Resources Categories
INDUSTRY FACT FILE · MARITIME, PORTS & SHIPPING
Market Landscape and the Drivers of Cybersecurity Demand in Ports and Shipping
The business, technology, international, regulatory, legal and statutory forces that create cybersecurity, audit and assurance work for ports, terminals, shipping companies, shipyards and waterway operators.
|
In this document 1. Market landscape 2. Business drivers 3. Technology drivers 4. Regulatory drivers: CERT-In, NCIIPC, IMO and IACS, ISPS, the 2025 Acts and DPDP 5. Legal and statutory drivers 6. How the drivers differ by organisation type 7. What this means for buyers and for Codec Networks |
1. Market landscape
India's maritime sector carries about 95 per cent of the country's trade by volume. Major ports handled a record 915 million tonnes in 2025-26, non-major ports under state boards and private groups handle a growing share, national waterways reached 145.5 million tonnes in 2024-25, and Sagarmala's 845 projects and the planned Vadhavan port add capacity. Terminal operations are increasingly private and automated, shipping companies run connected fleets, and 2025 brought the Indian Ports Act and Merchant Shipping Act to replace century-old law.
Cybersecurity demand follows four pressures. Continuity: Maersk, Nagoya and DP World Australia showed that cyber incidents stop cargo. Safety: cranes, SCADA and ship navigation are networked and GNSS interference is routine in chokepoints. Compliance: the IMO and IACS require cyber in ship safety management and newbuild design, ISPS plans cover port facilities, transport is an NCIIPC critical sector, CERT-In expects independent audits that include OT and DPDP arrives in 2027. Customers: cargo owners, charterers, lenders and insurers ask for evidence before and during contracts.
|
915 MT Major port cargo in 2025-26 |
145.5 MT Cargo on national waterways in 2024-25 |
6 hours Incident reporting to CERT-In |
May 2027 Most DPDP obligations take effect |
|
Market segment |
Landscape and buying behaviour |
Cybersecurity opportunity |
|
Major port authorities |
Public ownership, shared port systems, PCS 1x, possible NCIIPC notification |
CII-aligned audits, port-wide segmentation, SOC |
|
Private and listed port groups |
Multi-port estates, Boards and audit committees, SEBI disclosure, global customers |
Group OT programmes, recovery, red teaming, Board reporting |
|
Terminal operators |
Concessions, productivity targets, OEM-maintained automation |
Terminal OT assessment, TOS resilience, OEM access |
|
Shipping lines and ship managers |
ISM and class obligations, connected fleets, charterer scrutiny |
Ship cyber risk assessments, fleet SOC, UR E26/E27 readiness |
|
Shipyards |
Defence and export customers, valuable designs |
Data protection, subcontractor access, hunting |
|
Waterways, coastal and port services |
Smaller operators, thin IT, port customer requirements |
Baseline assessments, questionnaire readiness |
2. Business drivers
|
Business driver |
Buying trigger |
Relevant services |
|
Trade continuity |
A terminal outage stops cargo and ships within hours |
Resilience, segmentation, OEM controls |
|
Berth productivity and concessions |
Performance obligations and service credits |
TOS resilience, continuity playbooks |
|
Safety of ships, crews and terminals |
Cyber events can cause physical incidents |
OT and ship security, cyber in safety management |
|
Customer, charterer and lender assurance |
Cargo owners, charterers and lenders require security evidence |
ISO 27001, IEC 62443, audit readiness |
|
Insurance and P&I |
Insurers scrutinise cyber controls and exclusions |
Control validation, ransomware readiness |
|
Board accountability and disclosure |
Listed groups disclose incidents; Boards own risk |
Board advisory, incident records |
|
New capacity and go-lives |
New terminals and systems under Sagarmala |
Security by design, pre-go-live testing |
3. Technology drivers
|
Technology driver |
Exposure created |
Codec Networks opportunity |
|
Terminal automation and OEM access |
Remote links into crane, gate and SCADA networks |
OT assessments, access brokering |
|
TOS and PCS 1x integrations |
Cargo stops when platforms stop; fraud through portals |
Platform testing, backups, fraud controls |
|
Connected ships and satcom |
Ship-to-shore access and software updates |
Ship cyber risk assessments, remote access control |
|
GNSS, AIS and ECDIS |
Spoofing and jamming of navigation inputs |
Integrity monitoring, bridge procedures |
|
Cloud, analytics and digital twins |
Operational data and dashboards in the cloud |
Cloud posture, data protection |
|
Contractor and dredging systems |
Temporary networks and devices on port estates |
Device and access controls |
Figure 3: The four groups of drivers behind cybersecurity spending in ports and shipping.
