Resources Categories
INDUSTRY FACT FILE · METALS, MINING & CEMENT
Industry Overview: Metals, Mining and Cement in India
Who mines India's coal, ore and minerals and makes its steel, aluminium and cement, the obligations that apply, who buys cybersecurity and why each type of producer needs a distinct approach.
|
In this document 1. Why metals, mining and cement cybersecurity matters now 2. The ecosystem at a glance 3. Categories of metals, mining and cement companies 4. The regulatory, standards and buyer framework at a glance 5. Government, public-sector and private participants 6. Who buys cybersecurity inside a metals, mining or cement company 7. Why each type of producer needs a different approach 8. How Codec Networks works with metals, mining and cement companies |
|
Sector scope Sector: mining groups (coal, iron ore, bauxite, minerals), steel and aluminium producers, smelters and foundries, cement manufacturers, and the captive power and logistics units within them. Primary service proposition: industrial security, remote operations protection, SOC, and ERP and supply chain assessment. Manufacturing, chemicals, power, oil and gas and logistics have separate fact files. |
1. Why metals, mining and cement cybersecurity matters now
India is the world's second-largest producer of crude steel, with 164.9 million tonnes in 2025 according to Ministry of Steel data, and the second-largest producer of cement, with installed capacity estimated at about 690 million tonnes a year in the Economic Survey 2025-26. It is also the second-largest producer of primary aluminium and the fourth-largest producer of iron ore, and in FY 2024-25 it mined a record 1,047.57 million tonnes of coal. Behind these numbers sit public-sector giants in coal, iron ore and steel, listed private steel, aluminium, zinc and cement groups, commercial and captive mine owners, mine developers and operators, hundreds of foundries and secondary metal producers, and the captive power plants, rail sidings and truck fleets that keep material moving.
|
2nd Largest producer of crude steel and cement in the world |
1.05 bn t Coal mined in India in FY 2024-25, a record |
₹34,300 cr National Critical Mineral Mission outlay over seven years |
6 hours To report cyber incidents to CERT-In |
Policy is pushing the sector to grow and modernise. The National Steel Policy 2017 targets 300 million tonnes of steelmaking capacity by 2030-31, a ₹6,322 crore production-linked incentive supports specialty steel, commercial coal mining auctions have offered mines to private operators since June 2020, and the National Critical Mineral Mission approved in January 2025 commits ₹34,300 crore over seven years, backed by amendments to the MMDR Act in 2023 and 2025. Growth is arriving with technology: distributed control systems run furnaces, potlines and kilns; fleet management and tele-remote systems run mines from remote operations centres; ERP, weighbridges and state e-permit portals control dispatch; and OEMs, mine developers and contractors connect in from outside. Each link is a path for an attacker.
The consequences are visible in public incidents. In March 2019, LockerGoga ransomware forced Norsk Hydro to run aluminium plants on manual procedures for weeks, at a cost the company estimated at NOK 550–650 million for the first half of that year. In May 2025, Nucor, the largest steelmaker in the United States, disclosed in a Form 8-K that it had temporarily halted certain production operations at various locations after unauthorised access to its IT systems. In August 2024, Australia's Evolution Mining disclosed a ransomware attack on its IT systems, and Northern Minerals saw stolen data published after refusing to pay. IBM X-Force has ranked manufacturing the most attacked industry for five consecutive years, and Dragos reports that manufacturers made up more than half of industrial ransomware victims in 2024. None of these companies lost output because a furnace or truck failed; they lost it because the systems around them were compromised.
In India the obligations are mostly cross-sector but real. CERT-In's Directions require cyber incidents to be reported within six hours and ICT logs to be retained for 180 days; CERT-In's July 2025 audit policy guidelines expect risk-based, independent cyber audits that cover OT and ICS; listed producers must disclose cyber incidents in the quarterly corporate governance report under SEBI's LODR Regulations; NCIIPC protects systems notified as protected systems, which can include strategic and public enterprises in coal, steel and minerals; and the DPDP Act and Rules will govern employee, contractor and dealer data, with most obligations from May 2027. Sector statutes add a second layer: the MMDR Act and its amendments, the OSH Code 2020 in force since 21 November 2025 (subsuming the Mines Act 1952) administered by DGMS, state mining departments' e-permit systems, and, for exporters, the EU Carbon Border Adjustment Mechanism, whose definitive period began in January 2026 and depends on verified emissions data from Indian steel, aluminium and cement producers.
|
Key takeaway In metals, mining and cement, cybersecurity is production continuity, worker safety, dispatch integrity and lender and buyer trust in one. The mine, the furnace, the kiln, the captive power plant, the ERP and dispatch systems that feed them and the contractors connected to them must be protected together. |
2. The ecosystem at a glance
Figure 1: India's metals, mining and cement ecosystem.
