The standards and regulations we work to

The core series for OT cybersecurity: security programmes (2-1), service providers (2-4), risk assessment, zones and conduits (3-2), system requirements and security levels (3-3), secure product development and components (4-1, 4-2).

Security for substation and power-system protocols such as IEC 61850, IEC 60870-5-104 and DNP3.

Management-system controls, with energy-utility guidance for process control in 27019.

Where cybersecurity meets functional safety: protecting safety systems and their engineering access.

The main NIST guide for securing OT and industrial control systems, including an OT overlay of security controls.

Govern, Identify, Protect, Detect, Respond and Recover: a common language for OT cybersecurity programmes and board reporting.

Detailed control catalogue; tailored for OT through the overlay in SP 800-82.

How to apply the Cybersecurity Framework to manufacturing and process environments.

Notified in 2026 and in force from 1 April 2027 (per the notification): audits of critical systems by CERT-In-empanelled auditors, testing before commissioning and incident reporting.

The power-sector guidelines that preceded the regulations.

National directions on reporting cyber incidents and keeping logs.

Guidance for organisations designated as critical information infrastructure.

India's personal data protection law.

Qatar's baseline controls for securing critical industrial automation and control systems (issued by Q-CERT; now under NCSA).

Qatar's National Information Assurance Standard (NCSA, May 2023) for government and critical sectors, with certification.

Owner cybersecurity specifications written into project contracts.

Qatar's personal data protection law.

The federal information assurance controls for government and critical information infrastructure entities. First issued by NESA (2014), reissued by TDRA as the IA Regulation v1.1 (2020) and updated by the UAE Cyber Security Council (v2, 2025).

Dubai's OT-specific standard, mandatory for government and semi-government entities in Dubai that operate critical infrastructure or industrial control systems.

DESC's information security regulation (v3) for Dubai government and critical entities.

The national policy under which critical entities are designated and required to apply the IA Standard.

Owner and sector cybersecurity specifications written into project contracts.

Federal personal data protection law.

The baseline controls for government and critical national infrastructure; the 2024 edition replaced ECC-1:2018.

National controls specific to OT and industrial control systems, applied on top of the ECC.

Additional controls for systems designated as critical.

Third-party cybersecurity requirements and compliance certificate for Aramco suppliers.

Saudi Arabia's personal data protection law.

Basic Security Controls and the Cybersecurity Governance Guideline from the Ministry of Transport, Communications and IT, OCERT incident coordination, and the Personal Data Protection Law.

NCSC Kuwait cybersecurity requirements (including its 2025 data classification decision), CITRA regulations including data privacy, and operator specifications in oil, gas and power.

NCSC Baseline Cyber Security Controls, mandatory for critical national infrastructure sectors, the National Risk Management Framework, and the Personal Data Protection Law.

Legal duties for operators of essential services, including energy and water.

The outcome-based framework regulators use to assess operators of essential services, including their OT.

UK data protection law.