Put NIST SP 800-82 OT security guidance into practice
NIST SP 800-82 Rev. 3 is the National Institute of Standards and Technology's Guide to Operational Technology (OT) Security, published in September 2023. It explains how to secure industrial control systems, building automation, transport and other systems that monitor or control the physical world, while respecting their performance, reliability and safety needs. It covers OT architectures, threats, risk management, defence-in-depth architecture, applying the Cybersecurity Framework to OT, and an OT overlay that tailors NIST SP 800-53 Rev. 5 controls.
Is NIST SP 800-82 right for your organisation?
NIST SP 800-82 is used by organisations that run OT, such as energy and water utilities, manufacturers, oil and gas, transport and building operators. It was prepared for US federal agencies and is voluntary for everyone else, but it is widely used as a reference for OT security programmes, critical infrastructure expectations and customer assurance. It is most useful when you are building or maturing an OT security programme or extending IT controls into plant and control networks.
Adopting it is voluntary, though customers and auditors often expect it.
- Issued by
- National Institute of Standards and Technology (NIST)
- Full title
- Guide to Operational Technology (OT) Security
- Published
- September 2023
- Supersedes
- NIST SP 800-82 Rev. 2 (May 2015)
- Status
- Voluntary guidance; prepared for US federal agencies
- Control overlay
- Appendix F: OT overlay of SP 800-53 Rev. 5 with low, moderate and high baselines
- Next revision
- Rev. 4 initial public draft published September 2026
- Type
- Guidance (voluntary)
- Region
- United States, US
- In OneClickComply
- Supported today
OneClickComply makes it simple
NIST SP 800-82 Rev. 3 is mapped in OneClickComply's control library and is available on request. Its OT overlay controls are mapped to the same control set as SP 800-53, ISO 27001 and other frameworks, so evidence you collect once for policies, access, logging and incident response counts towards each. Our in-house audit team and Ask an Auditor help you decide how the guidance and the low, moderate or high overlay baseline apply to your OT environment.
Requirements covered
Six main sections (introduction, OT overview, OT cybersecurity programme development, risk management for OT, OT cybersecurity architecture and applying the Cybersecurity Framework to OT) plus seven appendices, with Appendix F holding the OT overlay of NIST SP 800-53 Rev. 5 controls for low, moderate and high impact systems.
Manual NIST SP 800-82 vs. OneClickComply
- Reading a 316-page PDF and translating guidance into owned tasks
- Cross-referencing the OT overlay against SP 800-53 Rev. 5 control by control
- Duplicating evidence for IT and OT when other frameworks ask for the same controls
- Tracking compensating controls where OT assets cannot be patched or changed
- Keeping policies and records current as plant, vendors and networks change
- Mapped controls turn the guidance into a clear list of tasks and owners
- Overlay controls are linked to their SP 800-53 counterparts in one place
- Evidence collected once counts towards every framework it applies to
- The risk register records OT exceptions and the compensating controls behind them
- Continuous monitoring alerts you when connected IT controls drift
Everything you need for NIST SP 800-82
SP 800-82 OT overlay controls mapped in the control library, available on request
Evidence reused across SP 800-53, ISO 27001 and other mapped frameworks
AutoComplete policies for OT access, remote access, patching and incident response
Risk register to record OT risks, safety impacts and compensating controls
Vendor risk management for OT suppliers, integrators and remote support providers
Ask an Auditor guidance on choosing a low, moderate or high overlay baseline
Three steps to NIST SP 800-82 compliance
Connect & scan
Connect your cloud, identity and SaaS tools. OneClickComply checks them against NIST SP 800-82 and shows you exactly where you stand.
Fix & generate
OneClickFix remediates technical gaps in one click, and AutoComplete generates NIST SP 800-82-aligned policies from your real environment.
Monitor & evidence
Continuous monitoring keeps you compliant, and our in-house audit team is on hand when you need expert guidance.
NIST SP 800-82 Rev. 3 requirements
The structure of SP 800-82 Rev. 3: its six sections with their main subsections and seven appendices; the OT overlay controls in Appendix F are covered on the separate low, moderate and high baseline pages.
| Reference | Requirement |
|---|---|
| Section 1 | Introduction |
| Section 2 | OT Overview |
| 2.1 | Evolution of OT |
| 2.2 | OT-Based Systems and Their Interdependencies |
| 2.3 | OT System Operation, Architectures, and Components |
| 2.4 | Comparing OT and IT System Security |
| Section 3 | OT Cybersecurity Program Development |
| 3.1 | Establish a Charter for the OT Cybersecurity Program |
| 3.2 | Business Case for the OT Cybersecurity Program |
| 3.3 | OT Cybersecurity Program Content |
| Section 4 | Risk Management for OT Systems |
| 4.1 | Managing OT Security Risk |
| 4.2 | Special Areas for Consideration |
| 4.3 | Applying the Risk Management Framework to OT Systems |
| Section 5 | OT Cybersecurity Architecture |
| 5.1 | Cybersecurity Strategy |
| 5.2 | Defense-in-Depth Architecture Capabilities |
| 5.3 | Additional Cybersecurity Architecture Considerations |
| 5.4 | Cybersecurity Architecture Models |
| Section 6 | Applying the Cybersecurity Framework to OT |
Always check the official NIST SP 800-82 text for the exact wording.
