OT systems need a level of security proportional to what a failure would do to safety, production and the environment, not a copy of office IT controls. NIST SP 800-82 Rev. 3 gives the method: know your assets, segment networks, control access, monitor, and plan recovery that keeps processes safe.
Why is OT different from IT?
NIST SP 800-82 Rev. 3, the Guide to Operational Technology Security, states that OT security has to address unique performance, reliability and safety requirements. OT includes industrial control systems, building automation, transportation systems and physical access control, anything that monitors or changes something in the physical world.
That changes priorities. In an office, confidentiality often leads. In a plant, availability and safety do. Patching a controller mid shift may be impossible. A scan that is harmless to a laptop can disturb an old programmable controller. Controls must be chosen with that in mind.
How do you decide the right level?
Start with consequences, then work back to controls.
- For each process, ask what happens if it stops, runs wrong or reports false data. Rate the impact on safety, product, environment and revenue.
- Group assets into zones by that impact and by function.
- Set controls per zone. A zone that can hurt people deserves stricter access control, monitoring and change management than a zone that logs temperatures.
NIST's guide builds on its SP 800-53 control catalog and provides an OT overlay with tailored guidance for typical OT constraints. Your zones become the unit to which those controls apply.
What does a sensible baseline contain?
CISA's Cross-Sector Cybersecurity Performance Goals are a plain list of outcomes aimed at both IT and OT operators. Taken together with NIST, the practical baseline looks like this.
Asset inventory. You cannot protect a controller you do not know about. Keep a list with owner, firmware version and network location.
Segmentation. Separate OT from corporate IT, and separate zones inside OT. Control and log the paths between them.
Remote access. Require multi-factor authentication, use named accounts and time limit vendor sessions.
Secure defaults. Change default passwords. Disable services you do not use.
Backups and recovery. Keep offline copies of configurations and logic, test restores, and write a manual operation plan for when the control system is unavailable.
Monitoring. Passive network monitoring suits OT because it does not touch the devices. Decide who watches the alerts and what they do.
Vulnerability management. Track advisories for your equipment. Where patching is not possible, record compensating controls.
What do insurers and auditors look for?
Requirements differ by insurer, by sector and by regulation, and published questionnaires change often. This post does not claim to know any particular insurer's rules. What you can do is ready the evidence that most reviews ask for in some form: an asset inventory, a network diagram with zones, a remote access policy, backup test records and an incident plan. Ask your broker or regulator for the current form and map your evidence to it.
A constructed example
A water treatment operator has three zones: a chemical dosing controller, a monitoring network, and a business network. A risk workshop rates the dosing zone as safety critical. The team puts a firewall rule set between zones, removes direct internet reachable remote access, enforces multi-factor authentication on the one vendor gateway, and stores offline copies of controller logic. The monitoring zone gets passive network monitoring. Spend follows risk instead of being spread evenly.
How to check or apply this
- Build or update the asset inventory for OT devices.
- Rate each process by safety and availability impact.
- Draw zones and conduits and mark where traffic crosses.
- Close direct internet exposure and require MFA for remote access.
- Verify offline backups of logic and configurations by test restore.
- Write and rehearse a manual operation procedure.
- Map your evidence to your insurer's or regulator's current questions.
Quick check
Should OT use the same patch cycle as IT?
Not usually. Patching can need downtime and vendor approval. Where you cannot patch promptly, document compensating controls.
Is NIST SP 800-82 mandatory?
It is guidance. Some sector rules reference it, so check what applies to you.
Sources
- NIST SP 800-82 Rev. 3: Guide to Operational Technology Security
- CISA: Cross-Sector Cybersecurity Performance Goals
- CISA: Industrial Control Systems
Last reviewed: 18 October 2026.