4. Regulatory drivers: CERT-In, NCIIPC, IMO and IACS, ISPS, the 2025 Acts and DPDP
|
Instrument |
Key requirements |
|
CERT-In Directions (2022) and audit guidelines (2025) |
Six-hour incident reporting; 180-day ICT logs; risk-based independent audits covering IT and OT/ICS |
|
IMO MSC.428(98) and MSC-FAL.1/Circ.3; DG Shipping circular |
Cyber risk in ship safety management systems from the first DOC verification after 1 January 2021 |
|
IACS UR E26/E27 |
Cyber resilience requirements for new ships contracted from 1 July 2024, verified by class |
|
ISPS Code; MS (Ships and Port Facility Security) Rules 2024 |
Port facility security assessments and plans with DG Shipping as designated authority |
|
Indian Ports Act 2025; Merchant Shipping Act 2025 |
New governing statutes for ports and shipping with rules being notified in phases |
|
NCIIPC; SEBI LODR; DPDP Act 2023 and Rules 2025 |
Critical-sector duties for notified systems; quarterly disclosure for listed operators; customer and crew data safeguards from May 2027 |
|
Confirm applicability Obligations depend on flag, class, vessel type, port category, concession terms, listing status and any NCIIPC notifications. Confirm against the official instruments and your contracts. |
Figure 4: Regulatory and standards timeline shaping maritime and port cybersecurity, as of October 2026.
5. Legal and statutory drivers
|
Law or obligation |
Relevance |
Demand created |
|
IT Act, 2000 and CERT-In Directions |
Incident reporting, logging and protected systems |
SOC, logging, audits and incident response |
|
Indian Ports Act, 2025 and Major Port Authorities Act, 2021 |
Port governance, safety and concessions |
Port-wide security governance, concession compliance |
|
Merchant Shipping Act, 2025 and ISM/ISPS instruments |
Ship safety management and port facility security |
Ship cyber risk, cyber in PFSA/PFSP |
|
Customs Act, 1962 and trade documentation rules |
Manifest, filing and release integrity |
Platform integrity and fraud controls |
|
Inland Vessels Act, 2021 |
Inland vessel safety and registration |
Vessel and terminal system security |
|
Companies Act, 2013 and SEBI LODR |
Board risk responsibility; disclosure for listed entities |
Board reporting, incident records |
|
DPDP Act, 2023 and Rules, 2025; contracts |
Customer, crew and driver data; charter and concession clauses |
Privacy programmes; independent testing and evidence |
6. How the drivers differ by organisation type
|
Organisation type |
Dominant business drivers |
Dominant technology drivers |
Principal regulatory drivers |
|
Major ports |
Trade continuity, national interest |
Shared systems, VTS, PCS 1x |
NCIIPC, CERT-In, ISPS, 2025 Acts |
|
Private and listed ports |
Growth, customers, disclosure |
Group TOS and OT estates |
SEBI LODR, CERT-In, ISPS |
|
Terminal operators |
Productivity, concession terms |
Cranes, gates, TOS, OEM access |
Concessions, ISPS, CERT-In |
|
Shipping companies |
Safety, charterers, class |
Ship OT, satcom, fleet IT |
MSC.428(98), UR E26/E27, DGS, CERT-In |
|
Shipyards and services |
Customer trust, IP, port contracts |
PLM, yard OT, dispatch systems |
Contracts, export controls, CERT-In |
7. What this means for buyers and for Codec Networks
|
Customer buying need |
Recommended offering |
Natural recurring engagement |
|
“If the TOS went dark, could we run the yard?” |
TOS resilience review and continuity playbooks |
Annual restore testing and drills |
|
“Who can reach our cranes and PLCs?” |
Terminal OT assessment and OEM access review |
Annual OT reviews and access recertification |
|
“Could a stolen login release our cargo?” |
Portal and API testing with fraud-resistance review |
Quarterly testing and monitoring |
|
“Are our ships ready for class and flag cyber audits?” |
MSC.428(98) assessment and UR E26/E27 readiness |
Annual fleet reviews |
|
“Our customer or lender is auditing our security.” |
ISO 27001 and IEC 62443 gap assessment, evidence pack |
Annual recertification support |
|
“We need 24x7 monitoring that includes the terminal.” |
IT/OT SOC |
Continuous monitoring |
|
“We need an independent cyber audit.” |
CERT-In-aligned IT/OT audit |
Annual audits |
Talk to Codec Networks
|
Contact Codec Networks Pvt. Ltd. New Delhi: 507, 5th Floor, New Delhi House, Barakhamba Road, Connaught Place, New Delhi – 110001 Gurugram: 707, 7th Floor, Silverton Tower, Golf Course Extension Road, Sector 50, Gurugram – 122018, Haryana Landline: 011 430 496 96 | 011 437 522 99 Mobile: +91 99716 76124 | +91 88007 88220 | +91 88003 31124 Email: mktg@codecnetworks.com Web: www.codecnetworks.com |
Note: This document is general industry guidance based on public information available as of October 2026. It is not legal, safety or regulatory advice. Obligations differ by port category, ownership, flag, vessel type, listing status, systems notified as critical information infrastructure and contracts; confirm them against the official CERT-In, MeitY, NCIIPC, MoPSW, DG Shipping, IMO, IACS and SEBI instruments and your contracts.