Manufacturing and critical infrastructure — OT & cybersecurity

Applicable regulations

• IEC 62443 / OT-security expectations for industrial control systems
• CERT-In directions (incident reporting, logging, empanelled testing)
• DPDP Act 2023 for employee and customer personal data
• ISO 27001 ISMS for enterprise assurance

Common cyber risks

• OT/IT convergence exposing plant networks to enterprise threats
• Ransomware halting production lines and logistics
• Supply-chain and vendor-remote-access compromise
• Legacy SCADA/PLC systems that cannot be patched

Audit findings we typically see

• No asset inventory or network segmentation between IT and OT
• Flat plant networks with unmanaged remote access
• Untested backup/recovery for production-critical systems
• No OT-aware incident-response or CERT-In reporting process

Services required

• VAPT across plant and enterprise networks
• ISO 27001 ISMS
• Network vulnerability assessment
• Security architecture review (IT/OT segmentation)

Our engagement approach

• Discovery. Inventory IT/OT assets, data flows, vendor access and applicable CERT-In/DPDP obligations.
• Assessment. Segmentation review, OT-safe vulnerability assessment and control gap testing against IEC 62443 themes and ISO 27001.
• Remediation. Prioritised roadmap — segmentation, remote-access hardening, recovery testing — sized for production constraints.
• Assurance. Retest, audit-grade reporting and board-ready risk summary.

Expected evidence

• IT/OT asset inventory and network diagrams
• Segmentation and remote-access test results
• Backup/recovery test evidence for critical systems
• Incident-response and CERT-In reporting procedure

Deliverables

• IT/OT gap assessment mapped to IEC 62443 themes
• Segmentation & architecture recommendations
• VAPT reports with closure evidence
• Production-safe remediation roadmap