Remote maintenance
Define who authorizes the supplier session, what equipment it can reach and how access ends. Validate the path without exposing control systems directly.
All frameworks & requirements
National Cybersecurity Authority
NCA OT Cybersecurity Controls Readiness
Build NCA OTCC readiness around industrial visibility, safe segmentation, vendor access, monitoring and recovery without compromising operations.
OTCC 1-2022Sources reviewed: 4 November 2026
Understand the requirement. Connect it to operations.
NCA Operational Technology Cybersecurity Controls extend ECC for industrial control systems and operational technology. The official publication identifies OTCC 1-2022 and provides a methodology/mapping annex. Industrial cyber risk must be understood in terms of operational consequences, not only vulnerability counts.
Production availability, safety, quality and environmental impact change how controls should be introduced. A practical readiness program involves engineering and operations from the start, records process dependencies and tests changes under approved conditions before deployment.
Confirm applicability before choosing controls.
Confirm which sites, industrial processes, control systems and connected services are relevant to the applicable requirements. Include historians, engineering workstations, remote support, identity services and IT/OT interfaces where they affect the assessed environment.
Use the official OTCC scope and applicable ECC baseline together. Agree the safe assessment method with plant owners, system vendors and responsible teams. Never assume that an IT scanning or patching approach is appropriate for a live industrial environment.
Turn requirements into implementation and evidence.
| Focus area | Implementation examples | Evidence to maintain |
|---|---|---|
| Industrial asset visibility | Validate assets and process communications using suitable discovery methods. | Reviewed asset register, diagrams and unknown-asset actions. |
| Segmentation and interfaces | Review zones, permitted conduits and IT/OT boundary access. | Approved communication matrix and tested firewall rules. |
| Vendor and engineer access | Control entry paths, privilege, approval and session traceability. | Remote-access approvals and reviewed activity records. |
| Monitoring and response | Connect industrial alerts to operational decision makers. | Detection use cases, escalation contacts and exercises. |
| Change and recovery | Plan vendor-compatible changes and restoration sequences. | Approved windows, rollback plans and recovery validation. |
What this looks like in practice.
A legacy control platform
Where a patch cannot be applied safely, document the risk and assess compensating safeguards. A permanent unsupported exception without an owner is not a treatment plan.
From readiness assessment to working controls.
Agree the scope, responsible owners and acceptance criteria before work begins. The approach is tailored to your systems, suppliers, operating constraints and existing evidence.
Assess and prioritize
Review applicability, current controls and evidence. Identify gaps and dependencies, distinguish design from operating effectiveness, and prioritize actions with accountable owners.
Design the improvements
Translate approved requirements into architecture, policies, processes and technical changes. Reuse effective controls while keeping national and sector mappings distinct.
Implement and validate
Configure agreed safeguards, document procedures and validate representative workflows within authorized access and change windows. Record exceptions and residual risks.
Handover and sustain
Organize evidence, transfer operating knowledge and define a review cadence. Track corrective actions as systems, services, suppliers and requirements change.
Agree concrete deliverables.
- A scope and applicability record with assumptions and responsibilities.
- A gap/risk register and prioritized remediation roadmap.
- Control mapping, architecture recommendations and operating procedures.
- An evidence register, agreed validation results and handover material.
Deliverables, depth, access and timing depend on the statement of work. This is readiness and implementation support; it does not include a promise of regulator acceptance or formal certification.
Common questions.
Can we actively scan the plant?
Only through an authorized method agreed with operations and relevant vendors. Start with safer evidence and discovery approaches; unexpected traffic can affect sensitive devices.
Does OTCC replace ECC?
No. OTCC extends the baseline for the applicable industrial environment. Keep cross-references clear and avoid duplicate evidence requests where one control supports both.
Must every legacy device be replaced?
Replacement depends on support, consequence, exposure and feasible safeguards. Assess alternatives and residual risk rather than treating one solution as mandatory.
Can IT and OT use the same SOC?
They can share capabilities, but monitoring, escalation and response must reflect industrial context. An IT containment action may interrupt a process or affect safety.
How do we control implementation risk?
Agree scope, operational owners, maintenance windows, acceptance criteria and rollback before changes. Validate proposed controls in a suitable environment when available.
Start with the official sources.
Read the linked authority publications for the binding scope, wording and applicable updates. The implementation examples on this page are practical recommendations, not a reproduction of every regulatory requirement.
General readiness and technology information, not a legal opinion, regulator endorsement or guarantee of compliance. Confirm applicability, current versions and sector directions with the competent authority and qualified advisers.
Related frameworks and requirements
Define the right scope for your organization.
Bring your services, systems, supplier dependencies and existing findings. We will help turn them into a practical assessment and implementation scope.
Discuss your readiness