NIST Special Publication 800-82 is the NIST guide to Operational Technology security. The current edition — Revision 3, published September 2023 — is titled Guide to Operational Technology (OT) Security and replaces earlier editions that were scoped specifically to industrial control systems.
What 800-82 covers
The publication is the OT-specific companion to NIST SP 800-53 (control catalog) and NIST SP 800-171 (CUI protection). It addresses the control categories that apply to OT environments: SCADA, distributed control systems, programmable logic controllers, safety instrumented systems, building automation, and industrial IoT.
The structure follows NIST 800-53 families but reinterprets each control for OT operating conditions:
- Availability over confidentiality. OT safety and uptime take precedence over traditional CIA ordering.
- Deterministic behavior. Controls must not introduce latency or jitter that disrupts control loops.
- Legacy compatibility. The guide explicitly addresses equipment with 20-year service lives and no firmware update path.
- Physical-cyber coupling. A cyber event in OT can cause physical consequences — process upset, equipment damage, safety incident.
How 800-82 relates to other frameworks
- NIST SP 800-53 supplies the full control catalog. 800-82 overlays OT-specific guidance on each family.
- NIST SP 800-171 defines CUI protection for non-federal systems. 800-82 addresses the OT portion of those systems.
- IEC 62443 is the international standard for industrial automation security. 800-82 and IEC 62443 map bidirectionally; organizations often cite both.
- CMMC Level 2 draws its 110 controls from NIST 800-171. When CMMC scopes OT assets under the Specialized Asset category, 800-82 provides the implementation guidance.
Why it matters for OT compliance programs
A compliance program that relies only on 800-171 will have gaps for OT — the parent standard does not address the operational constraints of control-system environments. 800-82 fills those gaps with specific guidance on segmentation, remote access, incident response, and logging in OT contexts.
The current revision added substantial material on zero-trust architecture applied to OT, software bill of materials requirements, and supply-chain risk for ICS vendors. These additions align with DoD DTM 25-003 expectations.
Related terms
- Industrial Control Systems Security
- IEC 62443
- NIST SP 800-171
- Operational Technology Security
- Purdue Model
Access Gate connection
Access Gate aligns with NIST SP 800-82 guidance on OT segmentation and identity-based access, providing a non-inline enforcement layer appropriate for control-system environments.
