Resources Categories
INDUSTRY FACT FILE · FMCG, FOOD & BEVERAGES
Industry Overview: FMCG, Food and Beverages in India
Who makes, moves and sells India's packaged foods, beverages, dairy and consumer goods, the obligations that apply, who buys cybersecurity and why each type of company needs a distinct approach.
|
In this document 1. Why FMCG, food and beverage cybersecurity matters now 2. The ecosystem at a glance 3. Categories of FMCG, food and beverage companies 4. The regulatory, standards and retailer framework at a glance 5. Government, industry and private participants 6. Who buys cybersecurity inside an FMCG, food or beverage company 7. Why each type of company needs a different approach 8. How Codec Networks works with FMCG, food and beverage companies |
|
Sector scope Sector: consumer goods groups, food processors, beverage companies, dairies and cooperatives, cold-chain and warehouse operators, and the distributor networks and channel platforms that serve retail. Primary service proposition: plant OT security, distributor portals, supply chain assessments, SOC and resilience. Retail and e-commerce, logistics, agriculture inputs and pharmaceuticals have separate fact files. |
1. Why FMCG, food and beverage cybersecurity matters now
India's fast-moving consumer goods, food and beverage sector reaches every household every day. The country is the world's largest milk producer, contributing about a quarter of global output with roughly 248 million tonnes in 2024-25; its food processing industry is supported by a ₹10,900 crore production-linked incentive approved in March 2021, under which 171 companies had been approved by early 2025; and its packaged food, beverage, home and personal care brands move through millions of retail outlets, modern trade, e-commerce and quick-commerce platforms. Listed consumer goods groups, multinational subsidiaries, regional food and beverage companies, dairy cooperatives, cold-chain operators and tens of thousands of distributors make up the ecosystem.
|
~25% Of the world's milk is produced in India (about 248 Mt in 2024-25) |
₹10,900 cr PLI outlay for food processing, 2021-22 to 2026-27 |
US$49 m Clorox's 2023 cyberattack costs by year end, with product shortages |
6 hours To report cyber incidents to CERT-In |
The whole chain now runs on connected systems. ERP and order management take distributor orders and release dispatch; programmable logic controllers, SCADA and manufacturing execution systems run batching, filling and packaging lines; laboratory and traceability systems hold recipes, batch records and food safety evidence; distributor management systems, sales-force apps and trade-scheme engines move secondary sales and claims; cold rooms and trucks report temperatures through IoT gateways; and loyalty apps, D2C stores and quick-commerce integrations hold consumer data. Co-packers, 3PLs, agencies and platform vendors connect in from outside. Each link is a path an attacker can use.
The consequences are visible in public incidents. In June 2017, NotPetya crippled Mondelez's systems and the company pursued a US$100 million insurance claim that was settled in 2022. In May 2021, ransomware forced JBS to halt meat plants in the United States, Australia and Canada, and the company paid a US$11 million ransom. In February 2023, Dole temporarily shut North American production plants after ransomware. In August 2023, a cyberattack at Clorox caused order-processing delays and product shortages and cost US$49 million by the end of that year. In 2023 ransomware hit about 30 per cent of cold-storage operator Americold's facilities, and in June 2025 a cyberattack at distributor United Natural Foods disrupted deliveries to grocers including Whole Foods. In India, snack maker Haldiram's reported a Maze ransomware attack in 2020. IBM X-Force has ranked manufacturing the most attacked industry for five consecutive years.
In India the obligations are cross-sector but real. CERT-In's Directions require cyber incidents to be reported within six hours and ICT logs to be retained for 180 days; CERT-In's July 2025 audit policy guidelines expect risk-based, independent cyber audits that include OT; listed consumer goods companies must disclose cyber incidents in the quarterly corporate governance report under SEBI's LODR Regulations; and the DPDP Act and Rules will govern consumer, loyalty, distributor and worker data, with most obligations from May 2027. Food and consumer statutes add a second layer: FSSAI licensing, records, traceability and recalls under the Food Safety and Standards Act 2006, administered through the FoSCoS portal; Legal Metrology declarations on every pack; and GST e-invoicing above ₹5 crore turnover. None of these prescribe cyber controls, but all of them depend on systems that must stay available and trustworthy.
|
Key takeaway In FMCG, food and beverages, cybersecurity is shelf availability, food safety, channel integrity and consumer trust in one. The plant, the ERP and order systems that feed the trade, the distributors and partners connected to it, the cold chain that preserves it and the apps that face the consumer must be protected together. |
2. The ecosystem at a glance
Figure 1: India's FMCG, food and beverages ecosystem.
