What is NIST?
NIST (National Institute of Standards and Technology) is a non-regulatory US federal agency within the Department of Commerce that develops measurement standards, technical standards and guidelines, including the cybersecurity publications used worldwide such as the NIST CSF and the SP 800 series. The institute imposes rules on no one: outside the US federal government, NIST publications are voluntary. They are, however, free, public and thoroughly reviewed, which is why organisations in IT, OT, industrial automation and critical infrastructure also use them in Europe as a reference for risk management and security.
🧠 What exactly does NIST do?
NIST was founded on 3 March 1901 as the National Bureau of Standards and received its current name in 1988. Its headquarters are in Gaithersburg, Maryland, with a second major campus in Boulder, Colorado, and it employs around 3,400 people. Cybersecurity is only one of its tasks:
- Measurement and time - NIST maintains US measurement standards and atomic clocks. Its Internet Time Service distributes UTC(NIST) via NTP with accuracy in the order of a millisecond; many OT networks indirectly synchronise to time sources like these.
- Cryptography - NIST standardises algorithms as FIPS publications, for example AES (FIPS 197, 2001) and, since August 2024, the first post-quantum algorithms (FIPS 203, 204 and 205). Cryptographic modules are validated against FIPS 140-3.
- Cybersecurity guidance - frameworks, control catalogues and guides, developed through public comment rounds.
- Vulnerability database - NIST runs the National Vulnerability Database (NVD), which enriches CVE records with severity scores and product information.
- Practical solutions - the National Cybersecurity Center of Excellence (NCCoE) in Rockville, set up in 2012 with the State of Maryland and Montgomery County, builds reference architectures together with vendors.
📚 What types of NIST publications exist?
Anyone working with NIST will come across several series. They differ in status and purpose:
| Series | What is it? | Example |
|---|---|---|
| FIPS | Federal Information Processing Standards, mandatory for US federal systems | FIPS 197 (AES), FIPS 140-3, FIPS 203 |
| SP 800 | Special Publications on computer security: guidelines and control catalogues | NIST SP 800-53, NIST SP 800-82 |
| SP 1800 | NCCoE practice guides with a reproduced reference solution | SP 1800-10 (ICS integrity in manufacturing) |
| NIST IR | Internal and interagency reports, often profiles or background studies | NIST IR 8183 (CSF Manufacturing Profile) |
| CSWP | Cybersecurity White Papers, including the frameworks themselves | NIST CSF 2.0 |
Each publication usually goes through one or more public drafts (Initial Public Draft, Final Public Draft) before the final version appears. A revision gets the suffix “Rev.” or “r”, as in SP 800-82r3.
📘 Which NIST publications matter for IT and OT security?
| Publication | Current version | Purpose |
|---|---|---|
| NIST CSF | 2.0, February 2024 | Overarching framework with six functions for cyber risk management |
| NIST SP 800-82 | Rev. 3, September 2023 | Guide to OT security: ICS, SCADA, DCS, PLCs |
| NIST SP 800-53 | Rev. 5, September 2020 (release 5.2.0, August 2025) | Catalogue of security and privacy controls |
| NIST SP 800-37 | Rev. 2, December 2018 | Seven-step Risk Management Framework |
| NIST SP 800-30 | Rev. 1, September 2012 | Method for risk assessment |
| SP 800-61 | Rev. 3, April 2025 | Incident Response as part of risk management |
| SP 800-40 | Rev. 4, April 2022 | Planning patch management as preventive maintenance |
| NIST SP 800-207 | August 2020 | Zero Trust architecture |
| SP 800-171 | Rev. 3, May 2024 | Protecting Controlled Unclassified Information (CUI) at suppliers |
| SP 800-218 | SSDF 1.1, February 2022 | Secure software development framework |
SP 800-61 Rev. 3 is no longer a standalone handbook but a Community Profile of CSF 2.0: incident response runs through all six functions. Release 5.2.0 of SP 800-53 added controls for deploying and verifying software updates securely.
🔐 How is the NIST Cybersecurity Framework structured?
The Cybersecurity Framework is NIST’s best-known publication. Version 1.0 appeared in February 2014 for US critical infrastructure; version 2.0, released on 26 February 2024, targets all organisations and has six functions:
- Govern - strategy, roles, policy and oversight, including supply chain risk
- Identify - know your assets, risks and dependencies
- Protect - implement safeguards such as access control and hardening
- Detect - recognise attacks and anomalous behaviour, for example from a SOC
- Respond - handle incidents in a structured way
- Recover - restore systems and learn from the incident
A Current Profile and a Target Profile show you where the gaps are. The CSF describes what you need to achieve; standards such as IEC 62443 and ISO 27001 fill in the how.
🏭 How do you use NIST in OT environments?
