Saudi government organizations
NCA’s OTCC implementation guidance includes Saudi government organizations and their companies and entities where the OTCC scope requirements apply.
NCA Operational Technology Cybersecurity Controls
NCA OTCC Compliance Saudi Arabia
SecureLink provides professional NCA OTCC Compliance Services in Saudi Arabia to help organizations determine applicability, strengthen OT cybersecurity governance, identify control gaps, and prepare for assessment readiness. Our experts support your organization with applicability and scope reviews, OTCC-1:2022 gap assessments, control mapping, documentation, evidence preparation, remediation planning, and practical compliance guidance aligned with NCA requirements for operational technology and ICS environments.
OTCC-1:2022 compliance
What Are the NCA Operational Technology Cybersecurity Controls?
Saudi Arabia’s National Cybersecurity Authority (NCA) published OTCC-1:2022 to set minimum cybersecurity requirements for operational technology and industrial control system environments within its defined scope. NCA positions OTCC as an extension of the Essential Cybersecurity Controls (ECC), with requirements focused on OT and ICS environments.
In practice, NCA OTCC compliance is not a box-ticking exercise. You first need the right facilities and assessment boundary, then the correct control set. From there, the assessment looks at how those controls actually work in the OT/ICS environment, what evidence supports them and what needs to change where gaps exist.
OTCC also needs to be read alongside the relevant NCA framework requirements. The OTCC-1:2022 document states that ECC 1:2018 compliance is a prerequisite for organizations within OTCC scope, while NCA’s current ECC 2:2024 publication explains that its former Industrial Control Systems domain was moved into OTCC. For a live engagement, the current NCA publications should be used to confirm the requirements and cross-references that apply.
ECC relationship: NCA’s OTCC-1:2022 document states that ECC 1:2018 compliance is a mandatory prerequisite for organizations within OTCC scope. NCA’s current ECC 2:2024 publication states that the former ICS Domain 5 was moved into OTCC. Use the latest NCA publications when confirming the requirements that apply to a specific engagement.
View the official NCA OTCC publication →
Applicability and scope
Who Should Assess NCA OTCC Applicability?
OTCC applicability depends on NCA scope requirements, your regulatory position, the OT/ICS facilities involved and how critical those facilities are. Company size or industry label alone is not enough.
Private-sector CNI organizations
The scope also covers private-sector organizations that own, operate or host Critical National Infrastructures. Their relevant OT/ICS facilities need to be assessed against the applicable OTCC requirements.
Other organizations in the Kingdom
Other organizations in Saudi Arabia can also use OTCC guidance and controls as cybersecurity best practice when operational technology or industrial control systems are part of their environment.
Do not assume OTCC applies—or does not apply—based only on industry or company size. Confirm the regulatory position, facilities, OT/ICS scope, applicable NCA requirements and facility-level methodology before starting the full control assessment.
Facility Criticality
Understanding OTCC Levels L1, L2 and L3
Under the OTCC methodology, facility criticality determines which control set applies. NCA provides a Facility Level Identification Tool, and the methodology considers business and service availability, Health, Safety & Environment (HSE), and potential impact on the national economy, national security or social influence.
L1
High-Criticality Facilities
L1 is the highest criticality level. It covers facilities where a cybersecurity incident could have severe effects on operations, assets, resources, or health, safety and the environment.
Control rule: L1 facilities implement all OTCC controls and sub-controls. NCA’s published table lists 151 controls and sub-controls for L1, including L2 and L3 controls.
L2
Medium-Criticality Facilities
L2 covers medium-criticality facilities where an incident could still cause significant adverse effects or operational impact.
Control rule: L2 facilities implement the controls identified for L2 and L3. NCA’s published table lists 117 controls and sub-controls for L2, including L3 controls.
L3
Lower-Criticality Facilities
L3 covers lower-criticality facilities where an incident could result in moderate adverse effects or operational impact.
Control rule: L3 facilities implement the controls identified for L3 at minimum. NCA’s published table lists 56 controls and sub-controls for L3.
Facility level is not a judgement call. NCA’s methodology uses defined impact criteria, and where a facility contains industrial control systems with different criticality levels, the facility is classified according to the highest-criticality system.
