What is NIST SP 800-82?
NIST SP 800-82 is a free, voluntary guideline from the US National Institute of Standards and Technology (NIST) that describes how to secure operational technology (OT), such as industrial control systems, SCADA, DCS, PLCs and RTUs, without compromising the performance, reliability and safety of the physical process. The current version, Revision 3 from September 2023, is titled Guide to Operational Technology (OT) Security. Before that, the publication was called Guide to Industrial Control Systems (ICS) Security. The document combines explanations of OT architectures, threats and vulnerabilities with concrete security measures and an OT-specific selection of controls from NIST SP 800-53.
NIST SP 800-82 translates established IT security practice to the demands of OT, where real-time behaviour, high availability and process safety come first.
🕰️ How did NIST SP 800-82 come about?
The initial public draft appeared in September 2006, at a time when SCADA and process networks were increasingly being connected to office networks. After three public drafts, the first final version appeared in 2011. Since then the guide has been revised three times:
| Version | Date | Main change |
|---|---|---|
| Initial public draft | September 2006 | Followed by drafts in 2007 and 2008, each with a public comment round |
| SP 800-82 (final) | June 2011 | First final Guide to ICS Security |
| Rev. 1 | May 2013 | Updated version of the ICS guide |
| Rev. 2 | May 2015 | New threats and vulnerabilities, tailoring guidance and an ICS overlay for SP 800-53 Rev. 4 |
| Rev. 3 | September 2023 | Scope widened from ICS to OT, overlay for SP 800-53 Rev. 5, closer alignment with the NIST CSF |
| Rev. 4 (draft) | September 2026 | Restructured around NIST CSF 2.0, open for comment until 30 November 2026 |
The shift to OT in Rev. 3 is more than a new name. The guide now also covers building automation, physical access control systems, transportation systems, safety systems and the Industrial Internet of Things: every programmable system that monitors or controls the physical world.
📚 How is NIST SP 800-82 structured?
Rev. 3 has six sections and seven appendices. The structure follows the logic of “what is OT, what threatens it and what do you do about it”:
| Part | Content |
|---|---|
| Section 1 Introduction | Purpose, scope and audience |
| Section 2 OT overview | How SCADA, DCS, PLC topologies, building automation, safety systems and IIoT work, plus a comparison of IT and OT |
| Section 3 OT cybersecurity programme | Charter, business case, governance, cross-functional team, policies, training, incident response and recovery |
| Section 4 Risk management for OT | Framing, assessing, responding to and monitoring risk; supply chain risk; applying the NIST Risk Management Framework |
| Section 5 OT cybersecurity architecture | Five-layer defence in depth (security management, physical, network, hardware, software), segmentation, Zero Trust and reference architectures for DCS, PLC and SCADA |
| Section 6 Applying the Cybersecurity Framework | OT-specific guidance per function (Identify, Protect, Detect, Respond, Recover) |
| Appendix C | Threat sources, vulnerabilities and known incidents |
| Appendix E | Security tools for OT, such as firewalls, monitoring and anomaly detection |
| Appendix F | The OT overlay for NIST SP 800-53 Rev. 5 |
Appendix C covers, among other things, malware, insiders, misconfiguration, supply chain risks and protocols such as Modbus and DNP3, which originally lacked authentication. Remote access, USB media and maintenance laptops are also discussed as attack paths.
🧠 Why is OT security different from IT security?
The core message of NIST SP 800-82 is that OT has different priorities from IT. Where IT traditionally protects confidentiality, integrity and availability in that order, OT puts the safety of people and the environment first, followed by availability, integrity and only then confidentiality.
| Characteristic | IT | OT |
|---|---|---|
| Performance | High throughput, delay acceptable | Time-critical, delay and jitter unacceptable |
| Availability | Rebooting is usually fine | Rebooting may be unacceptable; outages planned days or weeks ahead |
| Main risk | Delay to business operations | Injury, environmental damage, loss of the process |
| Change | Patches applied quickly and automatically | Extensive testing first, often dependent on the vendor |
| Lifetime | 3 to 5 years | 10 to 15 years or longer |
| Location | Usually local and easy to reach | Often distributed, remote and hard to reach |
The guide therefore recommends applying IT measures in an adapted way. A virus scanner or active network scan that is harmless in the office can freeze a PLC or HMI. For the same reason, the guide stresses close cooperation between control engineers, operators and IT security specialists.
🔐 What is the OT overlay for NIST SP 800-53?
NIST SP 800-53 is the large catalogue of security and privacy controls for US federal systems. That catalogue was written with IT in mind. Appendix F of NIST SP 800-82 therefore contains an OT overlay: a selection of controls, enhancements and supplemental guidance tailored to OT for three baselines.
- Three impact levels — you first determine whether a system is low, moderate or high impact, based on FIPS 199 or the impact definitions in IEC 62443-3-2
- Tailored baselines — for each level, the overlay states which controls apply and how to implement them in OT
- Compensating controls — if a control would disrupt the process, you choose an alternative and document why it provides equivalent protection. For example, operators often stay logged on continuously, so instead of locking an account after failed logon attempts you log those attempts and alert the security team
- Sector-neutral — the overlay applies to all OT sectors and can be tailored further per sector or per installation
Rev. 2 still contained an ICS overlay for SP 800-53 Rev. 4; Rev. 3 aligns with SP 800-53 Rev. 5.
