INDUSTRY FACT FILE · TEXTILES, APPAREL & CONSUMER MANUFACTURING

Cybersecurity FAQs for Textiles, Apparel and Consumer Manufacturing

Forty frequently asked questions and answers in five categories, written for Boards, CISOs, merchandising and export heads, design, finance, e-commerce, sourcing and plant teams.

In this document 1.  Category 1: Cyber risk, governance and strategy 2.  Category 2: Regulation, standards and buyer requirements 3.  Category 3: Shipments, payments, designs and buyers 4.  Category 4: D2C, e-commerce and consumer data 5.  Category 5: SOC, incidents and resilience

Audience: Boards, MDs, CFOs and CISOs

Q1. Why are textile, apparel and consumer manufacturers targeted?

Because a stopped shipment in season is expensive and visible, which makes ransomware pay; because export payments move by email across time zones; because designs are easy to copy; and because brands and D2C arms hold consumer accounts, loyalty value and card data that fraudsters monetise quickly.

Q2. What are the biggest risks for an Indian exporter or brand?

Ransomware that stops ERP and export documents in peak season; business email compromise diverting export proceeds; theft of designs and costings through contractors and shared folders; credential stuffing and skimming on D2C sites; job-worker outages; and slow detection that misses CERT-In's six-hour window.

Q3. Which incidents should the Board know about?

VF Corporation (December 2023) saw order fulfilment disrupted and data on about 35.5 million consumers exposed; Hanesbrands (2022) lost about US$100 million in quarterly sales to ransomware; Levi Strauss (June 2024) notified 72,231 customers after credential stuffing; Adidas (May 2025) reported a breach at a third-party customer service provider.

Q4. Is this an IT problem or a business problem?

A business problem. Most losses come from stopped shipments, diverted payments, copied designs and consumer fraud rather than from technology itself. Merchandising, finance, design, e-commerce and sourcing must own their controls, with IT enabling them and the Board accountable.

Q5. What should the Board review each quarter?

Shipment dependencies on IT and backup test results, BEC attempts and payment control exceptions, design access reviews, D2C fraud and account takeover trends, supplier assessments, incidents and near misses, audit findings, SOC coverage and buyer questionnaire status.

Q6. Who should own cybersecurity in a mid-sized exporter?

A named executive—usually the CFO or COO where there is no CISO—with IT, merchandising, finance and plant heads accountable for their controls, supported by a managed SOC and an independent assessor.

Q7. How should we prioritise investment?

Enforce MFA and payment verification, make ERP and documents recoverable, classify and control design data, test and protect D2C channels, assess critical suppliers and build monitoring across units and cloud—in that order.

Q8. How can Codec Networks help?

Codec Networks provides ERP, PLM and e-commerce security testing, IP protection programmes, BEC controls, 24x7 SOC, DPDP programmes, supplier assurance and buyer questionnaire and ISO 27001 readiness, planned around your season.

Audience: Compliance, company secretarial, export and CISO offices

Q9. Do CERT-In Directions apply to textile and apparel companies?

Yes. They apply to bodies corporate generally. Cyber incidents must be reported within six hours of noticing them and ICT logs retained for 180 days in India.

Q10. What do CERT-In's 2025 audit guidelines expect?

Risk-based, independent cyber audits covering IT, OT, cloud and applications, with closure of findings—so ERP, plant systems and e-commerce platforms belong in the audit scope.

Q11. What must listed groups disclose?

Under SEBI's LODR Regulations, listed entities disclose cyber security incidents, breaches and loss of data in the quarterly corporate governance report, and material events as required.

Q12. Does DPDP apply to a factory or an exporter?

Yes. Employee, contract worker, dealer and consumer personal data are in scope, and brands and D2C arms hold large consumer datasets. Most obligations under the DPDP Rules take effect in May 2027.

Q13. Are brand social and environmental audits cyber audits?

No. Schemes used by brands for labour, safety and environmental compliance do not assess cybersecurity. Brands increasingly send separate security questionnaires and may ask for independent assessment reports or ISO 27001 certification.

Q14. How do GST e-invoicing and customs filings affect security?

Businesses above ₹5 crore turnover must generate e-invoices through the Invoice Registration Portal, and exports depend on electronic customs filings. These flows must be available and correct, so they belong in recovery plans and integrity controls.

Q15. Does PCI DSS apply to our D2C site?

If you accept card payments, yes—PCI DSS v4.0.1 applies to the systems and scripts in the cardholder data environment, even when a payment gateway is used. Scope depends on how checkout is built.

Q16. Can Codec Networks audit us?

Yes. Codec Networks is CERT-In empanelled and performs IT and plant audits, ISO 27001 and PCI DSS gap assessments and buyer audit support.

Audience: Merchandising, export, finance, design and sourcing teams

Q17. How do we make sure ransomware does not stop a shipment?

Map which packing, invoicing, e-invoicing and customs processes depend on ERP, keep immutable backups with tested restores, segment plant and document systems from office IT, and rehearse manual shipping with merchandising and logistics.

Q18. How do we stop export proceeds being diverted?

Enforce MFA and conditional access on mailboxes, agree with every buyer and supplier that bank-detail changes are verified by an independent channel, monitor look-alike domains and mailbox rules, and run BEC simulations with finance and merchandising.

Q19. How should designs and tech packs be protected?

