Executive Overview
Dholera Special Investment Region (DSIR) is India’s first greenfield smart industrial city with a fully integrated Integrated Command and Control Centre (ICCC), smart grid SCADA, water utility SCADA, and industrial process control networks operated by DICDL (Dholera Industrial City Development Limited). Industrial operators setting up in DSIR are required to integrate their plant SCADA and DCS (Distributed Control Systems) with DICDL’s city-wide monitoring network under DSIRDA GDCR 2023 Chapter 13 (Smart Infrastructure and Cybersecurity), IEC 62443 (Security for Industrial Automation and Control Systems), and the NCIIPC (National Critical Information Infrastructure Protection Centre) Guidelines for Industrial Control Systems.
A cybersecurity breach in an industrial SCADA system in Dholera’s tightly interconnected infrastructure can cascade — compromising power distribution, water treatment, or chemical process control across multiple co-located facilities. This article provides a definitive engineering and policy reference for SCADA security design in DSIR.
1. Regulatory Framework
| Code / Standard | Scope |
|---|---|
| DSIRDA GDCR 2023 Chapter 13 | Smart infrastructure and ICS cybersecurity |
| IEC 62443-1-1 | Terminology and concepts for IACS security |
| IEC 62443-2-1 | Security management system for IACS operators |
| IEC 62443-3-2 | Security risk assessment for ICS design |
| IEC 62443-3-3 | System security requirements and security levels |
| IEC 62443-4-2 | Technical security requirements for IACS components |
| NCIIPC ICS Guidelines 2021 | National critical infrastructure protection — India |
| CERT-In Guidelines | Incident reporting for critical infrastructure |
| IT Act 2000 Section 70B | Protection of critical information infrastructure |
| DICDL Smart Grid Policy 2022 | Dholera city SCADA integration requirements |
DSIRDA GDCR 2023 Clause 13.2.1 mandates that all industrial facilities with process control systems (PLC, DCS, SCADA) connecting to or interfacing with DICDL’s city utilities must achieve a minimum IEC 62443 Security Level 2 (SL2) for the interface zone and maintain a dedicated cybersecurity management programme.
2. IEC 62443 Security Level Framework
2.1 Security Levels (SL)
| SL | Protection Against | Design Goal |
|---|---|---|
| SL 0 | No specific requirements | No protection |
| SL 1 | Casual/unintentional violations | Basic protection |
| SL 2 | Intentional violation with simple means | Defence-in-depth |
| SL 3 | Intentional attack with sophisticated means | Advanced security |
| SL 4 | State-sponsored, highly sophisticated attack | Highest protection |
DSIRDA minimum requirements: – Plant SCADA network: SL 2 (minimum) – DICDL city interface zone: SL 2 (mandatory) – Chemical process / hazardous plants: SL 3 – Power substation protection relays (ICCC-linked): SL 3
2.2 Security Foundational Requirements (SFR) — IEC 62443-3-3
| SFR | Name | SL2 Requirement |
|---|---|---|
| FR 1 | Identification & Authentication | Multi-factor auth for all SCADA user accounts |
| FR 2 | Use Control | Role-based access control (RBAC) — least privilege |
| FR 3 | System Integrity | Software integrity verification, OS hardening |
| FR 4 | Data Confidentiality | Encrypted communications (TLS 1.3 minimum) |
| FR 5 | Restricted Data Flow | Network segmentation, unidirectional gateways |
| FR 6 | Timely Response to Events | Security event monitoring, 24/7 SOC |
| FR 7 | Resource Availability | Redundant systems, tested backup/recovery |
3. Network Architecture and Zone Segmentation
3.1 Purdue Model (ISA-95 Reference Architecture)
“` LEVEL 4: Enterprise / Business Network (ERP, SAP, Office IT) │ ← DMZ with Firewall + Data Diode → LEVEL 3: Site Operations (Historian, MES, Engineering WS) │ ← Industrial Firewall / Next-Gen Firewall → LEVEL 2: SCADA / DCS / HMI Layer (control and monitoring) │ ← Industrial Switch + VLAN Segmentation → LEVEL 1: PLC / RTU / Field Controllers │ ← Physical access control → LEVEL 0: Field Instrumentation (sensors, actuators, valves) “`
DSIRDA GDCR 2023 Clause 13.2.3 prohibits direct Layer 2 connectivity between enterprise IT networks (Level 4) and OT control networks (Level 2 and below). A Demilitarised Zone (DMZ) with dual firewalls is mandatory at the IT/OT boundary.
