Walk the risk management, security program, architecture, and SP 800-53 OT overlay of the definitive US OT security guide, with a checklist built for industrial environments.
Rev 32023 edition
3Overlay baselines
20Control families
CSF + 62443Aligned
NIST SP 800-82 is the most widely referenced OT security guidance in the United States, and Revision 3 brought a significant change. Published in September 2023, Rev 3 expanded scope from industrial control systems to operational technology as a whole, refreshed its threats, risk, and architecture guidance, aligned with the NIST Cybersecurity Framework, and added a new OT overlay.
That overlay applies the SP 800-53 security controls to OT across low, moderate, and high impact baselines. If you are working from the 2015 Revision 2, you are reading ICS-only guidance that predates all of this. This checklist is built on Rev 3 and walks the full guide, in a form your team can use on a real plant.
Revision 2 is ICS-only, and out of date.
The old Revision 2 (2015) covered industrial control systems only. Revision 3 (2023) expanded scope to all operational technology, aligned with the NIST CSF, and added the OT overlay with low, moderate, and high baselines. Assessing against Rev 2 means missing everything that changed. This checklist is built on Rev 3.
What is inside
The checklist follows the structure of Revision 3. For each item, you get a plain-language description, an assessment prompt, and a status field; for the control overlay, you also record which baseline low, moderate, or high applies to each system.
PART 1
Scope & Impact Classification
Inventory your OT systems and set each one's impact level to select the right overlay baseline.
PART 2
OT Risk Management
Assess OT-specific threats, vulnerabilities, and consequences, with safety and reliability first-class.
PART 3
OT Cybersecurity Program
Governance, roles, policy, and training, aligned to NIST CSF and IEC 62443.
PART 4
OT Security Architecture
Segmentation, boundary protection, defense in depth, and secure remote access.
PART 5
The SP 800-53 OT Overlay
The 20 control families applied to OT, grouped and checklisted across the three baselines.
BASELINES
Low, Moderate, High
Classify each system, then apply the matching overlay baseline rather than one-size-fits-all controls.
Who it is for
Built for the people who own the program
OT and ICS security leaders building a program against recognized US guidance
Federal, defense, and critical infrastructure operators who must align with NIST
Compliance and GRC teams mapping OT security to SP 800-82 and SP 800-53
Security architects applying the OT overlay to low, moderate, and high systems
Consultants and integrators assessing OT programs against NIST guidance
Why use it
From the old ICS guide to the current OT guide
Work from Revision 3 — assess against the current OT-wide guide, not the 2015 ICS-only Rev 2
Apply the right baseline — classify each system and apply low, moderate, or high
Built for OT realities — availability-first, safety-critical environments
Framework-aligned — mapped to NIST CSF 2.0 and IEC 62443
How SP 800-82 fits with CSF and IEC 62443
SP 800-82 is not a standalone silo.
It implements the SP 800-53 controls for OT, aligns to the NIST Cybersecurity Framework 2.0, and sits comfortably alongside IEC 62443, the global control-system standard. Arista Cyber helps operators use SP 800-82 as their US-aligned OT control set while mapping it to CSF for program structure and IEC 62443 for control-system depth—so the three reinforce rather than duplicate each other. Our OT cybersecurity services go further than any checklist can.
Frequently Asked Questions
NIST SP 800-82 is the US National Institute of Standards and Technology's Guide to Operational Technology Security. It is the most widely referenced OT security guidance in the United States, covering OT, its threats and vulnerabilities, and the safeguards to manage OT cyber risk.
Revision 3, published in September 2023, expanded scope from industrial control systems to operational technology as a whole, updated OT threats, risk, and architecture, aligned with the NIST Cybersecurity Framework, and added an OT overlay that tailors the SP 800-53 controls for OT across low, moderate, and high impact baselines.
The OT overlay is tailoring guidance that takes the SP 800-53 Rev 5 controls and adapts them for operational technology, providing tailored baselines for low, moderate, and high impact OT systems. It lets you apply the right level of control to each system rather than a one-size-fits-all set.
SP 800-53 is the catalog of security controls. SP 800-82 applies those controls to OT through its overlay, telling you which controls matter for OT and how to tailor them for environments where availability and safety come first.
Yes. Rev 3 explicitly aligns with the NIST Cybersecurity Framework, and it maps well to IEC 62443, the global control-system security standard. The three are complementary, and a strong OT program uses them together.
It turns SP 800-82 Rev 3 into a practical, section-by-section assessment tool with the overlay baselines built in, written for OT. For hands-on support, explore our OT cybersecurity services.