NCA · OTCC-1:2022

Operational Technology Cybersecurity Controls (OTCC)

A regulatory framework issued by the National Cybersecurity Authority (NCA) defining requirements for protecting operational technology systems and their associated assets. It spans governance, defense, resilience, and risk management across industrial and operational environments — a reference for aligning IT and OT protection with national requirements.

Practical protection that respects production sensitivity — comprehensive coverage of IT+OT and industrial IoT environments.

Issuing AuthorityNational Cybersecurity AuthorityVersionOTCC-1Year2022Bound AudienceIndustrial & operational

Controls covered

22+

Active technologies

Security domains

Who are you?

Covered controls and matching solutions

Control #	Control name & description	Matching technologies
2-1	Asset Management OT asset inventory, criticality	NDR NAC UEM/MDM Data Classification
2-2	Identity & Access Management Identity separation, MFA, remote access	PAM cIAM MFA SSO ZTNA Windows MFA Passwordless
2-3	Systems & Processing Protection Endpoint/server protection, whitelisting	EDR EPM NDR NAC DLP Watermarking Cybersecurity Advisory Services
2-4	Network Security Management OT segmentation, zones, DMZ	NDR NAC ZTNA Deception Cybersecurity Advisory Services
2-5	Mobile Devices Security Mobile restriction, central management	UEM/MDM Secure Mobile Container Secure Communication DLP Data Classification
2-6	Data & Information Protection OT data protection, transfer control	DLP Data Classification Watermarking Secure Mobile Container Email Archive
2-7	Cryptography Encryption, periodic effectiveness	Certificate/Key Management Secure Communication Secure Mobile Container Email Archive
2-9	Vulnerability Management Assessment, low-disruption remediation	EDR NDR WAF/WAAP Microgateway Cybersecurity Advisory Services
2-10	Penetration Testing OT-tailored testing	NDR Cybersecurity Advisory Services
2-11	Event Logs & Monitoring UBA, remote sessions, monitoring	NDR Deception EDR NAC WAF/WAAP Cybersecurity Advisory Services
2-12	Incident & Threat Management Response alignment, RCA, simulation	NDR EDR Deception Email Security WAF/WAAP Cybersecurity Advisory Services

2-1

Asset Management

OT asset inventory, criticality

NDR NAC UEM/MDM Data Classification

2-2

Identity & Access Management

Identity separation, MFA, remote access

PAM cIAM MFA SSO ZTNA Windows MFA Passwordless

2-3

Systems & Processing Protection

Endpoint/server protection, whitelisting

EDR EPM NDR NAC DLP Watermarking Cybersecurity Advisory Services

2-4

Network Security Management

OT segmentation, zones, DMZ

NDR NAC ZTNA Deception Cybersecurity Advisory Services

2-5

Mobile Devices Security

Mobile restriction, central management

UEM/MDM Secure Mobile Container Secure Communication DLP Data Classification

Advisory services

Cybersecurity Advisory Services

Local delivery depth that complements the technologies: security architecture design, gap assessment, penetration testing, and incident response — addressing 6 of NCA · OTCC-1:2022's controls that call for advisory expertise, not a product alone.

Architecture design
Gap assessment
Penetration testing
Incident response

Request advisory services

Need something more specific?

Let's design the right path for you

Every organization has its own regulatory context and priorities. If nothing above matches your situation exactly — or you'd prefer an approach built around your reality — talk to Looptech experts to understand your needs and design a path that fits your environment and requirements.

Book a discussion

Search Looptech

Search Looptech

Operational Technology Cybersecurity Controls (OTCC)