Factory floor vulnerability management when you cannot patch on Tuesday

On 21 September 2026 NIST published the initial public draft of SP 800-82 Revision 4, the Guide to Operational Technology (OT) Security. Comments are open until 30 November 2026. The announcement says this revision expands guidelines for "asset management and network monitoring and detection" and is restructured around the NIST Cybersecurity Framework 2.0.

Both items sit at the heart of plant vulnerability management. You cannot manage what you have not inventoried, and you cannot patch a controller the way you patch a laptop. This post walks through a process that works inside those limits.

Safeguard does not run factory lines. The relevant part is the software and firmware inventory, the vulnerability data and the records around them.

What's affected

The standards you will hear named on a plant floor:

• IEC 62443, published in the US as the ISA/IEC 62443 series. The ISA catalogue lists parts relevant here: Part 2-3, patch management in the IACS environment, Part 3-3, system security requirements and security levels, Part 4-1, secure product development lifecycle requirements, and Part 4-2, technical security requirements for IACS components.
• NIST SP 800-82 Rev. 3, published September 2023, whose abstract describes guidance on securing OT "while addressing their unique performance, reliability, and safety requirements."

A real example of why this matters: CISA added CVE-2021-22681, "Rockwell Multiple Products Insufficient Protected Credentials Vulnerability," to the Known Exploited Vulnerabilities (KEV) catalog on 5 March 2026, with a due date of 26 March 2026 for US federal agencies. The entry says Studio 5000 Logix Designer software may allow a key to be discovered, and that the key is used to verify controllers are communicating with Rockwell design software. Exploitation requires network access to the controller. The required action is "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable."

The CVE dates from 2021. Its KEV listing arrived five years later. Any plant that closed it as low priority in 2021 has a reason to reopen the ticket.

How to check if you are exposed

Build the inventory first. You need, for each asset: vendor, product, firmware or software version, the zone it sits in, and whether it can be reached from the business network.

Then compare against the KEV catalog. CISA publishes it as JSON, so this works offline once you have downloaded the file.

curl -s https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json -o kev.json
jq -r '.vulnerabilities[] | select(.vendorProject=="Rockwell") | [.cveID,.product,.dateAdded,.dueDate] | @tsv' kev.json

At the time of writing, the catalog release dated 16 October 2026 held 1,748 entries. Filter by the vendors in your asset list, not by the full catalog.

What to do now

1. Triage by exposure, then by KEV. A KEV entry on a controller reachable only inside a cell is a different job from the same entry on one reachable from the office network.
2. Record a decision for every match. Patch, mitigate, accept with an owner and an expiry date. "Not reviewed" is not a decision.
3. Use compensating controls while you wait for a window. Network segmentation, disabling unused services and restricting who can run engineering software.
4. Plan updates around production. Part 2-3 of IEC 62443 is the part about patch management, so read it before you write your patch policy. Agree test steps and maintenance windows with operations weeks ahead, not on the day.
5. Protect the engineering workstations. The Rockwell entry above concerns design software. The laptop that programs controllers is part of the attack surface.
6. Watch for default credentials. KEV also lists CVE-2023-6448, where Unitronics Vision PLCs and HMIs "ship with an insecure default password." That one is closed by process, not by a patch.

Why it matters

Plant vulnerability management fails in two ways. One is treating OT like IT and demanding a 14 day patch on a line that runs 24 hours a day. The other is treating OT as untouchable, so nothing is ever reviewed.

The workable middle is a register: every asset, every match, every decision with an owner. When the KEV catalog changes, you can answer in minutes which cells are affected and what you decided last time.

Try it yourself

Pick five assets from one production cell. For each, write vendor, product, version and zone. Check them against the KEV file with the command above. Write one line of decision per match.

Click through it at your own pace, or open it full screen.

Quick check

Sources

• NIST SP 800-82 Rev. 4 initial public draft (21 September 2026)
• NIST SP 800-82 Rev. 3, Guide to Operational Technology (OT) Security
• CISA Known Exploited Vulnerabilities catalog (JSON feed)
• ISA, ISA/IEC 62443 series of standards