INDUSTRY FACT FILE · SMART CITIES, WATER & URBAN UTILITIES

Cybersecurity FAQs for Smart Cities, Water and Urban Utilities

Forty frequently asked questions and answers in five categories, written for commissioners, SPV CEOs, CISOs, plant engineers, ICCC and safe-city heads, revenue teams and procurement officers.

In this document 1.  Category 1: Cyber risk, governance and strategy 2.  Category 2: Regulation, audits and compliance 3.  Category 3: Plants, command centres and field systems 4.  Category 4: SOC, incidents and ransomware resilience 5.  Category 5: Citizen data, surveillance and privacy

Audience: Commissioners, SPV CEOs, CFOs and CISOs

Q1. Why are cities and water utilities cyber targets?

Because water, traffic and surveillance are visible, symbolic systems that hacktivists and state-linked groups want to disrupt, because municipal portals cannot stay down without public pressure, and because plants and field devices are exposed with default settings and small teams.

Q2. Which incidents should leadership know about?

Oldsmar (2021), where an intruder raised a water plant's lye set-point via remote desktop; Aliquippa (2023), where a booster station PLC was seized through a default password; and in India the Pimpri-Chinchwad smart city servers (2021), Goa's flood-monitoring system (2022) and Madhya Pradesh's e-Nagarpalika portal (2023).

Q3. What are the biggest risks for an Indian city or utility?

Plant HMIs and PLCs reachable from outside, integrators and contractors with standing access to the ICCC and SCADA, ransomware on citizen portals in collection season, misuse of surveillance data, weak backups and slow detection that misses CERT-In's six-hour window.

Q4. Is this an IT problem or an operations problem?

Both. The ICCC, portals and data platforms are IT; plants, pumping stations and field devices are operations; and integrators connect them all. Security must be owned jointly, with the commissioner or CEO accountable.

Q5. What changed when the Smart Cities Mission closed?

Cities and SPVs now own the operations, maintenance and cyber risk of systems that integrators built. Credentials, remote access, patching and backups must be transferred, documented and recertified—not assumed.

Q6. What should leadership review each quarter?

Plant and ICCC exposure, vendor and contractor access, backup test results, portal and payment risks, surveillance governance, incidents and near misses, audit findings, SOC coverage and exercise outcomes.

Q7. How should we prioritise investment?

Remove internet and remote-desktop exposure of plants, broker integrator access, segment plant, ICCC, field and office networks, make portals and platforms recoverable, govern surveillance data and build monitoring—in that order.

Q8. How can Codec Networks help?

Codec Networks provides ICCC and SCADA assessments, segmentation and vendor access design, surveillance governance, citizen portal and payment testing, CERT-In and government-entity audits, DPDP programmes, a 24x7 city SOC and crisis exercises.

Audience: Compliance, legal, audit and CISO offices

Q9. Do CERT-In Directions apply to municipal bodies and SPVs?

Yes. The Directions apply to government organisations and bodies corporate alike: incidents must be reported within six hours of noticing them and ICT logs retained for 180 days in India.

Q10. What do CERT-In's government-entity guidelines expect?

Issued on 30 June 2023, they set baseline controls for government bodies and their agencies—a designated CISO, asset inventory, access management, application, data, third-party and cloud security and continuity planning. Confirm whether your body falls within their scope.

Q11. What do CERT-In's 2025 audit guidelines mean for a city?

Risk-based, independent cyber audits covering IT, OT/ICS, cloud and applications with closure of findings—so plants, ICCCs and field systems belong in the audit scope, not only office IT.

Q12. Does NCIIPC apply to our water or city systems?

Only if the systems are notified as protected systems or critical information infrastructure by the owning government. Many are not, but good practice aligns with NCIIPC guidance regardless.

Q13. Does DPDP apply to a government body?

The Act covers personal data processed by public and private bodies, with provisions allowing the Central Government to exempt notified state instrumentalities. Most obligations under the DPDP Rules take effect in May 2027; confirm your position with legal advice.

Q14. What are MeitY's CCTV essential requirements?

Security requirements for CCTV cameras under the Compulsory Registration Order, tested by STQC and in effect from 9 April 2025. Safe-city and ICCC procurement should confirm compliance of cameras purchased and installed.

Q15. Which standards should we align to?

IEC 62443 for plant and field control systems and ISO/IEC 27001 for the management system, mapped to CERT-In guidelines; together they answer most auditor and lender questions.

Q16. Can Codec Networks audit a government entity?

Yes. Codec Networks is CERT-In empanelled and performs IT and OT audits, government-entity guideline gap assessments, ISO 27001 and IEC 62443 assessments and auditor evidence support.

Audience: Plant engineers, ICCC heads, traffic and lighting units, integrators

Q17. How do we stop an Oldsmar-style intrusion?

Remove remote-desktop tools and direct internet exposure from HMIs, broker any remote access with MFA and recording, change default passwords, set hard limits and alarms on critical set-points and monitor plant networks.

Q18. How should SCADA be assessed without risking the plant?

Passive asset discovery, configuration and architecture reviews, and any active testing planned in low-demand windows with operators present—never unplanned scanning of PLCs or dosing systems.

