NCA ECC
Gap assessment and remediation against the National Cybersecurity Authority Essential Cybersecurity Controls, the mandatory baseline for most Saudi organizations.
Learn moreAssess your industrial control systems against the National Cybersecurity Authority's Operational Technology Cybersecurity Controls, with a method that respects safety, uptime and the realities of plant environments.
The Operational Technology Cybersecurity Controls (OTCC-1:2022) extend the Essential Cybersecurity Controls to operational technology and industrial control systems: the networks, controllers and systems that run physical processes in sectors such as energy, water, manufacturing and utilities.
OT security differs from IT security. Availability and safety come first, systems are often old and cannot be patched quickly, and a careless scan can stop a process. The OTCC addresses governance, defence, resilience and third-party risk with that context in mind, and an assessment has to do the same.
Every engagement follows the Cyber Shields rhythm: Assess, Protect, Monitor. For this engagement, that translates into the following steps.
Findings are anchored to recognized frameworks so they are defensible and cross-mappable.
The documents behind this page, linked at the publisher. Where a Saudi regulation is published in both languages, the Arabic text is the binding version.
Every engagement is scoped individually. Pricing depends on the size and complexity of your environment, the systems or controls in scope, and the timeline you need to work to. Rather than publish figures that rarely fit a specific situation, we prepare a written proposal with a clear fee and schedule once your scope is understood.
Tell us about your organization and the deadline you are working toward, and we will return a tailored proposal within five business days, following a signed Non-Disclosure Agreement.
No. We use passive, non-disruptive methods by default and agree any active work, its timing and its safety rules in advance with your operations team.
The OTCC extends the ECC to operational technology, with requirements suited to industrial environments where safety and availability come first.
Yes. Where useful we cross-map findings to IEC 62443, which many OT vendors and integrators already use.
Yes. Reports, the executive summary, and the readout session are available in both Arabic and English at no additional cost.
Gap assessment and remediation against the National Cybersecurity Authority Essential Cybersecurity Controls, the mandatory baseline for most Saudi organizations.
Learn moreThe stricter NCA controls for critical systems, built on top of the ECC.
Learn moreHardening, segmentation, secure baselines and architecture review for production environments.
Learn moreTell us about your plants and systems and we will return a written proposal within five business days. NDA first, always.