NIST Opens Public Comment on Draft Revision 4 of OT Security Guide

NIST has opened the initial public draft of Special Publication 800-82 Revision 4 for public comment, with comments due by November 30, 2026. The publication is the federal government’s guide to securing operational technology (OT), including systems that monitor or control physical environments. Organizations that operate, secure, or support OT should review the draft and submit feedback before the deadline. The comment period creates an opportunity for contractors and other stakeholders to help shape future federal guidance, but it does not itself establish a procurement requirement or alter existing contract obligations.

The current final edition, Revision 3, was published in September 2023 and replaced Revision 2, which focused on industrial control systems. Revision 3 broadened the scope to OT generally, updated its treatment of threats, vulnerabilities, risk management, recommended practices, and architectures, and added alignment with other cybersecurity standards and guidelines, including the NIST Cybersecurity Framework. It also introduced tailoring guidance for SP 800-53 Revision 5 and an OT overlay with tailored baselines for low-, moderate-, and high-impact OT systems. These features make the publication a practical reference for evaluating security approaches across varied OT environments.

NIST’s OT examples include industrial control systems, building automation, transportation systems, physical access control, and physical environment monitoring and measurement systems. The guide also discusses system types such as supervisory control and data acquisition (SCADA), distributed control systems, programmable logic controller-based systems, safety systems, and the industrial internet of things. These systems can have distinct performance, reliability, and safety constraints, which is why the guidance emphasizes risk-based practices and controls tailored to operational context rather than a uniform, one-size-fits-all approach.

For GovCon teams, the key distinction is between guidance and enforceable requirements. SP 800-82 does not create a standalone mandate; a contractor’s obligations depend on the terms of the specific contract and any applicable regulatory requirements. Contractors can use Revision 3 as a current federal reference when assessing OT security and preparing for potential changes in Revision 4, while procurement and capture teams should avoid treating recommendations as mandatory unless incorporated into governing terms. Agencies and contracting teams can also use the comment period to identify where draft language, implementation expectations, or control tailoring may need clarification before the next revision is finalized.

• The public comment period for the initial SP 800-82 Revision 4 draft closes November 30, 2026; interested organizations should submit feedback by that date.
• Revision 3, published in September 2023, remains the current final edition while Revision 4 is in draft.
• The guide covers OT such as industrial control, building automation, transportation, physical access control, and environmental monitoring systems.
• Revision 3 expanded beyond the industrial-control-only scope of Revision 2 to address OT more broadly.
• Revision 3 updated threats, vulnerabilities, risk management, recommended practices, and architectures, and aligned with other cybersecurity guidance, including the NIST Cybersecurity Framework.
• The OT overlay tailors SP 800-53 Revision 5 control baselines for low-, moderate-, and high-impact OT systems.
• Contractors supporting OT environments can use Revision 3 as a security reference, but should verify the specific contract clauses and regulations governing their work.
• Procurement teams should distinguish risk-based recommendations from binding requirements when drafting or evaluating OT security provisions in solicitations and contracts.
• OT security planning should account for operational performance, reliability, and safety requirements alongside cybersecurity risk.