OT/ICS Security Operations Center: A Build Blueprint for Sonatrach and Sonelgaz Teams

Why Algeria’s Energy Sector SOC Moment Has Arrived

Algeria’s energy sector now sits at a deliberate inflection point. Presidential Decree 26-07, issued on 7 January 2026 as part of the National Cybersecurity Strategy 2025-2029, requires every public institution to stand up a dedicated cybersecurity unit — structurally separated from IT operations and reporting directly to the head of the organization. For Sonatrach (which generated roughly $45 billion in export revenue in 2024) and Sonelgaz (serving close to 12 million electricity customers), the decree converts what was previously a “good-practice” conversation into a defined operating model, mapped against ASSI guidance and DZ-CERT coordination duties.

The global threat picture sharpens the opportunity. A 2026 Hydrocarbon Processing operator survey found that 99 of 100 oil and gas operators reported at least one OT cyber incident since February 2026, with ransomware affecting OT-connected systems hitting 48% of respondents. Dragos’s industrial threat tracking identified 119 ransomware groups targeting industrial organizations in 2025, up 49% year over year, affecting 3,300 organizations globally. Resecurity ranked energy among the most-targeted critical-infrastructure sectors as geopolitical tensions drove a measurable surge in attacks, with adversaries increasingly using IT footholds as staging ground for OT lateral movement.

For Algerian energy teams, the read is straightforward: the regulatory mandate, the threat trajectory, and the budget conversation now point in the same direction. A purpose-built OT SOC — distinct from a traditional IT SOC — is the structural answer the next 6-12 months call for.

The Architecture of a SCADA-Aware SOC

An OT SOC is not an IT SOC with extra log sources. The engineering objective inside a Sonatrach refinery or a Sonelgaz substation is operational continuity and safety, not patch velocity. IT-grade controls — frequent agent updates, aggressive endpoint scanning, unannounced segmentation changes — can disrupt a Modbus or DNP3 conversation in ways that ripple into the physical process. A SCADA-aware SOC therefore inherits a different reference architecture: the Purdue Enterprise Reference Model layered on top of the IEC 62443 zones-and-conduits framework, with passive monitoring as the default and active probing strictly bounded.

Three architectural choices distinguish the build. First, OT-native visibility platforms speak industrial protocols (Modbus, DNP3, IEC 61850, OPC UA, S7) that classic SIEM rules do not parse. Industry analysts converge on a short list of purpose-built platforms — Dragos for industrial threat intelligence and IR, Nozomi Networks for breadth across cyber-physical assets and large-scale distributed visibility, and TXOne for OT endpoint and segmentation enforcement, per Reliamag’s 2026 OT/ICS platform comparison. Second, the SIEM remains the correlation backbone but is fed OT telemetry through a unidirectional gateway or carefully scoped data diode pattern, so the corporate SOC inherits OT visibility without opening a return path into the process network. Third, the Purdue model continues to define where systems sit, while IEC 62443 zones and conduits define what they are allowed to talk to — the two frameworks are complementary, not competing.

The output is a SOC that can issue an alert on a rogue Modbus write to a compressor station without first asking the plant operator to install another agent on the PLC.

How Sonatrach and Sonelgaz Security Teams Can Build It

1. Start with OT asset discovery before any alert rule

The single most leveraged early decision is to inventory the OT estate before deciding what to detect. The same Hydrocarbon Processing survey found that 87% of oil and gas operators say they would detect a breach within 24 hours, yet only 16% base that confidence on continuous OT monitoring — the rest are guessing. For Sonatrach upstream sites and Sonelgaz substations, the first 90 days should fund a passive-monitoring pilot at two or three representative facilities (one upstream, one downstream or substation, one office-IT bridge). The deliverable is a verified inventory of PLCs, RTUs, HMIs, engineering workstations, and the protocols they actually speak in production. Detection logic without an inventory produces alerts the SOC cannot triage.

