The U.S. National Institute of Standards and Technology (NIST) published an initial public draft of Special Publication (SP) 800-82r4, Guide to Operational Technology (OT) Security, on Monday, outlining updated guidance for securing OT systems while accounting for their distinct performance, reliability, and safety requirements. The fourth revision provides an overview of OT environments and common system topologies, identifies threats and vulnerabilities affecting organizational missions and business functions, and recommends security safeguards and countermeasures for managing associated risks.
NIST has also restructured the guidance around the Cybersecurity Framework 2.0, expanded its treatment of OT risk management and security controls, and added guidance on asset management, network monitoring and detection, system management functions, and zero trust principles. The public comment period is open through Nov. 30, 2026.
The SP 800-82r4 draft expands coverage to building automation and control systems, water and wastewater systems, food and agriculture, freight rail, maritime vessels, and Industrial Internet of Things and cloud convergence. It also covers expanded discussion of how OT risk management aligns with broader enterprise risk management, as described in NIST IR 8286r1; discussion of the adoption of the NIST Risk Management Framework (RMF); expanded guidelines for implementing OT security controls, including asset management and network monitoring and detection; and security architecture guidelines focused on protecting system management functions and applying zero trust principles.
The NIST 321-page document identified that defense-in-depth requires diverse, independent barriers across people, processes, technology, and physical systems, where no single failure should cause unacceptable consequences. While administrative and technical controls reduce risk, OT’s primary goal is preventing unsafe or destructive outcomes. It noted that a mature OT defense mindset is consequence-driven. Cyber controls should be evaluated alongside engineering countermeasures that can remove or reduce the impact of a successful attack. When selecting countermeasures, organizations should incorporate engineering-based methods (e.g., Cyber-Informed Engineering or CIE), so that risk reduction includes both cyber resilience and physical process resilience.
Design of an OT system depends on factors such as whether it uses a SCADA, DCS or PLC-based topology. These factors shape decisions around control, communication, reliability and redundancy, and in turn help determine the system’s security requirements.
Safety is a key consideration, with systems required to detect unsafe conditions and trigger actions that reduce those conditions to safe states. In most safety-critical operations, human oversight and control of potentially dangerous processes remain essential. Control timing requirements also vary widely, including requirements for high speed, consistency, regularity and synchronization. Because humans may be unable to meet these requirements reliably and consistently, automated controllers may be necessary. Some systems may also require computation close to sensors and actuators to reduce communication latency and ensure control actions occur on time.
Geographic distribution can range from small, local PLC-controlled processes to large distributed systems such as oil pipelines and electric power grids. Greater distribution typically creates a need for wide area networking and mobile communications. Hierarchical control can provide a central location that aggregates data from multiple sites, supporting control decisions based on the current state of the system and giving human operators a comprehensive view of the overall environment.
Control complexity is another consideration. Simple controllers and preset algorithms can perform many control functions, while more complex systems, such as air traffic control, may require human operators to ensure control actions support broader system objectives. Availability requirements also influence OT design, particularly for systems requiring stringent uptime. These environments may need greater redundancy or alternative implementations across communications and control functions. Finally, the potential impact of failures varies across domains. Systems where failures could have greater consequences may require redundant controls or the ability to continue operating in a degraded state.
OT systems fundamentally differ from traditional IT systems in their risks and priorities. While IT focuses on information security and throughput, OT prioritizes human safety, environmental protection, and production continuity. Originally isolated with proprietary protocols, OT systems increasingly adopt standard IT technologies like Ethernet, IP, and wireless devices to enable enterprise connectivity and remote access. However, this convergence exposes OT to cybersecurity vulnerabilities while requiring security solutions tailored to OT’s unique operational demands.
Securing OT requires addressing several operational and technical constraints. OT systems are time-critical and require reliable, deterministic responses with scheduled outages planned weeks in advance, making typical IT strategies like rebooting unacceptable. Resource-constrained legacy systems often lack encryption, logging, and password protection capabilities, while control engineers rather than IT personnel manage these networks. Safety is the paramount risk management concern; any security measure that compromises system safety is unacceptable.
