The short answer: you rarely need to replace a working SCADA system to get its data into modern analytics. The proven pattern leaves control where it is and copies data outward: a gateway reads from SCADA or the plant historian, the data crosses an industrial demilitarised zone (DMZ) or a one-way gateway into the IT side, and a message broker, time-series database and APIs feed dashboards, ERP and maintenance systems. In Saudi Arabia, industrial control systems in critical facilities fall under the National Cybersecurity Authority's Operational Technology Cybersecurity Controls (OTCC-1:2022), so segmentation, remote access and monitoring must be designed in from day one, not bolted on after the pilot.
Why legacy SCADA and modern IT don't talk
Much of Saudi Arabia's energy infrastructure runs on SCADA and DCS platforms installed years or decades ago. They reliably control pumps, valves and compressors, but they were never designed for the data-driven operations of 2026.
Operational technology (OT) such as SCADA and DCS is isolated by design: it prioritises safety, availability and deterministic behaviour over connectivity. Information technology (IT) — ERP, analytics platforms, cloud dashboards — lives in a connected environment. The challenge is bridging the two worlds without giving an attacker, or a badly written script, a path into the systems that keep a plant safe.
The Purdue model and the industrial DMZ
Most OT/IT integration follows a layered reference model, usually the Purdue model:
- Level 0: sensors, transmitters and actuators in the field
- Level 1: PLCs, RTUs and safety controllers executing control logic
- Level 2: SCADA servers and operator HMIs supervising the process
- Level 3: site operations — historians, alarm management, production reporting
- Industrial DMZ: the boundary where data is brokered between OT and IT
- Levels 4 and 5: enterprise IT, ERP, analytics and cloud services
NIST's Guide to Operational Technology Security (SP 800-82 Rev. 3) recommends organising OT networks with a model like this and using a DMZ as an enforcement boundary between segments. It advises firewall rules that only permit connections between adjacent levels — Level 4 devices should never talk directly to Levels 2, 1 or 0 — and outbound rules as strict as inbound ones. It also describes unidirectional gateways, or data diodes, which permit traffic in one direction only, as an alternative to firewalls. The principle is simple: data is replicated out of OT; IT never reaches in.
What NCA requires for OT in Saudi Arabia
NCA's OTCC Methodology and Mapping Annex sets out how the controls fit together:
- OTCC extends the ECC. OTCC-1:2022 is an extension of the Essential Cybersecurity Controls (ECC-1:2018); organisations comply with the ECC first, then with the additional OT controls.
- It covers OT in critical facilities. OTCC applies to industrial control systems residing in critical facilities. Critical systems that are not OT fall under the Critical Systems Cybersecurity Controls (CSCC-1:2019) instead.
- Controls scale with criticality. Facilities are classified as Level 1, 2 or 3 using NCA's facility level identification tool, based on criteria such as health, safety and environmental impact, national security and disruption to the national economy. Each control is tied to a level.
- It builds on international standards, including ISA/IEC 62443, the NIST Cybersecurity Framework and NIST SP 800-82.
The ECC's industrial control systems domain lists the minimum requirements any integration must respect: strict physical and virtual segmentation when industrial networks connect to corporate networks and to external networks (internet, wireless, remote access); continuous monitoring and event logging on industrial networks; isolation of safety instrumented systems; strict limits on external storage media and mobile devices; and hardening, vulnerability and patch management. For connected devices outside the control network, NCA has also published Cybersecurity Guidelines for Internet of Things (CGIoT-1:2024).
Whether a given facility is in scope, and at which level, is determined through that classification process — settle it with your cybersecurity function before architecture decisions are locked.
The integration architecture, component by component
- Protocol gateways: OPC UA is the platform-independent standard for reading tags from SCADA and historians, with built-in encryption, authentication and auditing. Older stations may also need converters for serial and legacy SCADA protocols such as Modbus or DNP3.
- Edge compute nodes: process, filter and buffer data locally before it leaves the site.
- MQTT brokers: MQTT is an OASIS-standard, lightweight publish/subscribe protocol built for constrained devices and unreliable links, with three quality-of-service levels. Eclipse Sparkplug adds birth and death certificates so subscribers know whether a device's data is still valid.
- Time-series databases: InfluxDB or TimescaleDB for high-frequency sensor data, or your existing plant historian.
- API layer: REST APIs exposing curated operational data to enterprise applications.
- Security tooling: firewalls, segmentation, OT-aware intrusion detection, and event logs forwarded to your security operations centre.
What operators gain
Once SCADA data flows into modern analytics platforms, operators gain real-time visibility across all facilities from a single dashboard, historical trend analysis for capacity planning, reporting pipelines that draw from one governed dataset instead of hand-built spreadsheets, and integration with ERP and maintenance systems so condition alerts become work orders. The same data foundation also feeds predictive maintenance.
A practical implementation roadmap
- 1.Inventory assets and data flows. List controllers, servers, protocols and every existing connection — including the undocumented ones.
- 2.Confirm the facility's NCA level with your cybersecurity team, because it decides which OTCC controls apply.
- 3.Design zones, conduits and the DMZ. Decide where a firewall is enough and where a one-way gateway is justified.
- 4.Pilot one site in read-only mode. Prove data quality, latency and security monitoring before adding more.
- 5.Harden and monitor, then scale site by site.
- 6.Run it as an OT system. Patch windows, change management and incident response should follow OT procedures, not IT habits.
Common pitfalls
- Writing back into control systems from IT. Keep integrations read-only; any setpoint change belongs in OT change control.
- Always-on vendor VPNs into Level 2. Remote access should be brokered, time-limited and logged.
- Flat networks where the historian, the HMI and office PCs share a segment.
- Ignoring data quality: inconsistent tag names, unsynchronised clocks and missing units make analytics unreliable.
- Cloud first, classification later. Decide which data may leave the Kingdom, and plan for regional resilience — see our guide to multi-region cloud deployment.
How Mantiqi can help
Mantiqi designs OT-to-IT integration for Saudi industrial operators: gateways, DMZ data paths, time-series platforms and dashboards, built around NCA's controls and your existing SCADA. Explore our industrial software, data analytics and DevOps services and our oil and gas industry page, or contact us to request a free OT-to-IT integration audit.