Understanding the Ministry of Defence Security Manual, its obligations for defence manufacturers, and a practical roadmap to compliance

Summary

On 3 July 2025, the Department of Defence Production (DDP), Ministry of Defence, published the revised Security Manual for Licensed Defence Industries (SMLDI), revised in June 2025. DPIIT subsequently issued Press Note No. 03 (2025 series) on 23 July 2025, formally directing companies holding Industrial Licences issued by DPIIT to comply with SMLDI 2025 before commencing production of licensed items.

SMLDI 2025 modernizes security protocols for industrial licence holders, reflecting the rapid digitization of defense manufacturing, heightened geopolitical espionage, and sophisticated cyber-physical threats to defense supply chains.

SMLDI 2025 is a mandatory security framework incorporated into the licensing conditions applicable to licensed defence manufacturing, with DDP/MoD and the relevant licensing authorities empowered to inspect and take action for non-compliance. The framework enforces a risk-proportionate architecture across two primary product classifications: Category A (highly classified/sensitive items) and Category B (semi-finished, sub-systems, or lower-sensitivity items).

Crucially, SMLDI is not merely a cybersecurity checklist. It is an integrated industrial security regime spanning eight foundational domains:

• Governance and Personnel Vetting (mandating C-suite oversight, Company Chief Security Officer (CCSO),  and Cyber Information Security Officer [CISO] appointments with government background vetting).

• Physical and Perimeter Security (requiring multi-tier access control, mandatory biometric verification at vital installations, and strict perimeter monitoring).

• Plant and Material Security (mandating Computerised Material Management Systems [CMMS] and controlled material gate protocols).

• Classified Document and Asset Management (enforcing end-to-end chain of custody, marking, and secure destruction).

• Cyber and Information Security (aligning with ISO/IEC 27001, Defense CSOC integration, zero-trust network zone separation, and DLP).

• Supply Chain and Subcontracting Controls (enforcing security flow-down clauses, mandatory vendor background checks, and audit rights).

• Foreign Visitors and International Transfers (banning tourist-visa entry to vital installations and mandating advanced Ministry/Intelligence clearance).

• Audit, Incident Response and Disaster Preparedness (mandating periodic internal/external audits, emergency protocols, and strict breach reporting).

Non-compliance risks severe administrative and legal sanctions, including licence suspension or cancellation, debarment from Ministry of Defence tenders, contractual termination, and prosecution under applicable national security legislation. Senior management, CSOs, and CISOs must immediately conduct a gap analysis against SMLDI 2025 and operationalize an audit-ready compliance program.

What is SMLDI 2025?

Origin, Purpose, and Statutory Authority

The Security Manual for Licensed Defence Industries is the primary regulatory security framework promulgated by the Department of Defence Production (DDP) under the Ministry of Defence (MoD). Its purpose is to ensure that private and public defense manufacturers maintain robust, standardized physical, personnel, material, and cyber security safeguards to prevent espionage, unauthorized access, sabotage, theft, and data leakage.

The regulatory hierarchy governing Indian defense manufacturing follows a strict top-down structure:

Under the licensing framework administered by the Department for Promotion of Industry and Internal Trade (DPIIT) and the Ministry of Home Affairs (MHA), compliance with security guidelines issued by the MoD is a statutory condition of the Industrial Licence.

Relationship with SMLDI 2014

SMLDI 2025 explicitly replaces and supersedes the earlier SMLDI 2014 edition. Key legal and operational shifts between the two versions include:

• Product Categorization Streamlining: SMLDI 2014 utilized a three-tier structure (Category A, B, and C). SMLDI 2025 eliminates Category C (generic/commercial off-the-shelf items) and establishes a focused two-tier system (Category A and Category B).

• Shift to Digital Integrity: Mandates digital material tracking (CMMS) and elevates access control from optional smart cards to mandatory two-factor biometric verification at vital locations.

• Personnel Vetting: Introduces mandatory periodic government re-vetting (every 3 years) for key security executives (CCSO/CISO) and strict pre-employment verification.

