Securing India’s Manufacturing Floor: A Practical OT/ICS Cybersecurity Guide

• 22 September, 2026
• No Comments

India’s manufacturing sector—buoyed by the Production Linked Incentive (PLI) scheme and Make in India—is racing to digitise shop floors, connect legacy PLCs to ERP systems, and deploy Industrial IoT sensors at scale. The efficiency gains are real. So is the expanded attack surface.

Operational Technology (OT) and Industrial Control System (ICS) networks were once isolated by design—air-gapped, proprietary protocols, physical access controls. That era is over. Today, the same network that carries SCADA traffic to a DCS controller may also route engineer laptops to cloud maintenance portals. The results of that convergence, when it goes wrong, are front-page news: production stoppages, safety incidents, extortionate ransomware demands from groups that specifically target industrial targets.

This guide is for IT and OT leaders at Indian manufacturing, pharma, logistics, and energy firms who need a practical framework—not vendor brochures—to harden their industrial environments against modern cyber threats.

Why OT/ICS Networks Are Attractive Targets

Attackers choose industrial targets for a simple reason: pressure works faster than in IT. A factory floor that cannot run costs lakhs per hour. A chemical plant that cannot confirm sensor integrity must halt production on safety grounds. Hospitals running SCADA-controlled HVAC or medical gas systems face patient risk. The economics of extortion are brutally efficient.

Several threat patterns are rising in India:

• Ransomware with OT pivot: Initial access via spear-phishing or VPN credential stuffing, lateral movement into the OT DMZ, deployment of ransomware families (LockBit, ALPHV/BlackCat) that specifically enumerate industrial file extensions and target historian servers.
• Supply chain implants: Compromised firmware updates from overseas OEM vendors, malicious engineering workstation software masquerading as legitimate PLC programming tools.
• Insider-facilitated access: Disgruntled contractors or employees with standing remote access credentials to SCADA systems.
• Nation-state reconnaissance: Persistent low-and-slow intrusions targeting critical infrastructure—power grids, water treatment, defence supply chains—for intelligence gathering or pre-positioning.

CERT-In’s 2024 sectoral advisories highlighted manufacturing and energy as high-priority targets receiving increased threat actor attention. The 6-hour incident reporting mandate (effective May 2022) applies unambiguously to OT incidents affecting critical infrastructure and means that organisations without automated detection cannot meet their legal obligations.

The Core Problem: IT and OT Were Designed for Different Worlds

Traditional IT security is built on the CIA triad—Confidentiality, Integrity, Availability—with confidentiality often treated as the primary concern. OT security inverts this: Availability and Integrity come first; a momentary availability interruption on a running blast furnace is a safety event, not just a service ticket.

This difference has practical consequences:

• Patching cycles that work in IT (weekly vulnerability scans, monthly patches) are unacceptable in OT, where a firmware update may require a scheduled maintenance window weeks away.
• Intrusive scanning tools that enumerate open ports can crash fragile PLCs or trip safety interlocks.
• OT protocols—Modbus, DNP3, IEC 61850, PROFINET—carry no native authentication. Any device on the segment can issue commands.
• OT asset lifespans stretch 15–20 years. Windows XP and Windows CE HMIs remain operational in Indian plants that were commissioned a decade ago.

Security controls must be designed around these realities, not imposed from an IT template.

A Layered Defence Architecture for Indian OT Environments

1. Network Segmentation and the Purdue Reference Model

The Purdue Enterprise Reference Architecture divides OT networks into zones: the Enterprise Zone (Level 4–5), Manufacturing Operations Zone (Level 3), Control Zone (Levels 0–2), and the critical OT DMZ that mediates between them. Proper segmentation means these zones communicate through enforced chokepoints, never through flat Layer 2 adjacency.

In practice, this means:

• FortiGate NGFW or industrial-grade firewalls at every zone boundary, with explicit permit rules—not “any/any” defaults.
• The OT DMZ hosting data diodes or unidirectional gateways for historian replication where strict unidirectionality is warranted.
• Remote access (vendor VPN, remote engineering) terminated in the DMZ, never directly into the control zone.
• Wi-Fi segmented onto dedicated SSIDs with VLAN isolation; no OT device on a guest or corporate SSID.

2. Asset Inventory and Vulnerability Visibility

You cannot defend what you cannot see. Most Indian industrial sites we engage have no accurate, current inventory of OT assets. PLCs, RTUs, HMIs, engineering workstations, and historian servers accumulate over years without consistent documentation.

