INDUSTRY FACT FILE · OIL, GAS & PETROCHEMICALS

Cybersecurity FAQs for Oil, Gas and Petrochemicals

Forty frequently asked questions and answers in five categories, written for Boards, CISOs, operations, process safety, instrumentation, retail and procurement teams.

In this document 1.  Category 1: Cyber risk, governance and strategy 2.  Category 2: Regulation, standards and compliance 3.  Category 3: Plants, pipelines and safety systems 4.  Category 4: SOC, incidents and resilience 5.  Category 5: Contractors, vendors, retail and data

Audience: Boards, CMDs and CISOs

Q1. Why is oil and gas a cyber target?

It combines hazardous processes, high-value data and operations that cannot easily stop, attracting criminals and state actors.

Q2. What are the biggest risks?

Ransomware causing shutdowns, safety system tampering, pipeline SCADA compromise, contractor and vendor access, wipers and weak OT monitoring.

Q3. Which incidents illustrate the risk?

Shamoon (2012), TRITON's targeting of a safety system (2017), the precautionary shutdown of a major US pipeline after IT ransomware (2021) and a reported 2022 ransomware attack on an Indian oil company.

Q4. Why link cybersecurity and process safety?

Attacks on control and safety systems can create hazardous conditions, so cyber risk belongs in process safety management.

Q5. What should the Board review?

OT and SIS risks, IT dependencies, contractor access, incidents, audit findings, drills and SOC coverage.

Q6. Who should own OT security?

The CISO jointly with operations, instrumentation and process safety leadership.

Q7. How should we prioritise investment?

Map IT dependencies, segment IT from OT, protect safety systems, control third parties and build OT monitoring.

Q8. How can Codec Networks help?

Codec Networks provides OT and SCADA assessments, SIS security reviews, third-party access programmes, IT/OT SOC and crisis exercises.

Audience: Compliance, HSE and CISO offices

Q9. Do CERT-In Directions apply?

Yes. Cyber incidents must be reported within six hours and ICT logs kept for 180 days in India.

Q10. What are CERT-In's audit guidelines?

CERT-In's July 2025 guidelines set expectations for risk-based, independent audits covering IT and OT/ICS.

Q11. What is NCIIPC's role?

NCIIPC protects systems notified as critical information infrastructure or protected systems, including in the energy sector.

Q12. What do PNGRB and OISD cover?

PNGRB sets technical, safety and integrity standards for pipelines and city gas; OISD sets safety standards for installations.

Q13. Do they set cyber requirements?

Their safety and integrity standards apply to systems that cyber incidents can affect; cyber controls support compliance with them.

Q14. Which international standards help?

IEC 62443 for industrial automation security and API 1164 for pipeline control system security.

Q15. Does DPDP apply?

Yes, to consumer personal data in retail, LPG and city gas; most obligations take effect in May 2027.

Q16. Can Codec Networks audit us?

Yes. Codec Networks is CERT-In empanelled and performs IT/OT audits and assessments.

Audience: Operations, instrumentation and process safety teams

Q17. How should IT and OT be separated?

Use a DMZ, remove dual-homed systems, control data flows and ensure OT can run without IT.

Q18. How do we assess OT safely?

Use passive discovery, offline reviews and testing planned with operations and safety teams.

Q19. How should safety instrumented systems be protected?

Isolate SIS networks, use physical key control for program mode, restrict and monitor engineering workstations and manage changes strictly.

Q20. How should pipeline SCADA be secured?

Protect communications to RTUs, control remote access, monitor commands and test regularly.

Q21. What about legacy DCS and HMIs?

Segment, restrict access, monitor and plan upgrades with OEMs.

Q22. How should removable media be handled?

Use scanning kiosks and restrict USB use in control rooms and plants.

Q23. How do we secure terminals?

Assess tank gauging and loading automation and verify the integrity of measurement data.

Q24. What about remote and offshore sites?

Secure satellite and radio links, broker remote access and plan safe local operation.

Audience: SOC, incident response and operations teams

Q25. Do oil and gas companies need an OT SOC?

Yes. Monitoring IT and OT 24x7 is essential for early detection and six-hour reporting.

Q26. What should the SOC monitor?

IT and OT networks, industrial protocols, engineering workstation activity, remote sessions and threat intelligence.

Q27. Why map OT dependencies on IT?

To know whether operations can continue safely and commercially if IT is unavailable.

Q28. What should incident playbooks include?

Safety decisions, containment, operations continuity, CERT-In reporting, NCIIPC coordination and communication.

Q29. How should OT backups be handled?

Keep offline, tested backups of configurations, logic and historians, and a restart plan.

Q30. Should we run joint drills?

Yes—with operations, process safety and leadership, using ransomware and safety-system scenarios.

Q31. How do we defend against wipers?

Tier privileged access, keep offline backups, monitor endpoints and rehearse rebuilds.

Q32. When should forensics be engaged?

As soon as OT or destructive-malware compromise is suspected, with OT-aware investigators.

Audience: Procurement, retail, privacy and IT teams

Q33. How should contractors be managed during turnarounds?

Scan and control devices, provide segmented temporary access, use named accounts and remove access afterwards.

Q34. How should vendor remote access work?

Brokered, time-bound sessions with MFA and recording, approved per request.

Q35. How should OEMs be assessed?

Review product security, update practices, support methods and incident commitments.

Q36. How should fuel station networks be secured?

Secure central remote management, test station automation, monitor configuration and price changes and align payments with PCI DSS.

Q37. How do we prevent measurement fraud?

Protect the integrity of tank, flow and dispenser data and monitor for anomalies.

Q38. How should consumer data be protected?

Apply DPDP-aligned safeguards to retail, LPG and CGD customer data.

Q39. What about digital refinery initiatives?

Assess IIoT, analytics and digital twin connections before they link to OT.

Q40. How can we start with Codec Networks?

Begin with a scoping call on your assets, control systems and contractors; Codec Networks will propose a safety-aware assessment plan.

Contact Codec Networks Pvt. Ltd. New Delhi: 507, 5th Floor, New Delhi House, Barakhamba Road, Connaught Place, New Delhi – 110001 Gurugram: 707, 7th Floor, Silverton Tower, Golf Course Extension Road, Sector 50, Gurugram – 122018, Haryana Landline: 011 430 496 96 | 011 437 522 99   Mobile: +91 99716 76124 | +91 88007 88220 | +91 88003 31124 Email: mktg@codecnetworks.com   Web: www.codecnetworks.com

Note: These FAQs provide general guidance as of October 2026 and do not constitute legal or safety advice. Confirm obligations against the official instruments applicable to your assets.