HIGH SEVERITYNCA ECCCRITICAL INFRASTRUCTURE
In a significant move to strengthen national cybersecurity posture, the National Cybersecurity Authority (NCA) has issued comprehensive mandatory security controls specifically targeting operational technology (OT) environments within Saudi Arabia's critical infrastructure sectors. The directive, effective immediately with a 180-day implementation window, addresses growing concerns over sophisticated threats targeting industrial control systems, SCADA networks, and other OT assets that underpin essential services across energy, water, healthcare, transportation, and telecommunications sectors.

Key Details

The new NCA directive introduces eight core security domains that critical infrastructure operators must implement: network segmentation between IT and OT environments, continuous monitoring of industrial control systems, mandatory multi-factor authentication for remote access to OT networks, encrypted communications for SCADA systems, regular vulnerability assessments of OT assets, incident response plans specific to OT disruptions, supply chain security verification for OT vendors, and mandatory reporting of OT-related security incidents within 24 hours.

Organizations classified under the Essential Cybersecurity Controls (ECC) framework's critical infrastructure category must conduct comprehensive OT asset inventories, implement air-gapped or strictly segmented networks for the most sensitive industrial systems, and establish Security Operations Centers (SOCs) with dedicated OT security analysts. The directive specifically references alignment with IEC 62443 industrial cybersecurity standards and requires organizations to achieve compliance certification by Q3 2025.

"The convergence of IT and OT systems has created unprecedented attack surfaces in our critical infrastructure. This directive ensures that organizations protecting essential services have the security architecture, monitoring capabilities, and response procedures necessary to defend against nation-state actors and sophisticated cybercriminal groups targeting industrial systems." — NCA Executive Statement

Impact on Saudi Organizations

The directive will significantly impact Saudi Aramco, SEC (Saudi Electricity Company), SWCC (Saline Water Conversion Corporation), Saudi Railways, major healthcare providers, and telecommunications operators including STC, Mobily, and Zain KSA. Energy sector organizations, which represent the backbone of Vision 2030's economic transformation, face the most stringent requirements given their classification as Tier 1 critical infrastructure. Financial institutions under SAMA supervision operating critical payment infrastructure and data centers must also comply, creating overlap with SAMA Cyber Security Framework requirements.

Industry experts estimate implementation costs ranging from SAR 5 million to SAR 50 million depending on organizational size and current security maturity levels. Organizations with legacy OT systems face particular challenges, as many industrial control systems were designed decades ago without security considerations. The 180-day timeline has prompted urgent procurement activities for OT security solutions, network segmentation hardware, and specialized security personnel with industrial cybersecurity expertise—a skill set currently in short supply across the Kingdom.

📋 Relevant Frameworks:NCA ECCIEC 62443NIST CSFSAMA CSF

Recommendations

  • Immediately conduct comprehensive OT asset discovery and classification exercises to identify all industrial control systems, SCADA networks, and connected operational technology within your environment
  • Establish a cross-functional implementation team including OT engineers, IT security professionals, compliance officers, and operational leadership to develop a phased compliance roadmap
  • Prioritize network segmentation projects to create defensible boundaries between IT and OT environments, implementing industrial firewalls and unidirectional gateways where appropriate
  • Invest in OT-specific security monitoring solutions capable of understanding industrial protocols (Modbus, DNP3, OPC) and detecting anomalous behavior without disrupting operations
  • Develop or enhance incident response playbooks specifically for OT scenarios, including procedures for isolating compromised industrial systems while maintaining safe operational states
  • Engage with NCA-approved OT security consultants and solution providers to accelerate implementation and ensure compliance with technical requirements
  • Begin recruitment or training programs to develop internal OT security expertise, as this specialized skill set will be critical for ongoing compliance and security operations