Control system migration and OT cyber security for plants with obsolete PLC, DCS and SCADA systems across the UAE, Saudi Arabia, Qatar and the wider GCC. We plan the replacement around your production, convert and test the code before site, and build IEC 62443 security into the new system from the start.
Control system migration and OT cyber security are two halves of the same job. When a PLC, DCS or SCADA platform reaches the end of its life, you replace it. When you replace it, you have the best chance you will get to build security in rather than bolt it on. We plan both together for plants in the UAE, Saudi Arabia, Qatar, Oman, Kuwait, Bahrain and Europe.
We build an installed base register of every controller, I/O card, network device, workstation and software licence. Each item is rated against its vendor lifecycle stage and its spare holding. The result is a ranked list that tells you what will stop you first, not just what is oldest.
We replace obsolete controllers, HMIs and servers with current platforms. Where it makes sense, we keep the field wiring, the I/O or the cabinets. The aim is a modern, supportable system with the least downtime and the least risk to production.
We assess, design and implement security for industrial systems to the IEC 62443 series. That means zones and conduits, a proper industrial DMZ, hardened hosts, controlled remote access, tested backups and monitoring that operators and IT can both use.
Most legacy systems were designed when the control network was isolated. Today the same plant sends data to a historian, a maintenance system and often a remote vendor. Old operating systems such as Windows XP, Windows 7 and Windows Server 2008 no longer receive security patches. Windows 10 reached end of support in October 2025, so many HMI and engineering stations installed in the last ten years are now in the same position. A migration that only swaps hardware leaves those gaps open. A migration designed with OT security in scope closes them in the same outage.
Every vendor publishes a lifecycle for its products. Reading those notices correctly, and acting before spares run out, is what separates a planned migration from an emergency one.
| Lifecycle phase | What it means for you | Recommended action |
|---|---|---|
| Active | Product sold, supported and updated with firmware and security fixes. | Standardise on it for new work. Keep firmware current. Register: green |
| Phase-out announced | Still available, but the vendor has published a cancellation date. | Buy strategic spares. Start the migration study and budget. Register: amber |
| Discontinued, spares only | No new sales. Repairs and spares for a limited period, often several years. | Detailed design and FAT. Fix the outage window. Register: red |
| End of support | No repairs, no firmware, no security patches. Spares only from the grey market. | Migrate now. Apply compensating controls until cutover. Register: critical |
The same patterns appear across vendors. Siemens S5 to S7 is the classic example: the S5 range has been unsupported for many years, so the logic, the I/O and often the panels need replacing. S7-300 and S7-400 systems now face the same decision as S7-1500 and the current redundant controllers take their place. On the DCS side, older PCS 7 versions running on unsupported Windows releases need a version upgrade of the software, the servers and the operator stations together. We work across Siemens, Rockwell, Schneider, ABB, Emerson, Honeywell and Yokogawa platforms, and the method is the same on each.
There is no single right way to migrate a running plant. The choice depends on how long the unit can stop, how much field wiring can be reused and how much risk the operator will accept.
Remove the old system and install the new one in a single shutdown. Cleanest result and lowest long-term cost. It needs a long enough turnaround and a thorough FAT so that the site work is installation and loop checks, not design.
Move one unit, area or process cell at a time. The old and new systems run side by side, linked by a gateway or OPC UA interface. Lower risk per step, but more interface engineering and a longer programme.
Transfer loops one by one while the plant runs, with operations holding each loop in manual or on a bypass. It avoids a shutdown but needs strict procedures, permits and experienced commissioning staff on every shift.
Keep the existing I/O modules and replace only the controller, using a vendor bus coupler or interface module. Field terminations are untouched, which shortens the outage and avoids re-doing loop checks.
Pre-wired adapters and front connector conversion kits let the new I/O card plug into the old field wiring. Cutover becomes a card swap per rack, with each channel tested from the adapter.
When migration cannot happen yet, we reduce risk on the old system: segmentation, application allowlisting, removable media control, spare holding and a verified image of every PC.
