Operational Technology
Overlay Name: NIST SP 800-82, Rev. 3, Guide to Operational Technology (OT) Security
Overlay Publication Date: September 2023
Technology or System: Operational Technology
Overlay Author: Keith Stouffer (NIST), Michael Pease (NIST), CheeYee Tang (NIST), Timothy Zimmerman (NIST), Victoria Pillitteri (NIST), Suzanne Lightman (NIST), Adam Hahn (MITRE), Stephanie Saravia (MITRE), Aslam Sherule (MITRE), Michael Thompson (MITRE)
Comments: The OT overlay is a partial tailoring of the controls and security baselines in SP 800-53, Revision 5, for Low, Moderate, and High-Impact (per FIPS 199) OT systems, with supplementary guidance specific to OT. Refer to SP 800-82r3, Appendix F, for the OT Overlay.
The OT overlay is intended to be applicable to all OT systems in all industrial sectors. Examples of OT systems include industrial control systems (ICS), building automation systems, transportation systems, physical access control systems, physical environment monitoring systems, and physical environment measurement systems.
Overlay Point of Contact: Keith Stouffer and Victoria Pillitteri
Return to Control Overlay Repository Overview
Disclaimer Statement The National Institute of Standards and Technology (NIST) has established the Security Overlay Repository as a public service. Security control overlays are made available by NIST on an “AS IS” basis with NO WARRANTIES Some submitted overlays may be available for free while others may be made available for a fee. It is the responsibility of the User to comply with the Terms of Use of any given overlay. Overlay users are solely responsible for determining the appropriateness of using and distributing the security control overlays. User assumes all risks associated with their use, including but not limited to compliance with applicable laws; damage to or loss of data, programs or equipment; and the unavailability or interruption of operation. NIST MAKES NO WARRANTY OF ANY KIND, EXPRESS, IMPLIED OR STATUTORY, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTY OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, NON-INFRINGEMENT AND DATA ACCURACY
