Apply the NIST 800-82 Moderate OT baseline with less manual effort

It is the moderate-impact control baseline in Appendix F of NIST SP 800-82 Rev. 3, the Guide to Operational Technology (OT) Security published in September 2023. NIST took the SP 800-53B moderate baseline, then added controls important for OT, removed privacy-only controls and wrote OT-specific discussion for many controls. The result is a starting point for securing OT systems whose compromise would have a serious adverse effect.

The Moderate baseline includes more controls and enhancements than Low and fewer than High. It is meant for OT systems categorised as moderate impact, where loss of confidentiality, integrity or availability would have a serious adverse effect. Examples of enhancements NIST added to the Moderate and High baselines include AC-17(10) for authenticating remote commands and AT-2(4) for training staff to recognise suspicious communications and anomalous system behaviour.

US federal agencies are the intended users, as NIST developed the overlay under its responsibilities in the Federal Information Security Modernization Act. Other organisations can use it voluntarily. Utilities, manufacturers, water, energy and building operators often adopt the Moderate baseline as a benchmark, and contractors or suppliers may be asked to align with it by federal or critical infrastructure customers.

No. NIST does not certify organisations against SP 800-82 or its OT overlay. Federal systems are assessed through the NIST Risk Management Framework, using SP 800-53A style control assessments and an authorisation decision. Private organisations typically demonstrate alignment through internal or third-party assessments, documented tailoring decisions and evidence for each selected control.

The overlay is a partial tailoring of NIST SP 800-53 Rev. 5. It uses the same control catalogue and numbering, such as AC-2 or SC-7, but adjusts which controls and enhancements sit in the moderate baseline for OT and adds OT discussion. If you already implement the SP 800-53 moderate baseline, much of your work carries over, with additional OT controls and tailoring to address.

They overlap but are not the same. ISO 27001 is a certifiable management system standard for information security, while the OT overlay is a detailed control baseline for OT systems. IEC 62443 is the international standard series for industrial automation security. Many organisations map SP 800-53 controls to ISO 27001 Annex A and use 800-82 alongside IEC 62443 for OT-specific design.

SP 800-82 Rev. 3 expects this and allows compensating controls. Where OT cannot support a control or enhancement, or applying it could harm performance, safety or reliability, organisations can select an alternative that gives equivalent or comparable protection. The rationale should be documented, and the overlay can be further tailored for your sector and specific systems.

Yes, on request. The Moderate OT overlay is mapped in OneClickComply's control library, but it is not yet a live self-serve framework. Contact us to enable it. Once enabled, its controls share one control set with frameworks such as NIST SP 800-53 and ISO 27001, so evidence collected once counts towards each, and our audit team can advise on tailoring.