NIST SP 800-82 FAQs
What is NIST SP 800-82 Rev. 3?
NIST SP 800-82 Rev. 3 is NIST's Guide to Operational Technology (OT) Security, published in September 2023. It explains how to secure systems that monitor or control physical processes, such as industrial control systems, SCADA, building automation and physical access control, while keeping their performance, reliability and safety requirements intact. It covers OT architectures, threats, risk management, security architecture and an OT overlay for NIST SP 800-53 Rev. 5.
Is NIST SP 800-82 mandatory?
No, NIST SP 800-82 is guidance, not a law. NIST prepared it for US federal agencies under its FISMA responsibilities, and non-government organisations may use it on a voluntary basis. In practice, sector regulators, customers and insurers often treat it as a benchmark for OT security, so following it helps demonstrate good practice even where it is not formally required.
What changed from Rev. 2 to Rev. 3?
Rev. 3 expanded the scope from industrial control systems to operational technology as a whole. NIST's change log also lists updated threats and vulnerabilities, risk management, recommended practices and architectures, closer alignment with the Cybersecurity Framework, new tailoring guidance for SP 800-53 Rev. 5, and an OT overlay giving tailored low, moderate and high impact baselines. Rev. 3 superseded Rev. 2, which was published in May 2015.
What is the NIST SP 800-82 OT overlay?
The OT overlay is Appendix F of SP 800-82 Rev. 3. It partially tailors the NIST SP 800-53 Rev. 5 controls and baselines for OT, adding OT-specific supplemental guidance and adding or removing controls compared with the SP 800-53B baselines. It provides low, moderate and high impact baselines and leaves out privacy-only controls. NIST intends it to apply to OT systems in all industrial sectors.
How does NIST SP 800-82 relate to the NIST Cybersecurity Framework and SP 800-53?
SP 800-82 Rev. 3 builds on both. Section 6 applies the Cybersecurity Framework functions (Identify, Protect, Detect, Respond and Recover) to OT, and Section 4 applies the Risk Management Framework. Its OT overlay tailors the SP 800-53 Rev. 5 control catalogue, so organisations already using SP 800-53 can extend their existing controls into OT rather than starting from scratch.
How does NIST SP 800-82 relate to ISO 27001 and IEC 62443?
They complement each other. ISO 27001 is a certifiable management system standard for information security, while SP 800-82 is free guidance focused on the technical and operational realities of OT. IEC 62443 is the international standards series for industrial automation security. Many organisations run an ISO 27001 programme and use SP 800-82 and IEC 62443 to shape OT-specific controls and architecture.
Is there a NIST SP 800-82 Rev. 4?
Rev. 4 is in draft. NIST issued a pre-draft call for comments in January 2026 and published the initial public draft of SP 800-82 Rev. 4 on 21 September 2026, with comments due by 30 November 2026. Until a final Rev. 4 is published, Rev. 3 remains the current final version. The pre-draft proposed moving the OT overlay into a separate document.
Does OneClickComply support NIST SP 800-82?
Yes, on request. NIST SP 800-82 Rev. 3 is mapped in OneClickComply's control library and is available on request rather than as a live self-serve framework. Its controls share evidence with SP 800-53, ISO 27001 and other mapped frameworks, and our in-house audit team can help you scope the guidance and overlay baseline for your OT environment.
Related standards
All standards- NIST SP 800-171A Rev. 3Guidance · US
- NIST SP 800-82 Rev. 3 High OT OverlayGuidance · US
- NIST SP 800-82 Rev. 3 Moderate OT Overlay BaselineGuidance · US
- NIST SP 800-171AGuidance · US
- NIST SP 800-161 Rev. 1Guidance · US
- NIST SP 800-161 Rev. 1 Level 3 (Operational C-SCRM)Guidance · US
- NIST AI 600-1 Generative AI ProfileGuidance · US
- NIST SP 800-161 Rev. 1 Level 2 (Mission and Business Process)Guidance · US
Get NIST SP 800-82 ready, not stressed
Automate controls, gather evidence continuously and stay audit-ready, all on one platform.