NIST SP 800-82: operational technology security (US · NIST SP 800-82)

What this publication is for

NIST Special Publication 800-82 Revision 3 is the Guide to Operational Technology (OT) Security. The CSRC final page states that it provides guidance on how to secure OT and address unique performance, reliability, and safety requirements. NIST announced the Final on 28 September 2023.

That is a publication of guidance. It is not a plant certificate. It is not a badge that means a site implements NIST.

Edition covered

SP 800-82 Rev. 3, Final, 28 September 2023. CSRC lists Date Published as September 2023. Document history stamps the Final as 09/28/23. DOI 10.6028/NIST.SP.800-82r3. The PDF is NIST.SP.800-82r3 on nvlpubs. The same CSRC page states that this Final supersedes SP 800-82 Rev. 2 (3 June 2015).

That full citation is the correct reference for the publication. A slide with only 800-82 does not show which revision.

What OT means in SP 800-82

The CSRC abstract describes OT as programmable systems and devices that interact with the physical environment, or that manage devices that do. They detect or cause a direct change when they monitor and/or control devices, processes, and events.

The CSRC examples are industrial control systems, building automation systems, transportation systems, physical access control systems, and physical environment monitoring and measurement systems. The OT category covers those systems. OT is not a vendor catalog of control products.

Why Revision 3 uses the term OT

Earlier revisions centered on industrial control systems. The 28 September 2023 news page states that Revision 3 expands the scope from ICS to OT. The same note lists updates to threats, vulnerabilities, risk management, architectures, and alignment with the Cybersecurity Framework.

The news page also states that Revision 3 adds guidance to tailor SP 800-53 Revision 5. That guidance has an OT overlay for low-impact, moderate-impact, and high-impact OT systems. The baselines stay in the publication.

OT is not IT with different logos

Plant and OT environments care about safety, reliability, and performance alongside information security. A change that looks like a routine IT patch can be a process-safety event if it breaks time constraints, availability, or approved operational procedures.

The guidance must adapt to the actual system and to approved operational procedures. The team asks the OT or operations owner which change window applies. The team asks before it proposes a network or host change that touches process control. That question stays private.

An air-gap is not the program

Isolation habits matter. "We air-gapped it once," or one VLAN, is not a security program. SP 800-82 does not replace isolation habits.

Segmentation guidance for a small manufacturing environment is in a different NIST publication, CSWP 28. That guide is related. CSWP 28 is not a subchapter of SP 800-82. CSWP 28 is not a weekend checklist.

What SP 800-82 is not

SP 800-82 is not a plant certification. It is not FedRAMP, the federal cloud Authorization program. It is not CMMC, the contractor assessment program. It is not a do-it-yourself list to harden every controller this weekend.

It also does not automatically cover every sector mandate. EPA water-sector resources and the Transportation Systems Sector Cybersecurity Framework Implementation Guidance are related resources. They are not part of SP 800-82.

Revision 4 is a draft

The CSRC page was re-opened on 25 September 2026. The Rev. 3 final page still carries a Planning Note dated 21 September 2026. The note points to an SP 800-82 Rev. 4 initial public draft. Public comments are due 30 November 2026. Rev. 3 remains the current Final until NIST publishes a new Final.

A Rev. 4 Final publication date is UNKNOWN. If that Planning Note changes, the draft status is UNKNOWN until a new check of the CSRC page. A draft does not make Rev. 3 obsolete today.

Rewrite the one-line claim

The claim "we are 800-82 certified" has no certificate behind it. Exact replacement: "We use SP 800-82 Rev. 3 as OT security guidance and adapt changes through approved ops."

Phrases that are often confused

Five phrases about SP 800-82, each with its correction.
Phrase people use	Literacy correction
OT is just IT with industrial logos.	OT interacts with the physical environment. Safety, reliability, and performance sit beside information security.
An air-gap or one VLAN means SP 800-82 is done.	Isolation is a habit, not the publication. CSWP 28 is related segmentation guidance for a small manufacturing environment, not a chapter of SP 800-82.
Our plant is 800-82 certified.	Rev. 3 is guidance. NIST did not certify the plant. Changes are adapted through approved ops.
The Rev. 4 draft retired Rev. 3.	Rev. 3 remains the current Final. Comments are due 30 November 2026. A Rev. 4 Final date is UNKNOWN.
800-82 means FedRAMP or CMMC.	FedRAMP is federal cloud Authorization. CMMC assesses contractors. Neither one is this publication.

Common misconceptions

OT is just IT with industrial logos.

OT systems interact with the physical environment. Safety, reliability, and performance sit beside confidentiality, integrity, and availability. A copy of an enterprise patch into a control network without approved ops can be a process-safety event.

We air-gapped it once, so OT security is done.

One air-gap, or one VLAN, is not a security program. Segmentation guidance for a small manufacturing environment is CSWP 28, a separate guide.

NIST published 800-82, so our plant is certified.

SP 800-82 Rev. 3 is guidance. It is not a plant certification.

The Rev. 4 draft means Rev. 3 is obsolete.

As of the 25 September 2026 CSRC check, Rev. 3 is still the current Final. Comments on the Rev. 4 initial public draft are due 30 November 2026.

800-82 is the same as FedRAMP or CMMC.

FedRAMP is a cloud Authorization program. CMMC is a contractor assessment program. SP 800-82 is OT security guidance. These are different lanes.

Sort the one-line claim

Three sentences, each in its own lane.
Sentence	Lane	What the fact is
We use SP 800-82 Rev. 3 as OT security guidance and adapt changes through approved ops.	Guidance, adapted	The publication is the Guide to OT Security. Changes that touch process control still go through the OT or operations owner.
We are 800-82 certified.	Not a plant certificate	NIST did not certify the plant when it published the guide. A plant certificate is not part of SP 800-82.
FedRAMP Authorization, or CMMC Status.	Different lane	FedRAMP is the cloud Authorization program. CMMC is the contractor assessment program. Neither one is SP 800-82.

CHECK THE CATEGORY

When Propulsion Lead Priya Nair and Vera Vance cite NIST SP 800-82 for an operational technology review, which statement is accurate?

Glossary and nearby pages

Use the agency page in the sources for the authoritative text.