Harnessing technology to enhance cybersecurity

The fast-paced digital transformation taking place across industries and businesses has triggered serious cybersecurity challenges, necessitating a holistic approach to countering the same. Cybersecurity challenges have marked an increase in incidents such as ransomware attacks.

With its growing focus on adopting advanced technologies to boost operational and cost efficiencies, Adani Ports and Special Economic Zone Limited (APSEZ) is also facing several cybersecurity challenges. To combat these concerns, we have adopted a comprehensive approach to digitalisation. Going beyond simple automation, we harness data simulation and manipulation to deliver superior outcomes.

Our investments in technology:

• Seek to reduce operational costs, provide real-time data for informed decision-making, optimise workflows, and strengthen information security

▶

This approach is designed to:

• Boost our operational capabilities
• Enhance our cybersecurity
• Enable us to resiliently navigate the digital age challenges

Key Highlights

• Implementation of Advanced Digital Logistics Systems
• Deployment of IoT for Real-Time Monitoring
• Implementation of Customer portal to enable customers to perform their transaction from their office and provide them more visibilities on their cargo
• Enhanced Cybersecurity Measures for Operational Technology
• Initiatives for Enhancing Digital Literacy and Skills Among Employees

Material Topics

M10Customer Satisfaction

M14Data Privacy and Security

M17Regulatory Compliance

M19Digital Inequality

Capitals Impacted

Financial Capital

Intellectual Capital

Human Capital

SDG Alignment

GRI Linkage:

GRI 416, GRI 418

We make continuous investments in technological innovation to anticipate and respond with agility to market changes, capitalise on opportunities, and effectively meet the evolving customer demands.

Focussed on Digital Transformation

Amid the evolving needs of our diverse stakeholders, we have adopted a well-crafted digital transformation strategy tailored to their unique aspirations. The strategy is designed to effectively cater to the needs of our employees, suppliers, vendors, and customers. The focus, at APSEZ, is on continuous technological and digital advancement and investment.

Empowering Operational Success through Digital Transformation

We pursue an integrated approach to transform our operations, catalysing new growth opportunities and ensuring sustained success. We consistently seek innovative methods to enhance our services and provide our customers with seamless and superior experience. Some key examples of such innovations are:

• Successful transformation of port operations and enhanced customer service by integrating advanced technologies and sophisticated software with superior infrastructure
• Enhanced operational capabilities through integration of Artificial Intelligence (AI) and the Internet of Things (IoT)

Comprehensive Integration of Technology Platforms Across Operations to become ‘Future-Ready’

Berth

Port ops management

▶

Railways

Real-time rake tracking

▶

Terminal

Automated container depot mgmt. (TOS)

▶

Truck

Fleet management system

▶

Last-mile delivery

Digital customer portal

Middleware Integrating All Our Systems

Command & Control (C&C)

(Central platform to plan & monitor end-to-end operations)

↔

Port Community System (PCS)

(Gateway for all external stakeholders for track & trace bookings, payment etc.)

Command & Control (C&C)

The Command & Control (C&C) platform functions as a central hub for planning, monitoring, and managing end-to-end operations. It integrates with various systems to offer:

• The Operations department at APSEZ has established a Strategic Command Centre to drive our logistics strategy
• The centre serves as a central Information hub, enabling effective management of real-time expectations while adhering to a comprehensive set of decision-making rules
• It enables optimisation of processes and delivery of exceptional service to our customers
• It uses Data Analytics with the objective of standardising processes and workflows, with its primary goal focussed on improving turnaround time (TAT), addressing pilferage risk, enhancing asset utilisation, improving response time, ensuring SLA adherence, and maintaining overall operational safety standards
• Critical alerts, such as Route Deviation, Risky Point Stoppage, Device Tampering, and Frequent Unwanted Stoppage, are logged as tickets in the system. These tickets are automatically assigned to the respective stakeholders for appropriate action and measures. The command centre deploys an advanced algorithm for performing risk assessments for each trip and generating exceptions for non-adherence. Key technology enablers include GPS, RFID, QR, Automatic Number Plate Reading, along with Biometric Integration with PCS and Government Database

Port Community System (PCS)

