Resources Categories
INDUSTRY FACT FILE · MARITIME, PORTS & SHIPPING
Applicable Cybersecurity Services and Codec Networks Bundles for Ports and Shipping
How Codec Networks services and bundled service models help ports, terminal operators, shipping companies, shipyards and waterway operators resolve their threats and meet CERT-In, NCIIPC, IMO, IACS, ISPS, SEBI and DPDP expectations.
|
In this document 1. Our approach 2. Mapping threats to services 3. Codec Networks service catalogue for the sector 4. Codec Networks bundles for the sector 5. Sector programmes built from the bundles 6. Packages: Foundation, Assurance and Continuous Resilience 7. Regulatory requirement-to-bundle mapping 8. Threat-to-bundle coverage matrix 9. Delivery methodology and deliverables 10. Why Codec Networks 11. Annex: indicative commercial ranges |
1. Our approach
Ports and ships need assurance that respects safety and trade continuity. Codec Networks works on four principles:
- Safety first: plan OT work with terminal operations and marine teams; passive first, active only by agreement and never on live cranes or bridge systems.
- Strong boundaries: IT/OT, TOS and OEM separation, brokered remote access for vendors and ships.
- Assume outage: make TOS, PLC configurations and ERP recoverable and rehearse running the yard and gate manually.
- Prove it to regulators and customers: findings mapped to IEC 62443, ISO/IEC 27001, IMO MSC.428(98), IACS UR E26/E27, ISPS and the audits your customers and lenders run.
2. Mapping threats to services
The table maps the 18 threats identified in Document 4 of this set to the Codec Networks services that help mitigate them.
|
Threat / challenge |
Applicable Codec Networks services |
Intended outcome |
|
Ransomware halting terminals |
Segmentation, backup and restore testing, EDR validation |
Terminals that keep working and recover fast |
|
Terminal OT and crane intrusion |
OT assessment, segmentation, change monitoring |
Protected control layer |
|
OEM and vendor remote access |
Remote access brokering, vendor assessments |
Controlled vendor access |
|
TOS and cargo platform attacks |
Platform and API testing, resilience review |
Hardened, recoverable platforms |
|
Container release fraud |
Portal MFA, anomaly detection, release verification |
Cargo released to the right party |
|
Ship system compromise |
Ship cyber risk assessment, remote access control |
Safer ships and clean audits |
|
GNSS and communications interference |
Integrity monitoring, bridge procedures, drills |
Resilient navigation |
|
Phishing |
Phishing simulation, MFA, awareness |
Fewer compromised accounts |
|
BEC |
Payment and master-data controls, BEC simulation |
Reduced fraud |
|
Flat IT/OT networks |
Zone-and-conduit design, terminal DMZ |
Contained networks |
|
Legacy SCADA and controllers |
Compensating controls, segmentation, monitoring |
Reduced exposure |
|
Customer, crew and cargo data breaches |
DPDP programme, data mapping, access controls |
Protected data |
|
State-backed sabotage and espionage |
Threat hunting, privileged access review |
Intruders found early |
|
Supply chain and software compromise |
Supplier assessments, update controls |
Trusted software and services |
|
Insider misuse |
Access reviews, activity monitoring, offboarding |
Accountable access |
|
Contractor networks and devices |
Device scanning, segmented temporary access |
Clean port networks |
|
Weak detection and response |
IT/OT SOC, playbooks |
Reliable 6-hour reporting |
|
Backup and recovery failure |
Backup review, configuration backups, restore drills |
Proven recovery |
3. Codec Networks service catalogue for the sector
|
Service line |
Sector-relevant services |
|
Security Vulnerability Assessment & Penetration Testing |
IT, terminal OT, crane, gate, conveyor, SCADA and marine OT reviews using safety-aware methods; ship system reviews |
|
Application, API & platform security |
TOS, PCS 1x, customer portals, booking and documentation platforms, customs and partner APIs; fraud-resistance testing |
|
Industrial & infrastructure security |
IT/OT architecture, zone-and-conduit segmentation, terminal DMZ, OEM remote access and IEC 62443-aligned gap assessments |
|
Ship cyber risk |
MSC.428(98) cyber risk assessments for the SMS, IACS UR E26/E27 readiness, bridge, engine-room and satcom reviews |
|
Recovery & resilience |
Backup and restore testing for TOS, PLC configurations and ERP; manual yard, gate and berth playbooks; crisis exercises |
|
Information security audit & compliance |
CERT-In-aligned IT/OT audits, NCIIPC-aligned controls, cyber in ISPS plans, ISO/IEC 27001, SEBI disclosure support |
|
Third-party risk management |
OEM, integrator, contractor, dredging, agent and platform provider assessments; access governance |
|
Data privacy & protection |
DPDP programmes for customer, crew, driver and visitor data; design data classification for shipyards |
|
24/7 Managed SOC & threat monitoring |
Terminal, port, fleet and enterprise monitoring, industrial protocol detection, OEM-session monitoring, threat hunting |
|
Cyber forensics & incident response |
Terminal, ship and enterprise investigations, 6-hour reporting and disclosure support, customs and customer communication |
4. Codec Networks bundles for the sector
Eleven of the twelve bundles in the Codec Networks Bundled Service Models apply directly to ports, terminals and shipping companies; the Global Cyber Back-Office SPV Program (Bundle 12) is offered separately for international clients.
