OT security standards and regulations

Regions

• International

  Standards that apply across borders and are referenced by most regional regulations. They form the common technical language for industrial cybersecurity.

  ISA/IEC 62443 ISO/IEC 27001 & 27002 ISO/IEC 27019 IEC 62351 6 standards and regulations

• European Union

  EU law now sets binding cybersecurity duties for operators of essential services and for makers of connected products, implemented through national legislation in each member state.

  NIS2 CRA NCCS CER 6 standards and regulations

• United Kingdom

  The UK regulates operators of essential services through the NIS Regulations and the NCSC Cyber Assessment Framework, with new legislation progressing to widen scope and strengthen reporting.

  NIS Regulations 2018 Cyber Security and Resilience Bill NCSC CAF HSE OG86 5 standards and regulations

• United States

  US requirements combine voluntary NIST frameworks with mandatory sector rules for electricity, pipelines, water and the defense supply chain.

  NIST CSF 2.0 NIST SP 800-82 Rev. 3 NERC CIP TSA Security Directives 8 standards and regulations

• Middle East

  Gulf states have national cybersecurity regulators with mandatory controls for government and critical infrastructure, including dedicated OT controls in Saudi Arabia.

  NCA ECC-2:2024 NCA OTCC-1:2022 NCA CSCC SACS-002 7 standards and regulations

• Assess once, map to many

  The Standards & Compliance module reuses the same evidence across overlapping requirements.

  See the module

Summaries are for orientation only and are not legal advice. Applicability depends on your sector, size and jurisdiction, and regulations change. Confirm obligations with the official texts and your legal or compliance advisers. OTVista does not certify compliance.