The Port Community System (PCS), also known as ITUP, acts as a gateway for all external stakeholders, offering services such as tracking and tracing, bookings, and payments. Key features include:

• Track & Trace: Real-time shipment and container tracking
• Bookings: Streamlined booking processes
• Payments: Secure and efficient payment processing
• Stakeholder Integration: Connecting shipping lines, freight forwarders, customs, and other stakeholders for efficient information exchange

Implementing Technology to Improve Efficiency

As we transition into an integrated transportation utility company, we recognise the importance of digitalisation and automation in driving efficiencies across our value chain. From customer interactions to port operations, storage, and real-time tracking of cargo, we have prioritised technology, and continue to invest in its adoption and implementation.

Other Major Tech Initiatives at APSEZ

We have successfully integrated cutting-edge technology into our hinterland connectivity strategy.

• Our Virochannagar MMLP is the first terminal in the Adani portfolio to initiate a zero-touch customer experience programme
• Our proprietary technology portal allows seamless customer and supplier interactions

We have established a state-of-the-art Strategic Command Centre in Ahmedabad.

• It acts as a primary information hub for all logistics operations, including real-time tracking and centralised monitoring of cargo from a single location
• It leverages advanced data analytics to improve turnaround time, increase asset utilisation, monitor SLA adherence, and maintain safety standards
• It is interlinked with local command centres at our logistic parks, improving visibility of the entire supply chain and leading to improved customer satisfaction

We have launched the Trucking Management Solution (TMS) to further complement the enhancements delivered by our command centre.

• The platform has been developed in-house, and acts as a transformational marketplace and fulfilment system
• It seamlessly integrates with customer systems, offering comprehensive trucking solutions, including real-time tracking
• It is supported by APSEZ’s SLA-based fulfilment assurance and presents a diverse range of fleet and commodity options to customers
• It is currently in use across group volumes and external clients, and is focussed on trucking operations, but will eventually be extended across the entire value chain

APSEZ Digital Transformation Operational Roadmap (2023-2028)

▶

▶

▶

▶

FY 2023-24NextGen Foundation

NextGen - TOS (Navis)

• Process standardisation
• Establishing capability (10 MTeUs per terminal)

PCS Foundation

• Paperless & Cashless port entry
• Axle-based billing
• Customer enablement of Marine module

FY 2024-25Scaling Digitalisation

NextGen - TOS (Navis)

• Digital expansion
• Crane operation digitalisation
• Gate operation automation
• Data lake

PCS Scaling

• Elevating customer experience
• Efficient information exchange
• Onboarding all ports

FY 2025-26Transformation

NextGen-TOS (Navis)

• Transformation of planning thru central C&C
• Data-driven action prompts
• Optimisation of inventory (Yard) and resources (EITV, RTGS, Manpower) - Expert Decking

PCS Transformation

• Enabling smart platform ecosystem
• Embed data intelligence
• Enable smart solutions
• Tailormade solutions for customers

Logistics super app

FY 2026-27Reimagination

• Digital innovations
• Digital twin
• Embed mobility
• AI/ML driven operation
• Zero touch ITUP

FY 2027-28Smart Operations

• Automated operations
• Auto planning
• AGV-based operation
• Connected integrated assets
• Operate from anywhere

Strategic Command Centre
Digitised Data for Decision-Making

• Serves as a central information hub
• Leverages data analytics to standardise processes and workflows, reduce TAT, address pilferage risk, increase asset utilisation, improve response time, ensure SLA adherence and maintain safety standards for overall operations
• Advanced algorithm performs risk assessment for each trip and generates exception reporting (route deviation, risky point stoppage, device tampering, frequent unwanted stoppage)
• Key technology enablers include GPS, RFID, QR, automatic number plate reading, biometric, integration with PCS and Government database

Applications

Track & TraceTOSRod TMSContainer Management SystemERPSalesforce

▶

Date Storage and Transformation

▶

Users

Using Technology to Drive Customer Satisfaction

At APSEZ, we prioritise customer relationships and satisfaction through sustained investments in cutting-edge technologies. Besides enhancing consumer experience, these investments are designed to integrate a forward-thinking approach into our services. They lend a strong competitive and market leading edge to the company in terms of customer service. They also enable us to reduce operational costs, augmenting productivity and efficiency, while effectively helping us steer our sustainability goals.

