What is NIST SP 800-82 Rev. 3?
NIST SP 800-82 Revision 3 is the federal reference guide for securing operational technology (OT) environments. Titled “Guide to Operational Technology (OT) Security,” NIST published it in September 2023. Specifically, it replaces the earlier “Guide to Industrial Control Systems (ICS) Security” and broadens the scope to cover the full range of OT systems in use today, including SCADA, DCS, PLCs, Building Automation Systems, IIoT devices, and Safety Instrumented Systems.
In fact, the guide exists because standard IT cybersecurity practices, applied without adaptation, can break OT environments. Therefore, Revision 3 offers OT-specific guidance that respects the unique performance, reliability, and safety requirements of these systems. Moreover, it still grounds organizations in established cybersecurity frameworks like the NIST Cybersecurity Framework and SP 800-53.
How is OT cybersecurity different from IT cybersecurity?
OT cybersecurity operates under fundamentally different priorities than IT cybersecurity. In fact, the differences are not cosmetic, because they drive completely different risk management decisions. As a result, lifting IT security tools and practices into OT rarely works without adaptation.
Specifically, five differences shape everything:
- Human safety comes first: OT failures can injure people, damage equipment, and cause environmental harm, so controls that could trigger unsafe behavior are unacceptable
- Continuous operation (24/7/365): patch windows are rare and tightly coordinated, because “just reboot it” is not an option during production
- Long asset lifespans: OT equipment often runs for 15 to 25 years or more, which makes legacy protocols and unsupported operating systems the norm
- Deterministic real-time performance: OT systems need response times in milliseconds, so latency-adding controls can break process control
- Physical consequences of compromise: OT attacks can manipulate physical processes, as Stuxnet, the Ukraine power grid attacks, and Colonial Pipeline all demonstrated
What is the NIST SP 800-82 OT Overlay?
The OT Overlay sits in Appendix F of NIST SP 800-82 Rev. 3. Specifically, it tailors the standard enterprise security controls from NIST SP 800-53 Rev. 5 for OT realities across three impact levels: low, moderate, and high. Moreover, federal agencies operating OT systems use the OT Overlay as the baseline for their authorization packages.
In practice, the Overlay provides four things:
- OT-specific supplemental guidance on how each control applies in an OT context
- Control enhancements that strengthen controls where OT faces heightened risk
- Compensating controls for cases where a baseline control cannot be applied as written, such as legacy equipment that cannot support modern authentication
- Tailoring considerations that help organizations decide which controls apply, which need adaptation, and which are not applicable
What does NIST SP 800-82 recommend for OT network architecture?
NIST SP 800-82 Rev. 3 strongly recommends a defense-in-depth strategy that physically and logically separates OT networks from corporate IT networks. Specifically, the underlying principle is simple: assume each layer will eventually fail, and design so no single failure gives an attacker free movement across the environment. Moreover, the architecture aligns with the IEC 62443 zones and conduits model.
In practice, the key recommendations are:
- DMZ between OT and IT: a controlled buffer zone for data historians, remote access servers, and any system that must communicate across both domains
- Strict network segmentation: firewalls or data diodes at zone boundaries, with security levels aligned to IEC 62443
- Unidirectional gateways or data diodes: where data must flow out of a high-impact OT zone without any return path
- Deny-by-default filtering: at every boundary, explicitly authorizing only the flows required for operations
- Tight control over remote access, engineering workstations, and removable media: because these remain the vectors most frequently exploited in real OT incidents
- Dedicated, strongly authenticated wireless networks for OT traffic, separated from corporate wireless
How does NIST SP 800-82 align with other cybersecurity frameworks?
NIST SP 800-82 Rev. 3 was deliberately designed to integrate with the wider cybersecurity standards landscape. As a result, compliance teams can use SP 800-82 as the central OT security reference while satisfying multiple regulatory and contractual requirements in parallel. Moreover, it connects the federal NIST ecosystem to international and sector-specific OT standards.
Specifically, the key alignments are:
- NIST SP 800-53 Rev. 5: through the OT Overlay in Appendix F, which provides tailored control baselines for OT systems
- IEC 62443: the international reference for industrial automation and control systems security, complementary to SP 800-82 and often used together
- CISA Cross-Sector Cybersecurity Performance Goals (CPGs): the federal baseline for critical infrastructure
- Sector-specific frameworks: including the Department of Energy’s C2M2, NERC CIP, and TSA pipeline and rail security directives, which all draw on or align with SP 800-82