Prepare before assessment
What to Prepare Before an NCA OTCC Assessment
You do not need a perfect document set before an NCA OTCC assessment starts. What matters is having enough information to understand the OT/ICS environment, identify the right people and see what evidence already exists. Bringing the following items together early makes scoping and evidence review much smoother.
01
OT/ICS Asset and Facility Information
Asset inventories, facility lists, system owners, critical-process information and known OT/ICS dependencies—whatever is already available.
02
Architecture and Network Documentation
Network diagrams, zoning or segmentation details, system interfaces, remote-access paths and other architecture records that show how the environment is connected.
03
Policies, Procedures and Standards
Current cybersecurity and OT policies, operating procedures, standards, change processes, access-control procedures and governance records used by the teams today.
04
Risk and Control Records
OT cybersecurity risk assessments, risk registers, previous findings, control records, remediation trackers and any accepted risks already on record.
05
Evidence Owners and Stakeholders
People from cybersecurity, OT, engineering, operations, safety, IT, procurement, risk, audit and management who can explain how the controls work in day-to-day operations.
06
Third-Party and Remote Support Information
Supplier, contractor, integrator, maintenance and remote-support arrangements that affect access to, support of or operation of the OT environment.
Incomplete evidence is not a reason to postpone the assessment.
Missing or inconsistent evidence is itself a useful finding. The first review can show what exists, what is missing, who owns it and what needs to be created or improved as part of the OTCC readiness roadmap.
NCA OTCC APPLICABILITY & SCOPING CHECKLIST
Download the NCA OTCC Scoping Checklist
Not sure where to start with NCA OTCC applicability and facility scope?
Use SecureLink’s NCA OTCC Applicability & Scoping Checklist to organize the decisions that come before a detailed assessment—regulatory scope, facility criticality, OT/ICS boundaries, applicable controls, evidence ownership and next actions.
01Confirm organization and facility scope
02Identify OT/ICS boundaries and dependencies
03Prepare for L1, L2 or L3 facility-level review
04Review applicable OTCC control areas
05Map evidence owners and source records
06Record known gaps and constraints
07Prioritize remediation actions
08Prepare for assessment-readiness review
Get Your OTCC Checklist
Fill in your details and our team will help you access the NCA OTCC Applicability & Scoping Checklist.
SecureLink resource based on publicly available NCA OTCC-1:2022 materials. It is not an NCA-issued document.
Preview the NCA OTCC Applicability & Scoping Checklist →Compliance services
Our NCA OTCC Compliance Services
Our NCA OTCC compliance services stay focused on applicability, control assessment, evidence readiness and remediation. If the assessment points to deeper OT engineering or technical security work, that work is defined separately so scope and ownership stay clear.
1. OTCC Applicability and Scope Assessment
We establish which facilities, OT/ICS environments, systems, assets, processes and business functions belong inside the assessment boundary. We also map the key stakeholders, regulatory drivers, current governance and available evidence.
2. NCA OTCC Gap Assessment
We compare the applicable OTCC requirements with your current governance, policies, procedures, operating practices, technical safeguards and evidence. Each finding is tied to evidence status, ownership, risk context and a practical corrective action.
3. OT Cybersecurity Governance, Roles and Accountability
OTCC work crosses teams that do not always share the same priorities. We help make accountability clear across cybersecurity, OT, engineering, operations, safety, IT, procurement, risk, internal audit and management.
4. OT/ICS Asset and Risk Governance
A useful assessment starts with an accurate picture of the OT environment. We review or strengthen asset inventories, facility and system scope, ownership information, OT cybersecurity risk assessments, risk registers and change-related risk processes.
5. Control Remediation Planning
Not every OTCC gap needs the same response or timeline. We prioritize remediation around compliance urgency, cyber risk, operational continuity, safety, technical feasibility, dependencies, responsible teams and sensible implementation sequencing.
6. Policy, Procedure and Evidence Development
Where documentation is weak or missing, we can help develop or improve OT cybersecurity policies, procedures, standards, registers and evidence records so the applicable controls can be shown as defined, approved, implemented, operated and reviewed.
7. Assessment and Evidence Readiness
Before an internal review, self-assessment or formal compliance activity, we organize evidence by control, flag missing records, confirm evidence owners and prepare the right stakeholders for evidence walkthroughs.
8. OTCC Remediation Support
After the gap assessment, we can help coordinate the remediation work: governance updates, policies and procedures, evidence improvement, risk treatment, ownership, management reporting and any agreed technical actions.
