Keywords: Saudi Arabia, OT Cybersecurity Controls, Cybersecurity Regulations, Physical Security, Risk-Based Cybersecurity, ARC Advisory Group.
Overview
The regulatory environment for OT cybersecurity is heating up as attacks on critical infrastructure persist and the private sector continues to lose billions to ransomware and other forms of cyber-attack. Cyber-attacks have now become a major source of unplanned downtime for industry and infrastructure. Many countries are putting stricter cybersecurity controls in place, mandated at the government level. As the largest crude oil exporter in the world, the Kingdom of Saudi Arabia is no exception. The country’s National Cybersecurity Authority (NCA) released its Operational Technology Cybersecurity Controls (OTCC) in 2022 as a comprehensive cybersecurity mandate to address the country’s own challenges in protecting its national critical infrastructure, which is not just limited to upstream and downstream oil and gas. The OTCC is a comprehensive list of cybersecurity controls that all critical facilities must adhere to.
Since OTCC is informed by the ISA/IEC 62443 cybersecurity set of standards as well as information from other…
