Cybersecurity
OT and ICS Cybersecurity in Saudi Arabia: Meeting NCA OTCC
Industrial environments cannot be secured like an office network. A practical approach to visibility, segmentation and monitoring that respects safety and uptime.
Key takeaways
- EDR is technology; MSSP and MDR are services built on top of technology.
- The real differentiator is response authority — who is allowed to contain a threat, and how fast.
- Measure providers on mean time to detect and contain, not on alert volumes.
- For NCA ECC and SAMA CSF, insist on log retention, in-Kingdom data handling and evidence you can hand to an assessor.
Three terms that get used interchangeably
Security vendors use EDR, MSSP and MDR loosely, which makes proposals hard to compare. The distinction matters because each model puts a different amount of work — and risk — on your own team.
- EDR (Endpoint Detection and Response) is software on laptops and servers that records behaviour, detects malicious activity and lets an analyst isolate a device. It is a capability, not a service. Someone still has to watch it.
- MSSP (Managed Security Service Provider) typically monitors your security tools, forwards alerts that cross a threshold and manages devices such as firewalls. Investigation and response often remain with you.
- MDR (Managed Detection and Response) is an outcome-based service: the provider hunts, investigates and contains threats on your behalf, using its own or your technology, under agreed response authority.
Where each model fits
| Model | Best for | Watch out for |
|---|---|---|
| EDR only | Organizations with an existing 24x7 SOC team | Tools without analysts generate unread alerts |
| MSSP | Device management and compliance-driven monitoring | Alert forwarding without investigation shifts work back to you |
| MDR | Lean security teams that need 24x7 response | Vague response authority and limited log sources |
| Co-managed SOC | Mature teams wanting to keep control and add scale | Needs clear runbooks and shared tooling |
The question that decides everything: response authority
A provider that can see an attack at 03:00 but has to wait for your approval to isolate a server has not reduced your risk much. Agree in writing which actions the provider may take without asking — isolating an endpoint, disabling an account, blocking an indicator — and which require a call. Pre-approved containment is the single biggest driver of a shorter attack window.
What to ask in a proposal
- Which log sources are included as standard — endpoint, identity, email, cloud control plane, firewall — and what costs extra?
- What are the contractual times to triage, to notify and to contain, by severity?
- Who are the analysts, where are they located and what access do they have to your data?
- How long are raw logs and investigation records retained, and can you export them?
- How is threat hunting performed and reported, and how often?
- What happens to detections and data if you leave?
Metrics that show it is working
Ask for monthly reporting on mean time to detect, mean time to respond, true-positive rate, coverage of critical assets and the number of incidents contained without your intervention. Alert counts on their own say nothing about security.
Regulatory considerations in the Kingdom
The NCA Essential Cybersecurity Controls expect event logs to be collected, monitored and retained, and many organizations treat in-Kingdom handling of security data as a requirement. SAMA-regulated entities must also evidence monitoring and incident response maturity. Make sure the provider's data handling, analyst access and reporting support those obligations, and that you can produce evidence for an assessor without depending on the provider's goodwill.
A practical decision path
- Inventory the security tools you already own — many organizations already pay for an EDR licence they do not fully use.
- Decide which hours you can genuinely cover with your own staff.
- Define the containment actions you are comfortable delegating.
- Shortlist providers that can work with your existing tools before replacing them.
- Run a 30-day proof of value against agreed metrics.
Next step: explore our Cybersecurity Services and Managed IT Services, or ask for a no-cost review of your current detection coverage.
Frequently asked questions
Is MDR the same as SOC as a Service?
They overlap. SOC as a Service usually describes outsourced monitoring and investigation; MDR adds a defined response capability. Read the scope rather than relying on the label.
Do I still need EDR if I buy MDR?
Usually yes. Most MDR services rely on endpoint telemetry, either from a tool the provider supplies or from one you already license.
How long does MDR onboarding take?
For a typical mid-sized estate, onboarding log sources, tuning detections and agreeing runbooks takes four to eight weeks.
NAZZTEC Editorial TeamWritten and reviewed by NAZZTEC practitioners. This briefing is general guidance, not legal advice.
