KSA OTCC-1:2022 Simplified
Summary: Saudi Arabia's NCA regulation OTCC-1:2022 sets OT cybersecurity controls for critical infrastructure in oil and gas, refineries, manufacturing, power, water, and other essential sectors, building on the earlier NCA ECC-1:2018 requirements. The regulation covers four areas: cybersecurity governance across people, process, and technology; defense controls for OT environments; resilience through risk analysis and incident response; and third-party cybersecurity extending controls to suppliers.
What you should know: The regulation reaches suppliers and service providers, not just the operator's own plant floor, so a security leader's third-party exposure is now part of the compliance surface. Dragos positions its platform and services around validating those controls and producing audit-ready documentation.
Read the original at Dragos Blog ↗
- Topics
- OT / ICS & Critical Infrastructure
- Related
- Siemens RUGGEDCOM APE1808 Cyber Risks · Nov 12, 2026How to Assess OT Incident Response Preparedness Cyber Risks · Nov 10, 2026Three China-Nexus Espionage Campaigns Linked Through Sparrow Malware Ecosystem Cyber Risks · Nov 10, 2026