Manufacturing and critical infrastructure — OT and cybersecurity

Applicable regulations

• IEC 62443 and OT-security expectations for industrial control systems
• CERT-In directions (incident reporting, logging and empanelled testing)
• DPDP Act 2023 for employee and customer personal data
• ISO 27001 ISMS for enterprise assurance

Common cybersecurity risks

• OT and IT convergence exposing plant networks to enterprise threats
• Ransomware halting production lines and logistics
• Supply-chain and vendor remote-access compromise
• Legacy SCADA and PLC systems that cannot be patched

Audit findings we typically see

• No asset inventory or network segmentation between IT and OT
• Flat plant networks with unmanaged remote access
• Untested backup and recovery for production-critical systems
• No OT-aware incident response or CERT-In reporting process

Services required

• VAPT across plant and enterprise networks
• ISO 27001 ISMS
• Network vulnerability assessment
• Security architecture review (IT and OT segmentation)

Our engagement approach

• Discovery. Inventory IT and OT assets, data flows and vendor access, and confirm which CERT-In and DPDP obligations apply.
• Assessment. Segmentation review, OT-safe vulnerability assessment and control gap testing against IEC 62443 themes and ISO 27001.
• Remediation. A prioritised roadmap covering segmentation, remote-access hardening and recovery testing, sized for production constraints.
• Assurance. Retest, audit-grade reporting and a board-ready risk summary.

Expected evidence

• IT and OT asset inventory and network diagrams
• Segmentation and remote-access test results
• Backup and recovery test evidence for critical systems
• Incident-response and CERT-In reporting procedure

Deliverables

• IT and OT gap assessment mapped to IEC 62443 themes
• Segmentation and architecture recommendations
• VAPT reports with closure evidence
• Production-safe remediation roadmap