Framework
NCA OTCC-1:2022 in Practice
4 domains, 23 subdomains, 47 main controls, 122 sub-controls.
Strategy Domain
Governance, risk management, and OT cybersecurity policy aligned to NCA requirements.
People Domain
Role-based OT security awareness and training for engineering and operations staff.
Process Domain
Change management, incident response, and asset inventory processes for OT environments.
Technology Domain
Passive monitoring, network segmentation, and secure remote access controls.
Passive Monitoring
Non-Disruptive Visibility
Asset Discovery
Passive fingerprinting of PLCs, RTUs, and SCADA servers without active scanning that could disrupt process control.
Protocol-Aware Inspection
Deep packet inspection of Modbus, DNP3, and IEC-61850 traffic for anomalies.
Purdue Model Segmentation
Monitoring and controls mapped to Purdue Levels 1-3, from field devices to the operations DMZ.
FAQ
OT / SCADA Cybersecurity - FAQ
What is NCA OTCC-1:2022?
OTCC-1:2022 is the National Cybersecurity Authority's Operational Technology Cybersecurity Controls framework, developed as an extension to the Essential Cybersecurity Controls (ECC) specifically to protect OT and ICS environments, structured across 4 domains, 23 subdomains, 47 main controls, and 122 sub-controls.
Why is passive monitoring preferred for OT and SCADA networks?
Active vulnerability scanning can disrupt sensitive industrial control devices such as PLCs and RTUs, some of which were not designed to handle unexpected network traffic. Passive monitoring observes network traffic without sending probe packets, giving visibility into assets and threats without risking process interruption.
Does OT cybersecurity replace HCIS physical security requirements?
No. HCIS physical security directives and NCA OT cybersecurity controls address different risk domains and are complementary; a fully compliant critical facility implements both the physical protection required by HCIS and the cybersecurity controls required by NCA for its OT environment.
