INDUSTRY FACT FILE · DEFENCE & STRATEGIC INDUSTRIES

Cybersecurity FAQs for Defence and Strategic Industries

Forty frequently asked questions and answers in five categories, written for Boards and CMDs, security officers and CISOs, programme and design heads, plant and OT teams, supply chain and partnership teams.

In this document 1.  Category 1: Cyber risk, governance and strategy 2.  Category 2: Licensing, regulation and partner requirements 3.  Category 3: Designs, software and supply chain 4.  Category 4: Plants, isolated networks, SOC and response 5.  Category 5: People, insiders and readiness

Audience: Boards, CMDs, managing directors and programme leadership

Q1. Why are defence and strategic organisations such frequent targets?

Because they hold designs, source code, test results and programme information that states want, deliver products whose integrity matters in the field, and run complex estates with many suppliers and partners. Espionage groups, ransomware operators and hacktivists all see value in them.

Q2. What are the biggest cyber risks for a defence manufacturer?

State-linked espionage through spear-phishing, supplier compromise, theft of designs and code, ransomware crossing into production, insider and removable-media leaks, tampered firmware and components, partner account abuse and slow detection that misses CERT-In's six-hour reporting window.

Q3. Which public incidents should leadership know about?

The Kudankulam administrative-network malware confirmed by NPCIL in 2019 after a CERT-In alert, LockBit's 2023 publication of data claimed from Boeing, Rheinmetall's 2023 ransomware attack contained by IT separation, Thales's 2022 leak via a partner account, and reported campaigns against Indian defence targets.

Q4. Is cybersecurity an IT problem or a leadership problem?

A leadership problem. SMLDI 2025 assigns security responsibilities across management tiers, expects a CISO and vetted security officers, and links compliance to licensed production. Leaks and compromised products affect national security, programmes and customer trust, not only the IT department.

Q5. What should the Board review each quarter?

SMLDI and audit findings and their closure, suppliers holding controlled data and their assessment status, transfers into isolated networks, secure development and firmware integrity, SOC coverage and incidents reported to CERT-In, phishing results, insider cases and progress on ISO 27001 and DPDP.

Q6. Who should own cybersecurity in a defence organisation?

A CISO working with the chief security officer, programme and design heads, plant heads, supply chain and HR, with a clear mandate from leadership, a single inventory of systems, controlled data and suppliers, and regular reporting to the Board or management committee.

Q7. How should we prioritise investment?

Keep controlled data off internet-facing systems and control transfers first; add MFA and EDR everywhere; segment IT, OT and isolated networks; assess high-risk suppliers; secure code and firmware pipelines; then add 24x7 monitoring, threat hunting and ISO 27001 over successive budget cycles.

Q8. How can Codec Networks help?

Codec Networks provides SMLDI 2025 gap assessments, CERT-In audits including OT, supplier assurance, secure development and firmware reviews, restricted environment assessments under clearance procedures, NIST SP 800-171 readiness, managed SOC with threat hunting, and forensics for espionage, leak and ransomware incidents.

Audience: Chief security officers, CISOs, compliance and partnership teams

Q9. What is SMLDI 2025?

The Security Manual for Licensed Defence Industries, issued by the Department of Defence Production in July 2025 to replace the 2014 manual. It sets physical, personnel, document and cyber security requirements for licensed private manufacturers and DPSUs, with two product categories.

Q10. When must a licensed company comply with SMLDI 2025?

DPIIT's Press Note 3 of 2025 directs holders of industrial licences for defence items to comply with SMLDI 2025 before commencing production of licensed items. Commentators note that timelines for firms already in production are less clear, so confirm with DDP and your licence.

Q11. What cyber controls does SMLDI 2025 expect?

As summarised by legal commentators: a dedicated CISO above ₹250 crore turnover, vetted security officers, official work on air-gapped networks, firewalls, intrusion detection, SIEM and privileged account management, SCADA and ICS policies, data classification and cyber awareness in induction.

Q12. What does log integration with the MoD CSOC mean for us?

