Date Published: September 21, 2026
Comments Due:
Email Comments to:
Author(s)
Keith Stouffer (NIST), Michael Pease (NIST), CheeYee Tang (NIST), Adam Hahn (MITRE), Jim Gilsinn (MITRE), Daniel Rebori-Carretero (MITRE), Otis Alexander (MITRE), Michael Fialk (MITRE), Zackary Louis Silva (MITRE)
Announcement
This report provides guidelines for improving the security of Operational Technology (OT) systems while addressing their unique performance, reliability, and safety requirements.
OT encompasses a broad range of programmable systems or devices that interact with the physical environment (or manage devices that interact with the physical environment). These systems/devices detect or cause a direct change through the monitoring and/or control of devices, processes, and events. Examples include industrial control systems (ICS), building automation systems, transportation systems, physical access control systems, physical environment monitoring systems, and physical environment measurement systems.
This fourth revision of SP 800-82 provides an overview of OT and typical system topologies, identifies common threats to organizational mission and business functions supported by OT, describes typical vulnerabilities in OT, and provides recommended security safeguards and countermeasures to manage the associated risks.
Updates in this revision include:
- Expanded introduction to operational technology (OT) sectors to include Building Automation and Control Systems (BACS), Water and Wastewater Systems (WWS), food and agriculture, freight rail, maritime vessels, and Industrial Internet of Things (IIoT) and cloud convergence
- Restructured around the NIST Cybersecurity Framework (CSF) 2.0, including a reorganization of the previous risk management section to focus on the CSF Govern Function
- Expanded discussion of how OT risk management aligns with broader enterprise risk management, as described in NIST IR 8286r1
- Discussion of the adoption of the NIST Risk Management Framework (RMF) in Appendix F
- Expanded guidelines for implementing OT security controls, including asset management and network monitoring and detection
- Security architecture guidelines focused on protecting system management functions and applying zero trust principles
The comment period on this initial public draft is open through November 30, 2026. We encourage you to use this comment template when preparing your comments.
NOTE: A call for patent claims is included in this draft. For additional information, see the Information Technology Laboratory (ITL) Patent Policy – Inclusion of Patents in ITL Publications.
This document provides guidelines on how to secure operational technology (OT) while addressing their unique performance, reliability, and safety requirements. OT encompasses a broad range of programmable systems and devices that interact with the physical environment, such as industrial control systems, building automation and control systems (BACS), freight railroad, maritime vessels, water and wastewater systems (WWS), Industrial Internet of Things (IIoT), and cloud environments. This document provides an overview of OT and typical system topologies, identifies common threats and vulnerabilities to these systems, and offers recommended security countermeasures to mitigate the associated risks in alignment with the NIST Cybersecurity Framework (CSF) 2.0.
This document provides guidelines on how to secure operational technology (OT) while addressing their unique performance, reliability, and safety requirements. OT encompasses a broad range of programmable systems and devices that interact with the physical environment, such as industrial control...
See full abstract
This document provides guidelines on how to secure operational technology (OT) while addressing their unique performance, reliability, and safety requirements. OT encompasses a broad range of programmable systems and devices that interact with the physical environment, such as industrial control systems, building automation and control systems (BACS), freight railroad, maritime vessels, water and wastewater systems (WWS), Industrial Internet of Things (IIoT), and cloud environments. This document provides an overview of OT and typical system topologies, identifies common threats and vulnerabilities to these systems, and offers recommended security countermeasures to mitigate the associated risks in alignment with the NIST Cybersecurity Framework (CSF) 2.0.
Hide full abstract
Keywords
computer security; distributed control system (DCS); industrial control system (ICS); information security; network security; operational technology (OT); programmable logic controller (PLC); risk management; security controls; supervisory control and data acquisition (SCADA); NIST Cybersecurity Framework (CSF) 2.0; zero trust
Control Families
None selected