Converting application logic is where most migration risk sits. Vendor tools can convert a large share of standard code automatically, but the parts that matter most, the interlocks, sequences and custom blocks, always need an engineer.
IEC 62443 is the international series for securing industrial automation and control systems. It gives asset owners, integrators and product suppliers a shared language, so security can be specified, built and checked like any other requirement.
A zone groups assets that share the same security needs, such as the safety system, a process unit or the Level 3 servers. A conduit is the controlled communication path between zones. Following IEC 62443-3-2, we run a risk assessment, draw the zones and conduits, and set a target security level for each.
Security levels run from SL 1, protection against casual or accidental violation, to SL 4, protection against sophisticated attack with extensive resources. Each zone gets a target level (SL-T). The design is checked so that the achieved level (SL-A) meets it, using the capabilities (SL-C) of the chosen products.
IEC 62443-3-3 groups system requirements into seven areas: identification and authentication, use control, system integrity, data confidentiality, restricted data flow, timely response to events and resource availability. Each has requirements that scale with the security level.
The Purdue reference model, used in ISA-95, splits a plant into levels. Level 0 is the field devices. Level 1 is the controllers. Level 2 is supervisory HMI and SCADA. Level 3 is site operations such as historians and engineering. Levels 4 and 5 are business IT. The industrial DMZ sits between Level 3 and Level 4. No traffic should pass straight from the business network to the control network. Data is brokered through servers in the DMZ, for example a historian replica, a patch relay or a remote access jump host.
We use industrial firewalls at each conduit with deny-by-default rule sets. Every allowed flow is written down with source, destination, port and the reason for it. Where protocols such as Modbus TCP, S7comm or EtherNet/IP have no built-in security, deep packet inspection can limit writes to specific registers. For one-way export of data to the enterprise, a data diode is sometimes the right answer. VLANs alone are not a security boundary, so we use them for traffic separation and firewalls for enforcement.
| Control area | What we put in place | Reference |
|---|---|---|
| Patching | Vendor-qualified patches only, tested on a reference system, deployed through a DMZ relay in planned windows. Risk-based approach where patching is not possible. | IEC TR 62443-2-3 |
| Backups | Scheduled backups of controller programs, HMI projects, server images and configurations. Copies held offline. Restores tested, not assumed. | 62443-3-3 SR 7.3 |
| Access control | Individual accounts, role-based access, removal of shared passwords, multi-factor authentication for remote and privileged access. | 62443-3-3 FR 1, FR 2 |
| Remote access | Single entry through a DMZ jump host, session approval by site, recording and time limits. No vendor modems or unmanaged remote tools. | 62443-3-3 SR 1.13 |
| Hardening | Unused ports and services disabled, application allowlisting, USB control, secure configuration baselines for hosts and network devices. | 62443-3-3 FR 3 |
| Monitoring | Passive OT network monitoring on switch mirror ports, asset inventory, anomaly detection and log forwarding to a security operations team. | 62443-3-3 FR 6 |
Control system migration and OT cyber security sit under a small set of well-defined standards. We reference the ones the client specifies and apply the rest as good practice.
Requirements for an asset owner's IACS security programme: policy, roles, risk management and continual improvement.
Security risk assessment, partition into zones and conduits, and assignment of target security levels.
System security requirements and security levels, grouped under the seven foundational requirements.
Secure development lifecycle requirements for suppliers of control system products.
Technical security requirements for components such as controllers, embedded devices, network devices and host software.
Security capability requirements for integration and maintenance service providers.
US guide to operational technology security, widely used as a practical reference alongside IEC 62443.
Safety instrumented systems for the process sector. Governs revalidation when a migration touches safety functions.
Factory acceptance, factory integration and site acceptance testing for process automation systems.
Operators of critical infrastructure in the region also follow national rules. In the UAE, many entities apply the UAE Information Assurance Standards, first issued by NESA. In Saudi Arabia, the National Cybersecurity Authority publishes the Operational Technology Cybersecurity Controls, OTCC-1:2022. In Qatar, the National Information Assurance standard applies to many organisations. We map our IEC 62443 design to whichever framework the client must show compliance with, so one set of controls answers both.