For operational technology, NIST SP 800-82 is the starting point. Rev. 3 broadened its scope from ICS to all OT, including building automation, and covers among other things:
- Architecture - the Purdue Model as a reference, network segmentation, a firewall between IT and OT, and defence in depth
- Detection - passive monitoring and intrusion detection (IDS) that does not disturb the process
- Risk - threat modelling, impact on safety and availability, and an OT overlay on SP 800-53 with baselines for low, moderate and high impact
- Components - the constraints of PLCs, RTUs and SCADA servers, such as long lifecycles and limited patching options
On 21 September 2026 the first draft of Rev. 4 was published, built around CSF 2.0, with comments open until 30 November 2026. The NCCoE guide SP 1800-10 (March 2022) shows with commercial products how to protect the integrity of ICS environments in manufacturing.
The NVD also affects OT teams directly. Because CVE submissions grew sharply (up 263% between 2020 and 2025), since 15 April 2026 NIST mainly enriches CVEs listed in the CISA Known Exploited Vulnerabilities catalogue, software used by the federal government and critical software. Many OT vulnerabilities therefore no longer receive NVD enrichment and often carry only the score from the CVE Numbering Authority, usually the vendor itself, so combine the NVD with vendor and CISA advisories in your vulnerability management.
🔄 How does NIST relate to ISO 27001, IEC 62443 and NIS2?
| Feature | NIST (CSF, SP 800) | ISO 27001 | IEC 62443 | NIS2 |
|---|---|---|---|---|
| Type | Voluntary guidance | Management system standard | Standards series for industrial automation | EU directive |
| Certifiable | No | Yes, the organisation | Yes, processes, systems and components | No, statutory supervision |
| Cost | Free | Paid | Paid | Public |
| Focus | Outcomes and controls, IT and OT | Information security management | Zones, conduits, security levels | Duty of care, incident reporting, board accountability |
NIS2 does not refer to NIST. However, ENISA’s technical implementation guidance for Implementing Regulation (EU) 2024/2690 maps its requirements to ISO 27001:2022 and NIST CSF 2.0, and Belgium’s CyberFundamentals framework follows the CSF structure. NIST is therefore a useful backbone, not a replacement for a certifiable standard.
🇳🇱 How do you apply NIST under the Dutch Cybersecurity Act?
The Dutch Cybersecurity Act (Cyberbeveiligingswet), in force since 15 August 2026, requires appropriate risk-based measures but does not prescribe a framework. A workable approach for an industrial organisation:
- Define the scope - which sites, production lines and OT networks fall under the duty of care?
- Build a Current Profile - assess the CSF subcategories together with IT, OT and management.
- Use SP 800-82 for the OT detail - and IEC 62443 for requirements on suppliers and components.
- Link to ISO 27001 - if you need certification or a management system.
- Set up incident handling along SP 800-61 Rev. 3 - and align it with the statutory reporting obligation.
- Measure and improve - repeat the profile annually and report to the board.
This way you work demonstrably risk-based, and NIST helps you substantiate compliance and architecture decisions, including during an audit against ISO standards.
❓ Frequently asked questions
Is NIST mandatory for European companies?
No, NIST publications are voluntary for European companies. NIST is a non-regulatory US agency; only US federal agencies and their contractors are bound by certain NIST documents. European companies do use NIST to demonstrate that they take appropriate measures under NIS2 and national laws such as the Dutch Cybersecurity Act.
Can you get NIST certified?
An organisation cannot get NIST certified, because the NIST CSF and the SP 800 series are not certifiable standards. Auditors can, however, carry out an assessment against the NIST CSF. For formal certification you use ISO 27001 for the organisation or IEC 62443 for processes and components; cryptographic modules can be validated against FIPS 140-3.
What is the difference between NIST CSF and NIST SP 800-53?
The NIST CSF is an overarching framework that describes, in six functions, which security outcomes an organisation should achieve. NIST SP 800-53 is a detailed catalogue of security and privacy controls that you use to implement those outcomes technically and organisationally. The CSF links to SP 800-53 through online mappings.
Which NIST publication matters most for OT?
For OT, NIST SP 800-82 is the most important NIST publication, because it specifically describes how to secure industrial control systems without compromising safety and availability. Rev. 3 from September 2023 also contains an OT overlay on NIST SP 800-53. Combine the guide with the NIST CSF for structure and with IEC 62443 for testable requirements.
Are NIST publications free?
Yes, all NIST publications are free to download and free to use. That sets NIST apart from ISO and IEC standards, which you have to purchase. As a result, NIST documents are an accessible starting point for smaller industrial companies and OT teams.
What is the NIST NVD?
The National Vulnerability Database (NVD) is the NIST-run database that enriches CVE vulnerabilities with CVSS scores and lists of affected products. Since 15 April 2026 NIST mainly enriches actively exploited vulnerabilities, federal software and critical software. For OT vulnerabilities, vendor and CISA advisories are therefore a necessary complement to the NVD.
📌 In summary
NIST is the non-regulatory US institute for measurement standards and technology whose free cybersecurity publications, such as the NIST CSF 2.0, SP 800-82 and SP 800-53, serve worldwide as a reference for IT and OT security. For European organisations NIST is voluntary, but combined with IEC 62443, ISO 27001 and NIS2 it helps you organise cybersecurity and incident response in factories and critical infrastructure in a structured and demonstrable way.