Passive network traffic analysis tools—which listen without injecting packets—can build an asset inventory from protocol traffic without touching devices. FortiGate’s OT/ICS application signatures can identify industrial protocols (Modbus, EtherNet/IP, OPC-UA) traversing zone boundaries and flag anomalous commands.

3. Identity and Access Management for OT

Shared credentials (“the plc password”) and standing remote access are among the most common findings in OT security assessments. Remediation steps:

• Privileged Access Management (PAM) for all engineering workstation and SCADA HMI accounts.
• Just-in-time VPN access for third-party vendors: credentials issued per session, automatically revoked on session close.
• Multi-factor authentication on all remote access gateways, even if the underlying OT application does not support MFA natively—enforce it at the gateway layer.
• FortiGate’s SSL-VPN or IPsec-VPN with certificate-based authentication for engineer remote access.

4. Continuous Monitoring and Anomaly Detection

Industrial environments benefit from behavioural baselines. A PLC that has issued the same 12 Modbus function codes for three years should not suddenly issue function code 06 (Write Single Register) from an unexpected source IP. SIEM correlation rules tuned for OT protocols can flag these deviations in near-real-time.

Log sources that matter in OT environments:

• FortiGate firewall logs at zone boundaries (permitted and denied flows)
• SCADA historian change logs and alarm logs
• Engineering workstation process creation and USB events
• Active Directory / LDAP authentication events for domain-joined OT assets
• Vendor remote access session logs (timestamps, duration, commands)

5. Incident Response Tailored for OT

An IT incident response playbook is insufficient for OT. Isolating a compromised server is straightforward; isolating a compromised DCS controller mid-production batch may not be safe to do immediately. OT IR playbooks need explicit decision trees: “If anomalous traffic is detected on the control network, who has authority to isolate the affected segment? What is the safe-state procedure?”

Under CERT-In’s 6-hour reporting mandate, this decision tree must execute fast. Organisations without pre-defined playbooks and automated alerting routinely miss the reporting window—not because they chose to, but because they did not know they had an incident until it was too late.

FortiGate in the OT/ICS Security Architecture

Fortinet’s FortiGate NGFW is uniquely positioned for OT environments because it ships with industrial protocol application signatures and IPS signatures specifically developed for OT threats (available in Fortinet’s FortiGuard Industrial Security Service). This means a FortiGate placed at an OT DMZ boundary can:

• Inspect and restrict industrial protocol traffic (Modbus, DNP3, IEC 61850) at Layer 7, blocking function codes that should never cross zone boundaries.
• Detect exploit attempts against known OT CVEs—from vulnerable Schneider PLC firmware to unsecured Siemens S7 interfaces.
• Integrate with FortiAnalyzer or a third-party SIEM for centralized log analysis.
• Provide SSL/TLS deep inspection on north-south traffic without requiring OT devices to handle decryption—the FortiGate terminates and re-encrypts transparently.

PJ Networks deploys FortiGate across OT DMZ segments with custom OT security profiles, working with plant engineers to ensure that aggressive threat-prevention settings are calibrated to avoid false positives that could interrupt production.

PrahiX Ora: Unified SecOps Visibility Across IT and OT

One of the persistent challenges in industrial security is that IT and OT operations teams work from different tools, different data, and often different incident queues. An IT SOC analyst seeing anomalous lateral movement on an engineering workstation may not know that the workstation connects to a control zone PLC. Context is missing, and response is slow.

PrahiX Ora is a unified SecOps platform built by PrahiX Tech Pvt Ltd. PJ Networks is its primary field deployment and operations partner, and it is the platform we deploy and operate for clients who need to bring IT and OT visibility under a single operational view.

Four capability pillars make it relevant for OT-heavy organisations:

SIEM — Multi-Source Correlation with MITRE ATT&CK Mapping: Ora’s SIEM ingests logs from OT firewalls, SCADA historians, engineering workstations, and cloud connectors simultaneously. Correlation rules mapped to MITRE ATT&CK for ICS (a separate technique matrix for industrial threats) allow analysts to see attack storylines reconstructed as graphs—not raw log lines. CERT-In’s direction on 180-day in-country log retention is addressed through tiered hot/cold/archive storage, keeping forensic data available without ballooning storage costs.

NMS — Unified Network Observability Across Multi-Vendor OT Estates: Most Indian manufacturing sites run a mix of Cisco, Fortinet, Hirschmann, and vendor-specific switches in their OT networks. Ora’s NMS uses LLDP/CDP topology discovery and ML-based anomaly detection to build a unified view of network behaviour—flagging unusual traffic patterns between OT zones before they become incidents. For NOC teams managing fragmented multi-vendor visibility today, this convergence substantially reduces mean-time-to-detect.

