Map your OT and ICS environment against all four OTCC domains and 47 controls, find your gaps, and prepare for audit. A free, practical checklist for critical infrastructure operators in the Kingdom.
4Domains
47Main controls
122Sub-controls
SAR 25MMax penalty
If you operate industrial control systems anywhere within Saudi Arabia's critical national infrastructure, OTCC-1:2022 is not a document you can skim once and shelve. Issued by the National Cybersecurity Authority, the Operational Technology Cybersecurity Controls are mandatory, enforced, and carry penalties of up to 25 million riyals for non-compliance.
This checklist turns the full framework, four domains, 23 subdomains, 47 main controls, and 122 sub-controls, into a practical tool your team can walk control by control to see exactly where you stand and what is left to close before an assessment.
What is inside
The checklist walks all four OTCC domains.
For each control, you get a plain-language description, an assessment prompt, and a status field, so a walkthrough produces an honest gap picture rather than a vague sense of readiness.
01
DOMAIN 1
Cybersecurity Governance
Policies and procedures, roles and responsibilities, OT cybersecurity risk management, change management, review and audit, and awareness and training.
02
DOMAIN 2
Cybersecurity Defense
Asset management, identity and access management, network security and segmentation, system and facility protection, and the core technical controls that protect OT day to day.
03
DOMAIN 3
Cybersecurity Resilience
The ability to withstand, respond to, and recover from OT cybersecurity incidents, including continuity of critical operations.
04
DOMAIN 4
Third-Party Cybersecurity
Managing the cybersecurity risks introduced by vendors, suppliers, and service providers with access to your OT systems.
Who it is for
Built for the people who own OTCC
OT and ICS security leaders at critical infrastructure operators in Saudi Arabia
Compliance and governance teams preparing for an NCA OTCC assessment
Plant and operations managers who need to understand their OTCC exposure
Consultants and integrators supporting Saudi operators through OTCC
Organizations that host or operate Saudi critical infrastructure, including from abroad
Why use it
From a vague sense of readiness to a real position
See your real position — a control-by-control view of where you comply and where you do not
Prepare for audit with evidence — organize the documentation an assessor expects
Prioritise by risk — focus remediation where the exposure is greatest
Built by OT engineers — written for live industrial environments, not repurposed from IT
Safety and security, together
Grounded in real industrial risk
OTCC matters most where OT protects people and processes, and Saudi Arabia is the country where the world first saw malware built to defeat a safety instrumented system. That attack proved a cyber compromise of an OT safety system is also a safety failure. Arista Cyber is one of the few firms that treats OT cybersecurity and functional safety as connected disciplines, which is why this checklist is grounded in real industrial risk. If your OTCC scope includes safety systems, our functional safety services in Saudi Arabia and our NCA OTCC compliance services go further than any checklist can.
NCA OTCC, answered
The Operational Technology Cybersecurity Controls, OTCC-1:2022, are Saudi Arabia's mandatory cybersecurity standard for protecting industrial control systems that form part of critical national infrastructure. They were issued by the National Cybersecurity Authority as an extension of the Essential Cybersecurity Controls, the ECC.
OTCC-1:2022 is organized into four domains, 23 subdomains, 47 main controls, and 122 sub-controls. The four domains are Cybersecurity Governance, Cybersecurity Defense, Cybersecurity Resilience, and Third-Party Cybersecurity.
Yes. For organizations that own, operate, or host critical national infrastructure and its industrial control systems in Saudi Arabia, OTCC compliance is a mandatory regulatory requirement, with penalties for non-compliance reaching up to 25 million riyals.
OTCC applies to public and private sector operators of critical national infrastructure in Saudi Arabia, across sectors including energy, oil and gas, water, power, and manufacturing. The requirement can also extend to organizations that host or operate this infrastructure from outside the Kingdom.
The checklist turns the full OTCC framework into a control-by-control assessment tool, so you can see where you comply, where you have gaps, and what evidence you need for audit. For hands-on support, explore our NCA OTCC compliance services.