3. Categories of metals, mining and cement companies
|
Category |
Who they are |
Typical ownership |
Key regulatory basis |
|
Coal mining |
Coal India and its subsidiaries, captive mines of power and steel companies, commercial coal mine operators |
Central PSUs, state undertakings, listed and private operators |
MMDR Act and coal auction rules; OSH Code and DGMS; CERT-In; NCIIPC where notified |
|
Iron ore, bauxite and mineral mining |
Iron ore, bauxite, limestone, zinc, lead, copper and critical mineral mines; exploration companies |
PSUs, listed private groups, state corporations |
MMDR Act and amendments; IBM mining plans; state e-permits; CERT-In; DPDP |
|
Steel producers |
Integrated plants with blast furnaces and coke ovens, electric-arc and induction furnace mills, specialty steel makers |
Public-sector and listed private groups; private mini mills |
CERT-In; SEBI LODR (listed); NCIIPC where notified; CBAM for EU exports |
|
Aluminium and non-ferrous metals |
Alumina refineries, aluminium smelters with potlines, zinc, lead and copper smelters |
Public-sector and listed private groups |
CERT-In; SEBI LODR; NCIIPC where notified; CBAM for EU exports |
|
Foundries and secondary metals |
Castings, forgings, secondary aluminium and steel, scrap recyclers |
Mostly private MSMEs and mid-sized companies |
CERT-In; customer requirements; DPDP |
|
Cement manufacturers |
Integrated plants with kilns, grinding units, ready-mix concrete |
Listed private groups and regional producers |
CERT-In; SEBI LODR (listed); CPCB environmental reporting; CBAM for EU exports |
|
Captive power, logistics and services |
Captive power plants, rail sidings, ports and trucking, mine developers and operators |
Units within producer groups and their contractors |
CERT-In; electricity and safety rules; contract obligations |
4. The regulatory, standards and buyer framework at a glance
|
Instrument or expectation |
What it means for producers |
|
CERT-In Directions (28 April 2022) |
Cyber incidents reported within six hours of noticing them; ICT logs kept for a rolling 180 days in India; clock synchronisation; designated point of contact |
|
CERT-In audit policy guidelines (25 July 2025) |
Risk-based, independent cyber audits covering IT, OT/ICS, cloud and applications, with findings closure—plants, mines and captive power belong in scope |
|
NCIIPC (IT Act Section 70A) |
Protection of systems notified as protected systems; strategic and public enterprises, which include coal, steel and mineral PSUs, are a recognised critical sector—most private sites are not notified |
|
SEBI LODR Regulations (listed companies) |
Cyber security incidents, breaches and loss of data disclosed in the quarterly corporate governance report since July 2023; Board responsibility for risk management |
|
DPDP Act 2023 and DPDP Rules 2025 |
Safeguards, notices, consent and breach intimation for employee, contractor, dealer and visitor personal data; most obligations from May 2027 |
|
Mining and safety statutes |
MMDR Act 1957 with the 2023 and 2025 amendments on auctions and critical minerals; OSH Code 2020, in force from 21 November 2025, subsuming the Mines Act 1952 and administered by DGMS; IBM mining plans and state e-permit and e-transit systems |
|
Export and buyer requirements |
EU CBAM definitive period from 1 January 2026 for steel, aluminium and cement, requiring verified embedded-emissions data; lender and insurer control conditions; IEC 62443 and ISO/IEC 27001 as the common language |
|
How these apply Most Indian cyber obligations are cross-sector and depend on size, ownership, listing status and notifications; mining obligations depend on the lease, mineral and state; export rules depend on what you sell and to whom. Confirm against the official instruments and your contracts. |
5. Government, public-sector and private participants
- The Ministries of Mines, Coal and Steel set sector policy—auctions, the National Critical Mineral Mission, the National Steel Policy and PLI for specialty steel; MeitY and CERT-In set cyber obligations.
