OT & IoTCritical Infrastructure
We help energy, water, transport, telecom and industrial operators classify facilities, implement the NCA OTCC and CSCC on top of the ECC, and prepare evidence for audit, with a plan that respects how plants run.
01Overview
Critical national infrastructure (CNI) security protects the facilities and systems a country depends on, such as energy, water, transport, telecommunications and healthcare, from cyber attack. In Saudi Arabia the NCA sets mandatory controls for organisations that own, operate or host CNI, building on the ECC with the OTCC for operational technology and the CSCC for critical systems.
Government bodies and private organisations that own, operate or host CNI, as identified by the NCA. Confirm your status with the NCA.
The OTCC addresses OT and industrial control systems. The CSCC addresses critical systems. Both build on the ECC.
By the consequence of compromise, into levels with progressively stronger controls.
Scoping, gap assessment, remediation, evidence and exercises.
02What we do
One programme across IT and OT.
Identify facilities and systems in scope and classify them by criticality.
What you receive
A defensible scope and a target control set.
Control-by-control assessment with evidence review.
What you receive
A prioritised gap list.
Policies, architecture and technical controls implemented and tested.
What you receive
Controls that run in practice.
Evidence packs and mock audits before the regulator comes.
What you receive
Confidence going into the audit.
Tabletop and technical exercises across IT and OT.
What you receive
A team that has practised.
Control over integrators, vendors and remote access.
What you receive
Fewer risks through suppliers.
03How we work
Typical stages. Timing depends on scope.
Facilities, systems and applicable controls.
Gap assessment and risk analysis.
Costed remediation roadmap.
Policies, architecture and technical controls.
Collect and organise evidence.
Mock audit and resilience exercise.
04Controls
Several documents work together. We map them into one programme.
The baseline that all in-scope organisations must meet first.
How we help: Baseline gap assessment.
Additional controls for OT environments, scaled by facility criticality.
How we help: OT implementation.
Controls for systems identified as critical.
How we help: Critical systems hardening.
Controls for data classification and protection.
How we help: Data programme alignment.
05Reference
Which document covers what.
| ECC | OTCC | CSCC | |
|---|---|---|---|
| Focus | Essential cybersecurity baseline | Operational technology and ICS | Critical systems |
| Applies to | Government and CNI organisations | OT of CNI operators | Systems identified as critical |
| Relationship | Foundation | Extends the ECC for OT | Adds requirements to the ECC |
| Our service | NCA compliance programme | OT security services | Critical systems hardening |
Summary only. Applicability and requirements are set by the NCA; confirm against the current documents.
06Saudi Arabia and the GCC
Attacks on critical operators affect the whole economy.
Giga-projects, smart cities and new industrial hubs create new critical infrastructure with security built in from the start.
Publicly reported attacks on safety and industrial systems in the region show the stakes.
Critical operators must use Tier 1 licensed managed SOC providers under NCA rules. We help you plan the delivery model.
Riyadh-based team with access to engineers across the Kingdom.
07Why GoAgile
One team across IT, OT and compliance.
Talk to a security specialistWe work across all three.
Plans that fit maintenance cycles.
Prepared for NCA audit.
Resilience tested, not assumed.
Both languages for leadership.
Credentials
08Clients
Organisations in regulated sectors choose GoAgile because security is delivered by the team that also builds and runs their infrastructure.
SAMI
Defence and industry
Tier-1 Saudi bank
Banking
National energy operator
Oil, gas and power
Government authority
Public sector
Regional telecom operator
Telecommunications
Healthcare group
Hospitals and clinics
Retail and e-commerce group
Retail
Ports and logistics operator
Logistics
Insurance company
Insurance
Fintech and payments provider
Financial technology
Industrial manufacturer
Manufacturing
SAMI engaged GoAgile to strengthen its cyber security posture with protection aligned to the rigorous security and compliance standards of its sector.
Plant networks had grown without a clear map, and remote access for vendors was a concern.
Result: A mapped, segmented network with a prioritised remediation plan the plant team could schedule.
The authority had to demonstrate compliance with the NCA Essential Cybersecurity Controls and did not know where to start.
Result: A clear compliance position, a funded roadmap and audit-ready evidence.
GoAgile strengthened our cybersecurity posture with enterprise-grade protection aligned to the rigorous security and compliance standards our sector demands. Their team has been a dependable partner on a mission-critical engagement.
Client names are withheld for confidentiality.
09Related services
Each service stands alone and works better with the others.
Tell us about your sector and sites. We will propose a scoping and gap assessment.
Talk about OTCC readiness10Questions answered
Tell us about your environment and what you need. We will respond with a scoped proposal, not a brochure.
Specialists who do this work every week, reporting in Arabic and English.