What NIST SP 800-82 is
NIST Special Publication 800-82 is the US National Institute of Standards and Technology's guide to securing operational technology. Revision 3, published in September 2023, is titled Guide to Operational Technology (OT) Security. Earlier revisions were called the Guide to Industrial Control Systems (ICS) Security; Rev. 3 widened the scope from ICS to OT in general, including building automation, transport and physical access systems.
It is free to download from NIST, it is guidance rather than a certification scheme, and it is written for US federal systems but used far more widely. If you work in OT, you will be asked about it, and OT security certifications expect you to know what it covers.
What is in it
Rev. 3 is long. The parts that matter for most readers:
- An overview of OT: how control systems work, the main architectures (DCS, SCADA, PLC-based) and how they differ from IT.
- Building an OT security program: governance, roles, and getting operations and engineering on board.
- Risk management for OT: applying NIST's risk management framework where safety and availability come first.
- OT security architecture: defense in depth, network segmentation and separation, boundary protection, DMZs, secure remote access, monitoring and logging.
- Applying the NIST Cybersecurity Framework to OT: what each function means in a plant.
- An OT overlay of SP 800-53 controls: which controls apply at low, moderate and high impact, with OT-specific notes.
The architecture guidance is where a network diagram earns its keep. Almost every recommendation in it is something you can either see on a good drawing or can't check without one.
What 800-82 expects a network diagram to show
| 800-82 architecture idea | What to draw | Book 1 chapter |
|---|---|---|
| Defense in depth | Layers from enterprise to the process, each with its own boundary | Ch. 3 |
| Segmentation and separation | Zones as boxes, each routed VLAN in exactly one zone, no VLAN spanning zones | Ch. 3, 4 |
| Boundary protection | The firewall, ACL or data diode on every zone edge, by name | Ch. 3, 16 |
| An OT DMZ | Brokers in the IDMZ (historian replica, patch relay, remote access gateway), and no rule that passes straight through | Ch. 3 |
| Restricting traffic | A flow register: default deny, one row per conversation, who starts it, ports, purpose and owner | Ch. 9, 10 |
| Secure remote access | The vendor path drawn end to end: internet, gateway, jump host, target, and who approves the session | Ch. 9, 14 |
| Network management | Switch and firewall management interfaces in their own zone, reached from jump hosts only | Ch. 3, 4 |
| Redundancy and availability | Rings, redundant pairs and what fails when one link goes down | Ch. 7 |
| Asset inventory | Every device, with zone, owner and firmware, kept in a source of truth rather than in the drawing | Ch. 5, 12 |
| Monitoring | Where logs go, where sensors or SPAN ports sit, which conduits are watched | Ch. 9 |
The logical page from Book 1's sample plant: each zone's VLANs, subnets, gateways and VRF, so segmentation can be checked rather than assumed.
800-82 and IEC 62443 together
They are not competitors. 800-82 is broad guidance on running an OT security program, written in NIST's vocabulary. ISA/IEC 62443 is a standards series with specific requirements and security levels that suppliers and integrators can certify against. Rev. 3 refers to 62443 and uses the same zone and conduit idea.
In practice, many plants use 800-82 to shape the program and 62443 to specify the system. One drawing serves both: zones and conduits with a target security level on each zone satisfy 62443, and the same drawing shows the segmentation, boundary protection and DMZ 800-82 asks for. See IEC 62443 zones and conduits, drawn.
A ten-question 800-82 check of your drawing
- Is every Purdue level from enterprise to the process on the page?
- Is there an OT DMZ, and does every IT-to-OT conversation stop at a broker in it?
- Does every zone boundary name the device that enforces it?
- Is every routed VLAN in exactly one zone?
- Is there a written flow register with default deny?
- Is the vendor remote access path drawn end to end?
- Are management interfaces in their own zone?
- Is the safety system its own zone?
- Is the drawing dated, with its data source named?
- Has someone compared the firewall rules with the register in the last year?
Fewer than eight yeses means the drawing is a sketch, not evidence. For a scored version, try score your network diagram.
Where to go next
- Free: Purdue model network diagram, Book 1 Chapter 3.
- Free: the flow register chapter, Book 1 Chapter 10.
- OT security basics for IT people.
- Studying for an OT security certification? See the OT security study map.
- Manufacturing Network Diagrams, Book 1, is the full method behind every row in the table above.
This guide summarises NIST SP 800-82 Rev. 3 in our own words and is not published or endorsed by NIST. Read the original, free, at csrc.nist.gov.