2. Deploy purpose-built OT detection alongside SIEM — not instead of it

OT detection and the corporate SIEM are layered, not substituted. The Forescout 2026 analysis documented a record 2,155 ICS vulnerabilities in 508 advisories, with manufacturing and energy at the top of the affected-sector list. An OT-native platform parses these vendor-specific advisories and protocol anomalies; the SIEM correlates them with identity, VPN, and IT-side signals so the analyst sees one incident instead of two half-pictures. Sonatrach and Sonelgaz teams should aim for a unidirectional architecture where the OT sensor lives inside the process network, exports a copy of detections to the enterprise SIEM, and never accepts inbound configuration changes from the IT side. This pattern keeps the safety-instrumented system uncompromised while the SOC keeps the unified view it needs.

3. Build the ASSI-aligned incident response playbook

Decree 26-07 turns incident response from an internal handbook into a coordinated workflow with ASSI and DZ-CERT. Sonatrach and Sonelgaz teams can productively front-run the operational details: a documented severity matrix that maps OT-side impact (loss of view, loss of control, safety-instrumented activation) to notification timelines; a pre-agreed point of contact at ASSI’s CNOSSI operational center; and tabletop exercises that walk a ransomware-on-IT-pivoting-to-OT scenario end-to-end with the legal, communications, and plant-management teams in the same room. The recently published national cybersecurity strategy analysis describes ASSI’s role as the technical and operational execution arm — energy teams that build their playbook with that interface in mind will find regulatory coordination easier and faster.

4. Staff the OT SOC for shift coverage, not headcount theatre

The 85% of operators running with five or fewer OT security staff is the binding constraint, not the budget line. A workable Algerian model is a hybrid: a small in-house core (3-5 senior OT-aware engineers) for architecture, vendor management, and the on-call rota, partnered with a managed detection arrangement for after-hours triage. The skills mix matters more than the headcount: at least one team member with hands-on PLC/HMI experience (often a former plant engineer cross-trained in security), at least one with industrial protocol packet analysis, and a clear escalation path to a process-engineering peer at each facility. Training pipelines through the national vocational programs cited in the 2025-2029 strategy — 285,000 places announced for 2026, with cybersecurity certifications among them — are the medium-term answer; the short-term answer is targeted hiring and retention bonuses for OT-trained talent.

Where This Fits in Algeria’s 2027 Critical Infrastructure Security Agenda

A well-built OT SOC is not a compliance artifact — it is the operational center that ties the National Cybersecurity Strategy 2025-2029 to the daily reality of running a pipeline, a refinery, or a substation. Sonatrach’s hydrocarbon flows and Sonelgaz’s grid are the two largest cyber-physical surfaces in the country, and they are also the two most natural candidates for a reference-architecture build-out that other state operators (water utilities, ports, transport) can adapt rather than reinvent.

The forward-looking framing matters here. Algeria’s energy sector is positioned to publish, rather than borrow, the operating model — a SCADA-aware SOC blueprint produced in Algiers, validated against ASSI guidance and IEC 62443, can become a regional reference rather than a copy of European or Gulf playbooks. The 6-12 month horizon is realistic: months 1-3 for asset discovery and architecture sign-off, months 4-9 for platform deployment and playbook drills, months 10-12 for the first full ASSI-coordinated tabletop. Done in that order, the SOC enters 2027 as a working capability rather than a stalled project — and the Decree 26-07 mandate becomes the launchpad it was designed to be.

Frequently Asked Questions

Sources & Further Reading

• Cyber Threats Against Energy Sector Surge as Global Tensions Mount — Resecurity
• Algeria National Cybersecurity Strategy 2025-2029: Full Analysis — algeriatech.news
• Annual OT/ICS Cybersecurity Report 2026 — TXOne Networks
• Energy and Utilities Cyber Threats Escalate as Ransomware and APT Activity Rise — Industrial Cyber / Cyfirma
• How Oil and Gas Operators Can Strengthen OT Security in 2026 — Hydrocarbon Processing
• Oil and Gas Cybersecurity: 2026 OT Threat Findings — Dragos
• ICS Cybersecurity in 2026: Vulnerabilities and the Path Forward — Forescout
• Best Industrial Cybersecurity Platforms (OT/ICS Security) 2026 — Reliamag
• IEC 62443 for Energy — Requirements & Implementation — nFlo