🔧 How do you apply NIST SP 800-82 in practice?
The guide describes a complete approach. In practice, organisations usually work through these steps:
- Set up an OT security programme — with a charter, a management sponsor and a team from OT, IT and safety
- Build an asset inventory — of all OT assets, network connections and data flows
- Assess the risk — frame, assess, respond to and monitor risk following the NIST SP 800-39 process, using likelihood scales from NIST SP 800-30; take physical consequences and safety into account
- Categorise and select controls — determine the impact level and start from the matching baseline in the OT overlay
- Segment the network — network segmentation following the Purdue Model or using zones and conduits, with an IDMZ between IT and OT; firewall rules only allow traffic between adjacent levels
- Secure administration and access — access control based on least privilege, a jump server for maintenance and remote access only with MFA
- Detect and respond — logging via Syslog to a SIEM, passive network monitoring and an OT-specific incident response plan
- Maintain in a controlled way — patch management after testing, coordinated with the vendor and planned downtime
According to the guide, Zero Trust is mainly practical at the higher Purdue levels (3 to 5) and in the OT DMZ, because many controllers and field devices do not support the required protocols. At level 0, sensors and actuators usually cannot authenticate, so additional measures are needed there, such as separate monitoring of field I/O.
🔄 How does NIST SP 800-82 relate to IEC 62443 and the NIST CSF?
| Aspect | NIST SP 800-82 | IEC 62443 | NIST CSF |
|---|---|---|---|
| Origin | US (NIST) | International (ISA/IEC) | US (NIST) |
| Nature | Free guideline with explanation and controls | Series of standards with requirements, certifiable | Generic framework of outcomes |
| Scope | OT in all sectors | Asset owners, integrators and product suppliers | All organisations, IT and OT |
| Structure | Programme, risk, architecture, CSF functions, overlay | Zones and conduits, security levels, roles | Govern, Identify, Protect, Detect, Respond, Recover |
| Certification | No | Yes, for processes, systems and components | No |
The three complement each other. The CSF provides the overarching what, NIST SP 800-82 the OT-specific how, and IEC 62443 supplies testable requirements for design, suppliers and components. Rev. 3 already maps the Risk Management Framework steps to IEC 62443-2-1 and to the CSF. Section 6 of Rev. 3 still follows the five functions of CSF 1.1; the Rev. 4 draft is built around CSF 2.0 and its new Govern function.
🇪🇺 Can NIST SP 800-82 be used outside the United States?
Yes. NIST SP 800-82 is freely available, is not tied to US legislation and is used worldwide by critical infrastructure and industrial companies. In the Netherlands, a large group of organisations has been covered since 15 August 2026 by the Cyberbeveiligingswet, the Dutch transposition of NIS2. That law does not prescribe a specific framework but requires appropriate, risk-based measures. NIST SP 800-82 helps make that duty of care concrete for OT, alongside ISO 27001 for the management system, COBIT for IT governance and IEC 62443 for technical requirements. Used this way, it supports broader compliance and risk management programmes rather than replacing them.
❓ Frequently asked questions
Is NIST SP 800-82 mandatory?
NIST SP 800-82 is a voluntary guideline, not a law or a certifiable standard. US federal agencies can use its OT overlay to apply NIST SP 800-53 to their OT systems; for companies in Europe the guide is a tool to help meet requirements such as NIS2.
What is the difference between NIST SP 800-82 Rev. 2 and Rev. 3?
NIST SP 800-82 Rev. 2 from 2015 focused on industrial control systems (ICS) and contained an overlay for SP 800-53 Rev. 4. Rev. 3 from September 2023 widens the scope to all operational technology, updates threats and architectures, and contains an overlay for SP 800-53 Rev. 5.
Can you get certified against NIST SP 800-82?
Certification against NIST SP 800-82 does not exist, because the guide is not a testable set of requirements. Organisations that want a certificate look at IEC 62443 for OT systems and components or at ISO 27001 for the management system. NIST SP 800-82 can still serve as a reference in an internal audit or assessment.
What is an overlay in NIST SP 800-82?
An overlay in NIST SP 800-82 is an OT-tailored version of the control baselines from NIST SP 800-53. For each impact level (low, moderate, high), the overlay indicates which controls apply and how to implement them without disrupting the process.
Is a new version of NIST SP 800-82 coming?
On 21 September 2026, NIST published the initial public draft of NIST SP 800-82 Rev. 4, with a comment period until 30 November 2026. The draft is structured around NIST CSF 2.0 and pays more attention to sectors such as water, building automation, rail and maritime, to Zero Trust and to asset management.
Who is NIST SP 800-82 intended for?
NIST SP 800-82 is intended for control engineers, OT administrators, IT security specialists, auditors and vendors who design, operate or secure OT systems. The guide is useful in any sector with programmable systems that control the physical world, from factories and utilities to buildings and transport.
📌 In summary
NIST SP 800-82 is NIST’s free, voluntary guide to securing operational technology, with explanations of OT architectures and threats, an approach to risk management and an OT overlay for NIST SP 800-53. Since Rev. 3 (September 2023), the guide covers all OT rather than only ICS. Together with the NIST CSF and IEC 62443, NIST SP 800-82 provides a practical basis for security and cybersecurity in factories, utilities and other critical infrastructure, including in Europe under NIS2.