- DGMS administers mine safety under the OSH Code; the Indian Bureau of Mines approves mining plans and runs the Mining Tenement System; state mining departments issue leases and e-permits; NCIIPC protects notified systems; SEBI governs listed-company disclosure.
- Public-sector undertakings anchor coal, iron ore, steel, aluminium and minerals production.
- Listed private groups lead steel, aluminium, zinc and cement; commercial mine operators and mine developers and operators (MDOs) run a growing share of mining.
- Foundries, secondary producers and recyclers form a large MSME base supplying automotive, engineering and construction.
- Automation, fleet and plant OEMs, EPC contractors and system integrators build and maintain the DCS, PLCs, fleet systems and ERP that sites depend on.
6. Who buys cybersecurity inside a metals, mining or cement company
|
Stakeholder |
What they care about |
What they buy |
|
Board, MD and CFO |
Production continuity, safety, disclosure, lender and insurer conditions |
Board advisory, resilience programmes, crisis exercises |
|
CIO and CISO |
IT and OT security across many sites, audits, NCIIPC and SEBI expectations |
Audits, assessments, SOC, GRC programmes |
|
Plant, works and mine heads |
Furnace, kiln and fleet uptime, safe operation, vendor access |
OT assessments, segmentation, playbooks |
|
Instrumentation, automation and electrical |
DCS, PLCs, captive power, remote operations |
IEC 62443 assessments, remote access controls |
|
Safety and environment heads |
Safety systems, DGMS records, emissions monitoring |
Safety and compliance system integrity reviews |
|
Sales, dispatch and logistics |
Weighbridges, e-permits, rail and port systems, e-auctions |
Dispatch system testing, analytics, fraud controls |
|
Procurement and contracts |
MDO, EPC and contractor security, transporter integrations |
Supply chain cyber risk programmes |
7. Why each type of producer needs a different approach
|
Producer type |
Highest-consequence risk |
Starting point for assurance |
|
Coal and mineral mining groups |
Remote operations, fleet and dispatch compromise; e-permit and royalty data fraud |
Remote-ops and fleet assessment, dispatch integrity, contractor access |
|
Steel producers |
Ransomware across multi-plant ERP and dispatch; furnace automation reached through vendors |
Segmentation, backup testing, vendor access, OT monitoring |
|
Aluminium and non-ferrous smelters |
Captive power and potline control compromise |
Captive power segmentation, DCS assessment, exercises |
|
Foundries and secondary producers |
Ransomware and BEC with outsourced IT; being a weak supplier |
Baseline assessment, backups, payment controls |
|
Cement manufacturers |
ERP and dispatch outage across many plants and depots; kiln DCS exposure |
Dispatch dependency mapping, segmentation, SOC |
|
Captive power and logistics units |
Power trips and rail or port integration abuse |
Utility OT assessment, partner integration reviews |
|
PSUs and strategic producers |
Espionage and notified-system obligations |
CII-aligned assessments, threat hunting, audits |
8. How Codec Networks works with metals, mining and cement companies
Codec Networks is a CERT-In empanelled information security auditing organisation certified to ISO 9001:2015, ISO/IEC 27001:2022 and ISO/IEC 20000-1:2018. For metals, mining and cement companies we deliver IEC 62443-aligned industrial security assessments using production-aware methods, remote operations and fleet system protection, IT/OT segmentation and brokered vendor access, ERP, dispatch and weighbridge security testing, supply chain assessments of MDOs, contractors and transporters, 24x7 IT/OT SOC across plants and mines, and crisis exercises with plant and mine leadership—connected from finding to closure.
Talk to Codec Networks
|
Contact Codec Networks Pvt. Ltd. New Delhi: 507, 5th Floor, New Delhi House, Barakhamba Road, Connaught Place, New Delhi – 110001 Gurugram: 707, 7th Floor, Silverton Tower, Golf Course Extension Road, Sector 50, Gurugram – 122018, Haryana Landline: 011 430 496 96 | 011 437 522 99 Mobile: +91 99716 76124 | +91 88007 88220 | +91 88003 31124 Email: mktg@codecnetworks.com Web: www.codecnetworks.com |
Note: This document is general industry guidance based on public information available as of October 2026. It is not legal, safety or regulatory advice. Obligations differ by company size, ownership, listing status, leases, licences and export markets; confirm them against the official CERT-In, MeitY, SEBI, NCIIPC, Ministry of Mines, Ministry of Coal, DGMS and EU instruments and your contracts.