Q19. How should integrator and contractor access work?

Through a brokered gateway with MFA, named accounts, approval per session, time limits and recording—never standing VPNs or shared logins, and with access removed at contract end.

Q20. How should an ICCC be segmented?

Separate zones for ICCC platforms, VMS and cameras, SCADA links, public Wi-Fi and office IT, with controlled flows through firewalls, no dual-homed servers and no direct internet exposure of platforms.

Q21. What should we check when a mission project is handed over?

That default credentials are changed, remote access is documented and brokered, networks are segmented, firmware and patches are current, cameras meet MeitY requirements and documentation and backups exist.

Q22. How do we secure smart streetlights, meters and sensors?

Assess gateways before deployment, isolate field networks from telemetry and office IT, change default credentials, manage firmware centrally and monitor for scanning and botnet behaviour.

Q23. What about PLCs and HMIs that cannot be patched?

Segment them, restrict access, remove internet paths, monitor traffic and plan upgrades with the OEM; compensating controls are expected where patching is impossible.

Q24. Should traffic signals and parking systems be in scope?

Yes. Signal controllers, AFC and parking platforms are networked systems whose manipulation affects safety and revenue; they need the same inventory, segmentation and access control as plant systems.

Audience: SOC, IT infrastructure, incident response and operations teams

Q25. Do cities need a SOC that covers plants and the ICCC?

Yes. Monitoring office IT alone misses plant networks, field devices and vendor sessions—the places where the most dangerous incidents begin.

Q26. What should the SOC monitor in a city?

Plant and field network traffic and industrial protocols, HMI and set-point changes, ICCC and VMS logins, vendor remote sessions, IoT gateways, portals and the IT systems everything depends on.

Q27. What should an incident playbook include?

Safety decisions for water and traffic, containment, isolation of vendors, CERT-In reporting within six hours, state and lender notification, public communication and FIR and evidence preservation.

Q28. How should backups be designed?

Immutable or offline backups of ICCC platforms, VMS settings, SCADA and PLC configurations, portals and ERP, with regular restore tests and documented restart sequences.

Q29. Should we run exercises?

Yes—annual tabletop exercises with leadership, plant, ICCC and civic teams using set-point tampering, ICCC ransomware and portal outage scenarios, plus technical restore drills.

Q30. How quickly can a portal recover from ransomware?

With tested immutable backups and a manual counter playbook, days; with three-day-old tape backups and no plan, weeks—as the e-Nagarpalika incident showed.

Q31. When should forensics be engaged?

As soon as compromise is suspected, with investigators who understand plant and city systems, to preserve evidence, establish root cause and support reporting, FIRs and public statements.

Q32. How do we handle hacktivist and DDoS campaigns?

Reduce exposed services, use DDoS protection for portals and ICCC endpoints, monitor threat intelligence, prepare communication plans and rehearse response with the SOC.

Audience: Revenue, safe-city, data platform, legal and privacy teams

Q33. How should citizen portals be secured?

Test web, mobile and APIs before launch and after changes, patch application servers promptly, enforce strong authentication for staff, protect payment integrations and back up immutably.

Q34. How do we stop fake payment links and collection fraud?

Publish and verify official payment channels, monitor look-alike domains, secure payment integrations, reconcile collections daily and train revenue staff and citizens.

Q35. How should surveillance data be governed?

Define purpose and legal basis, limit retention, give named users least privilege, log and review every export, align cameras to MeitY requirements and remove contractor rights at exit.

Q36. Does facial recognition need special controls?

Yes. Recognition and ANPR data are sensitive; governance should cover authorisation, accuracy, access logging, retention and review, and legal advice on the applicable constitutional and DPDP position.

Q37. How does DPDP affect a city data platform?

Citizen, commuter and sensor-linked personal data on platforms such as IUDX or state data centres require notices, safeguards, retention limits and breach workflows—design them before May 2027.

Q38. How do we protect data shared with start-ups and researchers?

Share anonymised or minimised data through authenticated APIs under agreements covering security, purpose and deletion, with monitoring of access and periodic reviews.

Q39. What should contracts with integrators and concessionaires say?

Security requirements, named access, logging, incident notification, audit rights, data handling and deletion, handover obligations and penalties—mapped to CERT-In and DPDP expectations.

Q40. How can we start with Codec Networks?

Begin with a scoping call on your plants, command centres, field systems, vendors and citizen platforms; Codec Networks will propose a plant-aware assessment and assurance plan.

Contact Codec Networks Pvt. Ltd. New Delhi: 507, 5th Floor, New Delhi House, Barakhamba Road, Connaught Place, New Delhi – 110001 Gurugram: 707, 7th Floor, Silverton Tower, Golf Course Extension Road, Sector 50, Gurugram – 122018, Haryana Landline: 011 430 496 96 | 011 437 522 99   Mobile: +91 99716 76124 | +91 88007 88220 | +91 88003 31124 Email: mktg@codecnetworks.com   Web: www.codecnetworks.com

Note: These FAQs provide general guidance as of October 2026 and do not constitute legal or regulatory advice. Confirm obligations against the official instruments applicable to your body's legal status, state and contracts.