The National Institute of Standards and Technology (NIST) has proposed an update to its operational technology (OT) security guide that broadens coverage of Industrial Internet of Things (IIoT) and cloud convergence and reorganizes risk guidance around the Cybersecurity Framework (CSF) 2.0.
The initial public draft of “Guide to Operational Technology (OT) Security,” Special Publication 800-82 Revision 4, is open for public comment through Nov. 30. NIST uses OT as a broad term for programmable systems and devices that interact with the physical environment, including industrial control, building automation and transportation systems. The draft would update Revision 3, the current final version published in September 2023.
The changes also expand the sectors and technologies discussed, reorganize the previous risk-management section around CSF 2.0’s Govern function and add more guidance on asset management, network monitoring and detection.
It also adds security-architecture guidance for system-management functions and the use of zero trust principles.
Broader IIoT and cloud coverage
NIST said Revision 4 expands its introduction to OT sectors and technologies, including building automation and control systems, water and wastewater systems, food and agriculture, freight rail and maritime vessels, as well as IIoT and cloud convergence.
NIST’s abstract also lists cloud environments alongside industrial control systems and other forms of OT.
Asset management is one area where NIST separately identified an OT challenge. In a June project description on OT asset management, the agency said OT environments often lack comprehensive asset inventories, citing factors including legacy systems, geographically distributed assets, diverse communications protocols and operational constraints.
The project description says organizations without a comprehensive OT asset-management program may find it difficult to implement risk assessment, network segmentation, vulnerability management, incident response, zero trust and technology modernization.
In Revision 4, asset management and network monitoring and detection receive expanded treatment.
OT governance shifts to CSF 2.0
The draft also places OT risk management more explicitly alongside enterprise risk management. NIST reorganized the former risk-management section around the CSF 2.0 Govern function and expanded discussion of how OT risk aligns with broader enterprise risk management as described in NIST Interagency Report 8286 Revision 1.
The Risk Management Framework remains part of the document, with discussion of its adoption in Appendix F.
Revision 4 is not final. The public comment period closes Nov. 30, and NIST’s publication page does not list a date for final release. Until then, Revision 3 remains the current final edition of SP 800-82.