FY 2025-26 Update

Customer Value Proposition Model

We have developed a robust customer-centric model rooted in our deep understanding of the evolving customer needs. We use world-class infrastructure, cutting-edge technology, and service excellence to not just meet but exceed customer expectations. This gives us a distinctive leadership edge in the competitive market and aids our growth trajectory.

The model is designed to drive our sustained, long-term growth and give us a strong competitive advantage.

Nurturing Long-Term Customer Relationships

Our efforts to build long-term relationships with our customers are steered by our commitment to deliver reliable, efficient and cost-effective logistics solutions. We use advanced technologies, such as APMS, SAP, Data Lake and Realtime dashboards, and web-based mobile applications, to provide real-time visibility into the cargo value chain, and help in precise tracking of port-based vessels and cargo. Our ‘smart port’ initiative boosts service delivery via IoT devices and data analytics, ensuring seamless customer experience and convenience.

Survey Topics and Key Findings

The following questionnaire was sent to customers as part of the survey.

Customer Satisfaction Survey Results

Focus on Cybersecurity

To ensure the protection of our systems and data against potential cyber threats during the adoption of advanced technologies and digital processes, we have integrated cybersecurity with digitisation. This helps in protecting the integrity and confidentiality of our critical infrastructure, besides enabling its seamless availability for delivery of secure logistics solutions.

Cybersecurity Governance Framework

Our Cybersecurity Policy (https://www.adaniports.com/investors/corporate-governance) is crafted to help us effectively address and manage the complexities of cyber risks. This ensures the protection of our IT and business operations against cyber threats.

We are continually investing in strengthening our cybersecurity framework and minimising our risk exposure through a structured governance framework, encompassing robust monitoring mechanisms and stringent reviews. This underlines our commitment to maintaining the highest standards of digital security and operational excellence in the face of evolving cyber threats.

Cybersecurity Governance Framework at APSEZ

Responsibilities of the Information Technology & Data Security Committee

The Information Technology & Data Security (IT & DS) Committee plays a vital role in overseeing and enhancing our cybersecurity framework. Its responsibilities include:

Cyber Risk Management Strategy

At APSEZ, we recognise the threat faced to organisational integrity and operational continuity by the various cybersecurity risks in the fast-evolving digital landscape. Our Risk Management Committee plays a vital role in mitigation of these risks through continuous monitoring and review of the company’s risk management strategies. The committee is focussed on identifying, assessing (both qualitatively and quantitatively), analysing, and effectively managing current and anticipated cybersecurity risks.

The cyber risk assessment framework at APSEZ is intricately aligned with the Information Security Management System (ISO 27001) standards, ensuring seamless integration with our broader enterprise risk management initiatives.

Cybersecurity Infrastructure and Processes

To minimise the various cybersecurity risks, we have adopted a comprehensive IT security plan, encompassing business continuity strategies that include redundancy and high availability across various levels. As part of this plan, we have adopted and implemented ISO 27001:2013 – Information Security Management System (ISMS) across all our operational sites, inline with our security policy. We have also set up a 24/7 Cyber Defence Centre, designed to proactively identify and mitigate cybersecurity incidents.

Audit and Compliance

We engage with independent auditing agencies to ensure compliance with cybersecurity standards. The internal and external annual IT General Controls (ITGC) and ISO/IEC 27001:2013 audits are part of this exercise. We are also covered by the various assessments conducted by the Adani Group Management Assurance Team. Besides ensuring our cybersecurity compliance, this provides an insight into our position with respect to cybersecurity.

Consequence Management for Non-Compliance

A robust consequence management protocol is followed by APSEZ for effectively addressing any cases of cybersecurity non-compliance and breaches effectively.

Business Continuity Plan

The cornerstone of our resilience strategy, our Business Continuity Plan (BCP) is designed to ensure uninterrupted operations in the face of natural disasters, cyber threats, and other disruptions affecting our Port and Special Economic Zone (SEZ) operations. The plan specifically addresses scenarios where critical aspects such as personnel availability, facilities, and technology are compromised, impacting the delivery of essential IT services vital for our business functions and customer service commitments.