Classify design data, restrict PLM and shared-folder access to need, remove contractor and leaver access on the last day, block uncontrolled downloads and personal cloud uploads, monitor bulk activity and keep evidence for disputes.

Q20. Our buyer sent a 150-question security questionnaire—what now?

Treat it as an audit: map questions to ISO 27001 controls, close the gaps, build an evidence pack you can reuse for every buyer and consider an independent assessment report or certification.

Q21. How do we manage job-worker and supplier cyber risk?

Identify suppliers whose outage would stop deliveries, assess their security proportionately, add security and incident-notification clauses, hold buffer stock or alternate capacity and run joint exercises with the most critical ones.

Q22. What about buyer portals and EDI?

Treat them as production systems: named accounts with MFA, access reviews, monitoring of downloads and uploads, and testing of any integration you build.

Q23. How should plant machines and OEM access be handled?

Segment production machines from office IT, broker OEM remote access with MFA and session recording, control vendor laptops and media, and apply compensating controls to machines that cannot be patched.

Q24. Should we insure against cyber incidents?

Cyber insurance helps with response costs but insurers require evidence of MFA, backups and controls, and payment diversion is often excluded or limited. Controls come first; insurance complements them.

Audience: E-commerce, marketing, product and privacy teams

Q25. What is credential stuffing and why does it hit brands?

Attackers replay username and password pairs leaked from other sites against your login. Brands with loyalty value, saved addresses and stored payment methods are attractive; Levi's 72,231 affected accounts in 2024 show the scale.

Q26. How do we stop account takeover?

Bot management and rate limiting on login, MFA or step-up verification for sensitive changes, alerts on unusual login and redemption patterns, and no checkout with stored payment methods without a second factor.

Q27. What is web skimming and how do we prevent it?

Malicious scripts injected into checkout through plug-ins, tag managers or compromised vendors steal card data. Control third-party scripts, monitor script integrity, keep checkout PCI DSS-aligned and test before every release.

Q28. How should we prepare a D2C platform for a sale event?

Test the site, APIs and app beforehand, scale bot controls, freeze risky changes, brief the SOC on expected patterns, verify payment and loyalty controls and rehearse fraud and outage responses.

Q29. What consumer data falls under DPDP?

Names, contact details, addresses, order histories, loyalty records, device identifiers and marketing preferences. DPDP requires notices, consent where applicable, safeguards, retention limits and breach intimation—most obligations from May 2027.

Q30. Are marketplaces and service providers our problem?

Yes for the data you share with them. Assess customer service, marketing, logistics and analytics providers, minimise the data they hold, add contract clauses and plan for their incidents—Adidas' 2025 breach came through a provider.

Q31. How do we handle counterfeits and fake stores online?

Monitor domains, marketplaces and social platforms for impersonation, use takedown procedures, educate consumers on official channels and feed intelligence to the SOC and legal teams.

Q32. How can we start with Codec Networks?

Begin with a scoping call on your units, systems, buyers, suppliers and channels; Codec Networks will propose a season-aware assessment and assurance plan.

Audience: SOC, IT infrastructure, incident response and plant teams

Q33. Do manufacturers and brands need a 24x7 SOC?

Yes, if shipments, payments or consumer channels matter to revenue. A managed SOC monitors units, cloud, email and e-commerce around the clock and supports six-hour reporting without a large internal team.

Q34. What should the SOC monitor in this sector?

Endpoints and email for ransomware and BEC, identity and mailbox rules, ERP and PLM access and downloads, D2C login and checkout patterns, look-alike domains, plant network anomalies and OEM remote sessions.

Q35. What should an incident playbook include?

Containment that protects shipments and consumers, manual shipping decisions, CERT-In reporting within six hours, buyer and payment partner notification, SEBI disclosure if listed, DPDP breach workflow and communication.

Q36. How should backups be designed?

Immutable or offline backups of ERP, PLM, documents, e-commerce configurations, machine programs and file shares, with regular restore tests and documented restart sequences.

Q37. Should we run exercises?

Yes—annual tabletop exercises with leadership, merchandising and finance using ransomware, BEC and D2C breach scenarios, plus technical restore drills and joint drills with key suppliers.

Q38. How quickly can an exporter recover from ransomware?

With segmented networks, tested backups and manual shipping playbooks, days; without them, weeks—as Hanesbrands' three-week fulfilment disruption shows.

Q39. When should forensics be engaged?

As soon as compromise or fraud is suspected, to preserve evidence, establish root cause, support CERT-In reporting, buyer notification, insurance claims and any recovery of diverted funds.

Q40. How do we report an incident to buyers without losing the programme?

Prepare in advance: know each buyer's notification clause, have an independent assessor ready to validate containment and remediation, and communicate facts, actions and timelines promptly.

Contact Codec Networks Pvt. Ltd. New Delhi: 507, 5th Floor, New Delhi House, Barakhamba Road, Connaught Place, New Delhi – 110001 Gurugram: 707, 7th Floor, Silverton Tower, Golf Course Extension Road, Sector 50, Gurugram – 122018, Haryana Landline: 011 430 496 96 | 011 437 522 99   Mobile: +91 99716 76124 | +91 88007 88220 | +91 88003 31124 Email: mktg@codecnetworks.com   Web: www.codecnetworks.com

Note: These FAQs provide general guidance as of October 2026 and do not constitute legal, tax or regulatory advice. Confirm obligations against the official instruments and your buyer contracts.