OT infrastructure presents distinct management challenges. Change management is critical but complex, as software updates require extensive vendor and end-user testing before implementation, and many systems run unsupported OS versions. OT components typically operate for over 10 to 15 years compared to IT’s typical three-to-five year lifecycle, and vendor-dependent support models often restrict third-party security solutions. Additionally, distributed OT components in remote, isolated locations require specialized physical and environmental security measures beyond typical IT facility requirements.
The SP 800-82r4 draft addresses OT Risk Management and Governance (CSF 2.0 – GOVERN), describing how organizations develop and implement cybersecurity programs and governance structures for new and deployed OT systems. Establishing effective OT cybersecurity governance requires developing a process with clear responsibilities and accountability within the enterprise risk management function, including establishing and communicating OT cybersecurity policy; coordinating OT roles and responsibilities with internal teams and external partners; understanding legal and regulatory requirements; and integrating cybersecurity risks into enterprise risk management processes.
OT governance encompasses policies, procedures, and processes needed to manage regulatory, legal, risk, environmental, and operational requirements. These must be well-understood by staff and directly inform OT cybersecurity risk management. Organizations vary in size, structure, geographical distribution, and complexity, which may drive decisions to hire OT cybersecurity resources as employees or contractors or to outsource security operations as a managed service. Regardless of the resource model, OT cybersecurity management must integrate with IT cybersecurity and the broader enterprise risk management function, and may occur iteratively or in different sequences depending on organizational approach.
The SP 800-82r4 draft addresses OT Cybersecurity Architecture, recommending separation of OT networks from enterprise networks due to fundamental differences in traffic, access requirements, and change management rigor. Enterprise networks typically permit internet access, email, and remote access, incompatible with OT security. Shared infrastructure exposes OT components to denial-of-service, man-in-the-middle, and network attacks, while separate networks enable independent security and performance optimization for each environment.
Segmentation should extend within OT itself. Operational networks carrying process control traffic have distinct availability requirements and security characteristics from management networks handling configuration, patching, and access control. Combining these functions risks introducing management activity into operational traffic, prevents independent security policies, and allows security events to propagate between network types. External vendor access requires architecturally separate paths with independent credential stores and enforcement boundaries, ensuring external trust levels don’t extend to internal functions through shared infrastructure.
While digital transformation, installation costs, and infrastructure efficiency often necessitate connections between OT and IT networks, these represent significant risk. Organizations should minimize such connections and implement additional security controls where unavoidable.
The NIST draft identified that zero trust architecture (ZTA) is a cybersecurity paradigm that protects resources by authorizing access decisions at the point of resource request and continuously evaluating them rather than implicitly granting access based on network location. Traditional network security relies on perimeter defenses and segmentation, assuming users inside the network boundary are ‘trusted’ and can access available resources freely. This approach fails to mitigate lateral movement risks within zones and becomes increasingly ineffective as organizations adopt distributed computing, wireless communications, and cloud environments that blur traditional network boundaries. Zero trust principles offer a more resilient security model for these evolving environments.
Several OT functions already embody core zero trust principles and can serve as practical starting points for broader ZTA implementation. Privileged access management represents clearest expression of zero trust, as the Access Manager evaluates and authorizes each privileged session individually to enforce least-privilege entitlements and time-bounded access rather than granting standing trust once a user reaches the network.
Credential separation ensures that OT network identity verification operates independently from enterprise systems, preventing compromised enterprise credentials from satisfying OT authorization checks. File transfer and removable media controls apply zero trust logic to content itself, scanning and validating each artifact before allowing use regardless of its source or path. Continuous security monitoring provides the observation needed to revoke or adjust trust in near real-time rather than relying on a single authorization decision at session start.
Implementing ZTA in OT environments presents challenges. Organizations may not find a single suitable solution and instead must integrate multiple technologies with varying maturity levels. Retrofitting zero trust principles into existing environments requires significant investment in time, resources, and technical expertise.
