NIST publishes draft SP 800-82r4 on OT security

NIST has released an initial public draft of Special Publication 800-82r4, Guide to Operational Technology (OT) Security, a 321-page revision that restructures its guidance around the Cybersecurity Framework 2.0 and adds zero trust principles. The public comment period runs until 30 November 2026.

The draft expands coverage to building automation and control systems, water and wastewater systems, food and agriculture, freight rail, maritime vessels, and Industrial Internet of Things and cloud convergence. It also adds guidance on asset management, network monitoring and detection, system management functions, and aligning OT risk management with enterprise risk management as described in NIST IR 8286r1.

NIST said a mature OT defence mindset is consequence-driven, with cyber controls evaluated alongside engineering countermeasures such as Cyber-Informed Engineering. The draft recommends separating OT networks from enterprise networks and segmenting operational traffic from management traffic, and notes that OT systems prioritise human safety, environmental protection and production continuity over the information security and throughput focus of traditional IT.