In most markets the line between operational technology and corporate IT is an architectural preference. In Saudi Arabia's Eastern Province it is a regulated boundary. The National Cybersecurity Authority's Operational Technology Cybersecurity Controls (OTCC-1:2022) apply to industrial control systems in government organisations and in private organisations operating critical national infrastructure — which is a fair description of much of the industrial base around Dammam, Dhahran, Jubail and Ras Tanura.
If you are building software that will read from a plant, that fact reshapes the architecture before you have drawn a box. And if you are selling that software, a second fact reshapes the commercial case: Aramco's iktva programme, which in February 2026 reached its 70% local content target and is now aiming at 75% by 2030.
Engineering context, not legal or compliance advice. NCA is the authority on OTCC and on whether it binds a given organisation.
The regulated boundary
OTCC-1:2022 was adopted by NCA in April 2022 and extends the Authority's Essential Cybersecurity Controls (ECC) into the operational domain. Its structure is 4 main domains, 23 subdomains, 47 main controls and 122 sub-controls, with the domains being Cybersecurity Governance, Cybersecurity Defense, Cybersecurity Resilience and Third-Party Cybersecurity.
Scope is the part to read carefully. The controls target industrial control systems in facilities deemed critical, owned or operated by Saudi government organisations, and private-sector organisations owning, operating or hosting critical national infrastructure on the government's behalf — covering all devices, systems and networks used to operate or automate industrial processes.
Two consequences follow for anyone writing software near a plant.
You are probably not the regulated party — and that does not help you. The obligation sits with the asset owner. But Third-Party Cybersecurity is one of the four domains, which means your presence in their environment is itself something they must control. In practice the operator's compliance posture becomes your requirements document: what you may connect to, how you may connect, what you may store, who on your team may touch it, and what evidence you must produce.
"We'll just pull the data into the cloud" is where projects die. The instinct that serves you everywhere else — put an agent on the machine, stream to a managed service, build the dashboard — proposes exactly the thing the controls exist to prevent. Not because cloud is forbidden, but because an unbroken path from a process network to the internet is the risk being regulated.
Design for the boundary, not around it
The architecture that survives review has the same shape almost every time.
Data leaves the OT network; commands do not enter it. Treat the boundary as one-way by default. Read historian and telemetry data outward into a DMZ, and build your analytics, reporting and ML on that side. Any feature that writes back into a control system is a different project with a different approval path — and most requirements described as "control" turn out, on inspection, to be advice to an operator who then acts, which needs no write path at all.
Put the integration in a DMZ, not in the plant and not in the cloud. A demilitarised zone between process and enterprise networks — the Purdue-model arrangement most industrial sites already run — is where your collector, broker or historian replica belongs. Design assuming you get a host there, no inbound connections, and an egress allowlist.
Assume no internet from the plant floor. No package installs at deploy time, no licence server call-home, no CDN font, no telemetry SDK phoning an analytics endpoint. Vendor them all. A dependency that fetches something at runtime will work perfectly in staging and fail in the only environment that matters.
Make your software auditable by design. The operator has to evidence controls across governance, defence, resilience and third parties. Build so that their evidence is a query, not an archaeology project: immutable logs of who accessed what, versioned configuration, a recorded deployment history, and a clear list of every network flow the system opens. You will be asked for this. Producing it in an afternoon rather than a fortnight is a real commercial advantage.
Plan around turnarounds. Industrial sites change during scheduled maintenance windows, not on your release cadence. A shutdown or turnaround may come once or twice a year and is planned long in advance. Anything requiring plant downtime has to align to it — which means your project plan is subordinate to theirs, and a missed window can cost six months.
Industrial data is not application data
The second thing that catches teams from a web or SaaS background is the shape of the data itself.
It is time-series, at volume, and mostly unchanging. A plant with tens of thousands of tags sampling at seconds produces a firehose of values that are usually identical to the last one. A normalised relational schema with a row per reading will work in the pilot and collapse in production. Use a time-series store, understand compression and deadbanding, and decide deliberately what resolution you keep and for how long.
Tags are not a schema. Historian tags carry names built from a plant's own conventions — unit, equipment, measurement, sometimes a decades-old numbering scheme. They are the vocabulary the people on site actually use, so do not rename them into something tidier. Map them; keep the original as the identifier.
Quality is a property of every value. Industrial protocols carry a status alongside a reading: good, bad, uncertain, stale. A system that reduces that to a number will happily average sensor failures into its reports. Carry quality through to the point of display, and make "this instrument was faulty for six hours" visible rather than smoothed away.
