Compliance & Certifications • NIST SP 800-82

NIST SP 800-82: The ICS Security Playbook Explained

Merobix Engineering • • 11 min read

Every serious conversation about securing SCADA in the United States eventually cites the same document: NIST Special Publication 800-82. It is free, it is vendor-neutral, and it is the reference that TSA directives, EPA guidance, insurers, and auditors quietly borrow from when they decide what "reasonable OT security" means. Revision 3 - retitled the Guide to Operational Technology Security - is the current edition, and it is long. This guide gives you the working version: what 800-82 actually covers, whether it binds you, how it fits with IEC 62443 and the NIST Cybersecurity Framework, how US operators put it to work, and how to turn its recommendations into sharp questions for any SCADA vendor.

Back to Blog

From the Merobix industrial security hub - every security, compliance & certification guide in one place.

2023Revision 3 Published
$0Cost - Free Public NIST Guidance
6NIST CSF 2.0 Functions It Feeds Into

What NIST SP 800-82 Is - and What It Is Not

SP 800-82 is NIST's comprehensive guide to securing operational technology: SCADA systems, distributed control systems, PLCs, RTUs, and - since Revision 3 - the broader OT family including building automation, physical access control systems, and industrial IoT. It was first developed in the 2000s when "ICS security" barely existed as a discipline, revised in 2015 (Rev 2), and substantially rewritten as Revision 3, published by NIST in September 2023.

Three things it is: a shared vocabulary for how OT differs from IT security, a catalog of architecture and control recommendations tailored to environments where a reboot can stop production, and a bridge that connects OT practice to the rest of the NIST ecosystem - the Cybersecurity Framework and the SP 800-53 control catalog.

Three things it is not: it is not a regulation (no private operator is fined for ignoring it), it is not certifiable (there is no "800-82 certified" - treat any vendor claiming that as a red flag), and it is not a checklist you can complete in an afternoon - it expects you to run a risk-based program, not tick boxes.

What Revision 3 Actually Covers

The current edition is organized around a handful of load-bearing themes:

The consistent thread is pragmatism: 800-82 repeatedly acknowledges that you often cannot patch promptly, cannot install agents on a PLC, and cannot take production down for security's convenience - and then tells you what to do instead: segment, restrict access, monitor, and plan response.

Is It Mandatory? The Honest Answer

For US federal agencies operating control systems, NIST guidance is effectively binding. For private operators, 800-82 is voluntary - but it becomes binding through the side door with remarkable consistency:

The practical posture: treat it as the definition of defensible practice. If your program can be described in 800-82's terms, every downstream audit gets easier.

How 800-82 Maps to IEC 62443 and NIST CSF

Buyers meet three frameworks in every OT security conversation, and they are complements, not competitors:

Attribute NIST SP 800-82 IEC 62443 NIST CSF 2.0
What it isFree descriptive guidance for securing OTNormative international standard family for IACS securityHigh-level risk framework, six functions
Primary audienceAsset owners and their security teamsAsset owners, integrators, and product vendors (separate parts for each)Executives and whole-of-organization programs
Certifiable?NoYes - product and system certification schemes (ISASecure, exida)No
Graded security levelsNo - risk-based tailoringYes - SL1 through SL4 by attacker capabilityTiers describe program maturity, not system strength
Geographic gravityUnited StatesInternationalUS origin, global adoption
Best used forBuilding and defending your internal OT programSpecifying requirements for systems and vendors you buyOrganizing and communicating the overall program

A clean division of labor emerges: CSF organizes the program and the board conversation, 800-82 tells your team how to secure OT specifically, and 62443 gives you contract language - security levels and certifications - to demand from vendors. Rev 3 makes the first mapping explicit by structuring guidance around CSF functions, and it acknowledges 62443's zone-and-conduit model in its architecture guidance. Deep dives on both companions: our IEC 62443 certification guide and certifications explainer.

How US Operators Actually Use It

In the field, 800-82 shows up in four recurring ways:

  1. As the skeleton for risk assessments. Water utilities doing AWIA assessments, pipeline operators writing TSA implementation plans, and manufacturers running their first OT risk review all crib its threat categories and architecture recommendations rather than inventing their own.
  2. As the referee in IT/OT arguments. When the corporate security team wants to run vulnerability scans against the PLC network and the operations team refuses, 800-82 is the neutral document both sides accept - it validates OT's availability concerns while denying OT a free pass on security.
  3. As policy raw material. Its recommendations convert almost line-by-line into internal standards: remote access policy, segmentation requirements, logging expectations, incident response roles.
  4. As justification in budget season. "NIST recommends this and we do not do it" remains one of the most effective sentences in a capital request.