Figure 6: Codec Networks bundles applied to the sector.
|
Bundle |
Name |
Sector-relevant scope |
Best suited for |
Key deliverables |
|
B1 |
Cyber Assessment & VAPT Assurance Program |
IT, terminal OT, marine OT and ship system assessments |
All operators |
Assessment reports, retests and closure tracker |
|
B2 |
Application, API & DevSecOps Security Program |
TOS, PCS 1x, portal and booking platform testing |
Ports, terminals, shipping lines, platform providers |
Application and API risk reports |
|
B3 |
Cloud, Infrastructure & Zero Trust Security Program |
IT/OT segmentation, terminal DMZ, OEM remote access, cloud posture |
All operators |
Architecture review and remediation roadmap |
|
B4 |
Regulatory Cybersecurity Audit & Compliance Assurance Program |
CERT-In, NCIIPC and ISPS-aligned audits, SEBI support |
Major ports, listed groups, PFSOs |
Audit report, gap matrix, evidence tracker |
|
B5 |
GRC, ISO, SOC 2 & Cyber Maturity Program |
IEC 62443, ISO 27001, MSC.428(98) and UR E26/E27 readiness |
Operators formalising OT and ship security |
Maturity scorecard, policies, evidence packs |
|
B6 |
Data Privacy, DPDPA & Data Protection Program |
Customer, crew, driver and visitor data protection |
Ports, lines and platforms ahead of May 2027 |
Privacy gap assessment and roadmap |
|
B7 |
Managed SOC, MDR & Continuous Threat Monitoring Program |
24x7 IT/OT SOC with threat hunting |
Multi-terminal operators and fleets |
SOC reports, MTTD/MTTR |
|
B8 |
Digital Forensics, Incident Response & Malware RCA Program |
Terminal and ship incident response and reporting |
Any operator facing an incident |
Forensic report, RCA, reporting support |
|
B9 |
Third-Party Risk Management & Supply Chain Cyber Risk Program |
OEM, integrator, contractor and agent assessments |
All operators |
Vendor risk register and assessments |
|
B10 |
Cyber Simulation, Awareness, Tabletop & Crisis Readiness Program |
Port crisis exercises and manual-operation drills |
Leadership, operations, customers, customs |
Exercise reports and playbooks |
|
B11 |
Emerging Technology, AI, Web3 & Future Security Program |
Automation, remote operations, digital twin and AI security |
Operators adopting new technology programmes |
Risk assessment |
5. Sector programmes built from the bundles
Codec Networks packages the catalogue bundles into six maritime and port programmes.
