NCA Operational Technology Cybersecurity Controls (OTCC-1:2022) compliance software
Assess the Kingdom's operational technology controls facility by facility, with each site's level beside its score and the weakest site leading the group view.
- Issuing authorityNational Cybersecurity Authority (NCA)
- EditionOTCC-1:2022, an extension to the ECC
- Structure4 domains, 23 subdomains, 47 main controls, 122 subcontrols
- Facility levelsLevel 1: 151, Level 2: 117, Level 3: 56 controls and subcontrols
- PrerequisiteCompliance with NCA's Essential Cybersecurity Controls
- Binding textArabic, with an English edition
What NCA OTCC requires
Who it applies to
- Government organisations that own or operate industrial control systems in critical facilities
- Private sector organisations that own, operate or host critical national infrastructure, in the Kingdom or abroad
- Operators with several plants, terminals or stations, each assessed at its own facility level
- Manufacturers, vendors and service providers of OT products and services, covered by OTCC's third-party domain
- Other organisations running OT, which NCA encourages to adopt the controls
The Operational Technology Cybersecurity Controls (OTCC-1:2022) are the National Cybersecurity Authority's controls for industrial control systems, issued to raise the protection of critical infrastructure that operates or depends on them. NCA wrote them as an extension to its Essential Cybersecurity Controls and states that compliance with the ECC is a mandatory prerequisite. Many OTCC controls apply in addition to, or with reference to, a numbered ECC control; they cite ECC-1:2018, the edition in force when OTCC was issued, which ECC-2:2024 has since replaced.
The controls apply to industrial control systems in facilities deemed critical, owned or operated by government organisations or by private sector organisations that own, operate or host critical national infrastructure, whether in the Kingdom or abroad. A facility is critical where its destruction or dysfunction could disrupt the organisation's operation. Every organisation in scope must comply with all applicable controls after ensuring that applying them will not jeopardise the continuity of its operation, and NCA encourages every other organisation running OT to use them.
OTCC has 4 main domains (Cybersecurity Governance, Cybersecurity Defense, Cybersecurity Resilience and Third-Party Cybersecurity), 23 subdomains, 47 main controls and 122 subcontrols. Each critical facility is assigned a level with NCA's Facility Level Identification Tool, from its criticality, its health, safety and environmental impact, and its national impact: a Level 1 facility applies 151 controls and subcontrols, Level 2 applies 117 and Level 3 applies 56. NCA evaluates compliance through the organisation's self-assessment and through field audits by NCA or designated third parties, and the Arabic text is binding.
Related reading: Saudi OTCC and CSCC: which NCA controls apply?; NCA Essential Cybersecurity Controls
How GRCLens supports NCA OTCC
NCA OTCC runs on the same shared control model as every other framework in GRCLens, so evidence captured once can satisfy several obligations at the same time.
The OTCC catalogue in Arabic and English
150 answerable controls and subcontrols, with the 19 main controls that only introduce their subcontrols kept as headings, and every ECC reference left in the text so an assessor sees which ECC control each OTCC control extends.
One assessment per facility
Assess each plant, terminal or station on its own and record its level. NCA publishes the per-control level marks as graphics in its PDF, so GRCLens does not guess them: controls outside a facility's level are marked not applicable, and the dashboard says so.
The weakest site leads
The enterprise view puts the weakest facility in the headline card, with the group average beside it as context and the table sorted worst first. The facility level is printed next to every score, because an L1 facility answering 151 controls and an L3 facility answering 56 are not sitting the same exam.
Scoring that says what it is
Implemented, partially implemented or not implemented, with not applicable left out of the denominator. Subdomain, domain and overall scores are means, the bands are GRCLens's own and labelled as such, and the headline is a percentage because OTCC is not a maturity model.
Evidence, owners and treatment
Evidence reviewed by Baseerah and decided by a person who did not upload it, an assurance register of owners and review dates, and a treatment plan for every gap, with a recorded risk decision where a control cannot be applied without endangering operations.
Segmentation evidence from NSPM
Where OTCC asks for OT zones, safety systems and the corporate network to be segmented, the NSPM module's findings and posture attach to the assessment from the live firewall rulebase rather than from a diagram.
Indicators that trace to controls
Derived indicators (controls not met, claimed but unevidenced, unanswered, stale) are computed from the answers. Measured key risk indicators name the controls they measure, and one outside appetite while every linked control is answered as implemented is flagged as a contradiction.
Facility and enterprise reports
Facility and enterprise reports in Word and PDF, with a Baseerah summary of where the group stands and what to fix first.
NCA OTCC frequently asked questions
What are the NCA OTCC controls?
OTCC-1:2022 is the National Cybersecurity Authority's set of cybersecurity controls for operational technology and industrial control systems in Saudi critical facilities. It has 4 main domains, 23 subdomains, 47 main controls and 122 subcontrols, and it extends the Essential Cybersecurity Controls.
Who must comply with OTCC-1:2022?
Government organisations, and private sector organisations that own, operate or host critical national infrastructure, for the industrial control systems in their critical facilities, whether in the Kingdom or abroad. NCA encourages every other organisation running OT to adopt the controls.
Is ECC compliance required before OTCC?
Yes. NCA states that compliance with the Essential Cybersecurity Controls is a mandatory prerequisite, and OTCC's controls are written as additions to numbered ECC controls.
How many controls are in OTCC-1:2022?
47 main controls and 122 subcontrols, 169 in all. NCA counts 151 controls and subcontrols for a Level 1 facility, 117 for Level 2 and 56 for Level 3. GRCLens's catalogue holds all 169 and asks 150 of them, because 19 main controls only introduce their subcontrols.
How do OTCC facility levels work?
NCA's Facility Level Identification Tool assigns each critical facility Level 1, 2 or 3 from the criticality of its operations, its health, safety and environmental impact, and its impact on the national economy, national security or society. Level 1 is the most critical. The per-control levels are in NCA's OTCC Methodology and Mapping Annex, and our guide to OTCC and CSCC explains which controls apply.
How does OTCC relate to ECC-2:2024?
OTCC was issued as an extension to ECC-1:2018 and cites its control numbers. ECC-2:2024 replaced that edition and no longer has an industrial control systems domain, which leaves OT to OTCC. GRCLens runs ECC-2:2024 and OTCC side by side, so both assessments and their evidence sit on one platform.
Can GRCLens run inside an OT operator's own environment?
Yes. GRCLens deploys on premises as a self-contained bundle, including air-gapped deployments, so assessment data and evidence about critical facilities stay inside your own estate.
One platform, many obligations
See all supported frameworks → Every framework that applies in Saudi Arabia →
Talk to us about NCA OTCC
Security Solution Consultants provides OT cybersecurity and OTCC advisory in Saudi Arabia alongside the platform, so you can combine tooling with hands-on expertise.