Saudi Arabia OTCC-1:2022

Why does it matter?

Plant networks fail differently from office networks: a bad change can stop production or defeat a safety system, so the OTCC writes safety into cybersecurity. Safety Instrumented Systems appear by name in the controls on system protection, network segmentation and physical access; change management has its own subdomain; and risk assessment must feed the Process Hazard Analysis that plants already run. The controls also recognize that some requirements cannot be applied in an OT environment, and instead of silence they require the justification to be documented and approved by the cybersecurity function and the Authorizing Official (1-3-1-6), with alternative controls defined for a set period when a risk is accepted (1-3-1-7).

Key benefits include:

• Safety systems are treated as crown jewels

Safety Instrumented Systems controllers must stay in modes that prevent unauthorized changes (2-3-1-5), must be segmented from other OT networks (2-4-1-3), and physical access to them is strictly limited (2-13-1-5); qualitative cyber risk analysis joins the Process Hazard Analysis for any change in plant operations (1-3-1-5).

• Zones, choke points and a DMZ jump host

The OT environment is segmented from other networks (2-4-1-1), zones inside it are segmented by level with traffic directed to choke points (2-4-1-2), wireless is restricted and segmented (2-4-1-4, 2-4-1-5), and direct corporate-to-OT communication is prevented, with required connections routed through a dedicated hardened jump host in the DMZ (2-4-1-9).

• OT identities separate from IT

Identity and access management for OT is separated and independent from IT, including the central solutions (2-2-1-1); service accounts are separated from interactive logins (2-2-1-2); default credentials are changed, disabled or removed (2-2-1-3); dual approval applies to sensitive actions (2-2-1-6); and remote access is exceptional, risk-assessed, multi-factor, encrypted, time-limited, monitored and recorded (2-2-1-7).

• An inventory with owners and criticality

An electronic OT asset inventory is required and reviewed periodically (2-1-1-1), collected with an automated solution (2-1-1-2), stored securely (2-1-1-3), with an owner for every asset (2-1-1-4) and a criticality rating approved by that owner (2-1-1-5).

• Resilience in safe mode

Minimum-operation activities are defined (3-1-1-1), redundancy follows the risk assessment (3-1-1-2), OT requirements enter the BCP, BIA, RTO and RPO (3-1-1-3) and the DRP (3-1-1-4), assets must fall to an acceptable safe mode after a cyber incident (3-1-1-5), and tabletop exercises test the plans (3-1-1-6).

How does it work?

Scope is defined by facility, not by sector. The controls apply to industrial control systems that reside in facilities deemed critical and owned or operated by government organizations (ministries, authorities, establishments and others) or by private sector organizations owning, operating or hosting Critical National Infrastructures, whether in the Kingdom or abroad; a critical facility is one whose destruction or dysfunction may disrupt or discontinue the organization's operation (Scope of Work). Other organizations are encouraged to use the controls. The Statement of Applicability then requires every in-scope organization that owns or operates ICS to comply with all applicable controls, after ensuring that applying them will not jeopardize operational continuity.

Levels decide how much of the document applies. The three criteria behind the levels are criticality and impact on business and service availability, impact on health, safety and environment, and impact on the national economy, national security or society (OTCC Controls and Sub-controls Levels). The Facility Level Identification Tool assigns L1, L2 or L3 to each facility, and risk control 1-3-1-4 requires that assignment to follow an approved methodology. Each control in the body carries an L1, L2, L3 marking, and Table 1 totals them at 151, 117 and 56 controls and subcontrols respectively, each higher level including the lower ones; the subcontrol-level detail sits in the Methodology and Mapping Annex.

Every OTCC control is written against an ECC reference. Policies and procedures refer to ECC controls 1-3-1 to 1-3-4, roles and responsibilities add to ECC subdomain 1-4 with a RACI for all OT stakeholders approved by the Authorizing Official (1-2-1-1), risk management adds to ECC subdomain 1-5, and project management adds to ECC controls 1-6-2 and 1-6-3 with cybersecurity in factory and site acceptance testing, commissioning and source code review (1-4-1-2) and secure-by-design architecture (1-4-1-3). Review follows the ECC pattern: the cybersecurity function reviews OTCC implementation at least annually (1-6-1) and independent parties outside it review it at least every three years (1-6-2), with reference to ECC controls 1-8-1 and 1-8-2.

Key Elements

• Domain 1, Cybersecurity Governance

Eight subdomains: 1-1 Cybersecurity Policies and Procedures, 1-2 Cybersecurity Roles and Responsibilities, 1-3 Cybersecurity Risk Management, 1-4 Cybersecurity in Industrial Control System Project Management, 1-5 Cybersecurity in Change Management, 1-6 Periodical Cybersecurity Review and Audit, 1-7 Cybersecurity in Human Resources and 1-8 Cybersecurity Awareness and Training Program.

