Overview
The Operational Technology Cybersecurity Controls (OTCC-1:2022) is a cybersecurity framework issued by the National Cybersecurity Authority (NCA) of Saudi Arabia to strengthen the security of Operational Technology (OT) environments and Industrial Control Systems (ICS). The framework establishes minimum cybersecurity requirements for organizations operating critical OT systems, including SCADA systems, Distributed Control Systems (DCS), Programmable Logic Controllers (PLCs), and other industrial control technologies. As an extension of the NCA's Essential Cybersecurity Controls (ECC), OTCC provides specialized controls designed to address the unique security, safety, and operational requirements of industrial environments. The framework covers key areas including OT cybersecurity governance, OT cybersecurity defense, OT resilience, third-party and supply chain security, and OT incident management, helping organizations protect critical infrastructure from cyber threats while maintaining operational continuity and safety. The controls are aligned with international cybersecurity standards, frameworks, and industry best practices to support a consistent and risk-based approach to OT security.