3. Categories of FMCG, food and beverage companies
|
Category |
Who they are |
Typical ownership |
Key regulatory basis |
|
Consumer goods groups |
Home care, personal care, packaged foods and beverages across many plants and brands |
Listed Indian groups and multinational subsidiaries |
CERT-In; SEBI LODR (listed); DPDP; FSSAI; Legal Metrology |
|
Food processors |
Snacks, staples, bakery, ready meals, meat, seafood and ingredients |
Listed and private companies, PLI beneficiaries |
CERT-In; FSSAI licences and records; DPDP; retailer contracts |
|
Beverage companies |
Soft drinks, juices, packaged water, brewing and spirits, bottling franchisees |
Multinational systems, listed and private bottlers |
CERT-In; FSSAI; state excise where applicable; SEBI LODR (listed) |
|
Dairies and cooperatives |
Milk collection, processing, chilled and long-life products |
Cooperatives, state federations, private dairies |
CERT-In; FSSAI; cooperative and state oversight; DPDP for members and consumers |
|
Cold-chain and warehouse operators |
Cold storage, refrigerated transport and distribution centres |
Private operators and 3PLs |
CERT-In; FSSAI for food handling; customer contracts |
|
Distributor networks and channel platforms |
Distributors, stockists, sales agents and the DMS and apps that run them |
Independent businesses and company-run platforms |
CERT-In; DPDP; GST and e-invoicing; principal contracts |
|
D2C, loyalty and quick-commerce channels |
Brand apps, loyalty programmes, marketplaces and quick-commerce integrations |
Units of brands and platform partners |
CERT-In; DPDP; PCI DSS for payments; consumer rules |
4. The regulatory, standards and retailer framework at a glance
|
Instrument or expectation |
What it means for FMCG, food and beverage companies |
|
CERT-In Directions (28 April 2022) |
Cyber incidents reported within six hours of noticing them; ICT logs kept for a rolling 180 days in India; clock synchronisation; designated point of contact |
|
CERT-In audit policy guidelines (25 July 2025) |
Risk-based, independent cyber audits covering IT, OT/ICS, cloud and applications, with findings closure—plants, DMS and consumer apps belong in scope |
|
SEBI LODR Regulations (listed companies) |
Cyber security incidents, breaches and loss of data disclosed in the quarterly corporate governance report since July 2023; Board responsibility for risk management |
|
DPDP Act 2023 and DPDP Rules 2025 |
Safeguards, notices, consent and breach intimation for consumer, loyalty, distributor, farmer and worker personal data; most obligations from May 2027 |
|
Food Safety and Standards Act 2006 and FSSAI |
Licensing and registration through FoSCoS, record-keeping, traceability and recall expectations—systems holding batch, lab and distribution records must be available and trustworthy |
|
Legal Metrology and GST |
Packaged Commodities Rules 2011 declarations on every pack; GST e-invoicing above ₹5 crore turnover since 1 August 2023 and e-way bills for movement |
|
Retailer, partner and payment requirements |
Modern trade and e-commerce security questionnaires, EDI and API standards; PCI DSS v4.0.1 for card payments on D2C channels; insurer control conditions; IEC 62443 and ISO/IEC 27001 as the common language |
|
How these apply Most Indian cyber obligations are cross-sector and depend on size and listing status; food and consumer obligations depend on licences and products; retailer requirements depend on whom you sell through. Confirm against the official instruments and your contracts. |
5. Government, industry and private participants
- FSSAI administers food safety under the FSS Act 2006, including licensing through FoSCoS; the Department of Consumer Affairs administers Legal Metrology; the Ministry of Food Processing Industries runs the PLI scheme; MeitY and CERT-In set cyber obligations.