• Cyber Realignment: Expands cybersecurity from basic IT hygiene to advanced controls, ISO/IEC 27001 alignment, and optional/contractual integration with Defense Cyber Security Operations Centers (CSOC).

Regulatory Consequences of Non-Compliance

Breach of SMLDI 2025 guidelines constitutes a direct violation of Industrial Licence conditions. Consequences enforced by DDP, DPIIT, or MHA include:

• Formal show-cause notices and mandatory suspension of production.

• Revocation or non-renewal of the Defence Industrial Licence.

• Debarment, financial penalties, or blacklisting from MoD procurement tenders under Defence Acquisition Procedure (DAP) provisions.

• Criminal prosecution under the Official Secrets Act (OSA), 1923, and the Information Technology Act, 2000, in cases involving unauthorized disclosure of classified defense data.

Who Does SMLDI 2025 Apply To?

SMLDI 2025 applies directly to all entities manufacturing defense items in India under a government-issued license, as well as downstream participants in the defense manufacturing ecosystem.

Direct vs. Flow-Down Applicability

Direct Applicability

Any company holding an Industrial Licence (issued under IDRA 1951) or a Manufacturing Licence (issued under the Arms Act 1959) for items listed in the Defence Production List is directly subject to SMLDI 2025. Regulatory compliance audits are conducted directly against the entity's licensed manufacturing facilities.

Flow-Down Obligations for Non-Licensed Vendors

Subcontractors, component suppliers, software vendors, and engineering consultants who do not hold an Industrial Licence themselves are not directly audited by DDP under SMLDI. However, SMLDI 2025 Chapter 8 explicitly requires licensed primary contractors (ILDCs) to flow down SMLDI security mandates to their supply chain via legally binding contracts, non-disclosure agreements (NDAs), and mandatory vendor security audits.

If a non-licensed vendor handles classified engineering drawings, sub-components, or software code for a Category A project, the primary licence holder is legally responsible for ensuring that the vendor abides by SMLDI-compliant controls.

Understanding SMLDI Categorization: Category A vs. Category B

SMLDI 2025 adopts a risk-based approach to security enforcement. Licensed entities must categorize their operations based on the sensitivity of the defense materials produced.

• Category A (High Sensitivity / Maximum Security): Covers items of high strategic value, lethal systems, or highly classified technologies. Examples include: small arms, heavy weapons, ammunition, explosives, propellants, warheads, missiles, military aircraft, warships, battle tanks, military radars, cryptographic systems, and classified defense software.

• Category B (Medium Sensitivity / Standard Security): Covers semi-finished products, dual-use sub-assemblies, non-lethal sub-systems, auxiliary components, and specialized structural assemblies for defense platforms.

Rule of Co-location and Segregation

If a facility manufactures both Category A and Category B items, the stringent Category A requirements apply to the entire facility by default.

To apply lower Category B controls to specific production lines, the company must establish strict physical and logical segregation:

• Physical Segregation: Separate physical structures, biometric access control perimeters, dedicated material handling areas, and isolated security zones.

• Logical Segregation: Air-gapped networks, segmented CAD/CAM databases, and isolated ERP modules.

Major SMLDI 2025 Mandates Across Key Domains

The SMLDI 2025 compliance framework spans 23 distinct operational domains. The table below breaks down the primary obligations, implementation requirements, and required evidence across these domains.

The following matrix is an implementation-oriented mapping developed from the requirements of SMLDI 2025. It is not an official SMLDI classification of 23 compliance domains.

Practical SMLDI Compliance Control Matrix

SMLDI Cybersecurity Requirements

SMLDI 2025 places strong emphasis on cyber security, recognizing that modern defense hardware is designed, manufactured, and controlled via digital systems.

 Core Cybersecurity Mandates

CISO Governance

SMLDI 2025 requires every ILDC to appoint or nominate a Cyber Information Security Officer (CISO). The function may be discharged by a suitably knowledgeable senior officer in smaller organisations; however, a dedicated CISO is mandatory where the company's turnover exceeds ₹250 crore. The CISO is subject to government vetting before appointment and re-vetting every three years.

