NIST SP 800-82 Rev. 3: the Guide to Operational Technology (OT) Security, explained

NIST SP 800-82 Revision 3, "Guide to Operational Technology (OT) Security," is the US National Institute of Standards and Technology's primary reference for securing the systems that monitor and control physical processes — not just traditional IT. NIST's own publication page states the document "provides guidance on how to improve the security of OT while addressing their unique performance, reliability, and safety requirements." Published in September 2023, Rev. 3 supersedes Revision 2 (3 June 2015), which carried the narrower title "Guide to Industrial Control Systems (ICS) Security." The rename signals the document's central change: its scope grew from industrial control systems specifically to operational technology as a whole.

From "ICS" to "OT": why the title changed

NIST's own definition, carried in the current publication, states that OT "encompasses a broad range of programmable systems or devices that interact with the physical environment (or manage devices that interact with the physical environment)," and that these systems and devices "detect or cause a direct change through the monitoring and/or control of devices, processes, and events." NIST's examples extend well past the classic ICS categories (SCADA, DCS, PLCs) to include building automation systems, transportation systems, physical access control systems, and physical environment monitoring and measurement systems. A reader who only knows Rev. 2 should expect Rev. 3 to apply to a wider set of systems than "industrial control systems" alone would suggest — including, for example, a building's HVAC controllers or an access-control panel, not only a factory floor's PLCs.

What Rev. 3 changed from Rev. 2

Per NIST's own September 2023 announcement of the publication, the major updates in Revision 3 are:

Change	What it means
Scope expansion	From industrial control systems (ICS) specifically to the broader category of operational technology (OT)
Updated threats and vulnerabilities	Revised descriptions of what typically threatens OT and where OT systems are typically weak
Updated risk management guidance	Revised recommended practices and reference architectures for managing OT risk
SP 800-53 alignment	New tailoring guidance for NIST SP 800-53 Rev. 5 controls, plus a dedicated OT overlay giving tailored control baselines for low-, moderate- and high-impact OT systems
Cross-framework alignment	Closer alignment with the NIST Cybersecurity Framework (CSF) and other OT security standards and guidelines

NIST's own page for the publication confirms the structural approach stays consistent with earlier revisions: the guide "provides an overview of OT and typical system topologies, identifies typical threats to organizational mission and business functions supported by OT, describes typical vulnerabilities in OT, and provides recommended security safeguards and countermeasures to manage the associated risks." Readers who need the exact section-by-section breakdown of the OT overlay (NIST's own announcement material associates it with an appendix of the full document) should confirm the appendix letter and precise control mappings against the published PDF rather than a secondary summary — this guide has not independently verified that appendix-level detail against the full text this run.

Who wrote it and where it fits

SP 800-82 Rev. 3 was produced jointly by NIST's Smart Connected Systems Division (Networked Control Systems Group) and NIST's Computer Security Division, with named authors Keith Stouffer, Michael Pease, CheeYee Tang, Timothy Zimmerman, Victoria Pillitteri and Suzanne Lightman at NIST, and Adam Hahn, Stephanie Saravia, Aslam Sherule and Michael Thompson at MITRE. NIST's September 2023 announcement notes the SP 800-82 series "has been downloaded more than 3 million times since its initial release" in 2006, underlining its role as a de facto reference point across OT security programs well beyond the US federal government that formally mandates NIST guidance.

Where this sits next to IEC 62443 and the CRA/RED

SP 800-82 is deliberately a risk-management and reference-architecture guide, not a certifiable requirements standard — it tells an organization what OT risk typically looks like and how to tailor general-purpose controls (like SP 800-53's catalogue) to OT's safety and availability constraints. That is a different role from the ISA/IEC 62443 series, which sets testable technical requirements at the system level (see our IEC 62443-3-3 guide) and the component level (see IEC 62443-4-2 vs the Cyber Resilience Act), or from EU product law such as the Cyber Resilience Act and RED delegated act (EN 18031), which impose legal obligations on products placed on the EU market. A factory operator can use SP 800-82 as the risk-assessment and architecture layer that informs which IEC 62443 security levels actually matter for a given zone, while a device maker selling into the EU still needs to track CRA and EN 18031 obligations separately — SP 800-82 does not substitute for either.

A workable starting point

1. Re-scope your asset inventory from "ICS" to "OT". If your existing inventory only captures SCADA/DCS/PLC assets, Rev. 3's broadened definition is a prompt to check whether building automation, physical access control, or environmental monitoring systems on the same networks have been left out.
2. Use the OT overlay as a starting baseline, not a final one, if your organization already maintains an SP 800-53 Rev. 5 control set — tailor from the overlay rather than building an OT control baseline from scratch.
3. Treat SP 800-82 and IEC 62443 as complementary layers: SP 800-82 for risk-based architecture and control tailoring, IEC 62443 for testable, certifiable requirements at the system and component level.
4. Confirm any specific control-ID or appendix citation against the published PDF before relying on it in an audit — this guide intentionally avoids citing section numbers it has not independently verified against the full text.

SoftWSP's OT Snapshot reads a factory's actual shop-floor traffic and maps the resulting device inventory and exposure against the threat and vulnerability categories SP 800-82 Rev. 3 describes, without requiring any agent installation on the OT network: see OT Snapshot.

This guide summarises a public NIST publication; it does not constitute legal or compliance advice.