3.2 Zone and Conduit Definition (IEC 62443-3-2)
| Zone | Description | Min SL | Allowed Protocols |
|---|---|---|---|
| Enterprise Zone (L4) | Office IT, ERP, email | SL 1 | HTTP/S, SMTP, standard IT |
| OT DMZ | Historian, data aggregation | SL 2 | OPC-UA (encrypted), historian push |
| Control Zone (L2) | SCADA servers, HMIs | SL 2 | Modbus-TCP (isolated), DNP3, IEC 104 |
| Field Zone (L1/L0) | PLCs, RTUs, instruments | SL 2 | Modbus-RTU, PROFIBUS, HART |
| DICDL Interface Zone | City utility interconnect | SL 2 (mandatory) | IEC 61968/61970 CIM, OPC-UA TLS |
4. Network Security Components
4.1 Industrial Firewall Requirements
| Parameter | DSIRDA Minimum Specification |
|---|---|
| Type | Industrial-rated NGFW (Palo Alto, Fortinet FortiGate-Industrial, Cisco FirePower) |
| Protocol inspection | Deep packet inspection for Modbus, DNP3, IEC 104, EtherNet/IP |
| Throughput | ≥ 1 Gbps (ICS traffic) |
| Redundancy | Active-passive HA pair — no single point of failure |
| Logging | All sessions logged to isolated SIEM — 1-year retention |
| Firmware update | Air-gapped update process — no internet-direct patching |
4.2 Data Diode (Unidirectional Gateway)
DSIRDA Clause 13.2.5 requires a hardware data diode (unidirectional security gateway) at the boundary between OT control zone and OT DMZ for: – All chemical processing plants (SL 3) – All power substation SCADA connections to ICCC – Any zone where outbound data should never trigger inbound control
Product examples: Waterfall Security Solutions, Owl Cyber Defense, Hirschmann GECKO
4.3 SCADA Historian Security
- Separate historian VLAN with read-only replication from control zone
- OPC-UA over TLS 1.3 for all historian data collection — no OPC-DA (DCOM-based) in DSIR
- Role-based access: Engineering team read/write; operations read-only; external auditors read-only via jump server
- Backup: Daily incremental + weekly full to isolated backup server in separate fire zone
5. Remote Access and Vendor Access Controls
DSIRDA GDCR 2023 Clause 13.3.1 mandates strict controls on remote access:
| Requirement | Specification |
|---|---|
| VPN technology | IPSec/SSL VPN — DSIRDA-approved gateway |
| Authentication | MFA mandatory — hardware token (RSA SecurID, YubiKey) or TOTP |
| Session recording | All remote sessions recorded with keystroke logging |
| Time-limited access | Vendor remote access: max 4-hour session windows, operator-approved |
| Jump server | All access through isolated jump server — no direct RDP to SCADA |
| Privileged Access Management | PAM solution for credential vaulting (CyberArk, BeyondTrust) |
| Audit trail | All remote access logged — SIEM alerts on anomalous commands |
6. OT Endpoint Hardening
| Category | Requirement |
|---|---|
| OS hardening | Disable unused services, ports, USB (Group Policy / whitelist) |
| Application whitelisting | Only approved process control software allowed to execute |
| Patch management | OT-compatible patches — test in staging before production push |
| Antivirus | ICS-aware AV (Claroty, Nozomi, Cylance) — signature + behavioural |
| Asset inventory | All OT assets registered in CMDB — IP, firmware version, role |
| Network monitoring | Passive OT network monitoring (Dragos, Claroty, Nozomi) for anomaly detection |
7. Incident Response — CERT-In and NCIIPC
DSIRDA GDCR 2023 Clause 13.4.1 aligns with CERT-In mandatory reporting:
| Incident Type | Reporting Deadline | Report To |
|---|---|---|
| Ransomware on OT system | 6 hours | CERT-In (cert-in.org.in) |
| Unauthorised access to SCADA | 6 hours | CERT-In + NCIIPC |
| Data breach (production data) | 6 hours | CERT-In |
| Sustained DDoS on control network | 6 hours | CERT-In |
| Any incident affecting DICDL ICCC | Immediate | DICDL Emergency Response Team |
DSIRDA additionally requires: Annual penetration test of OT network by CERT-In empanelled security auditor; annual ICS security drill; incident response plan reviewed every 6 months.