Management System Standard

Alignment with ISO/IEC 27001 (Information Security Management System) is established as a standard benchmark for Category A and B entities.

Network Segmentation and Air-Gapping

Networks handling classified design files (CAD/CAM), targeting algorithms, or proprietary defense IP must be physically and logically air-gapped from the general corporate IT network and the public internet.

Data Leakage Prevention (DLP) and Endpoint Protection

Mandatory deployment of DLP software on all endpoints handling defense documentation. Endpoint Detection and Response (EDR) agent installation, central patch management, and strict USB/removable media blocking via administrative policies.

ERP and CMMS Security

Enterprise Resource Planning (ERP) and Computerised Material Management Systems (CMMS) processing defense purchase orders, bill of materials (BOM), and inventory must feature role-based access control (RBAC), multi-factor authentication (MFA), and encrypted database storage.

Defense CSOC Integration

Where stipulated by MoD project contracts, the entity must support integration or security telemetry sharing with the Defense Cyber Security Operations Center (CSOC) or relevant Service HQ cyber cells.

Vulnerability Management and VAPT

Annual/periodic third-party cybersecurity audit: SMLDI requires the organisation's cyber security policy to be subject to third-party cyber security audit using an auditor selected from the CERT-In list. Vulnerability assessment and penetration testing can be incorporated into the technical assurance programme where appropriate.

Physical Security Requirements

SMLDI 2025 details strict physical defense controls required to safeguard manufacturing plants.

Site Perimeter and Access Control

• Perimeter Wall: Reinforced masonry boundary wall (A 8 Ft wall with barbed wire fence / concertina coil) topped with concertina razor wire.

• Clear Zones: SMLDI 2025 also requires a minimum 5-metre separation between the compound wall and nearby construction, with a 50-ft no-construction zone recommended wherever possible.

• Access Gates: Recommended implementation controls: automated boom barriers, vehicle screening, pedestrian turnstiles and other appropriate anti-tailgating measures may be deployed based on the site's risk assessment.

• Biometric Standard: SMLDI 2025 mandates biometric access control (fingerprint/facial recognition) as the baseline standard for all vital installations, classified storage vaults, and server rooms. Smart card-only access is no longer compliant for Category A vital points.

• Dual-Factor Access: Entry to "Top Secret" or "Secret" zones requires a second layer of authorization (e.g., biometric + PIN, or biometric + physical security escort).

CCTV and Surveillance Controls

• Continuous 24/7 CCTV coverage of perimeter walls, material gates, production floors, server rooms, and classified document safes.

• Mandatory video archive retention period of minimum 90 days (or longer if mandated by contract).

Plant Security Governance

• Security Control Room (SCR): Centralized 24/7 SCR monitoring CCTV feeds, perimeter intrusion detection systems (PIDS), and fire alarms.

• Plant Security Council: Establishment of an internal committee chaired by the CCSO that meets quarterly to review physical security breaches, guard performance, and physical infrastructure upgrades.

Classified Information and Document Security

Information security within SMLDI 2025 governs the complete lifecycle of classified defense documentation and assets.

Classification and Handling Lifecycle

1. Classification Levels: Information is categorized into TOP SECRET, SECRET, CONFIDENTIAL, and RESTRICTED based on national security sensitivity.

2. Marking: Physical documents must be explicitly stamped/marked at the top and bottom center of every page in red ink. Digital files must contain immutable header/footer classification banners and metadata tags.

3. Registration and Custody: Every classified document received or generated must be logged in a Central Classified Document Register. Documents classified as SECRET or TOP SECRET must be stored in dual-custody, fireproof steel safes located within a biometric-restricted area.

4. Transmission: Physical transport outside the plant requires double-envelope sealed packaging, dispatched via authorized security couriers or government-approved channels. Electronic transmission of classified material over public networks is strictly forbidden unless encrypted using government-approved cryptographic algorithms.