9. Ongoing OTCC Compliance Monitoring
OTCC readiness is not finished when the first assessment ends. Ongoing support can include periodic control reviews, remediation tracking, evidence refreshes, policy updates, management reporting and reassessment when facilities, systems, vendors or risks change materially.
A useful OTCC gap assessment gives you more than pass/fail results. It should leave you with a prioritized action plan that links each finding to an owner, evidence requirement, dependency and realistic remediation step.
Recommended starting point
Start with OTCC applicability and readiness.
Discuss Your OTCC Requirements
Confirm the assessment boundary, facility level, available evidence, priority gaps and the next remediation actions before expanding the programme.
OTCC-1:2022 control domains
The Four Main OTCC Control Domains
OTCC-1:2022 contains four main cybersecurity domains, 23 subdomains, 47 main controls and 122 subcontrols. Each domain needs to be assessed in the context of the applicable facility level and the way the organization’s OT/ICS environment actually operates.
Covers governance structures, policies, responsibilities, OT cybersecurity risk management, project and change requirements, periodic reviews and workforce-related cybersecurity duties.
Covers OT/ICS asset management, identity and access control, network security, information protection, backup and recovery, monitoring, vulnerability-related controls and incident protection.
Focuses on operational continuity, recovery and the resilience of critical OT/ICS services and the dependencies they rely on.
Addresses suppliers, contractors, integrators, maintenance providers, remote support and other third parties that can affect the security of OT environments.
Use the official OTCC document and the facility level established through NCA’s methodology to determine control applicability. Good evidence should show that the requirement works in practice—not just that a policy exists on paper.
Official regulatory sources
Official NCA OTCC References
For scope, control wording, facility-level methodology, implementation guidance and related ECC requirements, the NCA publications remain the authoritative reference. These sources should be checked when confirming an assessment decision or interpreting a requirement.
Operational Technology Cybersecurity Controls
The main NCA OTCC page, including the published OTCC-1:2022 resources and supporting assessment material.
Open NCA source →Operational Technology Cybersecurity Controls
The official OTCC-1:2022 control document covering domains, objectives, controls, sub-controls and control levels.
Open official document →Methodology and Mapping Annex
The NCA methodology for facility-level identification, applicable control sets and OTCC mapping information.
Open methodology →OTCC Implementation Guideline
NCA implementation guidance covering OTCC requirements, expected deliverables and practical implementation considerations.
Open implementation guide →Essential Cybersecurity Controls ECC 2:2024
NCA’s current Essential Cybersecurity Controls reference page. ECC 2:2024 removed the former ICS Domain 5 and moved those controls into OTCC; use the current NCA publications when confirming cross-references and applicability.
Open current ECC page →Clear service boundary
How OTCC Compliance Works Alongside Technical OT Cybersecurity
OTCC compliance and technical OT cybersecurity overlap, but they are not the same piece of work. Keeping the objectives and deliverables separate makes the programme easier to manage.
The OTCC work focuses on applicability, facility level, control interpretation, gap assessment, governance, remediation planning, evidence preparation, assessment readiness and ongoing compliance management.
If the assessment points to deeper engineering work—such as ICS/SCADA architecture changes, industrial network segmentation, hardening, vulnerability management, secure remote access, technical testing or OT monitoring—we define that work separately and coordinate it with the appropriate OT cybersecurity workstream.
OTCC compliance and readiness
Applicability, facility level, control assessment, gap analysis, remediation planning, evidence readiness and compliance monitoring.
Technical OT cybersecurity
ICS/SCADA architecture, segmentation, hardening, vulnerability management, secure remote access, security testing and operational monitoring.
Why the scopes should stay clear
Clear boundaries stop a compliance assessment from turning into an open-ended technical project, and they make responsibilities, budgets and deliverables easier to manage.
What the OTCC engagement should produce
A practical roadmap that connects the applicable requirements to owners, evidence, priorities and remediation actions that teams can actually maintain.
Delivery approach
Our NCA OTCC Compliance Approach
We move in a clear sequence: confirm applicability and facility level, assess the controls, prioritize the gaps, support remediation and then review readiness.
01
Discovery and Applicability
Start with the business and operational context: facilities, key processes, OT/ICS landscape, regulatory drivers, current cybersecurity governance and the reason for the assessment.
