Resources Categories
INDUSTRY FACT FILE · OIL, GAS & PETROCHEMICALS
Industry Overview: Oil, Gas and Petrochemicals in India
Who explores, transports, refines and distributes oil and gas, the obligations that apply, who buys cybersecurity and why each needs a distinct approach.
|
In this document 1. Why oil and gas cybersecurity matters now 2. The ecosystem at a glance 3. Categories of oil, gas and petrochemical organisations 4. The regulatory and standards framework at a glance 5. Government, public-sector and private participants 6. Who buys cybersecurity inside an oil and gas company 7. Why each organisation type needs a different approach 8. How Codec Networks works with oil and gas companies |
|
Sector scope Sector: oil, gas and petrochemicals — refineries, exploration companies, pipelines, LNG terminals and fuel distributors. Primary service proposition: industrial security, SCADA assessment, SOC, third-party access reviews and incident exercises. Power generation and renewable energy are covered in separate fact files. |
1. Why oil and gas cybersecurity matters now
India is one of the world's largest consumers and refiners of oil, with major public-sector and private refiners, upstream producers, a growing pipeline and city gas network, LNG terminals and tens of thousands of fuel retail outlets. These operations run hazardous processes through DCS, SCADA and safety instrumented systems, often across remote and offshore sites.
|
May 2021 Ransomware led to a precautionary US pipeline shutdown |
2017 Malware targeted a petrochemical plant's safety system |
Apr 2022 An Indian oil company reported a ransomware attack |
6 hours To report cyber incidents to CERT-In |
The sector has seen some of the most consequential cyber incidents anywhere. The 2012 Shamoon malware wiped around 30,000 workstations at a major Gulf oil company; in 2017, TRITON malware targeted a petrochemical plant's safety instrumented system; in May 2021, ransomware on IT systems led to a precautionary shutdown of a major US fuel pipeline; and in April 2022, an Indian oil company reported a ransomware attack on its systems in Assam.
In India, CERT-In's Directions require six-hour incident reporting, NCIIPC protects systems notified as critical information infrastructure, and PNGRB and OISD set technical, integrity and safety standards for pipelines and installations that cyber incidents can affect.
|
Key takeaway In oil and gas, cybersecurity and process safety are inseparable. Protecting control and safety systems—and the IT they depend on—keeps people safe and supply flowing. |
2. The ecosystem at a glance
Figure 1: India's oil, gas and petrochemicals ecosystem.
3. Categories of oil, gas and petrochemical organisations
|
Category |
Who they are |
Typical ownership |
Key regulatory basis |
|
Exploration and production companies |
Onshore and offshore exploration, drilling and production |
Public-sector majors, private and international operators |
Petroleum and natural gas rules (DGH); CERT-In; NCIIPC where notified |
|
Pipeline operators |
Crude, product and natural gas pipelines |
Public-sector and private operators |
PNGRB Act 2006 and regulations; CERT-In; NCIIPC |
|
Refineries and petrochemical complexes |
Refining, cracking and petrochemical production |
Public-sector and private refiners |
OISD standards; PESO; CERT-In; NCIIPC |
|
LNG and storage terminals |
Regasification, tank farms and strategic reserves |
Terminal operators and PSUs |
PNGRB; OISD; PESO; CERT-In |
|
Fuel retail and LPG distributors |
Retail outlets, LPG bottling and distribution |
Oil marketing companies and dealers |
MoPNG rules; DPDP for consumer data; PCI DSS for card payments |
|
City gas distribution |
Piped natural gas and CNG networks |
Authorised CGD entities |
PNGRB authorisation and standards; CERT-In |
|
EPC, OEM and service contractors |
Projects, turnarounds and control-system support |
Indian and global firms |
Client contracts; site safety rules |
4. The regulatory and standards framework at a glance
|
Instrument |
What it means for oil and gas companies |
|
CERT-In Directions (28 April 2022) |
Cyber incidents reported within six hours of noticing them; ICT logs kept for a rolling 180 days in India |
|
CERT-In audit policy guidelines (25 July 2025) |
Risk-based, independent cyber audits covering IT, OT/ICS, cloud and applications |
|
NCIIPC (IT Act Section 70A) |
Protection of systems notified as critical information infrastructure or protected systems in the energy sector |
|
PNGRB Act 2006 and regulations |
Technical, safety and integrity standards for pipelines and city gas networks |
|
OISD standards |
Safety standards for oil and gas installations under MoPNG, which cyber incidents affecting control and safety systems can undermine |
|
DPDP Act 2023 and international standards |
Consumer data safeguards for retail, LPG and city gas (most obligations from May 2027); IEC 62443 and API 1164 good practice |
|
How these apply Applicability depends on your assets, notifications and licences. Confirm against the official instruments and any NCIIPC notifications. |
5. Government, public-sector and private participants
- The Ministry of Petroleum and Natural Gas (MoPNG) sets policy; DGH oversees upstream activity.
