Resources Categories
INDUSTRY FACT FILE · MANUFACTURING & INDUSTRIAL PRODUCTION
Industry Overview: Manufacturing and Industrial Production in India
Who makes India's engineering, machinery, electronics and industrial equipment, the obligations that apply, who buys cybersecurity and why each type of manufacturer needs a distinct approach.
|
In this document 1. Why manufacturing cybersecurity matters now 2. The ecosystem at a glance 3. Categories of manufacturing and industrial production companies 4. The regulatory, standards and customer framework at a glance 5. Government, public-sector and private participants 6. Who buys cybersecurity inside a manufacturing company 7. Why each type of manufacturer needs a different approach 8. How Codec Networks works with manufacturers |
|
Sector scope Sector: engineering, machinery and capital goods, electronics and electrical equipment, industrial equipment, components, contract manufacturers and smart factories. Primary service proposition: IEC 62443-aligned assessments, OT segmentation, ransomware resilience and ERP security. Automotive, chemicals, metals, textiles, FMCG, pharma and medical devices have separate fact files. |
1. Why manufacturing cybersecurity matters now
Manufacturing contributes roughly a sixth of India's economy and is the centre of national industrial policy: Make in India since 2014, Production Linked Incentive schemes across 14 sectors with an outlay of about ₹1.97 lakh crore, and the National Manufacturing Mission announced in the Union Budget 2025-26. Electronics production alone has more than doubled in four years. Behind this growth sit thousands of plants—public-sector heavy-engineering units, listed capital-goods and electrical-equipment makers, electronics manufacturing services companies, machine-tool builders and a vast base of component makers and contract manufacturers supplying OEMs in India and abroad.
|
5 years Manufacturing the most attacked industry worldwide (IBM X-Force) |
> 50% Of industrial ransomware victims in 2024 were manufacturers (Dragos) |
14 plants Halted by one supplier's cyber incident (Toyota, March 2022) |
6 hours To report cyber incidents to CERT-In |
Those plants now run on connected technology. Enterprise resource planning (ERP) schedules production and ships goods; manufacturing execution systems (MES) and programmable logic controllers (PLCs) run the lines; product lifecycle management (PLM) holds the designs; and automation OEMs, suppliers and customers connect in through portals, EDI and remote-maintenance links. Industry 4.0 initiatives add IIoT sensors, edge gateways, robots, digital twins and AI. Each connection is a path an attacker can use—and manufacturing has become the most attacked industry in the world. IBM X-Force has ranked it first for five consecutive years, and Dragos reports that manufacturers made up more than half of the industrial organisations hit by ransomware in 2024.
The consequences are concrete. In March 2019, ransomware forced Norsk Hydro to run aluminium plants manually at a reported cost of roughly US$70 million. In March 2022, a cyber incident at a single parts supplier halted all 14 of Toyota's Japanese plants for a day. In 2023, a ransomware attack cost Clorox about US$49 million in direct expenses and months of disrupted order processing and shipping. In early 2025, an Indian engineering-services company within a large industrial group disclosed a ransomware incident that temporarily suspended parts of its IT services. None of these companies lost production because a machine broke; they lost it because the IT and OT systems around the machines were compromised.
In India, the obligations are cross-sector but real. CERT-In's Directions require cyber incidents to be reported within six hours and ICT logs to be retained for 180 days; CERT-In's 2025 audit policy guidelines expect risk-based, independent cyber audits that cover OT as well as IT; listed manufacturers must disclose cyber incidents in their quarterly corporate governance report under SEBI's LODR Regulations; and the DPDP Act and Rules will govern employee, dealer and consumer data, with most obligations taking effect in May 2027. Exporters face a second layer: the EU Cyber Resilience Act's vulnerability-reporting duties for connected products began in September 2026, NIS2 pushes security clauses down EU customers' supply chains, and OEM customers everywhere now audit their suppliers' cybersecurity before awarding contracts.
|
Key takeaway In manufacturing, cybersecurity is production continuity, design protection and customer trust in one. The plant, the ERP that feeds it, the OEMs and suppliers connected to it and the designs it builds from must be protected together. |
2. The ecosystem at a glance
Figure 1: India's manufacturing and industrial production ecosystem.
