A decade ago, SCADA systems and distributed control systems (DCS) at GCC utilities operated on isolated networks with proprietary protocols. Security was physical: locked rooms, dedicated cabling, and the assumption that network isolation equalled protection. That assumption no longer holds. Smart grid deployments, AMI meter data management, condition-based monitoring, and remote substation management have all required connectivity between operational technology and enterprise IT networks.
The consequence is a single attack surface that spans both domains. An attacker who compromises an IT workstation through a phishing email can, in poorly segmented environments, reach an engineering workstation that programs PLCs controlling power distribution. The Purdue Model was designed to prevent this. In practice, many utilities have punched so many exceptions through its layers — for vendor remote access, historian data replication, and cloud-based analytics — that the model exists on paper but not in packet flows.
NCA treats utilities as critical national infrastructure. The Essential Cybersecurity Controls and the Critical Systems Cybersecurity Controls (CSCC) impose specific obligations on OT environments: asset inventory, network segmentation, access control, and incident response capability tested through exercises, not just documented in policy. The SEC (Saudi Electricity Company) and water authority operators face additional sector-specific requirements. Meeting these with evidence requires visibility into OT network traffic that most utilities do not currently have.
