WindlassConsulting

What is NIST SP 800-82? The OT security guide explained

  • OT security
  • NIST 800-82r3
  • Standards
  • ICS

NIST Special Publication 800-82 is the U.S. government’s guide to securing operational technology. It explains how industrial control environments differ from IT, what risks they face and which security controls fit them.

The current final version is Revision 3, published in September 2023 as the Guide to Operational Technology (OT) Security. A new edition is coming: NIST released an initial public draft of Revision 4 on September 21, 2026, with comments open through November 30, 2026.

Where it came from

Revision 2, published in May 2015, was titled Guide to Industrial Control Systems (ICS) Security. Revision 3 expanded the scope from industrial control systems to operational technology generally, and the title changed with it. The revision also added alignment with the Cybersecurity Framework and new tailoring guidance for SP 800-53 Rev. 5 controls.

What it covers

Revision 3 is long. It’s organized around the questions an OT security program has to answer:

  • How OT differs from IT. Control systems put safety and availability first, run equipment with long service lives, and often can’t be patched or restarted on an IT schedule.
  • The risks. It lays out the threats and vulnerabilities specific to OT and records real incidents, including the ping-sweep cases in Why a routine IT scan can take down an RTU.
  • Building a program: risk management, security architecture, and how to segment OT from business networks.
  • Applying security controls. It includes an OT overlay for the NIST SP 800-53 Rev. 5 control catalog in Appendix F, with tailored baselines for low-, moderate- and high-impact OT systems.
  • Assessment methods. It describes active and passive testing and recommends deciding device by device what each system can tolerate. Active vs. passive vulnerability scanning in OT goes through that guidance.

Is it a requirement?

It’s guidance. NIST developed it under its FISMA responsibilities, and the publication says nongovernmental organizations may use it on a voluntary basis. A private operator uses it voluntarily unless a contract or a regulator points to it. Many operators use it as a reference for what good looks like, and as a source for assessment methods and the language of a security program.

How it relates to IEC 62443 and the Purdue model

IEC 62443 and NIST 800-82 overlap in purpose and differ in shape. 800-82 is a single guide from one body, tied into the rest of NIST’s control catalog. IEC 62443 is a series with separate parts for asset owners, integrators, product suppliers and service providers, and it defines security levels. Many programs use both: 800-82 for the guidance and the control overlay, 62443 for zone and conduit design and security levels.

The NIST Cybersecurity Framework sits above both as the program-level structure. The Purdue model is the reference diagram people commonly map all of them against.

What to do with it

Start with the parts on OT architecture and assessment methods, since they change how an assessment is run. Section 6 applies the Cybersecurity Framework to OT systems, and the OT overlay in Appendix F is where to begin when mapping a program to controls. Section and appendix numbers here refer to Revision 3. The Revision 4 draft may renumber them. What an ICS security assessment covers shows how the guide’s methods turn into evidence gathering. To see where a program stands against TSA requirements, take the Readiness Check.

Sources: NIST SP 800-82r3, Guide to Operational Technology (OT) Security, September 2023, which supersedes SP 800-82 Rev. 2 (May 2015); full text. NIST SP 800-82 Rev. 4 initial public draft, September 21, 2026.

All posts