3. Categories of manufacturing and industrial production companies
|
Category |
Who they are |
Typical ownership |
Key regulatory basis |
|
Capital goods and heavy engineering |
Turbines, boilers, plant and project equipment, heavy machinery; large engineering projects |
Public-sector majors and listed private groups |
CERT-In; SEBI LODR (listed); NCIIPC where systems are notified; customer and project contracts |
|
Electronics and EMS |
PCBs, consumer and industrial electronics, contract electronics manufacturing under PLI |
Indian and global EMS companies, PLI beneficiaries |
CERT-In; DPDP; EU CRA and customer product-security requirements |
|
Industrial machinery and automation |
Machine tools, pumps, compressors, packaging and process machinery, automation systems |
Listed and private engineering companies |
CERT-In; SEBI LODR (listed); IEC 62443 and customer requirements |
|
Electrical equipment |
Switchgear, motors, transformers, cables, control gear |
Listed and private manufacturers |
CERT-In; SEBI LODR (listed); BIS and QCO product rules; customer requirements |
|
Components and contract manufacturers |
Castings, forgings, precision parts, sub-assemblies, job work for OEMs |
Mostly private MSMEs and mid-sized companies |
CERT-In; OEM supplier security requirements; DPDP |
|
Smart factories and Industry 4.0 plants |
Plants with IIoT, robotics, MES, digital twins and analytics |
Any of the above adopting Industry 4.0 |
CERT-In; IEC 62443; cloud and data obligations |
|
Engineering PSUs and strategic production units |
Public-sector heavy engineering, electronics and strategic manufacturing |
Central and state public-sector undertakings |
CERT-In; NCIIPC protected systems where notified; government IT security requirements |
4. The regulatory, standards and customer framework at a glance
|
Instrument or expectation |
What it means for manufacturers |
|
CERT-In Directions (28 April 2022) |
Cyber incidents reported within six hours of noticing them; ICT logs kept for a rolling 180 days in India; clock synchronisation; designated point of contact |
|
CERT-In audit policy guidelines (25 July 2025) |
Risk-based, independent cyber audits covering IT, OT/ICS, cloud and applications, with findings closure |
|
SEBI LODR Regulations (listed companies) |
Cyber security incidents, breaches and loss of data disclosed in the quarterly corporate governance report since July 2023; Board responsibility for risk management |
|
NCIIPC (IT Act Section 70A) |
Protection of systems notified as protected systems or critical information infrastructure—relevant to strategic and public enterprises; most private plants are not notified |
|
DPDP Act 2023 and DPDP Rules 2025 |
Safeguards, notices, consent and breach intimation for employee, dealer, distributor and consumer personal data; most obligations from May 2027 |
|
Customer and export requirements |
EU Cyber Resilience Act for connected products (reporting from September 2026, full application December 2027); NIS2 supply-chain clauses; US defence CMMC; OEM security questionnaires and audits; IEC 62443 and ISO/IEC 27001 as the common language |
|
How these apply Most Indian obligations are cross-sector and depend on size, listing status and notifications; customer and export requirements depend on what you sell and to whom. Confirm against the official instruments and your contracts. |
5. Government, public-sector and private participants
- DPIIT and MeitY drive industrial and electronics policy—Make in India, PLI schemes and the National Manufacturing Mission; MeitY and CERT-In set cyber obligations.
- BIS sets product standards and administers Quality Control Orders; NCIIPC protects notified critical systems; SEBI governs listed-company disclosure.
- Public-sector engineering and electronics undertakings anchor heavy engineering and strategic production.
- Listed private groups lead capital goods, electrical equipment and machinery; global EMS companies and PLI beneficiaries lead electronics.
- MSME component makers and contract manufacturers form the supply base for every OEM, in India and abroad.
- Automation OEMs, system integrators and industrial software vendors build and maintain the control systems, MES and ERP that plants depend on.
6. Who buys cybersecurity inside a manufacturing company
|
Stakeholder |
What they care about |
What they buy |
|
Board, MD and CFO |
Production continuity, customer commitments, disclosure, insurance |
Board advisory, resilience programmes, crisis exercises |
|
CIO and CISO |
IT and OT security, audits, customer questionnaires |
Audits, assessments, SOC, GRC programmes |
|
Plant heads and COO |
Line uptime, safe restart, OEM access |
OT assessments, segmentation, playbooks |
|
Engineering, maintenance and automation |
PLCs, robots, MES, OEM remote support |
IEC 62443 assessments, remote access controls |
|
R&D and design heads |
Protection of designs, recipes and prototypes |
DLP, PLM access reviews, insider risk |
|
Supply chain and procurement |
Supplier reliability and contract security |
Supplier cyber risk programmes |
|
Sales, exports and product management |
Customer audits, EU CRA, product security |
Questionnaire readiness, product and firmware testing |
7. Why each type of manufacturer needs a different approach
|
Manufacturer type |
Highest-consequence risk |
Starting point for assurance |
|
Capital goods and heavy engineering |
Ransomware across multi-plant ERP and project data theft |
Segmentation, backup testing, PLM and project data protection |
|
Electronics and EMS |
Customer product data and firmware security; line stoppage |
Product security assessment, customer assurance, OT review |
|
Industrial machinery and automation |
OEM remote access to their own and customers' machines |
Remote access review, connected-product security |
|
Electrical equipment |
ERP-driven shipping stoppage and BEC fraud |
ERP security, payment controls, SOC |
|
Components and contract manufacturers |
Being the supplier that stops a customer's line |
Baseline assessment, backups, questionnaire readiness |
|
Smart factories |
IIoT and edge devices bridging IT and OT |
IIoT assessment, zone-and-conduit design, OT monitoring |
|
Engineering PSUs and strategic units |
Espionage and notified-system obligations |
CII-aligned assessments, threat hunting, audits |
8. How Codec Networks works with manufacturers
Codec Networks is a CERT-In empanelled information security auditing organisation certified to ISO 9001:2015, ISO/IEC 27001:2022 and ISO/IEC 20000-1:2018. For manufacturers we deliver IEC 62443-aligned OT assessments using production-aware methods, IT/OT segmentation and remote access design, ransomware resilience programmes for ERP and MES, ERP, PLM and portal security testing, supplier cyber risk programmes, 24x7 IT/OT SOC and crisis exercises with plant leadership—connected from finding to closure.
Talk to Codec Networks
|
Contact Codec Networks Pvt. Ltd. New Delhi: 507, 5th Floor, New Delhi House, Barakhamba Road, Connaught Place, New Delhi – 110001 Gurugram: 707, 7th Floor, Silverton Tower, Golf Course Extension Road, Sector 50, Gurugram – 122018, Haryana Landline: 011 430 496 96 | 011 437 522 99 Mobile: +91 99716 76124 | +91 88007 88220 | +91 88003 31124 Email: mktg@codecnetworks.com Web: www.codecnetworks.com |
Note: This document is general industry guidance based on public information available as of October 2026. It is not legal, safety or regulatory advice. Obligations differ by company size, listing status, products, customers and export markets; confirm them against the official CERT-In, MeitY, SEBI, NCIIPC and EU instruments and your customer contracts.