Industrial security projects often start with the same trigger: remote access has grown uncontrolled, networks have evolved organically, and a ransomware incident in the industry makes “OT security” suddenly urgent.
If you operate in the EU, regulatory drivers like NIS2, the Cyber Resilience Act (CRA) and the EU Machinery Regulation are now part of the conversation. Outside the EU—especially in the UAE/GCC—the driver is usually customer audits and national control frameworks.
This article explains what changes (regulatory drivers, language, audit expectations) and what stays the same (risk model, practical controls, deliverables). It also shows a pragmatic way to build one OT security baseline that works internationally.
1) What stays the same: OT risks and operator pain points
Whether your plant is in Germany, the UAE or Saudi Arabia, OT incidents typically translate into the same business problems:
- Downtime / business interruption (lost production, missed deliveries, penalties)
- Manipulation risk (process values, PLC logic, recipes, setpoints)
- Uncontrolled third-party access (vendors, contractors, remote support)
- Long lifecycles + patch constraints (hard to update, hard to test, limited shutdown windows)
The reality of OT does not change much across borders: legacy systems, tight uptime constraints, mixed IT/OT ownership, and a vendor ecosystem that needs access “right now”.
That’s why the most effective OT security programs focus less on buzzwords and more on operationally viable fundamentals:
- governed remote access,
- segmentation/containment,
- minimum access rights,
- logging and traceability,
- and repeatable processes for change, patch/vulnerability handling, and incidents.
2) What changes in the EU: compliance pressure and “evidence requirements”
NIS2: scope, supervision, and penalties
The EU’s NIS2 Directive is designed to raise a “high common level of cybersecurity” across sectors and introduces clear expectations around security risk management and incident reporting.
Two points matter most for operators:
(a) Scope includes manufacturing subsectors.
NIS2 explicitly includes “Manufacturing” in Annex II, with references to NACE divisions such as Division 28 (manufacture of machinery and equipment n.e.c.) and others.
(b) Penalties are real.
Article 34 sets minimum maximum administrative fines:
- essential entities: at least €10,000,000 or 2% of worldwide annual turnover (whichever is higher)
- important entities: at least €7,000,000 or 1.4% of worldwide annual turnover (whichever is higher)
Even if OT security is not spelled out as “IEC 62443 required”, the practical direction is clear: organisations need a defendable security posture and audit-ready evidence.
CRA: product security becomes a legal obligation (but timelines matter)
The Cyber Resilience Act (Regulation (EU) 2024/2847) is a horizontal EU law for “products with digital elements”. It is directly applicable EU-wide and sets cybersecurity requirements and lifecycle obligations (e.g., vulnerability handling).
Timeline (from the legislative text and EU summaries):
- CRA entered into force on 10 Dec 2024
- it applies from 11 Dec 2027
- reporting obligations in Article 14 apply from 11 Sep 2026
- Chapter IV (conformity assessment bodies) applies from 11 Jun 2026
For operators, CRA matters even though it targets manufacturers: procurement and lifecycle expectations shift. Over time, buyers will expect clearer vulnerability handling, support periods, and security-by-design from suppliers.
EU Machinery Regulation: cyber risks and safety are no longer separable
The EU Machinery Regulation (EU) 2023/1230 applies from 20 Jan 2027.
In practical retrofit and acceptance work, the message is: when digital elements can influence safety-relevant functions, cyber risks become part of “safe operation” expectations. This pushes operators to treat security as a safety-adjacent discipline, at least in terms of governance and evidence.
3) What changes in the UAE/GCC: national control frameworks + customer audits
Outside the EU, the compliance driver is typically not NIS2/CRA—yet the expectation for structured security controls is very real.
UAE: Information Assurance (IA) Standard
The UAE Cyber Security Council describes the UAE Information Assurance (IA) Standard as a nationally recognised framework to enhance security and resilience of critical information infrastructure, with controls/sub-controls. It distinguishes controls that are mandatory versus risk-based, and expects entities to justify deviations via risk acceptance.
For you as an operator or project owner, this means auditors and customers may ask for a control-aligned approach and documented risk acceptance—not just “we installed a firewall”.
Dubai: DESC ISR and ICS Security Standard
Dubai Electronic Security Center (DESC) publishes the Information Security Regulation (ISR) for Dubai Government Entities to ensure continuity of critical processes and minimise security risks, emphasising CIA (confidentiality, integrity, availability) and being technology-neutral.
DESC also announced an ICS Security Standard for Dubai, aimed at fortifying the industrial sector’s digital infrastructure.
Even if your customer is not a government entity, large organisations and critical-sector operators often borrow these frameworks as procurement and audit baselines.
