NIST SP 800-82 Rev. 3: Guide to Operational Technology (OT) Security

Overview

The guide defines OT as programmable systems that interact with the physical environment or manage devices that do; examples are industrial control systems (ICS), building automation, transportation, physical access control and environment monitoring. OT differs from conventional IT because its logic directly affects the physical world, with risks to health and safety, the environment and production. OT security objectives typically prioritise integrity and availability, then confidentiality, with safety as an overarching priority. The document notes that adding IT solutions reduces OT's isolation and that wireless networking raises risk.

Its structure is: Section 2, an OT overview (SCADA, DCS, PLC-based topologies, building automation, physical access control, safety systems, industrial IoT) and a comparison of OT and IT security; Section 3, OT cybersecurity programme development (charter, business case, governance, cross-functional team, strategy, policies, training, maintenance tracking, incident response, recovery); Section 4, OT risk management and the RMF; Section 5, cybersecurity architecture; Section 6, applying the Cybersecurity Framework to OT. Appendix F gives the OT overlay for SP 800-53 Rev. 5 and control selection.

The architecture section recommends five layers of defence in depth: security management, physical, network, hardware and software security. In the network layer it advises characterising, segmenting and isolating IT and OT devices, using a model such as the Purdue model, ISA-95 levels or the three-tier IIoT architecture, with a DMZ as an enforcement boundary. Firewall rulesets should permit connections only between adjacent levels, so Purdue Level 4 devices cannot talk directly to Level 2, 1 or 0, and outbound rules from the control network should be as strict as inbound ones. A unidirectional gateway or data diode is an alternative.

Availability considerations include redundancy for critical components, protecting redundant communication to the same level as the primary, time-sequenced 'backup-in-depth' at local, facility and disaster levels, and primary and alternate power sources. The document stresses that monitoring and control systems for UPSs, generators, HVAC, fire alarms and cooling water plant are also vulnerable to cyber attack and can affect OT. Firewalls, patching, remote access, wireless, time synchronisation and incident response receive OT-specific recommendations.

Key points

1. OT covers ICS, building automation, transportation, physical access control and environment monitoring systems.
2. OT security usually prioritises integrity and availability, then confidentiality, with safety as the overarching priority.
3. The OT cybersecurity programme should be part of OT safety and reliability programmes and the enterprise programme.
4. The cross-functional team should at least include IT staff, a control engineer, a control system operator, a network and system security expert, a management member and a physical security member.
5. Defence in depth has five layers: security management, physical, network, hardware and software security.
6. Network architecture should characterise, segment and isolate IT and OT devices, using the Purdue model, ISA-95 or an IIoT model, with a DMZ.
7. Firewall rules should permit connections only between adjacent levels; Level 4 devices must not talk directly to Level 2, 1 or 0; outbound rules from the control network should be as strict as inbound ones.
8. Critical components should have redundant counterparts and fail without generating unnecessary traffic, with graceful degradation from normal to emergency to manual operation.
9. Systems that manage UPSs, generators, HVAC, fire alarms and cooling water plant are also vulnerable and must be protected.

Using it in design

• Zone the data centre's electrical (UPS, generator, ATS) and mechanical (cooling, HVAC) control systems as an OT network, separated from the corporate IT network by a DMZ.
• Design firewall rules to allow connections only between adjacent levels and to restrict outbound traffic; evaluate a unidirectional gateway for critical control networks.
• Define primary and alternate power, redundant communication and graceful degradation modes (automatic, emergency, manual) as design requirements for BMS and SCADA.
• Plan local, facility and disaster-level backups of BMS and access control systems (configurations, firewall rules, ACLs) and tie restore testing to a schedule.
• Write OT-specific procedures for remote access, wireless and patching; apply patches after testing under field conditions.
• Use the SP 800-53 Rev. 5 OT overlay (Appendix F) as the starting point for control selection.

Who should read it

Engineers responsible for OT, ICS and building automation security, security managers, risk managers and system integrators.

Document contents

1. Executive Summary
2. 1. Introduction
3. 2. OT Overview
4. 2.3 OT System Operation, Architectures, and Components (SCADA, DCS, PLC, Building Automation Systems, Physical Access Control Systems, Safety Systems, IIoT)
5. 2.4 Comparing OT and IT System Security
6. 3. OT Cybersecurity Program Development
7. 4. Risk Management for OT Systems
8. 4.3 Applying the Risk Management Framework to OT Systems
9. 5. OT Cybersecurity Architecture
10. 5.2 Defense-in-Depth Architecture Capabilities (Layers 1-5)
11. 5.3 Additional Cybersecurity Architecture Considerations
12. 5.4 Cybersecurity Architecture Models
13. 6. Applying the Cybersecurity Framework to OT
14. Appendix C. Threat Sources, Vulnerabilities, and Incidents
15. Appendix D. OT Security Organizations, Research, and Activities
16. Appendix E. OT Security Capabilities and Tools
17. Appendix F. OT Overlay

Related standards

• NIST SP 800-53 Rev. 5
• ISA/IEC 62443
• NIST CSF 2.0

Read the document

Publication details

Authors

Keith Stouffer; Michael Pease; CheeYee Tang; Timothy Zimmerman; Victoria Pillitteri; Suzanne Lightman; Adam Hahn; Stephanie Saravia; Aslam Sherule; Michael Thompson

Publisher

National Institute of Standards and Technology

Year

2023

Document number

NIST SP 800-82 Rev. 3

Document language

English

Source type

Expert / community

Access

Open licence — downloadable

DOI

10.6028/NIST.SP.800-82r3

Licence

U.S. public domain — U.S. Government work; free to reuse

Licence evidence

www.copyright.gov

Citation