Official websites use .gov
A .gov website belongs to an official government organization in the United States.

Secure .gov websites use HTTPS
A lock ( ) or https:// means you’ve safely connected to the .gov website. Share sensitive information only on official, secure websites.

NIST SP 800-82 Rev. 3

Guide to Operational Technology (OT) Security

Documentation Topics

Date Published: September 2023

Supersedes: SP 800-82 Rev. 2 (06/03/2015)

Planning Note (07/18/2024):

Some potential updates have been identified. These are not official changes but may be corrected in a future errata update or revision of the publication.

Author(s)

Keith Stouffer (NIST), Michael Pease (NIST), CheeYee Tang (NIST), Timothy Zimmerman (NIST), Victoria Pillitteri (NIST), Suzanne Lightman (NIST), Adam Hahn (MITRE), Stephanie Saravia (MITRE), Aslam Sherule (MITRE), Michael Thompson (MITRE)

Abstract

This document provides guidance on how to secure operational technology (OT) while addressing their unique performance, reliability, and safety requirements. OT encompasses a broad range of programmable systems and devices that interact with the physical environment (or manage devices that interact with the physical environment). These systems and devices detect or cause a direct change through the monitoring and/or control of devices, processes, and events. Examples include industrial control systems, building automation systems, transportation systems, physical access control systems, physical environment monitoring systems, and physical environment measurement systems. The document provides an overview of OT and typical system topologies, identifies common threats and vulnerabilities to these systems, and provides recommended security countermeasures to mitigate the associated risks.

Keywords

computer security; distributed control systems (DCS); industrial control systems (ICS); information security; network security; operational technology (OT); programmable logic controllers (PLC); risk management; security controls; supervisory control and data acquisition (SCADA) systems

Control Families

None selected

Documentation

Publication:
https://doi.org/10.6028/NIST.SP.800-82r3
Download URL

Supplemental Material:
Potential updates [7-10-2024] (xlsx)
OT Security project

Related NIST Publications:
SP 800-82 Rev. 4 (Draft)

Document History:
04/23/21: SP 800-82 Rev. 3 (Draft)
04/26/22: SP 800-82 Rev. 3 (Draft)
09/28/23: SP 800-82 Rev. 3 (Final)

Topics

Security and Privacy

risk management, security programs & operations

Applications

cyber-physical systems, Internet of Things, operational technology

Sectors

energy, manufacturing, transportation

CS Knowledge Base