, dealer groups, fleets	Supplier risk register and assessments
B10	Cyber Simulation, Awareness, Tabletop & Crisis Readiness Program	Ecosystem crisis exercises and plant drills	Leadership, plant, dealer and supplier teams	Exercise reports and playbooks
B11	Emerging Technology, AI, Web3 & Future Security Program	Connected vehicle, AI, V2X and charging technology security	OEMs, EV makers, mobility platforms	Risk assessment and CRA readiness

5. Sector programmes built from the bundles

Codec Networks packages the catalogue bundles into six automotive and mobility programmes.

Programme	Built from bundles	Challenges addressed
Vehicle Cybersecurity (CSMS/SUMS)	B4, B5, B1, B2	AIS 189/190, TARA, vehicle, OTA and API testing
Plant OT Security & Resilience	B1, B3, B10	PLCs, robots, MES, segmentation, backups and drills
Connected Services & Charging	B2, B11, B7	Apps, APIs, telematics, OCPP backends and payments
Supplier, Dealer & Platform Risk	B9, B10	Tier-n suppliers, DMS and SaaS providers, joint exercises
Customer Assurance & Privacy	B5, B6	TISAX, ISO 27001, DPDP and OEM questionnaires
IT/OT SOC & Hunting	B7, B8	Detection, response and 6-hour reporting

6. Packages: Foundation, Assurance and Continuous Resilience

Package element	Foundation	Assurance	Continuous Resilience
Typical organisation	Component suppliers, dealers and charging start-ups	EV makers, charging networks and mid-sized suppliers	OEMs, tier-1 majors and fleet platforms
Testing	B1: IT and plant or backend assessment	B1 + B2: vehicle, charger or product and app testing	B1 + B2 + B10: continuous vehicle, API, OTA and plant testing with red teaming
Audit and GRC	B5: TISAX or OEM questionnaire readiness	B4: annual independent audit + B5	B4 + B5 + B9: AIS 189/190 programme, customer assurance and supplier programme
Cloud and privacy	B3: backup and remote access review + B6 pack	B3: segmentation and cloud posture + B6	B3 + B6 + B11: segmentation, DPDP and connected-vehicle security
Monitoring and response	IR retainer (B8)	B7: IT/OT SOC + B8	B7: SOC with vehicle-cloud monitoring + B8
Reporting	Compliance checklist and customer evidence	CISO and management reporting	Board, SEBI, MoRTH and OEM reporting

7. Regulatory requirement-to-bundle mapping

Requirement (source)	How Codec Networks helps	Bundle
Vehicle cyber security and software update management for type approval (AIS 189/190, draft CMVR rules)	CSMS/SUMS readiness, TARA, vehicle and OTA testing	B4, B1, B2
Cyber incidents to CERT-In within six hours; 180-day logs (CERT-In Directions)	IT/OT SOC, IR retainer and reporting support	B7, B8
Risk-based independent cyber audits including OT (CERT-In audit guidelines, 2025)	Independent IT/OT audits	B4, B1
Quarterly cyber incident disclosure by listed companies (SEBI LODR)	Incident records and disclosure support	B4, B8
Customer, vehicle, driver and dealer personal data (DPDP)	DPDPA programme	B6
Supplier information security (TISAX, OEM contracts)	TISAX and ISO 27001 readiness	B5, B9
Vehicles and connected products in export markets (UN R155/R156, EU CRA)	CSMS/SUMS and CRA readiness, product security testing	B4, B2, B11
Card payments at chargers and dealers (PCI DSS)	Payment security review	B2, B5
Public charging infrastructure guidelines (Ministry of Power, BIS)	Backend, charger and operational security review	B1, B3

Auditor eligibility and independence

Where a regulator, standard or contract requires CERT-In empanelled or independent auditors, Codec Networks—CERT-In empanelled for information security auditing services—confirms eligibility and independence in each proposal.

8. Threat-to-bundle coverage matrix

Threat / challenge	Primary bundle	Supporting bundles
Ransomware halting plants	B3	B7, B10, B8
Supplier outage	B9	B10
Dealer platform outage	B9	B10, B6
Remote vehicle access	B2	B7, B11
OTA and software supply chain	B2	B11, B5
Charging backend and OCPP	B1	B3, B7
IP theft	B3	B6, B7
Vendor remote access abuse	B9	B3, B7
Flat IT/OT networks	B3	B1
Phishing	B10	B7
BEC	B10	B2, B7
Customer and driver data theft	B6	B2, B7
Telematics and GPS manipulation	B2	B11, B7
Keyless and relay theft	B1	B11
Counterfeit parts and firmware	B9	B11
Cloud and SaaS misconfiguration	B3	B2
Weak OT detection	B7	B8
Backup and recovery failure	B10	B3

“Primary” and “supporting” indicate suggested combinations, not guaranteed mitigation or complete coverage.

9. Delivery methodology and deliverables

Title: Figure 7: The Codec Networks delivery methodology. - Description: Figure 7: The Codec Networks delivery methodology.