Video Surveillance (VMS) — Physical and Cyber Under One Operations View: Ora’s video surveillance (VMS) module manages ONVIF, Hikvision, and Dahua cameras with integrated video analytics. For manufacturing and multi-site retail estates, this means physical access events—an after-hours door badge, a camera detecting unauthorised entry to a server room—are correlated with network security events in the same platform. A physical breach that correlates with a simultaneous network login from an OT asset is a very different alert than either event in isolation.

SOAR — Playbook Automation That Makes CERT-In 6-Hour Reporting Realistic: Ora’s SOAR module ships with pre-built connectors and automated response actions, including pushing blocklists directly to FortiGate. For OT incidents, this is the capability that makes CERT-In’s 6-hour reporting window achievable. Manual analysis at 2 a.m. cannot consistently meet that threshold; automated playbooks that triage, enrich, and draft the initial incident report can. Clients operating under CERT-In compliance obligations should evaluate whether their current response tooling can deliver that timeline at scale.

Compliance and Regulatory Context for Indian OT Operators

Indian OT operators face an evolving regulatory landscape:

• CERT-In Directions (April 2022): 6-hour incident reporting, 180-day log retention, mandatory use of NTP servers, annual cybersecurity audits—all applicable to critical sectors including energy, manufacturing, and transport.
• DPDP Act 2023: While focused on personal data, manufacturing firms that collect employee biometrics, visitor data, or customer data on-premises must apply data protection controls that extend into OT-adjacent systems (CCTV, access control, MES systems). PrahiX Ora’s integrated surveillance (VMS) and security monitoring can support compliance with DPDP Act obligations for physical data collection systems.
• IEC 62443: The international standard for industrial cybersecurity, increasingly referenced in tenders and insurance assessments. Zone-and-conduit segmentation, security levels (SL), and component requirements provide a structured framework for OT security programmes.
• NCIIPC Guidelines: For entities designated as Critical Information Infrastructure, NCIIPC sector-specific guidelines impose additional security controls and reporting obligations.

A Practical OT Security Roadmap for Indian Enterprises

For organisations starting their OT security journey, here is a pragmatic sequence:

1. Month 1–2: Assess and Inventory. Passive OT asset discovery, zone mapping, identification of internet-exposed OT assets (check Shodan for your ASN), and documentation of all remote access paths.
2. Month 2–4: Segment and Enforce. Deploy or reconfigure firewalls at OT zone boundaries; remove flat network paths; enforce DMZ for all remote access; deploy PAM for shared credentials.
3. Month 4–6: Instrument and Monitor. Onboard OT log sources to SIEM; build OT-specific correlation rules; deploy 24/7 SOC coverage for OT alerts—PJ Networks’ managed SOC includes OT threat monitoring.
4. Month 6–12: Harden and Test. Vulnerability assessments for OT assets (passive scan + vendor SBOM review); tabletop incident response exercises; OT-specific IR playbooks with CERT-In reporting procedures documented.
5. Ongoing: Manage and Improve. Monthly threat intelligence briefings; quarterly FortiGuard signature updates; annual OT security audits aligned with CERT-In compliance requirements.

How PJ Networks Supports Industrial Security

PJ Networks provides managed security services specifically designed for Indian enterprises with OT/ICS environments. Our capabilities relevant to manufacturing and industrial clients include:

• FortiGate OT Security: Deployment and management of FortiGate NGFW with industrial protocol inspection at OT zone boundaries, including FortiGuard Industrial Security Service subscriptions.
• 24/7 Managed NOC/SOC: Round-the-clock monitoring of both IT and OT environments, with OT-aware analysts trained on MITRE ATT&CK for ICS.
• ZTNA for OT Remote Access: Zero Trust Network Access replacing legacy VPN for vendor and engineer remote connections, with session recording and just-in-time access controls.
• PrahiX Ora Deployment: End-to-end deployment and management of the Ora unified SecOps platform, integrating SIEM, NMS, video surveillance, and SOAR across IT and OT environments.
• CERT-In Compliance Support: Incident response retainers, 6-hour reporting workflow automation, and log retention architecture that helps evidence compliance with CERT-In directions.

If your organisation is assessing OT security maturity or preparing for a CERT-In audit, our team is available to conduct a no-obligation OT security assessment. Contact PJ Networks to schedule a conversation with our industrial security practice.