5. Destruction: Classified waste and obsolete documents must be destroyed via heavy-duty cross-cut shredding or incineration under the direct supervision of two vetted security officers, who must execute a formal Certificate of Destruction.

Material Security and Supply-Chain Security

Physical material tracking prevents unauthorized removal of defense components and safeguards against counterfeit parts.

Material Gate Protocols

• Computerised Material Management System (CMMS): SMLDI 2025 makes the implementation of a digital CMMS mandatory for generating material gate passes, recording inward/outward consignments, and maintaining inventory reconciliation.

• Gate Pass Classification: Distinct workflows for Returnable Gate Passes (RGP) and Non-Returnable Gate Passes (NRGP). All RGPs (e.g., tools sent out for calibration or repair) must carry automated target return dates in the CMMS.

• Physical Inspection: Vehicle inspection bays at material gates must utilize under-vehicle surveillance systems (UVSS) and manual search protocols prior to allowing entry or exit.

Supply-Chain Security Flow-Down

Primary licence holders must enforce supply-chain security controls:

• Vendor Due Diligence: Pre-qualification security audits of all sub-contractors handling sensitive defense components.

• Contractual Flow-Down Clauses: Inclusion of standard SMLDI security clauses in purchase orders, reserving the right for the buyer and MoD to conduct unannounced physical/cyber security audits at subcontractor facilities.

• Secure Transportation: Sensitive consignments (Category A) must be transported in GPS-tracked, sealed containers accompanied by armed escorts or dedicated logistics security personnel.

Personnel Security

Human risk management is a central pillar of the SMLDI 2025 framework.

Background Verification Protocols

• Character and Antecedents (CandA): Mandatory Police Verification (PCC) for all permanent employees, temporary contract workers, and casual laborers prior to granting plant access.

• Top Secret Vetting: Personnel assigned to Category A or TOP SECRET project areas must undergo comprehensive security vetting coordinated through government intelligence channels.

• Periodic Re-Verification: SMLDI 2025 mandates that key executive positions (CCSO, CISO) and personnel handling classified work undergo re-verification every 3 years.

Access Management and Offboarding

• Role-Based Access (RBAC): Access to secure areas and digital repositories must adhere strictly to the principle of "need-to-know."

• Exit Controls: Formal offboarding checklist requiring immediate revocation of physical badges, digital credentials, and VPN access, accompanied by a mandatory exit debriefing regarding lifelong Non-Disclosure obligations.

Foreign Nationals, International Security, and Overseas Transfers

Interactions with foreign entities and individuals carry elevated risk profile obligations under SMLDI 2025.

Foreign Visitor Regulations

• Prior Approval: Hosting foreign nationals at a licensed defense facility requires advance written notification and clearance from the Department of Defence Production (DDP) and Ministry of Home Affairs (MHA).

• Tourist Visa Prohibition: SMLDI 2025 explicitly prohibits foreign nationals on Tourist or e-Tourist visas from entering vital defense manufacturing installations. Visitors must possess valid Business Visas with explicit authorization.

• Escort Protocols: Foreign visitors must be continuously accompanied by a designated, vetted security escort from entry to exit.

• Photography and Device Restrictions: Absolute ban on personal laptops, mobile phones, cameras, or recording equipment carried by foreign visitors within manufacturing areas.

International Data and Technology Transfers

• Any exchange of defense technical data, CAD models, or proprietary software with foreign OEMs or overseas partners must comply with India's SCOMET (Special Chemicals, Organisms, Materials, Equipment and Technologies) export control regulations and applicable MoD approvals.

Audits, Compliance Evidence Pack, and Readiness Assessment

SMLDI Audit-Readiness Matrix

To prepare for regulatory inspections by DDP or Service HQ teams, entities should maintain the structured audit matrix below.

 Essential SMLDI Compliance Evidence Pack

A fully compliant entity must maintain a central, audit-ready document repository containing:

1. Licence and Governance Documents: Copy of Defence Industrial Licence, DDP approvals, signed Corporate Security Policy.