Saudi Arabia (regional benchmark in the GCC): NCA ECC and OTCC
Saudi’s National Cybersecurity Authority (NCA) publishes the Operational Technology Cybersecurity Controls (OTCC-1:2022) as minimum cybersecurity requirements for OT systems, described as an extension to the NCA’s Essential Cybersecurity Controls.
NCA also publishes the Essential Cybersecurity Controls (ECC), including an ECC English document (ECC-1:2018).
For GCC projects, KSA NCA frameworks are frequently used as a “serious OT security controls baseline” when customers want something concrete and measurable.
4) The bridge that works globally: ISA/IEC 62443 as the technical baseline
When you operate across jurisdictions, you need a baseline that:
- is internationally recognised,
- speaks both IT and OT,
- and produces deliverables auditors understand.
That’s exactly why ISA/IEC 62443 is such a strong anchor.
ISA describes the ISA/IEC 62443 series as consensus-based standards defining requirements and processes for implementing and maintaining secure industrial automation and control systems (IACS), bridging operations and IT and addressing people, process and technology across the lifecycle.
If you need a simple mental model: 62443 gives you a structured way to define scope, segment environments, define requirements, and govern third-party access.
A widely used concept from this family is Zones and Conduits. ISA training material describes zones as logical groupings of assets sharing common security requirements and conduits as groupings of communication channels connecting zones.
5) Practical implication: one baseline, two “compliance skins”
Here’s the pragmatic approach that avoids reinventing the wheel for each region:
Step 1: Build everything around a 62443-style baseline (technical + organisational)
- Define your OT scope and access paths
- Create a segmentation model (zones, conduits, permitted communications)
- Specify minimum requirements: remote access rules, authentication, logging, patch/vulnerability handling, incident basics
- Define responsibilities (operator vs vendor vs integrator)
Step 2: Add an “alignment note” depending on region/customer
- In the EU, you link the evidence to NIS2 risk management expectations and incident readiness, and (where relevant) supplier lifecycle expectations influenced by CRA timelines.
- In the UAE/Dubai, you provide a short mapping to UAE IA / DESC ISR expectations as requested by the customer.
- In KSA projects (or KSA-influenced audits), you map to NCA ECC/OTCC where requested.
This keeps your core work consistent and your deliverables reusable.
6) What “audit-ready deliverables” look like (and why they close deals)
Operators do not buy “standards”. They buy:
- clarity,
- reduced risk,
- and documentation that survives audits.
A practical evidence pack usually contains:
- OT scope + access map
What is in scope? Which vendors connect? Which remote paths exist? - Zones & conduits segmentation sketch
Enough detail to drive real network changes, not just a diagram for PowerPoint. - Remote access ruleset
Who may access what, when, how approvals work, MFA/VPN/jump host expectations, and logging. - Patch/vulnerability handling model
Including compensating controls when patching is not possible (common in OT). - Incident basics
What counts as an OT incident, who is informed, how isolation is executed, what evidence is preserved. - Optional alignment note (EU or UAE/GCC)
A concise mapping to the customer’s preferred framework, so the evidence pack is immediately usable for audits.
This is consulting-first: you deliver decision-quality information and operating rules, not just technical changes.
7) Where CESA fits (and why EU discipline is an advantage internationally)
If you are trained in EU industrial security practice (CESA), you typically bring:
- a strong “evidence discipline”,
- structured risk assessment thinking,
- and an audit-ready documentation mindset.
That’s valuable in UAE/GCC too—because many audits there are control-framework driven and document-heavy. The key is to present it as:
- international best practice baseline (ISA/IEC 62443),
- plus local alignment on request.
Not “EU compliance exported”, but “EU-grade evidence and process discipline applied to your framework”.
8) A good starting point: the OT Security Quick Check
If you want clarity fast without a big project, start with a short Quick Check:
- baseline assessment (scope + access paths)
- top risks
- prioritised 90-day plan
- and a recommendation whether you need a full evidence pack or a program/maturity roadmap
This approach works in the EU and in UAE/GCC—because it is based on operations, not legislation.
Conclusion
- In the EU, NIS2/CRA/Machinery Regulation increase compliance pressure and push operators towards “managed security with evidence”. NIS2 penalties can be significant.
- In the UAE/GCC, the driver is often customer audits and national frameworks like UAE IA, DESC ISR/ICS, and KSA NCA OT controls.
- The best bridge is an international technical baseline: ISA/IEC 62443 (zones & conduits, governance, lifecycle thinking), plus an optional alignment note for local frameworks.
If you want to de-risk OT security pragmatically, focus on a repeatable process and audit-ready deliverables—then apply the “compliance skin” required by your customer or region.