Our method moves from survey to handover in fixed stages. Each stage ends with a document the client approves before we spend money on the next.
Every migration and OT security project leaves a complete document set, so the next engineer, auditor or regulator can see exactly what was done.
| Document | Content |
|---|---|
| Installed base and obsolescence register | Every asset with part number, firmware, lifecycle phase and spare holding. XLSX |
| Migration strategy report | Options compared on cost, outage, risk and long-term support, with a recommendation. |
| Functional design specification | Interlocks, sequences, alarms and control narratives for the new system. |
| Cyber risk assessment | Threats, consequences, zone and conduit model and target security levels. IEC 62443-3-2 |
| Network architecture and firewall rule base | Purdue-aligned drawings, IP plan, VLANs and every permitted flow with its justification. |
| Hardening baselines | Secure configuration for each host type, switch and firewall. |
| FAT and SAT procedures and reports | Test scripts, signed results and punch lists. IEC 62381 |
| Cutover plan and fallback procedure | Hour-by-hour plan, hold points, responsibilities and tested rollback. |
| Backup and recovery procedure | What is backed up, where, how often and how to restore it. |
| As-built drawings and code | Final drawings with reference designations, archived programs and project files. |
Plants in the Gulf put extra stress on control equipment, and that stress shortens hardware life. It is one reason obsolescence often arrives early in the region.
We have worked in the GCC for more than 17 years, from offices in Dubai and the UK. Our team commissioned the control systems on TenneT's 980 MW HVDC offshore wind converter platform, built by McDermott at Jebel Ali in Dubai. That work covered two redundant Siemens S7-400H systems, ET 200SP HA distributed I/O over PROFINET and fibre, and SCALANCE switches with dual network access for PRP redundant networks. The same attention to redundancy, documentation and testing goes into every migration we deliver in Dubai, Abu Dhabi, Saudi Arabia, Qatar, Oman, Kuwait and Bahrain.
Migration and security projects often draw on our other control system services.
Short answers to what clients ask us most. For anything specific to your plant, talk to an engineer.
Control system migration is the replacement of an obsolete PLC, DCS or SCADA system with a current, supported platform. It usually includes converting the application code, replacing controllers and HMIs, and sometimes reusing the existing I/O and field wiring to reduce downtime.
Check each product against the vendor's lifecycle notices. If it is in phase-out, discontinued or end of support, or if its operating system no longer receives security patches, it is time to plan a migration. An installed base audit gives you a ranked list of what to replace first.
Yes, in many cases. A hot cutover moves loops one at a time while the plant runs, and a phased migration moves one unit at a time. Both need careful procedures, a tested fallback and experienced commissioning staff, and some safety functions may still need a short planned outage.
IEC 62443 is the international series of standards for the security of industrial automation and control systems. It covers asset owner programmes, risk assessment with zones and conduits, system security requirements with security levels 1 to 4, and secure product development for suppliers.
IT security protects data and puts confidentiality first. OT security protects physical processes, so availability and safety come first. OT systems often run old software that cannot be patched quickly, use industrial protocols without built-in security and must keep running around the clock.
An industrial DMZ is a separate network zone between the business network and the control network, at Level 3.5 of the Purdue model. Data and remote access pass through servers in the DMZ, so there is no direct connection between the office and the plant.
Saudi Arabia's National Cybersecurity Authority publishes the Operational Technology Cybersecurity Controls, OTCC-1:2022. Many UAE entities follow the UAE Information Assurance Standards, and Qatar has its National Information Assurance standard. Major operators add their own specifications, and an IEC 62443 based design can be mapped to all of them.
Apply compensating controls. Segment the old system behind a firewall, remove direct internet and vendor modem connections, control USB use, take verified backups and images of every PC, and hold critical spares. This buys time while the migration is budgeted and planned.
Tell us what you have installed, what is causing concern and when your next outage is. We will reply with a proposed approach, from a short obsolescence and cyber gap assessment to a full migration with security built in, for sites in the UAE, Saudi Arabia, Qatar, Oman, Kuwait, Bahrain and Europe.
