INDUSTRY FACT FILE · METALS, MINING & CEMENT

Cybersecurity FAQs for Metals, Mining and Cement

Forty frequently asked questions and answers in five categories, written for Boards, CISOs, plant and mine heads, instrumentation and automation engineers, safety, dispatch, procurement and finance teams.

In this document 1.  Category 1: Cyber risk, governance and strategy 2.  Category 2: Regulation, standards and buyer requirements 3.  Category 3: Plants, mines, remote operations and captive power 4.  Category 4: SOC, incidents and ransomware resilience 5.  Category 5: Dispatch, contractors, ERP and data

Audience: Boards, MDs, CFOs and CISOs

Q1. Why are metals, mining and cement companies attractive targets?

Because stopped dispatch and production are measured in lost tonnes and penalties, which makes ransomware pay; because dispatch, royalty and procurement flows move large sums; and because coal, steel and critical minerals are strategic. Sites also run on legacy, connected control systems that are hard to patch.

Q2. What are the biggest risks for an Indian producer?

Ransomware that stops ERP and dispatch while kilns and furnaces keep running; remote operations and fleet systems reached through contractors; OEM access nobody controls; manipulated weights, permits or emissions data; captive power on flat networks; and slow detection at remote sites that misses CERT-In's six-hour window.

Q3. Which incidents should the Board know about?

Norsk Hydro (2019) ran aluminium plants manually for weeks after ransomware, estimating a first-half cost of NOK 550–650 million; Nucor (May 2025) halted certain production operations after unauthorised access to its IT systems; Evolution Mining (2024) disclosed ransomware; Northern Minerals (2024) saw stolen data published after refusing to pay.

Q4. Is this an IT problem or an operations problem?

Both. Most stoppages begin in IT—ERP, email, dispatch servers—and reach operations through flat networks and dependencies, while vendor laptops and contractor accounts enter directly at the plant or mine. Cybersecurity must be owned jointly by IT, operations, instrumentation and safety, with the Board accountable.

Q5. What should the Board review each quarter?

Dispatch and plant dependencies on IT, backup and recovery test results, OEM, MDO and contractor access, dispatch and compliance data integrity checks, incidents and near misses, audit findings, SOC coverage by site and exercise outcomes.

Q6. Who should own OT security across many sites?

The CISO or CIO jointly with plant, mine and instrumentation leadership, with a named owner at each site, a single inventory of control and fleet assets and a group standard based on IEC 62443.

Q7. How should we prioritise investment?

Map what dispatch and production depend on, segment IT from plant, mine and captive power, make ERP, dispatch and control configurations recoverable, broker vendor and contractor access, make statutory data tamper-evident and build monitoring that reaches every site—in that order.

Q8. How can Codec Networks help?

Codec Networks provides IEC 62443-aligned industrial security assessments, remote operations and fleet protection, segmentation and vendor access design, ERP and dispatch testing, supply chain assessments, 24x7 IT/OT SOC and crisis exercises with plant and mine leadership.

Audience: Compliance, company secretarial, sales and CISO offices

Q9. Do CERT-In Directions apply to mining and metal companies?

Yes. They apply to bodies corporate generally. Cyber incidents must be reported within six hours of noticing them and ICT logs retained for 180 days in India, which includes logs from plant and mine networks where they exist.

Q10. What do CERT-In's 2025 audit guidelines expect?

Risk-based, independent cyber audits covering IT, OT/ICS, cloud and applications, with closure of findings—so DCS, fleet systems, captive power and dispatch belong in the audit scope.

Q11. Does NCIIPC apply to our sites?

Only if systems are notified as protected systems. Strategic and public enterprises are a recognised critical sector, so coal, steel and mineral PSUs are more likely to be notified than private producers. Good practice aligns with NCIIPC guidance either way; confirm against any notification.

Q12. What must listed producers disclose?

Under SEBI's LODR Regulations, listed entities disclose cyber security incidents, breaches and loss of data in the quarterly corporate governance report, and material events as required, which makes incident records and classification essential.

Q13. How do mining statutes interact with cybersecurity?

The MMDR Act, state rules and the OSH Code administered by DGMS do not prescribe cyber controls, but they rely on accurate dispatch, royalty, safety and mining-plan records—so the integrity and availability of the systems holding that data become statutory matters.

Q14. What is CBAM and why does it matter to security?

The EU Carbon Border Adjustment Mechanism's definitive period began on 1 January 2026 for steel, aluminium and cement. EU importers rely on verified embedded-emissions data from producers, so emissions monitoring and reporting systems need integrity and availability controls.

Q15. Which standards should we align to?

IEC 62443 for industrial automation and ISO/IEC 27001 for the management system. Together they answer most lender, insurer and buyer questionnaires and map cleanly to CERT-In and NCIIPC expectations.

Q16. Can Codec Networks audit us?

Yes. Codec Networks is CERT-In empanelled and performs IT/OT audits, NCIIPC-aligned reviews, IEC 62443 and ISO 27001 gap assessments and lender and buyer evidence support.

Audience: Plant, mine, instrumentation, automation and safety teams

Q17. How should IT, plant and mine networks be separated?

Use a zone-and-conduit model from IEC 62443: plant and site DMZs, no dual-homed systems, controlled data flows to ERP and historians, segmented site links to remote operations centres and the ability to run each site if IT or the group link is down.

Q18. How do we assess DCS and PLCs without disrupting production?

Passive asset discovery, configuration and architecture reviews, and any active testing planned in shutdowns or maintenance windows with operations—never unplanned scanning of controllers running a furnace, potline or kiln.

