Compliance
OT Cybersecurity in Saudi Arabia: Protecting Plant Networks
OT cybersecurity in Saudi Arabia protects the control systems that run plants, utilities and industrial sites. Waves Telecom helps operators and their suppliers in Jubail, Ras Tanura and the Eastern Province separate, protect and monitor OT networks in line with NCA OTCC.
- Fortinet Gold Partner
- Aligned to NCA OTCC-1:2022
- Based in Al Khobar
10 yearsin cybersecurity
150+companies passed Aramco CCC
Gold PartnerSophos & Fortinet
Why OT cybersecurity matters in Saudi Arabia
Operational technology (OT) is the equipment that runs physical processes: PLCs, SCADA, HMIs, engineering workstations and safety systems. In Jubail, Ras Tanura and Dammam, these systems run petrochemical, power, water and manufacturing sites. An attack on OT can stop production or create a safety risk, not just a data loss.
Many OT networks were built to stay isolated. Over time they have been connected to corporate IT, vendor laptops and remote access tools. OT cybersecurity in Saudi Arabia is about controlling those connections without disturbing operations.
Waves Telecom has 10 years in cybersecurity and is a Fortinet Gold Partner. We help plant operators and their suppliers design segmentation, secure remote access and keep evidence for audits.
The Saudi rule behind it: NCA OTCC-1:2022
The NCA's Operational Technology Cybersecurity Controls (OTCC-1:2022) cover industrial control systems in critical facilities. They apply to government bodies and to private organisations that own, operate or host critical national infrastructure. The NCA encourages other organisations to adopt them too. Compliance with the NCA's Essential Cybersecurity Controls is a prerequisite.
OTCC has 4 domains, 23 subdomains, 47 main controls and 122 subcontrols. Each facility is given a level from L1, the most critical, to L3. The controls include separating OT from corporate networks with zones and a DMZ. Remote access must use MFA, be encrypted, time-limited and monitored. Sites also need an asset inventory, hardened workstations, and backup and incident response.
OTCC also tells organisations to confirm that applying a control will not disrupt operations. Suppliers feel the same pressure: Aramco's CCC includes an Operational Technology classification for third parties.
OTCC-1:2022 has 47 main controls and 122 subcontrols, with facility levels from L1 (most critical) to L3.
How Waves approaches OT security
Walk-down and inventory
We list OT assets, network links and remote access paths with your operations team, without touching live control logic.
Gap review against OTCC
We compare what we find with the OTCC controls for your facility level and agree priorities with you.
Segmentation design
We design zones, a DMZ and firewall rules between IT and OT, and plan changes for agreed maintenance windows.
Secure remote access
We replace open vendor connections with controlled access that uses MFA, time limits and logging.
Install and document
We install and configure the equipment and hand over drawings, rule sets and evidence for audits.
What we deliver and who it is for
IT/OT segmentation
Firewalls between corporate and plant networks, with a DMZ for historians and data exchange.
Industrial-grade firewalls
Fortinet FortiGate models, including rugged options for harsh environments, supplied and configured by our team.
Remote access control
MFA-protected, logged access for vendors and engineers, switched on only when needed.
OT asset records
An up-to-date inventory of controllers, HMIs and network devices with owners and criticality.
Plant operators
Petrochemical, utility and manufacturing sites in Jubail, Ras Tanura and Dammam working toward OTCC.
Suppliers to industry
Vendors that connect to plant networks and need controls in place for an Aramco CCC OT classification.
Brands and partners
FortinetSophosCiscoMicrosoftDellHPE
Frequently asked questions
Does OTCC apply to our plant?
OTCC applies to industrial control systems in critical facilities run by government bodies or by private organisations that own, operate or host critical national infrastructure. Other organisations are encouraged to adopt it. We can review your situation with you, but the NCA or your regulator confirms formal scope.
Will security work stop production?
It should not. OTCC itself asks organisations to confirm that controls will not disrupt operations. We start with passive review, agree every change with your operations team and schedule work in maintenance windows.
What is the difference between IT and OT security?
IT security protects data and office systems. OT security protects the equipment that controls physical processes, where uptime and safety come first. The tools overlap, but OT needs more careful change control.
Which products do you use?
We are a Fortinet Gold Partner and often use FortiGate firewalls, including rugged models, for segmentation. We also work with Cisco, Sophos and Microsoft. We choose based on your site and existing equipment.
We are a supplier, not an operator. Does OT security affect us?
It can. Aramco's CCC includes an Operational Technology classification for third parties. If your staff or tools connect to plant networks, expect your customer to check your controls.
Do you work on site in Jubail and Ras Tanura?
Yes. Our team is based in Al Khobar and works on site across the Eastern Province. We follow the site's permit and safety rules.
Start with an OT security review
Tell us about your site and how your OT network connects today. We will propose a safe first step.
- 📞 +966 58 236 5619
- 💬 +966 58 236 5619
- ✉️ info@wavestelecom.net
- 📍 3266 Adh Dhahran – Al Aqrabiyah Dist, Al Khobar 34446