|
Programme |
Built from bundles |
Challenges addressed |
|
Terminal OT Security Programme |
B1, B3 |
Cranes, gates, SCADA, segmentation and OEM access |
|
Cargo Platform Assurance |
B2, B7 |
TOS, PCS 1x, portals, APIs and release fraud |
|
Recovery & Continuity |
B3, B10 |
Backups, restore times and manual yard playbooks |
|
Ship Cyber Programme |
B5, B1, B10 |
MSC.428(98), UR E26/E27, bridge and engine-room reviews, drills |
|
Third-Party & Contractor Access |
B9, B3 |
OEMs, integrators, dredging and construction partners |
|
IT/OT SOC & Response |
B7, B8 |
Detection, response and 6-hour reporting |
6. Packages: Foundation, Assurance and Continuous Resilience
|
Package element |
Foundation |
Assurance |
Continuous Resilience |
|
Typical organisation |
Non-major ports, single terminals and ship managers |
Major ports and multi-terminal operators |
Listed port groups, large fleets and CII owners |
|
Testing |
B1: IT and terminal OT assessment |
B1 + B2: IEC 62443 assessment and TOS, PCS 1x and portal testing |
B1 + B2 + B10: continuous OT testing and red teaming |
|
Audit and GRC |
B5: policy, awareness and crisis plan pack |
B4: annual independent audit + B5 |
B4 + B5 + B9: audit, ship cyber programme and vendor programme |
|
Cloud and privacy |
B3: OEM access and backup review |
B3 + B6: segmentation and DPDP |
B3 + B6 + B11: segmentation, DPDP and automation security |
|
Monitoring and response |
IR retainer (B8) |
B7: IT/OT SOC + B8 |
B7: SOC with threat hunting + B8 |
|
Reporting |
Compliance checklist and customer evidence |
CISO and management reporting |
Board, regulator and customer reporting |
7. Regulatory requirement-to-bundle mapping
|
Requirement (source) |
How Codec Networks helps |
Bundle |
|
Cyber incidents to CERT-In within six hours; 180-day logs (CERT-In Directions) |
IT/OT SOC, IR retainer and reporting support |
B7, B8 |
|
Risk-based independent cyber audits including OT/ICS (CERT-In audit guidelines, 2025) |
Independent IT/OT audits |
B4, B1 |
|
Cyber risk addressed in the ship safety management system (IMO MSC.428(98); DG Shipping circular) |
Ship cyber risk assessments and SMS procedures |
B5, B1 |
|
Cyber resilience of new ships and on-board systems (IACS UR E26/E27) |
Newbuild specification review and readiness verification |
B5, B9 |
|
Port facility security assessments and plans (ISPS Code; MS Security Rules 2024) |
Cyber elements in PFSA and PFSP, PFSO support |
B4, B1 |
|
Protection of notified protected systems (NCIIPC) |
CII-aligned assessments and controls |
B4, B3 |
|
Quarterly cyber incident disclosure by listed operators (SEBI LODR) |
Incident records and disclosure support |
B4, B8 |
|
Customer, crew, driver and visitor personal data (DPDP) |
DPDPA programme |
B6 |
|
Customer, charterer, lender and insurer requirements |
ISO 27001, IEC 62443 and evidence packs |
B5, B9 |
|
Auditor eligibility and independence Where a regulator, standard or contract requires CERT-In empanelled or independent auditors, Codec Networks—CERT-In empanelled for information security auditing services—confirms eligibility and independence in each proposal. |
8. Threat-to-bundle coverage matrix
|
Threat / challenge |
Primary bundle |
Supporting bundles |
|
Ransomware halting terminals |
B3 |
B7, B10, B8 |
|
Terminal OT and crane intrusion |
B1 |
B3, B7 |
|
OEM and vendor access |
B9 |
B3, B7 |
|
TOS and cargo platform attacks |
B2 |
B3, B7 |
|
Container release fraud |
B2 |
B7, B9 |
|
Ship system compromise |
B5 |
B1, B7 |
|
GNSS and communications interference |
B1 |
B10 |
|
Phishing |
B10 |
B7 |
|
BEC |
B10 |
B2, B7 |
|
Flat IT/OT networks |
B3 |
B1 |
|
Legacy SCADA and controllers |
B3 |
B1, B7 |
|
Customer and crew data breaches |
B6 |
B2, B3 |
|
State-backed sabotage and espionage |
B7 |
B3 |
|
Supply chain and software compromise |
B9 |
B3, B11 |
|
Insider misuse |
B7 |
B3 |
|
Contractor networks and devices |
B9 |
B3 |
|
Weak detection and response |
B7 |
B8 |
|
Backup and recovery failure |
B10 |
B3 |
“Primary” and “supporting” indicate suggested combinations, not guaranteed mitigation or complete coverage.
9. Delivery methodology and deliverables
Figure 7: The Codec Networks delivery methodology.
Typical deliverables include IT/OT and IEC 62443 assessment reports with retests, a zone-and-conduit segmentation design for terminals and control centres, TOS, PCS 1x and portal test reports with fraud-resistance findings, an OEM and contractor access programme, a TOS and PLC recovery review with tested restore times, ship cyber risk assessments and UR E26/E27 readiness reports, a CERT-In-aligned audit report, cyber inputs to ISPS plans, customer and lender evidence packs, crisis playbooks and exercise reports, and IT/OT SOC reporting.