SMLDI 2025 expects companies that handle government orders, technologies, designs or products to integrate log data with the Ministry of Defence's cyber security operations centre. That requires reliable log sources, retention and architecture, which should be reviewed before integration.

Q13. Do CERT-In's Directions apply to defence manufacturers?

Yes, to body corporates and government organisations alike. Specified cyber incidents must be reported to CERT-In within six hours of noticing them, and ICT logs kept for 180 days within India. Other reporting to DDP, customers or partners may also apply.

Q14. What does NCIIPC mean for defence organisations?

If a system is notified as a protected system under Section 70 of the IT Act, NCIIPC guidance and controls apply and unauthorised access is a serious offence. Strategic and public enterprises are among NCIIPC's critical sectors; confirm whether any of your systems are notified.

Q15. What is CMMC and does it affect Indian suppliers?

CMMC is the US Department of Defense programme verifying that contractors protect controlled information, mainly through NIST SP 800-171. It reaches Indian firms supplying US primes through contract flow-down. Phase 1 began in November 2025; Phase 2 certification was suspended in July 2026 pending review.

Q16. Which other laws matter?

The Official Secrets Act 1923 for classified information, the IT Act 2000, the IDR Act 1951 and Arms Act 1959 for licences, the DPDP Act 2023 for personal data, export-control and end-use commitments, and SEBI LODR disclosure duties for listed companies.

Audience: Programme, design, software, supply chain and quality teams

Q17. How should we protect designs and drawings?

Classify them, keep them on isolated or tightly controlled networks, limit access to those who need it, share with suppliers only through controlled exchange rather than email, watermark and log access, and monitor for unusual downloads or transfers.

Q18. How should suppliers be assessed?

Tier suppliers by the controlled data and access they hold, use questionnaires for low tiers and evidence-based or on-site assessments for high tiers, check MFA, EDR, backups and data handling, flow down contract clauses and reassess annually or after incidents.

Q19. What security clauses belong in supplier contracts?

Data classification and handling rules, approved exchange methods, MFA and endpoint protection, incident reporting to the customer within hours, right to audit, sub-contracting approvals, return or destruction of data at contract end and flow-down of partner requirements such as NIST SP 800-171.

Q20. How do we secure software and firmware development?

Protect repositories and build systems with MFA and least privilege, scan for secrets and vulnerable components, review code for high-risk modules, sign firmware and verify it on boot, keep a software bill of materials and retest before each release.

Q21. Why does a software bill of materials matter?

Because modern firmware includes many third-party and open-source components. An SBOM lets programme managers and customers see what is inside each release, check it against new vulnerabilities and prove provenance when questions arise.

Q22. How do we reduce counterfeit and tampered components?

Buy from authorised sources, keep component provenance and test records, inspect and test high-risk parts, control spares and returns, and include counterfeit-avoidance and notification duties in supplier contracts.

Q23. How should partner portals and collaboration tools be secured?

Use MFA for every partner account, grant project-level access only, set expiry dates, block bulk downloads where possible, log and review access, and remove accounts promptly when people or contracts change.

Q24. How does Codec Networks assess the supply chain?

Codec Networks runs tiered supplier assessments, secure exchange and contract clause reviews, component provenance reviews and partner access reviews, reports risk by supplier and programme, and tracks remediation through to closure.

Audience: Plant, OT, IT infrastructure, security operations and incident response teams

Q25. How should defence plants approach OT security?

Map the OT and test-bench networks, separate them from corporate IT, control vendor remote access through jump hosts with MFA, back up MES and machine programs offline, monitor plant traffic and include OT in the risk-based audits CERT-In's 2025 guidelines expect.

Q26. How do we keep an air-gapped network genuinely isolated?

Remove undocumented connections, allow data in or out only through an approved transfer process with scanning and logging, permit only registered and encrypted media, restrict who may transfer, and monitor and audit the isolated network itself.

Q27. How are classified or restricted environments assessed?

Only under the customer's security clearance procedures: with vetted staff, on the customer's premises and systems where required, with approved tools, and with findings and evidence held as the customer directs. No controlled data should leave the customer's custody.