Q19. What about controllers and HMIs that cannot be patched?

Segment them, restrict access, remove internet paths, monitor traffic and plan upgrades with the OEM; compensating controls are expected where patching is impossible on long-life assets.

Q20. How should OEM, MDO and contractor remote access work?

Through a brokered gateway with MFA, named accounts, approval per session, time limits and recording—never standing VPNs or shared passwords, and never direct connections to Level 2 or fleet networks.

Q21. How do we secure a remote operations centre?

Treat it as a critical zone: segmented site links, hardened fleet and dispatch servers, named and MFA-protected operator and contractor accounts, integrity monitoring on fleet data and a tested fallback to local control at each site.

Q22. Should captive power plants be in scope?

Yes. A captive power plant trip can damage potlines and kilns and stop the site. Its DCS and substations need the same segmentation from corporate IT, access control and monitoring as the main process.

Q23. How should vendor laptops and media be handled during shutdowns?

Check and register devices at the gate, use clean engineering laptops owned by the site, scan media at kiosks, allow connections only through approved points and supervise and log vendor sessions.

Q24. How do we protect safety and emissions systems?

Isolate safety PLCs, gas monitoring and interlocks, control program mode physically, monitor engineering changes, protect continuous emissions monitoring from tampering and include cyber risk in safety and environmental reviews.

Audience: SOC, IT infrastructure, incident response and site teams

Q25. Do producers need an OT SOC across sites?

Yes, if plants and mines matter to revenue. Monitoring IT alone misses the site; an IT/OT SOC sees remote sessions, engineering activity, industrial protocols and dispatch anomalies as well as endpoints and email, across every location.

Q26. What should the SOC monitor at a plant or mine?

Control network traffic and industrial protocols, engineering workstations, remote-access and contractor sessions, fleet and dispatch servers, historians, IIoT gateways, captive power systems and the IT systems the site depends on.

Q27. Why map dispatch and plant dependencies on IT?

To know in advance which processes stop when ERP, weighbridge software, e-permit portals, licensing servers or Active Directory are unavailable—and to design lawful manual workarounds before an incident.

Q28. What should an incident playbook include?

Containment that keeps sites safe, decisions on manual dispatch and operation, CERT-In reporting within six hours, DGMS and state department communication where safety or statutory records are affected, SEBI disclosure if listed, and buyer and insurer notification.

Q29. How should backups be designed?

Immutable or offline backups of ERP, dispatch and weighbridge systems, DCS and PLC configurations, fleet and remote-ops servers, historians and engineering projects, with regular restore tests and documented restart sequences per site.

Q30. Should we run exercises?

Yes—annual tabletop exercises with leadership, plant and mine teams using ransomware, dispatch outage and captive power scenarios, plus technical restore drills and joint drills with key contractors.

Q31. How quickly can a site recover from ransomware?

With segmented networks, tested backups and manual-operation playbooks, days; without them, weeks—as Norsk Hydro's experience shows.

Q32. When should forensics be engaged?

As soon as compromise or fraud is suspected, with investigators who understand control systems and dispatch data, to preserve evidence, establish root cause and support reporting, royalty disputes and insurance claims.

Audience: Sales, dispatch, procurement, finance, IT and privacy teams

Q33. How do we stop weighbridge and permit manipulation?

Enforce least privilege and segregation of duties, make logs tamper-evident, reconcile weights against permits, royalties and rail or port records, run analytics for anomalies and review edits after dispatch.

Q34. How do we manage contractor and MDO cyber risk?

Tier contractors by access and criticality, assess their security, add security and incident-notification clauses, give them named and MFA-protected accounts, recertify access and run joint exercises with those who run your operations.

Q35. How should ERP and dispatch systems be secured?

Harden configuration and roles, enforce MFA, control master-data, pricing and dispatch changes, segment from control networks, back up immutably, test integrations with railways, ports and e-permit portals and monitor for anomalies.

Q36. How do we stop payment diversion fraud?

Verify transporter, scrap vendor and supplier bank-account changes by call-back, require dual approval, monitor for look-alike domains and train finance and procurement teams with BEC simulations.

Q37. How do we protect geological, bid and process data?

Classify it, restrict access to need, block personal cloud uploads, monitor downloads and portal activity, protect auction and bid workflows and enforce leaver procedures on the last working day.

Q38. How should e-auction, trading and dealer portals be secured?

Test them as internet-facing applications and APIs, enforce strong identity for buyers and dealers, protect pricing and scheme logic, monitor for account takeover and include them in the SOC's scope.

Q39. How does DPDP affect a producer?

You hold personal data of employees, large contract workforces, dealers, transporters and visitors; DPDP requires notices, safeguards, retention limits and breach intimation—build the programme before May 2027.

Q40. How can we start with Codec Networks?

Begin with a scoping call on your plants, mines, control systems, ERP and dispatch, contractors and buyers; Codec Networks will propose a production-aware assessment and assurance plan.

Contact Codec Networks Pvt. Ltd. New Delhi: 507, 5th Floor, New Delhi House, Barakhamba Road, Connaught Place, New Delhi – 110001 Gurugram: 707, 7th Floor, Silverton Tower, Golf Course Extension Road, Sector 50, Gurugram – 122018, Haryana Landline: 011 430 496 96 | 011 437 522 99   Mobile: +91 99716 76124 | +91 88007 88220 | +91 88003 31124 Email: mktg@codecnetworks.com   Web: www.codecnetworks.com

Note: These FAQs provide general guidance as of October 2026 and do not constitute legal, safety or regulatory advice. Confirm obligations against the official instruments and your contracts.