02
Scope, Facility Level and Evidence Request
Agree the assessment boundary, facility criticality, relevant systems, stakeholders, evidence sources, documentation needs and who is responsible for what.
03
Control Assessment
Assess the applicable OTCC requirements through document review, stakeholder interviews, workshops, evidence validation and checks against relevant operating practices.
04
Gap and Risk Prioritization
Classify the findings and prioritize them based on compliance needs, cyber risk, safety, operational constraints, evidence weaknesses and implementation dependencies.
05
Remediation Planning and Support
Turn the findings into a workable plan covering governance changes, policies, procedures, evidence improvements, technical actions, owners, dependencies and target dates.
06
Readiness Review
Before internal sign-off or formal assessment activity, re-check priority controls, evidence quality, open findings, ownership and management reporting.
The result should be traceable from scope and applicability all the way through control evidence, remediation ownership and ongoing readiness.
Multi-facility OTCC governance
Managing OTCC Across Multiple Facilities
If you manage several plants, sites or operational environments, you need one governance model without pretending every facility has the same criticality, systems, risks, evidence or remediation constraints.
01
Central Governance Framework
Set common OTCC governance, policy expectations, reporting, review cadence and escalation paths across the organization.
02
Facility-Level Ownership
Give each facility clear local owners who understand the real OT/ICS environment, operational constraints, maintenance windows and available evidence.
03
Facility-Level Applicability
Use the NCA methodology to determine the applicable control set for each facility instead of applying one level across every site.
04
Site-Specific Constraints
Record local dependencies, technical limitations, compensating measures, open constraints and approvals where remediation has to differ by facility.
05
Consistent Evidence Management
Standardize evidence naming, ownership, review dates and control mapping so records from different facilities are easier to maintain and review consistently.
06
Portfolio-Level Remediation Tracking
Track gaps by facility, priority, owner, dependency, due date and evidence status so management can see shared issues and site-specific risks in one view.
Consistency does not mean forcing every facility into the same control level or remediation plan.
The aim is consistent governance and reporting while still respecting each facility’s criticality, operational context, technology constraints and evidence reality.
Engagement outputs
Typical Deliverables
The exact deliverables are agreed during scoping. The level of detail depends on the facilities involved, control applicability, OT/ICS complexity, evidence quality and current readiness.
Applicability and scope summary
A clear record of OTCC applicability, in-scope facilities and boundaries, key stakeholders and the relevant OT/ICS environments.
Facility-level determination record
A documented facility-level determination and the resulting OTCC control applicability used for the assessment.
Control-by-control gap assessment
A control-by-control record comparing current practices and evidence with the applicable OTCC requirements.
Evidence register
An evidence inventory and request list mapped to the applicable controls and responsible owners.
Prioritized remediation roadmap
A remediation roadmap prioritized by compliance urgency, risk, feasibility, dependencies, ownership and sequencing.
OT/ICS governance recommendations
Practical recommendations for governance, accountability and OT/ICS cybersecurity risk management.
Policy and procedure support
Policy, procedure, standard, register and control-documentation support where it is included in scope.
Responsibility matrix
Clear ownership for controls, evidence, remediation actions and management escalation paths.
Remediation tracker
A structured tracker for open findings, owners, actions, dependencies, target dates and status.
Management reporting
Concise management reporting that shows progress, blockers, overdue actions and unresolved risk.
Assessment-readiness review
A final review of evidence quality, priority controls, open findings and readiness before formal assessment activity.
Residual-risk summary
A summary of unresolved issues that need further remediation, management treatment or an accepted-risk process.
Why SecureLink
A Practical Approach to OTCC Readiness
Our approach keeps the NCA OTCC requirements tied to real operating conditions, clear ownership and evidence that can be maintained—not just produced once for an assessment.
Compliance-Led Scope
We start by confirming applicability, facility level, control requirements and evidence so the work has a defined compliance boundary from day one.
Operational Context
Remediation planning takes OT availability, safety, engineering constraints, maintenance windows and operational dependencies into account.
Clear Accountability
Every finding is tied to a responsible owner, priority, evidence requirement, dependency and target action.
Practical Remediation
Recommendations are broken into manageable workstreams so teams can move from assessment findings into implementation without losing track of dependencies.