- CBIC administers GST, e-invoicing and e-way bills; SEBI governs listed-company disclosure; BIS sets product standards.
- Listed consumer goods groups and multinational subsidiaries lead branded foods, beverages, home and personal care.
- Dairy cooperatives and state federations anchor milk collection and processing; private dairies and regional food companies compete across categories.
- Distributors, stockists and sales agents form the general-trade backbone; modern trade, e-commerce and quick-commerce platforms add integrated channels.
- Co-packers, 3PLs, cold-chain operators, agencies and platform vendors build and run the systems and flows that brands depend on.
6. Who buys cybersecurity inside an FMCG, food or beverage company
|
Stakeholder |
What they care about |
What they buy |
|
Board, MD and CFO |
Shelf availability, recalls, disclosure, insurer and retailer confidence |
Board advisory, resilience programmes, crisis exercises |
|
CIO and CISO |
ERP, cloud, DMS, plant and app security; audits |
Audits, assessments, SOC, GRC programmes |
|
Supply chain and plant heads |
Line uptime, dispatch, co-packers, cold chain |
OT assessments, segmentation, partner assurance |
|
Quality and food safety |
Batch records, recipes, traceability, recalls |
Record integrity and recall system reviews |
|
Sales and trade marketing |
Distributor platforms, schemes, claims integrity |
DMS and app testing, fraud analytics |
|
Marketing, D2C and loyalty |
Consumer apps, data, brand trust |
App and API testing, DPDP programme, brand monitoring |
|
Procurement and finance |
Supplier and farmer payments, BEC |
Payment controls, BEC simulation, SOC |
7. Why each type of company needs a different approach
|
Company type |
Highest-consequence risk |
Starting point for assurance |
|
Consumer goods groups |
Ransomware across group ERP and order management stopping dispatch to the trade |
Dependency mapping, segmentation, backup testing, SOC |
|
Food processors |
Plant OT and record tampering with food safety consequences; co-packer compromise |
OT assessment, record integrity, supplier assurance |
|
Beverage companies |
Distributor scheme fraud across franchised bottlers and distributors |
DMS and API testing, analytics, access reviews |
|
Dairies and cooperatives |
Cold-chain IoT and member or farmer payment fraud |
IoT assessment, segmentation, payment controls |
|
Cold-chain and warehouse operators |
Being the partner whose outage spoils customers' stock |
Baseline assessment, backups, customer evidence |
|
Distributor networks |
Account takeover and claims abuse through DMS and apps |
Portal testing, onboarding controls, monitoring |
|
D2C and loyalty channels |
Consumer data breaches through apps, APIs and agencies |
App and API testing, DPDP, vendor reviews |
8. How Codec Networks works with FMCG, food and beverage companies
Codec Networks is a CERT-In empanelled information security auditing organisation certified to ISO 9001:2015, ISO/IEC 27001:2022 and ISO/IEC 20000-1:2018. For FMCG, food and beverage companies we deliver IEC 62443-aligned plant OT assessments using production-aware methods, distributor portal, sales app and retailer API testing, supply chain assessments of co-packers, 3PLs, cold-chain operators and agencies, 24x7 IT/OT SOC with claims and fraud analytics, resilience programmes for ERP and order processing, DPDP programmes for consumer and loyalty data, and crisis exercises with sales, plant and supply chain leadership—connected from finding to closure.
Talk to Codec Networks
|
Contact Codec Networks Pvt. Ltd. New Delhi: 507, 5th Floor, New Delhi House, Barakhamba Road, Connaught Place, New Delhi – 110001 Gurugram: 707, 7th Floor, Silverton Tower, Golf Course Extension Road, Sector 50, Gurugram – 122018, Haryana Landline: 011 430 496 96 | 011 437 522 99 Mobile: +91 99716 76124 | +91 88007 88220 | +91 88003 31124 Email: mktg@codecnetworks.com Web: www.codecnetworks.com |
Note: This document is general industry guidance based on public information available as of October 2026. It is not legal, food safety or regulatory advice. Obligations differ by company size, listing status, products, licences, channels and markets; confirm them against the official CERT-In, MeitY, SEBI, FSSAI, Consumer Affairs and CBIC instruments and your retailer and partner contracts.