Written and maintained by CASRAI Editorial Board
Last updated
NIST SP 800-82 is the National Institute of Standards and Technology’s guide to securing operational technology (OT). The current final edition is Revision 3, titled “Guide to Operational Technology (OT) Security” and published in September 2023. It replaced Revision 2, which covered industrial control systems (ICS) only. People search for it as nist 800-82, nist 800-82 r3, nist sp 800 82 or nist sp 800-82; all of those names point to the same publication. This guide explains what the document does, how it is organised, and which section answers which question.
What NIST SP 800-82 is and who publishes it
NIST SP 800-82 Rev. 3 is a Special Publication from NIST, written by NIST authors (Stouffer, Pease, Tang, Zimmerman, Pillitteri and Lightman) with MITRE co-authors (Hahn, Saravia, Sherule and Thompson). Its stated purpose is to provide guidance on how to secure operational technology while addressing OT’s unique performance, reliability and safety requirements. It gives an overview of OT and typical system topologies, identifies common threats and vulnerabilities, and recommends security countermeasures. It also includes an OT overlay: a tailored version of the SP 800-53 Rev. 5 control baselines.
NIST defines OT as programmable systems and devices that interact with the physical environment, or manage devices that do. The document’s examples are industrial control systems, building automation systems, transportation systems, physical access control systems, and physical environment monitoring and measurement systems. Section 2.3 walks through the major system types: SCADA, distributed control systems (DCS), PLC-based systems, building automation, physical access control, safety systems and the industrial internet of things (IIoT).
For research institutions the relevance is practical: lab building controls, environmental chambers, access control and instrument-adjacent control systems are all OT in NIST’s sense. The document does not address research administration itself; see the related CASRAI guides on cybersecurity and research security for that side.
What changed from Revision 2 to Revision 3
The Rev. 3 “Note to Readers” lists the changes, and this is the part most summaries skip:
- Scope widened from industrial control systems to operational technology generally.
- Threats and vulnerabilities were updated.
- Risk management, recommended practices and architectures were updated.
- Additional alignment with other cybersecurity standards and guidelines, including the NIST Cybersecurity Framework.
- New tailoring guidance for SP 800-53 Rev. 5.
- A new OT overlay that provides tailored baselines for low-, moderate- and high-impact OT systems.
Revision 3 supersedes Revision 2 (2015). Earlier drafts of Revision 3 were released for comment in April 2021 and April 2022.
Who it applies to (eligibility and status)
There is no application or eligibility process. NIST states that the publication “may be used by nongovernmental organizations on a voluntary basis and is not subject to copyright in the United States.” Section 1.2 lists the intended readers: control engineers, integrators and architects; system administrators and IT professionals; security consultants; managers and senior management; researchers and analysts; and vendors.
The document is also not meant to be used as a checklist. Section 1.1 tells readers to perform a risk-based assessment and tailor the guidance to their own environment. Whether a particular contract, grant or regulator makes it mandatory is a question for that agreement’s own terms. The publication itself does not create the obligation.
What it requires, and what it covers
As a guidance document it recommends rather than requires. The priorities it sets are the most distinctive part. The Executive Summary says OT security objectives typically prioritise integrity and availability, followed by confidentiality, and that safety must be considered as an overarching priority. That ordering is the reverse of many IT programs and is the main reason NIST treats OT separately from IT; Section 2.4 compares OT and IT directly. Cybersecurity programs, NIST says, should be part of broader OT safety and reliability programs. The emphasis on integrity echoes the principles in CASRAI’s guide to data integrity.
