The National Institute of Standards and Technology (NIST) has initiated the process of revising SP 800-82, Guide to Operational Technology (OT) Security, and is inviting public input as part of that effort. For organizations responsible for industrial control systems and other OT environments, this is an important opportunity to help shape future guidance that is widely referenced across critical infrastructure sectors.
NIST has indicated that the revision will incorporate lessons learned, align more closely with updated NIST guidance including Cybersecurity Framework (CSF) 2.0, NIST IR 8286 Rev. 1, and NIST SP 800-53 Rev. 5.2.0, and reflect changes in the OT threat landscape as well as current OT cybersecurity standards and practices. The agency is asking the public to provide feedback on the guide’s effectiveness, relevance, and overall usefulness in helping organizations understand and manage OT cybersecurity risk.
The public comment period is open through February 23, 2026. Comments should be submitted to sp800-82rev4@nist.gov with the subject line “Comments on SP 800-82.”
NIST SP 800-82 is one of the most widely referenced cybersecurity guides for operational technology. It is designed to help organizations enhance the security of OT systems while accounting for performance, reliability, and safety requirements that are fundamental to industrial operations.
The guide provides:
SP 800-82 is part of the NIST Special Publication 800-series, which covers research, guidelines, and outreach related to computer security, as well as collaborative work with industry, government, and academia. While SP 800-82 itself is not regulatory, it is frequently referenced in sector guidance, audits, and internal security programs across energy, water, manufacturing, transportation, and other critical infrastructure industries.
The current version of the guide is SP 800-82 Revision 3, published in September 2023. Rather than releasing a draft Revision 4 immediately, NIST is starting with this pre-draft request for input to help determine what changes and additions would be most valuable to the OT community.
In its call for public input, NIST outlined several areas where it is seeking feedback. These are not finalized changes, but they indicate the direction of travel for the next revision of the guide.
While NIST is exploring how SP 800-82 should evolve, we do not expect the core focus of OT cybersecurity guidance to fundamentally change. Based on how cybersecurity frameworks and regulatory expectations continue to develop, we expect foundational, cyber hygiene oriented controls to remain central to how organizations are expected to manage OT risk.
Asset management, for example is a core fundamental. Across frameworks and standards, organizations are consistently expected to maintain accurate and current inventories of OT devices, systems, software, and firmware, and to understand how those assets support operational processes. Keeping inventories updated as components are added, replaced, patched, or reconfigured remains essential to understanding risk and supporting nearly every other security function.
This extends beyond simply knowing that a device exists. In practice, effective OT asset management typically includes:
We also expect configuration management to remain a foundational expectation. Secure configuration baselines, access control settings, service hardening, and network restrictions continue to play an important role in reducing exposure in OT environments. These controls are also closely tied to formal change management processes, which are critical in environments where availability and safety requirements limit how quickly systems can be modified.
Logging and monitoring are similarly unlikely to diminish in importance. Network and computing devices such as routers, switches, firewalls, servers, and workstations are expected to generate logs that support monitoring, alerting, and incident response. Centralized log management and analysis helps organizations detect abnormal behavior and investigate incidents without relying solely on ad hoc troubleshooting.
We also expect updated guidance to continue recognizing practical OT constraints, such as latency sensitivity and device limitations that affect the use of encryption or certain endpoint protections. In OT environments, security decisions require informed tradeoffs rather than direct transplantation of IT security controls.
Taken together, while guidance may expand to address new technologies and system types, we expect foundational cyber hygiene practices to remain central to effective OT cybersecurity programs.
Public comments on the SP 800-82 revision process are open through February 23, 2026, and NIST encourages organizations across the OT community to share input on how the guide can better reflect today’s operational and security realities. In the meantime, as organizations continue to focus on foundational practices like asset management, configuration management, and security monitoring, Industrial Defender is ready to partner with customers looking to strengthen these core capabilities in real world industrial environments.