Cross-Framework Awareness
Related ECC obligations and other applicable requirements can be considered while keeping the OTCC-specific assessment boundary clear.
Sustainable Evidence
The aim is repeatable governance and evidence that remains usable as facilities, systems, people and risks change.
Prepare for NCA OTCC Compliance with a Clear Roadmap
Whether you are confirming applicability, setting facility levels, preparing for an assessment or closing known gaps, SecureLink can help turn the work into a clear programme with defined scope, usable evidence, accountable owners and prioritized remediation.
A practical starting point is an OTCC applicability and readiness assessment: confirm what applies, see what evidence already exists, identify the gaps and agree what needs to happen next.
Frequently asked questions
Frequently Asked Questions About NCA OTCC Compliance
These answers cover the questions we see most often around OTCC scope, facility levels, gap assessments, evidence, remediation and the relationship between compliance work and broader technical OT cybersecurity.
What does NCA OTCC stand for?
OTCC stands for Operational Technology Cybersecurity Controls. Saudi Arabia’s National Cybersecurity Authority issued OTCC-1:2022 to define minimum cybersecurity requirements for operational technology and industrial control system environments that fall within its scope.
Is OTCC the same as NCA ECC?
No. OTCC-1:2022 is an extension of NCA’s Essential Cybersecurity Controls for OT and ICS environments. NCA’s Methodology and Mapping Annex specifically documents the relationship between OTCC and ECC Domain 5. The OTCC publication should be used together with the applicable ECC baseline and current NCA guidance.
Who does NCA OTCC apply to?
NCA’s OTCC implementation guidance covers Saudi government organizations and their companies and entities, as well as private-sector organizations that own, operate or host Critical National Infrastructures. NCA also encourages other organizations in the Kingdom to use OTCC as cybersecurity best practice where it is relevant.
What are OTCC levels L1, L2 and L3?
The OTCC methodology uses facility criticality levels to decide which controls apply. L1 is the highest criticality, L2 is medium and L3 is lower. L1 facilities implement all OTCC controls and sub-controls, L2 facilities implement the controls identified for L2 and L3, and L3 facilities implement the L3 controls at minimum.
What is included in an NCA OTCC gap assessment?
An NCA OTCC gap assessment compares the applicable controls with your current governance, policies, procedures, OT/ICS practices, technical safeguards and evidence. The output should show what is missing, why it matters, who owns the action, what it depends on and what evidence is needed to close it.
Does OTCC compliance require technical testing?
Some OTCC requirements rely on technical configuration, validation, monitoring or security testing. The exact work depends on the applicable controls, facility level, OT architecture and risk. Deeper engineering or technical security work should be scoped separately within the right OT cybersecurity workstream.
Can SecureLink support remediation after the assessment?
Yes. SecureLink can support remediation after the assessment, including governance improvements, policy and procedure work, evidence preparation, risk treatment planning, responsibility assignment, management reporting and coordination of agreed technical actions.
How long does an OTCC compliance engagement take?
There is no single OTCC timeline. It depends on the number of facilities, OT/ICS scope, facility levels, control applicability, documentation quality, current maturity, stakeholder availability and the complexity of the gaps. A realistic schedule can be set once discovery and scoping are complete.
What evidence is normally needed for OTCC readiness?
The evidence depends on the controls in scope. Common examples include approved policies and procedures, asset inventories, architecture records, risk registers, access and change records, monitoring records, incident processes, awareness records, third-party documentation, review records and remediation evidence.
What are the four main OTCC domains?
OTCC-1:2022 is organized into four main domains: Cybersecurity Governance, Cybersecurity Defense, Cybersecurity Resilience, and Third-Party Cybersecurity. The document also contains 23 subdomains, 47 main controls and 122 subcontrols.
How does NCA evaluate OTCC compliance?
The OTCC-1:2022 publication states that NCA evaluates compliance through mechanisms such as organizational self-assessment and/or field audit visits by NCA or designated third parties, using mechanisms approved by NCA. Organizations can also use the NCA OTCC Assessment and Compliance Tool to organize compliance measurement.
What is the first step for an NCA OTCC compliance programme?
Start with an applicability and scope review. Confirm the relevant facilities, facility criticality, OT/ICS boundaries, stakeholders, regulatory drivers and evidence sources before moving into a detailed control assessment and remediation programme.