Figure 7: The Codec Networks delivery methodology.

Typical deliverables include TARA reports and CSMS/SUMS gap assessments for AIS 189/190, vehicle network, ECU and OTA test reports, plant OT and IEC 62443 assessment reports with segmentation designs, app, API, backend and charger test reports, a supplier and platform risk register, a CERT-In-aligned audit report, TISAX and OEM questionnaire evidence packs, crisis playbooks and exercise reports, and IT/OT SOC reporting with vehicle-cloud metrics.

10. Why Codec Networks

CERT-In empanelled for information security auditing services, and empanelled with NICSI for application audit and compliance services (start-up category).
Certified to ISO 9001:2015, ISO/IEC 27001:2022 and ISO/IEC 20000-1:2018.
Full stack: VAPT, regulatory audit, managed SOC, forensics, privacy and Board advisory from one partner, so findings, monitoring and closure stay connected.
Automotive depth: vehicles, OTA, plants, chargers, apps and telematics assessed by one team and mapped to AIS 189/190, ISO/SAE 21434, IEC 62443 and TISAX.
Recognised frameworks and tools: OWASP ASVS/MASVS and API Top 10, MITRE ATT&CK, NIST CSF, ISO 27001 and PCI DSS; tools such as Burp Suite, Nessus, Metasploit, Prowler and leading SIEM/EDR platforms.
Certified people: CEH, OSCP, CPENT, CISA, ISO 27001 LA/LI, CHFI, CTIA and ECIH professionals.

Annex: Indicative commercial ranges

For internal sales reference only—remove this annex before sharing externally. Ranges are taken from the Codec Networks Bundled Service Models and are subject to scoping, asset counts, frequency and service levels.

Bundle	Package examples and indicative ranges
B1 VAPT Assurance	Essential ₹1.5–5 lakh; Professional ₹5–15 lakh; Enterprise ₹15–40 lakh; Annual retainer ₹25 lakh–₹1.5 crore
B2 AppSec & DevSecOps	API Quick Check ₹2–6 lakh; AppSec Professional ₹8–20 lakh; DevSecOps Maturity ₹12–35 lakh; Secure SDLC retainer ₹3–15 lakh/month
B3 Cloud & Zero Trust	Cloud Essential ₹3–8 lakh; Professional ₹8–25 lakh; Enterprise ₹25–75 lakh; Continuous assurance ₹2–10 lakh/month
B4 Regulatory Audit	Gap review ₹5–15 lakh; Full regulatory audit ₹15–50 lakh; Multi-framework audit ₹30 lakh–₹1.25 crore; Annual retainer ₹3–20 lakh/month
B5 GRC, ISO, SOC 2	ISO readiness ₹5–15 lakh; ISO implementation ₹15–45 lakh; SOC 2 readiness ₹15–60 lakh; GRC retainer ₹2–12 lakh/month
B6 Privacy & DPDPA	Quick assessment ₹3–10 lakh; Implementation ₹10–40 lakh; DPO-as-a-Service ₹2–8 lakh/month; Privacy retainer ₹3–15 lakh/month
B7 Managed SOC	Starter ₹2–5 lakh/month; Professional ₹5–15 lakh/month; Enterprise ₹15–50 lakh/month; co-managed per FTE/shift
B8 Forensics & IR	Triage ₹3–15 lakh; Full investigation ₹15–75 lakh; Ransomware response ₹25 lakh–₹1.5 crore; IR retainer ₹5–50 lakh/year
B9 TPRM	₹25,000–₹2 lakh per vendor; batch pricing for 50–500 vendors; retainer ₹3–25 lakh/month
B10 Simulation & Tabletop	Awareness ₹1–5 lakh; Phishing simulation ₹2–10 lakh; Tabletop ₹5–20 lakh; Cyber war-game ₹15–75 lakh; Annual retainer ₹10 lakh–₹1 crore/year
B11 Emerging Tech	AI/LLM risk review ₹5–25 lakh; Smart contract audit ₹5–50 lakh; Emerging tech retainer ₹5–25 lakh/month

Talk to Codec Networks

Contact

Codec Networks Pvt. Ltd.

New Delhi: 507, 5th Floor, New Delhi House, Barakhamba Road, Connaught Place, New Delhi – 110001

Gurugram: 707, 7th Floor, Silverton Tower, Golf Course Extension Road, Sector 50, Gurugram – 122018, Haryana

Landline: 011 430 496 96 | 011 437 522 99 Mobile: +91 99716 76124 | +91 88007 88220 | +91 88003 31124

Email: mktg@codecnetworks.com Web: www.codecnetworks.com

Note: Service scope, deliverables, monitoring coverage and service levels are confirmed during engagement scoping. Services support risk reduction and assurance but do not guarantee prevention of all cyber incidents or regulatory compliance. Regulatory references are summaries; confirm against the official instruments applicable to each entity.