The Recommendations That Should Shape Your SCADA Purchase

Strip the document to the guidance that directly affects what you buy, and you get a short list:

This list doubles as a scorecard for platforms. Merobix was engineered along exactly these lines: an outbound-only gateway that requires no inbound OT firewall rules, per-user MFA (TOTP and passkeys) with per-site role authorization, TLS on cloud, MQTT, and industrial connections, signed telemetry envelopes with replay detection, immutable audit records with runtime threat monitoring delivered to email, SMS, webhook, or SIEM, and control-tag authorization with setpoint bounds checking on every write - with the full detail published on our security page. Merobix also maps its platform controls to IEC 62443 and runs a SOC 2 readiness program, so the 800-82-shaped questions in your assessment have documented answers.

Key takeaway: NIST SP 800-82 is not a law and not a certificate - it is the playbook US assessors, insurers, and regulators quietly grade you against. Use it three ways: structure your internal OT program on its guidance, translate its architecture chapter into hard requirements for any SCADA purchase, and expect every serious vendor to answer its themes - segmentation, individual authentication, encrypted transport, tamper-resistant logging, controlled writes - fluently and in writing.

Turning 800-82 Into Vendor Evaluation Questions

Close the loop by making the guidance interrogative. Six questions cover the core:

  1. What firewall rules does your architecture require at the OT boundary, and in which direction?
  2. Is every user individually identified with MFA, and can roles restrict both visibility and control actions per site?
  3. How is data protected in transit on every hop - field to gateway, gateway to platform, platform to user?
  4. Which security events do you log, are the logs tamper-resistant, and how do they reach our SIEM?
  5. What validation happens before a setpoint write reaches a device, and what record exists afterward?
  6. How does the system behave through a connectivity outage, and how are backups and restores tested?

A vendor who answers all six specifically - with architecture documents, not adjectives - is aligned with the playbook whether or not they cite it. A vendor who answers with "military-grade encryption" and no specifics has told you what you need to know. Bring the list to a Merobix demo and ask them live; the broader question bank is in our 50 vendor security questions.

Frequently Asked Questions

What is NIST SP 800-82?

NIST Special Publication 800-82 is the US National Institute of Standards and Technology's guide to operational technology (OT) security - the closest thing the industry has to a free, comprehensive playbook for securing SCADA systems, DCS, PLCs, and related control systems. Revision 3, published in 2023, retitled it the Guide to Operational Technology Security and broadened it beyond classic industrial control systems to cover building automation, physical access control, and industrial IoT. It explains how OT differs from IT, how to run an OT risk program, how to architect defensible control networks, and how to tailor NIST's general security controls to environments where availability and safety come first.

Is NIST SP 800-82 mandatory?

Not for private operators - it is guidance, not regulation. US federal agencies must apply NIST controls to their own systems, which pulls 800-82 into government-operated OT. For everyone else it becomes binding indirectly: TSA pipeline security directives, EPA water-sector guidance, cyber insurers, and customer security questionnaires all reference or borrow from it, and auditors treat it as the standard of reasonable care for US operators. In practice, if you run OT in the United States and something goes wrong, the question asked afterward is usually whether you followed the practices 800-82 describes.

What is the difference between NIST 800-82 and IEC 62443?

They approach the same problem from different directions and work best together. NIST 800-82 is free descriptive guidance for asset owners - it explains threats, architecture patterns, and how to tailor security controls to OT, but nothing is certified against it. IEC 62443 is a formal international standard family with normative requirements, four graded security levels (SL1 to SL4), and certification schemes such as ISASecure that vendors and products can actually be certified under. A common pattern: use 800-82 to structure your internal program and risk assessment, and use IEC 62443 security levels and certifications to specify requirements for vendors and systems you buy.

What changed in NIST 800-82 Revision 3?

Three big things. First, scope: the guide moved from industrial control systems specifically to operational technology broadly, adding building automation systems, physical access control, and IIoT devices. Second, alignment: Rev 3 ties OT security to the NIST Cybersecurity Framework and provides an OT-tailored overlay of the SP 800-53 control catalog, so OT programs plug into the same language enterprise security teams already use. Third, modernization: expanded treatment of risk management, defense-in-depth architecture, and current practices reflecting how threats and technology - including cloud-connected monitoring - evolved since Revision 2 in 2015.

How should buyers use NIST 800-82 to evaluate SCADA vendors?

Turn its recommendations into vendor questions. The guide's core themes translate directly: How does your architecture support network segmentation, and does it require inbound firewall rules into the OT zone? Is authentication unique per user with MFA, and is least privilege enforceable per role and per site? Are all communications encrypted and device identities managed? What security events are logged, are logs tamper-resistant, and can they reach our SIEM? How are patches delivered and validated? A vendor fluent in these answers - with architecture documentation to back them, the way Merobix publishes its outbound-only gateway design, role model, and audit-chain approach - is demonstrating alignment with the playbook US assessors actually use.

Sources & Further Reading

Built Along the 800-82 Playbook

Outbound-only gateway, per-user MFA and roles, encrypted transport, tamper-evident audit records, and controlled setpoint writes - see how the architecture answers the assessment before the assessor asks.

Request a Demo → See Our Security Architecture
Free SCADA operator training
Merobix University - 70 video lessons & 261 quiz questions, from first login to compliance reporting. No demo call required.
Start free →