2. Executive Vetting Orders: Formal designation letters and government security vetting clearances for CCSO and CISO.

3. Personnel Registers: Employee Police Verification tracking register, 3-year re-vetting schedule, visitor logs.

4. Physical Security Layouts: Site security plan, CCTV layout map, biometric access control user list.

5. Material Records: CMMS system administration guide, sample digital gate passes, inward/outward registers.

6. Classified Asset Logs: Central Classified Document Register, destruction certificates, safe key management log.

7. Cybersecurity Assurance: ISO 27001 certificate, recent VAPT reports, network air-gap topology diagrams, DLP policy config files.

8. Supply Chain Controls: Vendor NDA register, standard security flow-down contract template, vendor audit reports.

9. Emergency Plans: Business Continuity Plan (BCP), Disaster Management Plan (DMP), Incident Response Logs.

10. Audit Compliance File: Internal security audit reports, Corrective Action Reports (CAR), and annual SMLDI Compliance Statement filed with DDP.

SMLDI Maturity and Readiness Model Proposed by Shieldworkz

Level 0: Non-Existent: No formal security controls in place

Level 1: Initial: Ad-hoc security measures; lack of documentation

Level 2: Defined: SMLDI policies drafted; basic physical controls active

Level 3: Implemented: Biometrics, CMMS, DLP operational; CCSO/CISO vetted

Level 4: Managed/Audited: ISO 27001 active; annual audits; supply chain flow-down

Level 5: Optimized: Continuous CSOC monitoring; automated threat intelligence

Entities should target Level 3 as the operational baseline for licensing compliance and Level 4 for audit readiness.

Practical SMLDI Implementation Roadmap (0 to 12 Months)

Phase Breakdown

Phase 1: Governance and Baseline (Month 1)

• Board formally adopts SMLDI 2025 compliance mandate.

• Formally designate CCSO and CISO; initiate government security vetting filings.

• Determine product categorization (Category A vs. Category B) and define facility physical/logical perimeters.

Phase 2: Gap Analysis and Scoping (Month 2)

• Conduct physical and cyber security gap assessment against SMLDI 2025 clauses.

• Audit existing employee police verification files and vendor NDAs.

• Scope required CMMS and biometric access control upgrades.

Phase 3: Physical and Cyber Controls Deployment (Months 3–4)

• Upgrade vital location access points to biometric dual-factor systems.

• Deploy CMMS software for digital material gate pass generation.

• Enforce DLP, air-gapping of CAD/CAM networks, and endpoint security.

Phase 4: Supply Chain and Operationalization (Months 5–7)

• Roll out security flow-down amendments to all active subcontractor contracts.

• Conduct security awareness and classified document handling training for workforce.

• Operationalize foreign visitor advanced clearance protocols.

Phase 5: Internal Audit and Remediation (Months 8–10)

• Conduct comprehensive Internal Security Audit across physical, personnel, and cyber domains.

• Execute Corrective Action Reports (CAR) for any identified gaps.

• Engage CERT-In empaneled auditor for VAPT testing.

Phase 6: External Audit Readiness and DDP Filing (Months 11–12)

• Compile the SMLDI Compliance Evidence Pack.

• Execute final executive sign-off and file annual Compliance Statement with DDP.

• Host DDP/MoD joint inspection team for license compliance verification.

Common Compliance Gaps and Remediation Strategies

SMLDI 2025 vs. Other Global Compliance Frameworks

Understanding how SMLDI 2025 interacts with standard IT/OT frameworks clarifies implementation scope.

Framework Comparison

Practical Integration Strategy

ISO/IEC 27001 provides a strong foundation for SMLDI's information-security requirements, but certification alone does not demonstrate SMLDI compliance. The organisation must address the additional personnel, physical, material, classified-information, subcontracting, international-security and defence-specific cybersecurity requirements prescribed by the Manual.

Special Considerations for Defence Manufacturing Facilities (OT/ICS Environment)

Defense manufacturing involves convergence between traditional IT networks and Operational Technology (OT), such as CNC machines, industrial robotics, PLC controllers, and automated testing rigs.