8. DICDL ICCC Integration Security Requirements
Dholera’s city-wide ICCC requires all facility SCADA to share specified telemetry (energy consumption, water usage, alarm states) with DICDL. Security controls for this interface:
| Requirement | Specification |
|---|---|
| Protocol | OPC-UA over TLS 1.3 (IEC 62541) — no plain text |
| Data shared | Read-only telemetry — no inbound commands from ICCC to plant |
| Authentication | X.509 certificate-based mutual TLS |
| Interface device | Separate OPC-UA aggregation server in OT DMZ |
| Data validation | Schema validation before ICCC ingestion |
| Availability | 99.5% uptime SLA for telemetry link |
FAQ
What is the minimum IEC 62443 Security Level required for SCADA systems in Dholera SIR?
DSIRDA GDCR 2023 Clause 13.2.1 mandates a minimum of **IEC 62443 Security Level 2 (SL2)** for all plant SCADA networks and the DICDL city interface zone. Chemical processing and hazardous material facilities must achieve SL3. SL2 requires protection against intentional attacks using simple means, implemented through MFA, RBAC, network segmentation, encrypted communications, and security event monitoring.Is direct connectivity between IT and OT networks permitted in Dholera industrial facilities?
No. DSIRDA GDCR 2023 Clause 13.2.3 explicitly prohibits direct Layer 2 connectivity between enterprise IT networks (Purdue Level 4) and OT control networks (Level 2 and below). A mandatory Demilitarised Zone (DMZ) with dual firewalls must exist at the IT/OT boundary. Chemical plants and substation SCADA additionally require hardware data diodes.Is OPC-DA (DCOM-based) protocol permitted for SCADA data exchange in Dholera?
No. DSIRDA GDCR 2023 mandates OPC-UA over TLS 1.3 (IEC 62541) for all historian data collection and DICDL ICCC integration. OPC-DA (DCOM-based) is prohibited in Dholera DSIR networks due to its inherent DCOM/RPC security vulnerabilities and incompatibility with network segmentation requirements.How quickly must a SCADA cybersecurity incident be reported in Dholera SIR?
Under DSIRDA GDCR 2023 Clause 13.4.1 aligned with CERT-In mandatory reporting rules, incidents such as ransomware, unauthorised SCADA access, or data breaches must be reported to CERT-In within **6 hours** of detection. Incidents affecting DICDL’s ICCC require immediate notification to the DICDL Emergency Response Team.What network monitoring tools are approved for OT security in Dholera industrial facilities?
DSIRDA requires passive OT network monitoring — approved solutions include Dragos Platform, Claroty Continuous Threat Detection, Nozomi Networks Guardian, and similar ICS-aware monitoring tools. These perform passive deep packet inspection of OT protocols (Modbus, DNP3, EtherNet/IP) without disrupting control system operations, detecting anomalies that indicate insider threats or external intrusions.Download Dholera SIR 2026 Investor’s Kit
Get instant access to the official planning documents: Dholera Investment Handbook (PDF), 2026 Land Price List, TP Zone & Village Map, and the NRI Buying Guide.
Join The Discussion