Saudi Arabia's National Cybersecurity Authority (NCA) treats OT as a distinct discipline. The Operational Technology Cybersecurity Controls (OTCC-1:2022) build on the Essential Cybersecurity Controls (now ECC-2:2024) with requirements tailored to industrial control systems in critical sectors such as energy, water and transport.
How OTCC relates to ECC
Think of ECC as the organization-wide baseline and OTCC as the OT extension. Many OTCC controls refine an ECC domain for industrial environments: governance, asset management, segmentation, remote access, monitoring and resilience. Requirements are scaled by the criticality level of the facility, so scoping comes first.
Step 1: Scope by facility and criticality
List facilities and their OT systems, then determine the criticality level the NCA framework assigns or that your organization has agreed with the regulator. The level drives which controls apply and how strictly.
Step 2: Know your assets
OTCC expects an accurate inventory of OT assets. In practice that means controllers, HMIs, servers, network devices and their firmware, location and owner. Our asset inventory guide explains a practical method.
Step 3: Segment and control access
Expect detailed questions on:
- separation between IT and OT, and between OT zones,
- remote and vendor access, including approval and monitoring,
- privileged accounts and default credentials.
The zones and conduits approach from IEC 62443 provides a clean structure to answer them.
Step 4: Build the evidence
Assessors will ask for proof: architecture diagrams, access reviews, change records, backup and restore tests, and incident exercises. Keep evidence linked to each control so it can be shown quickly. Suppliers to Saudi Aramco should also align with SACS-002, the third-party cybersecurity standard.
Step 5: Plan remediation realistically
Many fixes need outages or vendor support. Prioritize by risk, apply compensating controls first and schedule outage-dependent work with operations.
How OTVista helps
OTVista's team has hands-on experience with OT security programs for energy and railway operators in the region. The Standards & Compliance module maps NCA ECC and OTCC alongside IEC 62443, and our compliance readiness service helps you prepare. See all Middle East standards.
General information; confirm requirements with the official NCA publications.
Topics: NCA OTCC, Operational Technology Cybersecurity Controls, NCA ECC-2:2024, Saudi OT security, critical national infrastructure Saudi Arabia