Units and conventions are a correctness problem. Mixed unit systems are normal in this industry. Barrels, cubic metres, standard versus actual conditions, gauge versus absolute pressure. Put the unit in the type, convert at boundaries, and never let a bare number cross a module edge.
Timestamps come from the field. Record the source timestamp, not the ingestion time, and keep them distinct. Late and out-of-order data is routine when a link drops and a buffer flushes, so the pipeline must be idempotent and tolerant of backfill.
iktva: the commercial half
For a software company, the Eastern Province is not only a technical market. Aramco's In-Kingdom Total Value Add programme is the mechanism by which local content is measured across its supply chain, and it is consequential for suppliers.
The scale is real. Aramco announced on 11 February 2026 that iktva had achieved its 70% local content target, with a new goal of 75% by 2030. The company reports that since inception the programme has added $280 billion to Saudi GDP, attracted $9 billion of inward investment, and contributed to more than 200,000 direct and indirect jobs, alongside more than 200 localisation opportunities across 12 sectors representing an annual market of $28 billion.
What matters to a vendor is how the score is composed. It is commonly described as combining localised goods and services, salaries paid to Saudis, training and development of Saudis, supplier development spending, and R&D. Treat that breakdown as directional and confirm it against Aramco's own iktva material before you build a commercial strategy on it — but the direction is unambiguous, and it says something useful: local content here is not only about where a thing is bought. It is about employment, training and development inside the Kingdom.
For a software business that has honest consequences. Delivery entirely offshore scores differently from delivery involving Saudi engineers who are trained and developed on the work. That is a structural commercial fact rather than a marketing preference, and it is better confronted at proposal stage than discovered during supplier registration.
What this adds up to
Building for the Eastern Province industrial sector is a different discipline from building a product or a portal. The constraints come from the plant and the regulator rather than from the backlog, the data does not behave like application data, and the commercial model rewards a delivery structure that many vendors do not have.
None of which makes it exotic. It makes it specified — and a specified environment rewards teams that read the specification. The failure mode we see is not incompetence; it is a good web architecture applied unchanged to an industrial network, discovered at the operator's security review, six weeks before a turnaround.
Related reading: Saudi cloud data residency and CST classification for where the data may physically sit, Saudi government platform integrations for access timelines, and ZATCA Wave 25 for the invoicing obligation that arrives alongside. For the market itself, app development in Dammam.
Frequently asked questions
What is OTCC-1:2022?
The National Cybersecurity Authority's Operational Technology Cybersecurity Controls, adopted in April 2022. Four domains — Cybersecurity Governance, Cybersecurity Defense, Cybersecurity Resilience and Third-Party Cybersecurity — with 23 subdomains, 47 main controls and 122 sub-controls.
Does OTCC apply to us as a software vendor?
The obligation sits with the organisation owning or operating the industrial control systems. But Third-Party Cybersecurity is one of the four domains, so a regulated operator's controls will be applied to you as a condition of working in their environment.
Can industrial data go to the cloud?
The question is not cloud or not cloud; it is whether there is an unbroken path from the process network outward. The workable pattern is data flowing out through a DMZ, with no inbound path to the control network.
Why can't we just install an agent on the control system?
Because what you may install on an industrial control system, and what it may talk to, is governed by the operator's controls — and often by the equipment vendor's support terms. Read outward from a historian or a DMZ collector instead.
What database should industrial telemetry use?
A time-series store. A row-per-reading relational schema does not survive tens of thousands of tags at second-level sampling.
What is iktva?
Aramco's In-Kingdom Total Value Add programme, which measures and drives local content across its supply chain. It reached its 70% target in February 2026 and targets 75% by 2030.
Does iktva affect a software supplier?
Yes. Local content as measured there reflects employment, training and development in the Kingdom, not only procurement location — so how you structure delivery is a commercial variable, not just an operational one.
What is the most common planning mistake?
Ignoring turnarounds. Anything needing plant downtime waits for a scheduled maintenance window, and those are planned far ahead.
Sources
- NCA — Operational Technology Cybersecurity Controls (OTCC)
- NCA — Operational Technology Cybersecurity Controls, OTCC-1:2022 (PDF)
- Digital Policy Alert — adoption of the Operational Technology Cybersecurity Controls
- Aramco — iktva achieves 70% local content target (11 February 2026)
- Aramco — In-Kingdom Total Value Add (iktva)
- Saudi Press Agency — Aramco achieves 70% local content target
OTCC structure and scope above are corroborated across several independent OT-security analyses; NCA's own document was not reachable from our network at the time of writing, so confirm the current controls and your own applicability with NCA directly. The iktva score composition is likewise a secondary-source description — Aramco's iktva material is the authority.