- PNGRB regulates pipelines and city gas distribution; OISD sets safety standards; PESO regulates explosives and petroleum storage safety.
- CERT-In and NCIIPC handle incident response and critical infrastructure protection.
- Public-sector majors dominate refining, pipelines and marketing, alongside large private refiners and international operators.
- EPC firms, OEMs and contractors build and maintain plants and control systems.
6. Who buys cybersecurity inside an oil and gas company
|
Stakeholder |
What they care about |
What they buy |
|
Board and CMD |
Safety, supply continuity, reputation |
Board advisory, crisis exercises |
|
CISO |
IT and OT security, compliance |
Audits, SOC, OT programmes |
|
Director (Refineries / Pipelines) |
Operational continuity and safety |
OT and SCADA assessments |
|
Process safety and HSE |
Safety system integrity |
SIS security reviews |
|
Instrumentation and control heads |
DCS, SCADA and SIS |
Segmentation and engineering workstation controls |
|
Marketing and retail heads |
Retail automation and payments |
Retail and payment security |
|
Contracts and procurement |
Contractor and vendor risk |
Third-party access programmes |
7. Why each organisation type needs a different approach
|
Organisation type |
Highest-consequence risk |
Starting point for assurance |
|
E&P company |
Destructive malware and remote/offshore access |
PAM, offline backups, remote access review |
|
Pipeline operator |
SCADA compromise and IT-dependent shutdowns |
SCADA assessment, dependency mapping, segmentation |
|
Refinery or petrochemical complex |
Safety system tampering and contractor access |
SIS security, contractor controls, OT SOC |
|
LNG or storage terminal |
Tank gauging and loading automation |
Terminal automation assessment |
|
Fuel retail and LPG |
Retail automation and payment fraud |
Retail system and payment testing |
|
City gas distribution |
SCADA and metering exposure |
SCADA and remote access reviews |
8. How Codec Networks works with oil and gas companies
Codec Networks is a CERT-In empanelled information security auditing organisation certified to ISO 9001:2015, ISO/IEC 27001:2022 and ISO/IEC 20000-1:2018. For oil and gas companies we deliver industrial security and SCADA assessments using safety-aware methods, safety system security reviews, third-party access programmes, 24x7 IT/OT SOC and incident exercises with operations and safety teams.
Talk to Codec Networks
|
Contact Codec Networks Pvt. Ltd. New Delhi: 507, 5th Floor, New Delhi House, Barakhamba Road, Connaught Place, New Delhi – 110001 Gurugram: 707, 7th Floor, Silverton Tower, Golf Course Extension Road, Sector 50, Gurugram – 122018, Haryana Landline: 011 430 496 96 | 011 437 522 99 Mobile: +91 99716 76124 | +91 88007 88220 | +91 88003 31124 Email: mktg@codecnetworks.com Web: www.codecnetworks.com |
Note: This document is general industry guidance based on public information available as of October 2026. It is not legal or safety advice. Confirm obligations against the official CERT-In, NCIIPC, PNGRB, OISD and MoPNG instruments and any notifications applicable to your systems.