The BCP framework:

• Delineates a clear crisis management organisation structure, detailing the roles, responsibilities and procedures for recovery and resumption
• Activates when APSEZ management triggers the recovery protocols in response to a disaster or emergency, ensuring continuity, resilience, and a swift return to normal operations

Core Elements of the BCP

Activation – The BCP is activated on the direction of the APSEZ management in the event of a BCP-defined crisis. This comprehensive system:

• Is designed to facilitate understanding of departmental responsibilities during resumption, recovery, restoration, and return phases
• Outlines the essential resources and records needed by critical departments for effective business resumption

To ensure the plan's effectiveness and readiness, we conduct semi-annual tests of all procedures and protocols.

Oversight and Cybersecurity Measures – The Chief Information Security Officer (CISO) plays a pivotal role in overseeing the Business Continuity and Disaster Management Plan. The CISO:

• Focusses on meeting the various technological and cybersecurity requirements
• Is entrusted with responsibilities that extend to assessment of system upgrades, consultation with technology partners, and engagement with other stakeholders to strengthen the cybersecurity framework

Cybersecurity Awareness and Capability Enhancement – Recognising the importance of cybersecurity in our overall business continuity strategy, APSEZ mandates annual cybersecurity training for all employees.

• The company emphasises rigorous adherence to all its protocols
• In FY 2025-26, we successfully trained 3,471 employees, enhancing our cybersecurity awareness and preparedness

Operational Improvements and Systems Implementation

The IT team at APSEZ has deployed a series of systems to further enhance the company’s operational efficiencies.

• Grievance Management System (GMS)
• Integrated Transport Utility Platform (ITUP)
• Ransomware Protected Backup solution (Commvault AirGap)
• Gate Operating System (GOS)

Each implementation is targeted at streamlining operations, enhancing security, and improving service delivery across the organisation.

Through comprehensive BCP, rigorous cybersecurity initiatives, and continuous operational improvements, APSEZ maintains resilience, upholding the safety and security of its operations, and providing uninterrupted service to its customers, even in the face of unforeseen challenges.

Cybersecurity and Operational Improvement Initiatives

Beyond training, we have implemented several advanced cybersecurity measures at APSEZ. These include:

These initiatives significantly strengthen our defence against cyber threats by providing real-time threat detection, log analysis, and incident response capabilities. They help in quick identification and mitigation of potential security threats, thereby reducing the risk of data breaches and other cyber incidents.

Protecting Data Privacy

We have prioritised data protection and privacy at APSEZ, not merely as a compliance requirement but as a core value that drives our commitment to excellence and integrity in all our operations. We are committed to upholding the highest standards of data protection and privacy. Our business model is built on a foundation of trust, transparency, and ethical practices, ensuring that all personal and sensitive information is handled with the utmost care and confidentiality.

Data Privacy Governance

Our commitment to safeguarding the privacy and security of the data of our various stakeholders is unwavering. To uphold this commitment, we have formulated a comprehensive Data Privacy Policy, covering all individuals and entities associated with the organisation, including employees, contractors, partners and third-party vendors. The policy will help manage personal and sensitive data responsibly. It will comply with current regulations and will incorporate the best global practices, underscoring our belief that privacy is a fundamental right.

We implement robust measures to protect Personally Identifiable Information (PII), ensuring our processes meet regulatory standards. We also encourage our stakeholders, including customers and business partners, to contact us via email or phone with any questions about their personal data. These initiatives are designed to promote transparency and open communication regarding data collection and use.

We have integrated a detailed privacy policy system into our group-wide risk and compliance management framework. This system ensures the protection of stakeholders' privacy rights, regulatory compliance in data handling practices, and effective risk mitigation strategies. By embedding privacy policies throughout the organisation, we prioritise data security and build trust with our customers and partners.

Note: The organisation currently processes Personally Identifiable Information (PII) predominantly in digital form.

The Head - Cybersecurity is responsible for ensuring compliance of the Privacy Policy at APSEZ.

Strategy for Data Privacy Protection & Risk Mitigation

Given the threat posed by data privacy issues to the company’s integrity and operational continuity, we have aligned our framework for data privacy risk assessment with the Digital Personal Data Protection (DPDP) Act. Our efforts are focussed on ensuring compliance with legal requirements and industry’s best practices as per the Act.

