Secure low-impact OT systems with the NIST 800-82 Low OT Overlay
The NIST SP 800-82 Rev. 3 Low OT overlay is the set of security controls NIST recommends for low-impact operational technology systems, published in Appendix F of SP 800-82 Rev. 3. It starts from the NIST SP 800-53 Rev. 5 low baseline and tailors it for OT, adding or adjusting controls and giving OT-specific guidance where safety, availability and legacy equipment change how a control should be applied.
Is NIST 800-82 Low OT Overlay right for your organisation?
The Low OT overlay suits organisations whose OT systems have been categorised as low impact, meaning a loss of confidentiality, integrity or availability would have a limited adverse effect. It is used by US federal agencies and their contractors under the NIST Risk Management Framework, and voluntarily by manufacturers, utilities and facility operators who want a recognised OT control baseline.
Adopting it is voluntary, though customers and auditors often expect it.
- Issued by
- National Institute of Standards and Technology (NIST)
- Source document
- NIST SP 800-82 Rev. 3, Guide to Operational Technology (OT) Security, Appendix F
- Published
- 28 September 2023
- Built on
- NIST SP 800-53 Rev. 5 low baseline (SP 800-53B)
- Applies to
- OT systems categorised as low impact
- Status
- Voluntary guidance, used within the NIST Risk Management Framework
- Assessment route
- No certification; assessed through RMF authorisation or independent review
- Type
- Guidance (voluntary)
- Region
- United States, US
- In OneClickComply
- Supported today
OneClickComply makes it simple
The NIST 800-82 Low OT overlay is mapped in OneClickComply's control library and available on request. Once enabled, its controls sit alongside your other frameworks, so evidence collected from your IT and identity tools counts towards every standard it applies to, with policies, a risk register and monitoring to support the OT-specific work. Our in-house audit team can advise on tailoring the overlay to your OT environment.
Requirements covered
A tailored low-impact baseline of NIST SP 800-53 Rev. 5 controls and enhancements across 19 control families, each with OT-specific supplemental guidance, set out in Appendix F of SP 800-82 Rev. 3.
Already working towards another framework?
- ISO 2700121% of NIST 800-82 Low OT Overlay overlaps
- SOC 271% of NIST 800-82 Low OT Overlay overlaps
- NIST CSF55% of NIST 800-82 Low OT Overlay overlaps
- GDPR20% of NIST 800-82 Low OT Overlay overlaps
Evidence you collect once counts towards every framework it applies to.
Manual NIST 800-82 Low OT Overlay vs. OneClickComply
- Cross-referencing SP 800-82 Appendix F with SP 800-53 to work out which controls apply
- Rewriting generic IT policies so they make sense for OT environments
- Chasing screenshots and exports from IT and identity tools for evidence
- Tracking the same controls separately for NIST, ISO 27001 and customer audits
- Spotting control drift only when the next assessment comes round
- The overlay's controls are already mapped, so you start from a defined list
- Policies generated from your real environment and adapted for OT
- Evidence pulled automatically from connected tools and logged
- One set of controls with evidence that counts towards every framework
- Continuous monitoring flags drift as soon as it happens
Everything you need for NIST 800-82 Low OT Overlay
Low OT overlay controls mapped to your existing frameworks
Automated evidence collection from IT, cloud and identity tools
AutoComplete policies for access, incident response and contingency planning
Risk register to record OT system categorisation and risks
Supply chain and vendor risk management for OT suppliers
Continuous monitoring with alerts when controls drift
Three steps to NIST 800-82 Low OT Overlay compliance
Connect & scan
Connect your cloud, identity and SaaS tools. OneClickComply checks them against NIST 800-82 Low OT Overlay and shows you exactly where you stand.
Fix & generate
OneClickFix remediates technical gaps in one click, and AutoComplete generates NIST 800-82 Low OT Overlay-aligned policies from your real environment.
Monitor & evidence
Continuous monitoring keeps you compliant, and our in-house audit team is on hand when you need expert guidance.