• Domain 2, Cybersecurity Defense

Thirteen subdomains: 2-1 Asset Management, 2-2 Identity and Access Management, 2-3 System and Processing Facilities Protection, 2-4 Networks Security Management, 2-5 Mobile Devices Security, 2-6 Data and Information Protection, 2-7 Cryptography, 2-8 Backup and Recovery Management, 2-9 Vulnerabilities Management, 2-10 Penetration Testing, 2-11 Cybersecurity Event Logs and Monitoring Management, 2-12 Cybersecurity Incident and Threat Management and 2-13 Physical Security.

• Domain 3, Cybersecurity Resilience

3-1 Cybersecurity Resilience Aspects of Business Continuity Management (BCM), with six minimum requirements from minimum-operation activities to tabletop exercises and root cause analysis (3-1-1-1 to 3-1-1-6).

• Domain 4, Third-Party Cybersecurity

4-1 Third-Party Cybersecurity, covering manufacturers of OT hardware and software, vendors of OT products and suppliers of OT services: cybersecurity in the procurement life cycle, evaluation and information-sharing requirements, a documented secure development life cycle for anything deployed in OT, and periodic assessments and audits of providers (4-1-1-1 to 4-1-1-4).

• Change management (1-5)

Changes are validated in a separate environment before production (1-5-3-2), functionally equivalent replacement devices are validated before use (1-5-3-3), exceptional changes follow a restricted process (1-5-3-4) and automated configuration and asset change detection is in place (1-5-3-5).

• System protection (2-3)

Advanced malware and APT protection (2-3-1-1), vendor-aligned hardening and patching under formal change management (2-3-1-2, 2-3-1-3), least privilege and least functionality (2-3-1-4), application whitelisting (2-3-1-6), dedicated hardened engineering workstations and HMIs (2-3-1-7) and scanning and restriction of external storage media (2-3-1-8, 2-3-1-9).

• Cryptography and people

Cryptographic technologies in OT must align with the NCA National Cryptographic Standard NCS1:2020 (2-7-1); all personnel with OT access are screened before access (1-7-1) and receive customized training, with the Saudi Cybersecurity Workforce Framework recommended as reference material (1-8-2-1).

• Control levels, tools and annex

The L1, L2 and L3 scheme with Table 1 totals, the Facility Level Identification Tool, the Assessment and Compliance Tool, the Methodology and Mapping Annex, and Appendices (A) Terms and Definitions and (B) List of the Abbreviations.

What does it cover?

The OTCC applies to industrial control systems that reside in critical facilities owned or operated by government organizations, including ministries, authorities and establishments, and by private sector organizations owning, operating or hosting Critical National Infrastructures, whether in the Kingdom or abroad, all referred to as the Organization (Scope of Work). A critical facility is defined as one whose destruction or dysfunction may lead to the disruption or discontinuity of the organization's operation, and industrial control systems means all devices, systems or networks used to operate or automate industrial processes. The level assigned by the Facility Level Identification Tool then determines whether the 151, 117 or 56 controls and subcontrols of L1, L2 or L3 apply (Table 1).

What are its objectives?

The Objectives section states what the controls are for:

To extend the ECC so that national cybersecurity goals are met in industrial control systems by defining their cybersecurity requirements (Objectives).

To let national organizations fulfill mandated cybersecurity requirements that raise the protection of critical infrastructure and its readiness against cyber risks (Objectives).

To address the four cybersecurity pillars of Strategy, People, Process and Technology in the OT environment (Objectives).

To draw on international OT and ICS cybersecurity guidance, standards and controls studied during development (Introduction).

To keep production uptime and safe operations alongside the confidentiality, integrity and availability of OT assets (objective of subdomain 2-1).

Framework in Context

The OTCC is where the NCA's industrial control systems requirements now live. ECC-1:2018 carried them as main domain 5, Industrial Control Systems Cybersecurity; the ECC-2:2024 edition deleted that domain and records in Appendix (C) that its controls moved to the OTCC, so the OTCC references to ECC-1:2018 control numbers should be read against the 2024 text. The Critical Systems Cybersecurity Controls (CSCC-1:2019) cover critical information systems rather than industrial ones, and an operator can be in scope of both. The OTCC also points to two other NCA instruments: the National Cryptographic Standard NCS1:2020 for cryptography in OT (2-7-1) and the Saudi Cybersecurity Workforce Framework for training (1-8-2-1).

Common Framework Mappings

Operators that already follow international OT security standards map the OTCC subdomains to them, and the document's own Methodology and Mapping Annex describes its relationships to those standards.

Mapped frameworks include:

CIS Controls v8.1

IEC 62443

ISO 27001:2022

ISO 27002:2022

NERC CIP

NIST CSF 2.0

NIST 800-53 Rev.5

PCI DSS 4.0.1

SOC 2