NCA OTCC Compliance Toolkit v3.0.1 (Bilingual EN/AR)

Everything an OT/ICS facility in Saudi Arabia needs to assess, implement, evidence and sustain compliance with the NCA Operational Technology Cybersecurity Controls (OTCC-1:2022): all 169 controls (47 main + 122 sub; 150 scored criteria) traced from requirement to policy, verification and evidence, with facility-level (1 / 2 / 3) logic built in. Bilingual English + Arabic, fully editable. Built by a certified GRC practitioner (CISSP, CISM, CRISC, CISA).

1. 01

   Assessment Workbook (Excel, blank + filled SAMPLE)

   Entity Profile with facility level and approved boundary; every OTCC control with level applicability, status, evidence reference, reviewer, verification and review date, with evidence-gated acceptance. Dashboard with indicator tiles, official subdomain table (EN/AR) and chart, filtered by the approved facility level. Control Library with the official wording in English and Arabic, control type, facility level and an "In official tool" flag (the 14 subcontrols that appear only in the published controls document are identified). Evidence tracker, operating settings, indicators and source register.

2. 02

   Risk & Remediation Register (Excel, blank + filled SAMPLE)

   OT-specific scales, risk register with inherent and residual scoring, remediation flags, owners and due dates, and KPI/KRI status. Coverage matrix and evidence index (Excel) link all 169 controls to policy clauses, verification checks and cases.

3. 03

   23 Policies + 4 Forms (Word, separate EN and AR editions)

   One policy per OTCC subdomain: policies and procedures, roles and responsibilities, risk management, ICS project management, change management, periodical review and audit, human resources, awareness and training, asset management, identity and access, system and processing facilities protection, network security, mobile devices, data protection, cryptography, backup and recovery, vulnerabilities, penetration testing, event logs and monitoring, incident and threat management, physical security, business continuity resilience and third-party cybersecurity. 510 implementation statements, at least 9 adjustable operating settings per policy, two six-step procedures per policy, KPIs and verification annexes. Forms: OT asset inventory, OT change and maintenance permit, safety-system cyber impact, and removable-media log.

4. 04

   Implementation Guides (PDF + DOCX, 52 pages EN / 52 pages AR)

   Adoption and safe implementation, facility levels and assessment denominators, evidence acceptance, workbook use and subdomain-by-subdomain guidance with plant-safe constraints (no unapproved active scanning or automatic isolation).

5. 05

   Evidence Samples

   Eight domain evidence books (four per language): 169 learning cases, each with a positive example, an insufficient example and a verification workpaper.

• A one-page Executive Dashboard sheet in the assessment workbook: headline KPI tiles, compliance by domain and subdomain, and charts
• Every figure is calculated automatically from your assessment, so it updates the moment you change a status
• Drop it straight into a steering-committee or board pack; the separate risk dashboard shows inherent and residual risk at a glance

Not sure what evidence an assessor will ask for? Every expected evidence item for every control now has a dedicated, realistic sample in 05-Evidence-Samples/Evidence-Artifacts.

• 63 evidence artifacts: 13 Word documents, 34 Excel registers and 16 screenshot images (consoles, dashboards, emails and diagrams)
• Examples: OT configuration baselines, an inter-zone firewall rule export, an OT IAM effectiveness dashboard, OT incident-response training statistics, unauthorised-change monitoring use cases, OT contractor session logs and an OT dev/test network diagram
• Each sample carries a reference number, owner role, date, classification and an assessor verification note, so your team sees exactly what good evidence looks like
• Evidence Coverage Matrix (Excel): maps all 351 expected evidence items to the control they prove and to the sample that shows it
• These sit alongside the evidence books, so you get the explanation and a ready example for every control

• One ZIP organised in numbered folders, ready to share with your team
• Blank workbooks for your own assessment plus filled SAMPLE versions to learn from
• Editable Word, Excel and PDF files in English and Arabic
• CHANGELOG and a release manifest with SHA-256 checksums for every file

OT/ICS security, cybersecurity GRC, plant engineering, internal audit and assurance teams at energy, utilities, oil and gas, water, manufacturing, transport and other critical-infrastructure operators subject to OTCC.

Your copy is individually licensed and watermarked with your name and order number, then emailed to you within minutes of purchase. One licence covers one legal entity. Consultants: contact support@cyberhacking.io for a multi-entity licence.

All sales are final. Faulty files are replaced when reported within 14 days to support@cyberhacking.io.

Official NCA wording is attributed; policies, defaults and examples are implementation aids. This independent resource does not claim NCA approval, certification or endorsement.