Reading map: which section answers which question
| If you need to… | Go to |
|---|---|
| Understand OT systems and how they differ from IT | Section 2 (OT overview; 2.3 system types; 2.4 OT and IT comparison) |
| Build an OT cybersecurity program | Section 3 (charter, business case, governance, cross-functional team, strategy, policies, training, incident response, recovery) |
| Manage risk in OT | Section 4 (applying the NIST Risk Management Framework to OT) |
| Design a defensible architecture | Section 5 (defense-in-depth layers, with models for DCS, DCS/PLC with IIoT, and SCADA) |
| Use the Cybersecurity Framework with OT | Section 6 (applying the Cybersecurity Framework to OT) |
| Look up threats and vulnerabilities | Appendix C |
| Find security capabilities and tools | Appendix E |
| Select tailored SP 800-53 Rev. 5 controls | Appendix F (the OT overlay, intended to stand alone) |
Steps to apply it
NIST does not prescribe a single sequence, but the document’s structure suggests one reading order. These steps follow the sections above rather than an official checklist.
- Establish the program. Section 3 covers the program charter, the business case, and program content such as governance, a cross-functional team, strategy, policies and training.
- Apply the Risk Management Framework to OT. Section 4 walks through the RMF steps: Prepare, Categorize, Select, Implement, Assess, Authorize and Monitor.
- Select and tailor controls. Use the Appendix F overlay, which provides tailored baselines for low-, moderate- and high-impact OT systems.
- Design the architecture. Section 5 describes defense-in-depth across security management, physical, network, hardware and software layers.
- Map to the Cybersecurity Framework. Section 6 starts with the Identify function.
Typical phases
NIST’s text gives no durations, so this guide does not either. The phases follow the document’s own organisation: program charter and business case; risk management through the seven RMF steps; architecture and control selection; and ongoing maintenance tracking, incident response and recovery, all of which Section 3.3 lists as program content.
Common mistakes
- Using it as a checklist. Section 1.1 says it should not be used purely that way; assess risk and tailor.
- Carrying IT priorities into OT. The document puts integrity and availability first, with safety overarching.
- Working from Revision 2. Its scope was ICS only; Revision 3 covers OT and adds the SP 800-53 Rev. 5 overlay.
- Treating security as separate from safety. NIST recommends making the cybersecurity program part of broader OT safety and reliability programs.
Related publications
| Publication or framework | How SP 800-82 Rev. 3 relates to it |
|---|---|
| SP 800-53 Rev. 5 | Rev. 3 gives tailoring guidance and an OT overlay (Appendix F) with low-, moderate- and high-impact baselines. |
| NIST Cybersecurity Framework | Section 6 applies it to OT, and Rev. 3 adds alignment with it. |
| NIST Risk Management Framework | Section 4 applies its seven steps to OT. |
| SP 800-82 Rev. 2 | Superseded by Rev. 3; scope was industrial control systems. |
For other NIST-based requirements that research institutions encounter, see CASRAI’s entries on NIST SP 800-171, CMMC compliance for research institutions and CISA’s OT guidance for the power grid.
FAQ
Is NIST 800-82 the same as NIST SP 800-82 Rev. 3?
Yes in everyday use. “NIST 800-82”, “NIST SP 800-82” and “800 82 r3” all refer to this series; the current final version is Revision 3 (September 2023).
Is NIST SP 800-82 mandatory?
The publication states nongovernmental organizations may use it voluntarily. Any mandate would come from a separate contract, regulation or policy, not from the document itself.
Is there a newer version than Revision 3?
As described on the NIST CSRC page checked on 2026-10-29, an initial public draft of Revision 4 is open for comment, with comments due November 30, 2026. Revision 3 remains the final publication.
Does it cover SCADA and building systems?
Yes. Section 2.3 covers SCADA, distributed control systems, PLC-based systems, building automation, physical access control, safety systems and IIoT.
Sources
- NIST CSRC, SP 800-82 Rev. 3, Guide to Operational Technology (OT) Security, https://csrc.nist.gov/pubs/sp/800/82/r3/final, checked 2026-10-29.
- NIST, full text of NIST SP 800-82r3 (PDF), https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-82r3.pdf, DOI https://doi.org/10.6028/NIST.SP.800-82r3, checked 2026-10-29.
- NIST CSRC, Operational Technology Security project, https://csrc.nist.gov/projects/operational-technology-security, checked 2026-10-29.
