NIST SP 800-82 Revision 3: Guide to Industrial Control Systems (ICS) Security 6: OT Audit, Monitoring, Anomaly Detection, and OT-Specific SOC

Implement OT audit + monitoring + anomaly detection per NIST SP 800-82 Rev 3 Chapter 6 (Security Architecture) + Chapter 7. OT audit and logging must (a) capture host audit events from OT workstations + engineering workstations + HMI + historian + AD + identity broker, (b) capture network telemetry via passive OT-aware sensors (Nozomi + Claroty + Dragos + similar) on key conduits, (c) capture device telemetry from PLCs + RTUs + safety instrumented systems where the device supports it, (d) retain logs aligned to regulatory + investigative + incident response requirements (often 90-365 days for OT). OT monitoring must (a) baseline normal OT behaviour (protocol distribution + asset communication patterns + setpoint range + sensor value range), (b) detect anomalies (new protocols + unauthorised devices + unexpected communications + setpoint excursion + sensor manipulation patterns), (c) integrate with IT SOC via OT-aware SIEM rules that recognise OT protocols (Modbus + DNP3 + IEC 61850 + PROFINET + EtherNet/IP + OPC) and OT process semantics, (d) maintain an OT-specialised analyst capability (training + tooling + runbooks + escalation to engineering for context). Threat intelligence consumption must include CISA + ICS-CERT + sector ISAC + commercial OT-specialised threat intelligence + vendor advisories.