The standards and regulations we work to
We assess and design against international standards and the national rules of the countries where your assets operate. Regulations change, so we confirm the current version for every engagement. We don't issue certifications; we tell you, with evidence, where you stand.
International standards
Authority
IEC, ISA, ISO
The core series for OT security: security programmes (2-1), service providers (2-4), risk assessment, zones and conduits (3-2), system requirements and security levels (3-3), secure product development and components (4-1, 4-2).
Security for substation and power-system protocols such as IEC 61850, IEC 60870-5-104 and DNP3.
Management-system controls, with energy-utility guidance for process control in 27019.
Where cybersecurity meets functional safety: protecting safety systems and their engineering access.
NIST (US) guidance for OT and ICS
Authority
National Institute of Standards and Technology, used worldwide
The main NIST guide for securing OT and industrial control systems, including an OT overlay of security controls.
Govern, Identify, Protect, Detect, Respond and Recover: a common language for OT security programmes and board reporting.
Detailed control catalogue; tailored for OT through the overlay in SP 800-82.
How to apply the Cybersecurity Framework to manufacturing and process environments.
India
Authority
Central Electricity Authority (CEA), CERT-In, NCIIPC
Rules for power entities covering audits of critical systems, testing before commissioning and incident reporting.
The power-sector guidelines that preceded the regulations.
National directions on reporting cyber incidents and keeping logs.
Guidance for organisations designated as critical information infrastructure.
India's personal data protection law.
Qatar
Authority
National Cyber Security Agency (NCSA)
Qatar's national standard for securing industrial control systems in critical sectors.
Qatar's national information assurance requirements for government and critical sectors.
Owner cybersecurity specifications written into project contracts.
Qatar's personal data protection law.
United Arab Emirates
Authority
UAE Cybersecurity Council, TDRA, Dubai Electronic Security Center
Federal information assurance controls for critical entities.
Dubai's security regulation for government and critical entities.
Owner and sector cybersecurity specifications written into project contracts.
Federal personal data protection law.
Saudi Arabia
Authority
National Cybersecurity Authority (NCA)
The baseline controls for government and critical national infrastructure.
National controls specific to OT and industrial control systems.
Additional controls for systems designated as critical.
Third-party cybersecurity requirements and compliance certificate for Aramco suppliers.
Saudi Arabia's personal data protection law.
Oman, Kuwait and Bahrain
Authority
National cybersecurity authorities and sector regulators
Requirements from Oman's national cybersecurity authorities, plus the Personal Data Protection Law.
National cybersecurity requirements, CITRA regulations including data privacy, and operator specifications.
National cybersecurity requirements for critical infrastructure, plus the Personal Data Protection Law.
United Kingdom
Authority
NCSC, sector competent authorities (e.g. Ofgem, DESNZ, HSE)
Legal duties for operators of essential services, including energy and water.
The outcome-based framework regulators use to assess operators of essential services, including their OT.
UK data protection law.
We assess and design against these standards. We don't issue certifications, and our reports never claim a system is certified.