Cybersecurity
OT and ICS Cybersecurity in Saudi Arabia: Meeting NCA OTCC
Industrial environments cannot be secured like an office network. A practical approach to visibility, segmentation and monitoring that respects safety and uptime.
Key takeaways
- CVSS severity alone is a poor guide to real-world risk.
- Combine exploit intelligence (such as CISA KEV and EPSS) with asset exposure and criticality.
- Set remediation SLAs by risk tier and measure adherence.
- Asset inventory is the foundation — you cannot scan what you do not know exists.
Why traditional vulnerability management stalls
A typical enterprise scan produces thousands of findings, many rated high or critical by CVSS. Teams try to work through them by score, fall behind, and the backlog grows. Meanwhile, attackers exploit only a small fraction of published vulnerabilities — often ones that were not top of the list.
The ingredients of risk-based prioritisation
- Exploitability — is there known exploitation in the wild? Sources such as the CISA Known Exploited Vulnerabilities (KEV) catalogue and the Exploit Prediction Scoring System (EPSS) help answer this.
- Exposure — is the asset reachable from the internet, or from a user network, or only from a restricted segment?
- Asset criticality — does it host sensitive data or support a critical business service?
- Compensating controls — is the weakness mitigated by configuration, segmentation or a WAF?
Remediation tiers and SLAs
| Tier | Example | Target |
|---|---|---|
| Emergency | Known exploited, internet-facing | 48–72 hours |
| High | Exploitable, internal critical asset | 14 days |
| Medium | Exploit unlikely or mitigated | 30–60 days |
| Low | Informational or very low likelihood | Next maintenance cycle |
Building the programme
- Complete the asset inventory, including cloud, containers and SaaS.
- Scan authenticated wherever possible — unauthenticated scans miss most missing patches.
- Enrich findings with threat intelligence and business context.
- Assign owners automatically through your ITSM tool.
- Track SLAs and exceptions, with risk acceptance signed by the asset owner.
- Validate fixes by rescanning and through periodic penetration testing.
Beyond CVEs: exposure management
Misconfigurations, weak identities and exposed services cause as many incidents as unpatched software. Continuous threat exposure management (CTEM) broadens the programme to include attack surface discovery, cloud posture and identity weaknesses, and validates which exposures form real attack paths.
Reporting that leadership understands
Report the number of known-exploited vulnerabilities open on internet-facing assets, SLA adherence by tier, mean time to remediate and the trend in risk-weighted exposure. These metrics also evidence NCA ECC vulnerability management requirements.
Next step: learn about NAZZTEC Exposure on our product roadmap, or engage our Cybersecurity Services for a managed vulnerability programme.
Frequently asked questions
How often should we scan?
Internet-facing assets continuously or at least weekly; internal assets at least monthly; and after every significant change.
Is CVSS useless?
No — it describes technical severity well. It should be one input alongside exploitability, exposure and business impact.
What if a system cannot be patched?
Apply compensating controls such as segmentation or virtual patching, document the risk acceptance and plan replacement.
NAZZTEC Editorial TeamWritten and reviewed by NAZZTEC practitioners. This briefing is general guidance, not legal advice.