Detection Mechanisms

• Monitoring Tools: Intrusion Detection Systems (IDS), Data Loss Prevention (DLP) solutions, and Security Information and Event Management (SIEM) platforms are utilised to monitor suspicious activities
• Access Logs: Access logs are regularly reviewed to identify unauthorised access or anomalies
• Incident Reporting Channels: Employees are trained to promptly report suspicious activities or potential breaches to the cybersecurity team

Reporting Procedures

• Internal Reporting: Potential breaches are escalated to the Incident Response Team (IRT) for further investigation and containment
• Regulatory Reporting: Timely notification to regulatory authorities is ensured for confirmed breaches involving personal data, as mandated by data privacy regulations
• Stakeholder Notification: Detailed information about the breach and the measures taken is provided to affected individuals and stakeholders, along with guidance on how they can protect themselves

Our Data Privacy Protocols

We have instituted a comprehensive privacy impact assessment (PIA) for various projects at APSEZ. The assessment is designed to evaluate how a project, system or process affects the privacy of individuals whose data is being collected, stored, or processed. It ensures compliance with data protection laws like the GDPR and DPDP Act and helps mitigate potential privacy risks.

Data Protection and Information Sharing Practices

We follow elaborate practices designed to ensure the integrity and security of data sharing and protection. These include:

As a B2B enterprise, with our primary focus on commercial activities rather than marketing, we don’t necessitate an opt-out option for our customers regarding the handling of their personal information. In the broader context, given that the personal data is predominantly used for commercial purposes, the application of such data for secondary purposes is not relevant.

Compliance

Robust Data Privacy Incident Response Management

A robust Incident Response Plan (IRP) is in place with respect to cybersecurity & data privacy at APSEZ. The plan ensures effective management of data breaches involving personal data and is aligned with the organisation’s overall cybersecurity strategy as well as the requirements of privacy regulations like the DPDP Act.

We are now in the process of establishing dedicated communication channels, such as an email helpdesk and a grievance cell, to enable data principals to seamlessly lodge complaints. These mechanisms will be backed by defined timelines to address concerns efficiently.

Training & Awareness

Information Security and Data Privacy training and awareness help employees identify and avoid cyber threats, protect sensitive information reducing the risk of data breaches and cyberattacks. These training fosters a culture of security compliance, ensuring that everyone in the organisation understands their role in protecting sensitive information and maintaining regulatory standards.

Key Topics of these trainings focus on phishing awareness, password best practices, and data protection. Additionally, it covers safe internet practice, social engineering, mobile device security, two-factor authentication, data classification and secure handling, and privacy principles such as consent, minimisation, retention, and accountability. Training should also address access control and least privilege, device and endpoint protection, secure use of networks and cloud services, social engineering and physical security, incident reporting and initial response, backup and recovery, and third-party risk management.

We empower all our employees through concise e-learning modules, instructor-led sessions, role-based tracks, simulated phishing campaigns, tabletop exercises, hands on labs, and microlearning tips to reinforce secure behaviours.

The effectiveness of data privacy and cybersecurity training is measured through several methods:

1. Pre- and Post-Training Assessments: Comparing knowledge and skills before and after training to gauge improvement
2. Phishing Simulations: Conducting simulated phishing attacks to see how well employees apply what they've learned
3. Employee Feedback: Gathering feedback from participants to understand their perception of the training's relevance and effectiveness

Maintaining Confidentiality

We follow a zero-tolerance policy against any violations to the privacy policy. We have embedded the principle of confidentiality of personal information into our code of conduct. Any violation of the privacy policy, or involvement in privacy breaches, by an employee invites strict disciplinary action. We have an excellent track record in terms of customer privacy protection and have not reported any cases of information security breaches, data breaches, or cybersecurity incidents in the past three fiscal years. APSEZ has the distinction of ZERO substantiated incidents related to breach of customer privacy, data theft, leaks, or loss for FY 2025-26. This underlines our strong commitment to data protection and implementation of cybersecurity measures. No fines or penalties levied have been imposed on APSEZ with respect to data security breaches or cybersecurity incidents.