SMLDI Compliance in Plant Floor Operations

Engineering Workstation and CAD Protection

Workstations running CAD/CAM software used for designing defense components contain primary intellectual property. SMLDI requires these workstations to operate in a segregated, air-gapped VLAN, with USB ports administratively locked and hard disk drives encrypted.

Production Floor and CNC Security

Industrial CNC machines and shop-floor controllers must be isolated from corporate Wi-Fi and direct internet connectivity. Code transfer to CNC units must occur via encrypted, dedicated local buses or whitelisted, managed USB devices.

Maintenance Vendors and Remote Access

OEM maintenance vendors servicing industrial equipment must not be granted direct unmonitored remote access to shop-floor OT systems. Any remote diagnostic session must be time-bound, conducted over encrypted VPN with multi-factor authentication, monitored live by the internal IT/OT security team, and fully logged.

Executive Management Action Checklist

This checklist provides senior management, CSOs, and CISOs with a quick reference tool to evaluate SMLDI 2025 readiness.

Security Governance and Personnel

• [ ] Security Policy updated to align explicitly with SMLDI 2025 mandates.

• [ ] CCSO and CISO formally appointed and government security vetting filed.

• [ ] Police Verification Certificates (PCC) completed for 100% of employees and contract staff.

• [ ] Three-year re-verification applies in the circumstances specified by the Manual, while personnel employed on TOP SECRET work are subject to prior positive vetting and re-vetting every two years.

Physical and Plant Security

• [ ] Perimeter wall meets height (2.4m) and razor wire specifications.

• [ ] Multi-factor biometric access control operational at all vital and sensitive locations.

• [ ] CCTV system covers all perimeter, access, and storage zones with 90-day archive retention.

• [ ] Security Control Room (SCR) operational 24/7.

Material and Document Security

• [ ] Computerised Material Management System (CMMS) implemented for gate pass generation.

• [ ] Central Classified Document Register active; SECRET files stored in fireproof dual-custody safes.

• [ ] Approved cross-cut shredding / destruction protocols operational.

Cybersecurity and Supply Chain

• [ ] ISO/IEC 27001 framework implemented across corporate and production networks.

• [ ] Classified design (CAD/CAM) networks air-gapped from internet.

• [ ] Endpoint Detection (EDR) and DLP software active on all endpoints.

• [ ] Subcontractor contracts updated with mandatory SMLDI security flow-down clauses.

• [ ] Foreign visitor pre-clearance process active; tourist-visa entry strictly enforced/banned.

• [ ] Annual SMLDI Compliance Statement prepared for submission to DDP.

The release of the Security Manual for Licensed Defence Industries (SMLDI 2025) marks a significant evolution in India's defense industrial policy. As India accelerates its Aatmanirbhar Bharat (Self-Reliant India) initiative in defense manufacturing, private vendors, DPSUs, and global OEMs operating in India are handling increasingly sensitive defense technologies. SMLDI 2025 establishes the mandatory operational framework to ensure that these defense assets remain protected against modern physical and cyber threats.

Compliance with SMLDI 2025 is not a one-time paper exercise, nor can it be delegated solely to an IT department. It requires an integrated industrial security architecture spanning governance, physical perimeter engineering, personnel background integrity, material traceability, cyber resilience, and supply-chain vigilance.

Defence vendors and licence holders must immediately evaluate their security posture against SMLDI 2025, address operational gaps, build a verifiable evidence pack, and establish continuous security monitoring. By embedding SMLDI compliance into daily manufacturing and corporate operations, defense suppliers safeguard their licensed status, ensure tender eligibility, and contribute directly to the national security architecture of India.

Learn more about how Shieldworkz can help your organisation in compliance with SMLDI mandate.

Regulatory note: This article is an implementation-oriented interpretation of SMLDI 2025 and is intended to help defence manufacturers understand and operationalise its requirements. It should not be treated as a substitute for the official Security Manual, applicable licence conditions, government directions, project-specific security requirements or legal advice. Where this article recommends technical or organisational controls beyond the express wording of SMLDI 2025, those recommendations are identified as implementation guidance.