OT security protects programmable systems that monitor or control physical processes, such as pumps, breakers and building controls. The goals look like IT security, but performance, reliability and safety requirements change which controls are acceptable. A patch or scan that is routine on a laptop can be risky on a live process.
What NIST means by OT
NIST SP 800-82 Rev. 3, published in September 2023, is titled Guide to Operational Technology (OT) Security. Its abstract describes OT as programmable systems and devices that interact with the physical environment, or manage devices that do. Examples named include industrial control systems, building automation, transportation systems, physical access control and environmental monitoring.
The keywords also name SCADA systems, distributed control systems and programmable logic controllers. The listed sectors are energy, manufacturing and transportation.
Where priorities shift
The NIST abstract says the guide covers how to secure OT while addressing its unique performance, reliability and safety requirements. Read that sentence as a warning against copying an IT playbook.
Three differences show up again and again in practice:
- Availability and safety come first. In an office, a crashed server is an inconvenience. In a plant, an unexpected restart can affect a physical process.
- Change is slow and planned. Control systems often run for long periods between maintenance windows, so patching is scheduled rather than automatic.
- Testing needs care. Active network scans that are normal in IT may upset fragile devices, so passive methods and vendor guidance matter.
These are general engineering realities that the NIST guide addresses, not claims from one page. Check the full document for the details that apply to your systems.
What stays the same
Credentials still need to be strong and unique. Remote access still needs to be controlled. You still need an inventory, backups and a plan for an incident. CISA's guidance on primary mitigations for OT, covered in our post on the five first steps, reads like basic hygiene because most of it is.
The difference is in how you deliver it. Replacing a default password on a PLC may need a change window and a tested backup of the logic first.
A short comparison
| Question | Typical IT answer | Typical OT answer |
|---|---|---|
| What fails if it breaks? | Data or service | A physical process |
| How often can you patch? | Frequently | On a planned schedule |
| Who owns it? | IT | Operations and engineering, with IT |
The ownership row matters most. Many OT security failures start with a gap between the team that runs the plant and the team that runs the network.
Quick check
Is SCADA the same as OT?
No. SCADA is one kind of system within OT. The NIST abstract lists industrial control systems, building automation and others as well.
Does NIST SP 800-82 replace the older version?
Rev. 3 supersedes Rev. 2 from June 2015, according to the NIST page. The page also notes that a draft of Revision 4 was open for comment at the time of review, so check for the current status.
For the software that sits around your control systems, such as engineering workstations and vendor tools, Safeguard offers asset discovery and dependency scanning. It does not monitor PLCs or control networks directly.
Sources
Last reviewed: 19 October 2026.