NIST SP 800-82 Rev. 3 Low OT Overlay requirements
The 19 NIST SP 800-53 Rev. 5 control families covered by the Low OT overlay, which contain the controls and enhancements selected for low-impact OT systems.
| Reference | Requirement |
|---|---|
| AC | Access Control |
| AT | Awareness and Training |
| AU | Audit and Accountability |
| CA | Assessment, Authorization, and Monitoring |
| CM | Configuration Management |
| CP | Contingency Planning |
| IA | Identification and Authentication |
| IR | Incident Response |
| MA | Maintenance |
| MP | Media Protection |
| PE | Physical and Environmental Protection |
| PL | Planning |
| PM | Program Management |
| PS | Personnel Security |
| RA | Risk Assessment |
| SA | System and Services Acquisition |
| SC | System and Communications Protection |
| SI | System and Information Integrity |
| SR | Supply Chain Risk Management |
Always check the official NIST 800-82 Low OT Overlay text for the exact wording.
NIST 800-82 Low OT Overlay FAQs
What is the NIST SP 800-82 Rev. 3 Low OT overlay?
It is the low-impact control baseline in the OT overlay published in Appendix F of NIST SP 800-82 Rev. 3, Guide to Operational Technology (OT) Security. It takes the NIST SP 800-53 Rev. 5 low baseline and tailors it for OT systems, adding or adjusting controls and giving supplemental guidance on applying each one where safety and availability come first.
Who should use the Low OT overlay?
Organisations with OT systems categorised as low impact should use it. That includes US federal agencies and contractors following the NIST Risk Management Framework, and private operators of industrial control, building automation and SCADA systems who want a recognised baseline. Systems with a moderate or high impact level should use the matching moderate or high OT overlay instead.
Is the NIST 800-82 Low OT overlay mandatory?
No, it is guidance, not law. It becomes effectively required when a US federal agency applies it under the Risk Management Framework or when a contract or customer specifies it. Many private organisations adopt it voluntarily. There are no fines attached to the overlay itself, but failing a contractual or agency requirement can affect authorisation to operate or contract eligibility.
How does the Low OT overlay differ from the moderate and high overlays?
The Low OT overlay contains the smallest set of controls, matching systems where a security failure would have a limited adverse effect. The moderate and high overlays build on it with more controls and enhancements, such as stronger monitoring, redundancy and access protections. Your choice depends on the impact categorisation of each OT system, not on the size of your organisation.
How does the Low OT overlay relate to NIST SP 800-53?
It is built directly on NIST SP 800-53 Rev. 5. The overlay starts from the 800-53 low baseline defined in SP 800-53B, then tailors it for OT by adding, removing or adjusting controls and giving OT-specific guidance. The control references, such as AC-2 or SI-4, are the same 800-53 identifiers, so the two can be implemented together.
How does the Low OT overlay relate to ISO 27001 and IEC 62443?
They overlap but serve different purposes. ISO 27001 is a certifiable management system standard for information security, while IEC 62443 is an international series of standards for industrial automation and control system security. The NIST Low OT overlay is a US control baseline. Many controls map across all three, so evidence for one can support the others.
How do you implement the Low OT overlay?
Start by categorising each OT system's impact level and confirming it is low. Then select the overlay's controls, tailor them to your environment, document how each is implemented, and assess them. Use the supplemental guidance in Appendix F to apply controls safely, for example testing patches before deployment and avoiding scanning that could disrupt live processes. Monitor controls continuously afterwards.
Does OneClickComply support the NIST 800-82 Low OT overlay?
Yes, on request. The Low OT overlay is mapped in OneClickComply's control library and can be enabled for your account. Once enabled, its controls are linked to your other frameworks, so evidence, policies and risk records you already maintain count towards it. Our in-house audit team can help you tailor it to your OT environment.
Related standards
All standards- NIST SP 800-82 Rev. 3Guidance · US
- NIST SP 800-171A Rev. 3Guidance · US
- NIST SP 800-82 Rev. 3 High OT OverlayGuidance · US
- NIST SP 800-82 Rev. 3 Moderate OT Overlay BaselineGuidance · US
- NIST SP 800-171AGuidance · US
- NIST SP 800-161 Rev. 1Guidance · US
- NIST SP 800-161 Rev. 1 Level 3 (Operational C-SCRM)Guidance · US
- NIST AI 600-1 Generative AI ProfileGuidance · US
Products that power NIST 800-82 Low OT Overlay compliance
Get NIST 800-82 Low OT Overlay ready, not stressed
Automate controls, gather evidence continuously and stay audit-ready, all on one platform.