10. Why Codec Networks
- CERT-In empanelled for information security auditing services, and empanelled with NICSI for application audit and compliance services (start-up category).
- Certified to ISO 9001:2015, ISO/IEC 27001:2022 and ISO/IEC 20000-1:2018.
- Full stack: VAPT, regulatory audit, managed SOC, forensics, privacy and Board advisory from one partner, so findings, monitoring and closure stay connected.
- Maritime depth: cranes, gates, SCADA, TOS, PCS 1x, bridge and engine-room systems assessed with safety-aware methods and mapped to IEC 62443, MSC.428(98) and IACS UR E26/E27.
- Recognised frameworks and tools: OWASP ASVS/MASVS and API Top 10, MITRE ATT&CK, NIST CSF, ISO 27001 and PCI DSS; tools such as Burp Suite, Nessus, Metasploit, Prowler and leading SIEM/EDR platforms.
- Certified people: CEH, OSCP, CPENT, CISA, ISO 27001 LA/LI, CHFI, CTIA and ECIH professionals.
Annex: Indicative commercial ranges
For internal sales reference only—remove this annex before sharing externally. Ranges are taken from the Codec Networks Bundled Service Models and are subject to scoping, asset counts, frequency and service levels.
|
Bundle |
Package examples and indicative ranges |
|
B1 VAPT Assurance |
Essential ₹1.5–5 lakh; Professional ₹5–15 lakh; Enterprise ₹15–40 lakh; Annual retainer ₹25 lakh–₹1.5 crore |
|
B2 AppSec & DevSecOps |
API Quick Check ₹2–6 lakh; AppSec Professional ₹8–20 lakh; DevSecOps Maturity ₹12–35 lakh; Secure SDLC retainer ₹3–15 lakh/month |
|
B3 Cloud & Zero Trust |
Cloud Essential ₹3–8 lakh; Professional ₹8–25 lakh; Enterprise ₹25–75 lakh; Continuous assurance ₹2–10 lakh/month |
|
B4 Regulatory Audit |
Gap review ₹5–15 lakh; Full regulatory audit ₹15–50 lakh; Multi-framework audit ₹30 lakh–₹1.25 crore; Annual retainer ₹3–20 lakh/month |
|
B5 GRC, ISO, SOC 2 |
ISO readiness ₹5–15 lakh; ISO implementation ₹15–45 lakh; SOC 2 readiness ₹15–60 lakh; GRC retainer ₹2–12 lakh/month |
|
B6 Privacy & DPDPA |
Quick assessment ₹3–10 lakh; Implementation ₹10–40 lakh; DPO-as-a-Service ₹2–8 lakh/month; Privacy retainer ₹3–15 lakh/month |
|
B7 Managed SOC |
Starter ₹2–5 lakh/month; Professional ₹5–15 lakh/month; Enterprise ₹15–50 lakh/month; co-managed per FTE/shift |
|
B8 Forensics & IR |
Triage ₹3–15 lakh; Full investigation ₹15–75 lakh; Ransomware response ₹25 lakh–₹1.5 crore; IR retainer ₹5–50 lakh/year |
|
B9 TPRM |
₹25,000–₹2 lakh per vendor; batch pricing for 50–500 vendors; retainer ₹3–25 lakh/month |
|
B10 Simulation & Tabletop |
Awareness ₹1–5 lakh; Phishing simulation ₹2–10 lakh; Tabletop ₹5–20 lakh; Cyber war-game ₹15–75 lakh; Annual retainer ₹10 lakh–₹1 crore/year |
|
B11 Emerging Tech |
AI/LLM risk review ₹5–25 lakh; Smart contract audit ₹5–50 lakh; Emerging tech retainer ₹5–25 lakh/month |
Talk to Codec Networks
|
Contact Codec Networks Pvt. Ltd. New Delhi: 507, 5th Floor, New Delhi House, Barakhamba Road, Connaught Place, New Delhi – 110001 Gurugram: 707, 7th Floor, Silverton Tower, Golf Course Extension Road, Sector 50, Gurugram – 122018, Haryana Landline: 011 430 496 96 | 011 437 522 99 Mobile: +91 99716 76124 | +91 88007 88220 | +91 88003 31124 Email: mktg@codecnetworks.com Web: www.codecnetworks.com |
Note: Service scope, deliverables, monitoring coverage and service levels are confirmed during engagement scoping. Services support risk reduction and assurance but do not guarantee prevention of all cyber incidents or regulatory compliance. Regulatory references are summaries; confirm against the official instruments applicable to each entity.