Bring your OT and ICS estate in line with NCA OTCC

OTCC, the Operational Technology Cybersecurity Controls (OTCC-1:2022), is a set of minimum cyber security requirements for industrial control systems issued by Saudi Arabia's National Cybersecurity Authority. It contains 4 main domains, 23 subdomains, 47 main controls and 122 subcontrols covering governance, defence, resilience and third-party security, and it must be implemented as an extension of the NCA Essential Cybersecurity Controls.

Organisations in scope are government bodies, and private sector organisations owning, operating or hosting critical national infrastructure, that run industrial control systems in facilities deemed critical. Critical facilities are those whose destruction or dysfunction could disrupt the organisation's operations. Scope covers such facilities in the Kingdom or abroad, and the NCA encourages all other Saudi organisations to use the controls as best practice.

OTCC is an extension of the Essential Cybersecurity Controls (ECC-1:2018), not a replacement. Compliance with the ECC is a mandatory prerequisite, and most OTCC controls start with phrases such as "in addition to" or "with reference to" a specific ECC control, adding OT and ICS requirements on top. The NCA's Methodology and Mapping Annex explains the relationship with ECC Domain 5, which covers industrial control systems.

OTCC has three control levels set by facility criticality, based on impact on operations, health, safety and environment, and the national economy or security. Level 1 covers the most critical facilities and requires 151 controls and subcontrols, Level 2 requires 117 and Level 3 requires 56. The NCA provides a Facility Level Identification Tool to help organisations assign the right level.

The NCA assesses compliance through self-assessment by the organisation and audit field visits by the NCA or third parties it designates. It issues an OTCC Assessment and Compliance Tool to structure the evaluation. Internally, the cybersecurity function must review OTCC implementation at least annually, and independent parties outside that function must review it at least once every three years.

OTCC is a mandatory national regulation focused on industrial control systems, while ISO 27001 is a voluntary, certifiable information security management standard. They overlap on governance, risk management, access control, logging and supplier security, so an ISO 27001 programme helps. OTCC adds OT-specific requirements such as zone segmentation, safety instrumented system protection and secure engineering workstations, which ISO 27001 does not prescribe.

Start by confirming ECC compliance, then determine each critical facility's level using the NCA identification tool. Build an OT/ICS asset inventory, extend policies, roles and risk management to OT, and implement defensive controls such as network segmentation, remote access restrictions and monitoring. Finally, embed OT into business continuity and third-party processes, and schedule the periodic reviews each subdomain requires.

Yes, on request. OTCC is mapped in OneClickComply's control library and available on request rather than live as a ready-made framework today. Once enabled, you can track its subdomains alongside the NCA ECC, reuse evidence across mapped controls, manage OT risks and vendors, and get guidance from our in-house audit team. OneClickComply does not certify compliance; assessment remains with the NCA.