Standards and regulations
OT cybersecurity standards: Middle East
Gulf states have national cybersecurity regulators with mandatory controls for government and critical infrastructure, including dedicated OT controls in Saudi Arabia.
Key standards and regulations
| Standard | Who it applies to | What it covers | OTVista modules |
|---|---|---|---|
| NCA ECC-2:2024Essential Cybersecurity Controls (Saudi Arabia)Mandatory controls | Government entities and critical national infrastructure operators | The National Cybersecurity Authority's baseline controls across governance, defense, resilience and third-party security. | Standards & ComplianceGovernance & PolicyEvidence & Audit Trail |
| NCA OTCC-1:2022Operational Technology Cybersecurity Controls (Saudi Arabia)Mandatory controls | Organizations operating industrial control systems in critical sectors | Extends ECC with OT-specific controls, scaled by facility criticality level. | Standards & ComplianceZones & ConduitsAsset Visibility |
| NCA CSCCCritical Systems Cybersecurity Controls (Saudi Arabia)Mandatory controls | Owners of systems classified as critical | Additional controls for critical systems beyond ECC. | Standards & Compliance |
| SACS-002Saudi Aramco Third Party Cybersecurity StandardSupplier standard | Suppliers and contractors to Saudi Aramco | Cybersecurity requirements for third parties connecting to or supporting Aramco environments. | Third-party & Remote AccessEvidence & Audit Trail |
| UAE IA RegulationUAE Information Assurance RegulationRegulation | Government entities and critical sectors in the UAE | National information assurance controls covering management and technical domains. | Standards & ComplianceGovernance & Policy |
| Dubai ISRDubai Information Security RegulationRegulation | Dubai government entities and related organizations | Information security requirements issued by the Dubai Electronic Security Center. | Standards & Compliance |
| Qatar NIANational Information Assurance Policy and StandardStandard | Government and critical sector organizations in Qatar | National information assurance requirements overseen by Qatar's National Cyber Security Agency. | Standards & ComplianceGovernance & Policy |
Summaries are for orientation only and are not legal advice. Applicability depends on your sector, size and jurisdiction, and regulations change. Confirm obligations with the official texts and your legal or compliance advisers. OTVista does not certify compliance.
Other regions
International
ISA/IEC 62443, ISO/IEC 27001 & 27002, ISO/IEC 27019, IEC 62351, IEC 61511, ISO 31000
ViewEuropean Union
NIS2, CRA, NCCS, CER, Machinery Regulation, CLC/TS 50701
ViewUnited Kingdom
NIS Regulations 2018, Cyber Security and Resilience Bill, NCSC CAF, HSE OG86, Cyber Essentials
ViewUnited States
NIST CSF 2.0, NIST SP 800-82 Rev. 3, NERC CIP, TSA Security Directives, AWIA 2018, CISA CPGs, DOE C2M2, CMMC 2.0
View
From the blog
Insights on Middle East requirements
-
Regulation6 min
Preparing for Saudi NCA OTCC: a practical readiness guide
OTCC extends the NCA's Essential Cybersecurity Controls into industrial control systems. Here is how to scope, assess and evidence readiness.
Read the article -
Best practice5 min
Secure remote access for OT vendors: a 2026 baseline
Remote access remains one of the most common routes into OT. A clear, achievable baseline for vendor and engineering access in 2026.
Read the article
Preparing for NCA ECC-2:2024 or another requirement?
We combine the OTVista Platform with compliance readiness services to get you audit-ready.