Q28. Do defence organisations need a SOC?

Yes. Espionage is quiet and persistent, ransomware moves fast and CERT-In expects six-hour reporting. Round-the-clock monitoring of IT, plant, partner and remote access, with threat hunting, is needed. Smaller suppliers and start-ups can use a managed SOC.

Q29. What should the SOC monitor?

Email and endpoint alerts, remote-access and VPN sign-ins, privileged and partner activity, unusual downloads from PLM and repositories, beaconing to unfamiliar servers, lateral movement towards plants, media use and transfers, and CERT-In advisories relevant to the estate.

Q30. What should we do if we suspect espionage?

Do not alert the intruder: preserve evidence, involve the security officer and CISO, engage forensics under clearance procedures, scope affected systems and data quietly, report to CERT-In within six hours and follow ministry and licence reporting channels.

Q31. What should we do in the first hours of ransomware?

Isolate affected systems without switching them off, protect backups and isolated networks, preserve logs, activate the crisis team, report to CERT-In within six hours, inform customers as contracts require and engage forensics before restoring production systems.

Q32. How should backups be designed for plants and engineering data?

Keep offline or immutable copies of ERP, MES, machine programs and engineering data, separate from everyday administrator credentials, test restores regularly and agree which programmes and lines must be restored first.

Audience: HR, vigilance, security, training and communication teams

Q33. How should insider risk be managed?

Combine personnel vetting with least-privilege access, separation of duties, monitoring of privileged and bulk-data activity, controls on media and personal devices, clear reporting channels and prompt access removal when people move or leave sensitive programmes.

Q34. How should engineers and officers be trained?

Short, regular awareness on phishing, data handling and media use, realistic spear-phishing simulations using directive, posting and event lures, special briefings for those on sensitive programmes and SMLDI 2025's cyber awareness module in induction.

Q35. What about social media and personal devices?

Set clear rules on discussing programmes, posting photographs of sites or equipment and carrying personal devices into sensitive areas, explain why adversaries collect such information, and enforce device restrictions where the site's security plan requires them.

Q36. How should staff exits be handled?

Link identity management to HR so access is removed on the last day, recover devices and media, review recent downloads and transfers for people leaving sensitive programmes, and remind leavers of their continuing obligations under the Official Secrets Act and contracts.

Q37. Should we run cyber crisis exercises?

Yes. Annual tabletop exercises with leadership, the security officer, CISO, programme, plant, legal and communication teams, using espionage, supplier leak and ransomware scenarios, test decisions on containment, reporting and customer notification before a real incident.

Q38. How do we handle communication during an incident?

Keep communication on a need-to-know basis, agree spokespeople in advance, coordinate with CERT-In, ministry and customer channels, avoid public speculation about attribution and prepare holding statements for defacements or service outages.

Q39. How do we counter fake apps and lookalike domains?

Monitor domain registrations and app stores for names resembling your organisation, enforce email authentication, publish official channels to staff and partners, request takedowns promptly and warn staff when lures appear.

Q40. How can we start with Codec Networks?

Begin with a scoping call on your sites, programmes, suppliers and licence obligations, or approach us through your usual procurement route; Codec Networks will propose a practical assurance, monitoring and readiness plan, delivered under your security procedures.

Contact Codec Networks Pvt. Ltd. New Delhi: 507, 5th Floor, New Delhi House, Barakhamba Road, Connaught Place, New Delhi – 110001 Gurugram: 707, 7th Floor, Silverton Tower, Golf Course Extension Road, Sector 50, Gurugram – 122018, Haryana Landline: 011 430 496 96 | 011 437 522 99   Mobile: +91 99716 76124 | +91 88007 88220 | +91 88003 31124 Email: mktg@codecnetworks.com   Web: www.codecnetworks.com

Note: These FAQs provide general guidance as of October 2026 and do not constitute legal, regulatory or security-clearance advice. Confirm obligations against the official instruments applicable to your organisation, your industrial licence, any NCIIPC notification and your contract and programme terms.