Frameworks / NIST SP 800-82 Revision 3: Guide to Industrial Control Systems (ICS) Security / NISTSP82-1 NIST SP 800-82 Revision 3: Guide to Industrial Control Systems (ICS) Security
OT Security Program Governance
NIST SP 800-82 Revision 3: Guide to Industrial Control Systems (ICS) Security NISTSP82-1: OT Security Program Governance, Policy, Roles, and Safety-Security Integration Establish an Operational Technology (OT) security program per NIST SP 800-82 Rev 3 Chapter 3 (OT Cybersecurity Program Development) and Chapter 4 (Risk Management). The program must (a) define OT scope distinct from IT (industrial control systems + SCADA + DCS + PLC + safety instrumented systems + building automation + transportation systems + medical devices where applicable), (b) document OT-specific risk tolerance recognising safety + reliability + availability priorities over confidentiality, (c) name accountable executives (CISO + Plant Manager + Safety Director + Operations Leadership) with documented decision authority, (d) integrate Safety and Security per Chapter 3 Section 3.7 covering shared assets + competing requirements + safety case integrity + cyber-physical interaction analysis, (e) align with NIST Cybersecurity Framework 2.0 OT profile + ISA/IEC 62443 + sectoral guidance (TSA Pipeline + CISA Water + FDA Medical Device + NRC Nuclear). Develop OT-specific policies covering acceptable use + change control + access control + remote access + incident response + business continuity + supply chain + safety system isolation. Establish OT security training and awareness for engineers + operators + maintenance + contractors + vendors.
Maintained by Gerard Blokdyk · Verified against the published standard 31 May 2026 · Control text last updated 21 May 2026 What else in your programme already covers this This control maps to 326 controls across 121 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
NIST-CSF-DE.AE-08 Incidents are declared when adverse events meet the defined incident criteria NIST-CSF-GV.RM-03 Cybersecurity risk management activities and outcomes are included in enterprise risk management processes NIST-CSF-GV.RM-04 Strategic direction that describes appropriate risk response options is established and communicated NIST-CSF-GV.SC-01 A cybersecurity supply chain risk management program, strategy, objectives, policies, and processes are established and agreed to by organizational stakeholders NIST-CSF-PR.AA-05 Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties NIST-CSF-PR.DS-10 The confidentiality, integrity, and availability of data-in-use are protected NIST-CSF-PR.IR-03 Mechanisms are implemented to achieve resilience requirements in normal and adverse situations NIST-CSF-PR.IR-04 Adequate resource capacity to ensure availability is maintained NIST-CSF-PR.PS-01 Configuration management practices are established and applied FFIEC-03 Risk appetite and tolerance for IT risk FFIEC-05 Roles and responsibilities definition FFIEC-10 Secure configuration standards FFIEC-11 Business continuity planning and testing FFIEC-12 Disaster recovery procedures FFIEC-14 Critical service identification FFIEC-18 Ongoing monitoring and assessment FFIEC-20 Exit strategy and transition planning IEC62304-4.1 Quality Management System IEC62304-5.1 Software Development Planning IEC62304-5.2 Software Requirements Analysis IEC62304-5.3 Software Architectural Design IEC62304-7.2 Risk Control Measures IEC62304-7.4 Risk Management of Software Changes ISO23894-1 Scope of AI Risk Management ISO23894-3 AI-Specific Terminology ISO23894-5.1 Leadership and Commitment ISO23894-5.2 AI Risk Management Integration ISO23894-5.5 Framework Evaluation ISO23894-6.2 Scope, Context and Criteria 27557-1 Scope 27557-3 Terms and definitions 27557-6.2 Scope, context, and criteria for privacy 27557-6.4 Privacy risk treatment 27557-6.6 Recording and reporting 27557-7.3 Risk-based privacy program implementation ASD37-04 User application hardening (Essential) ASD37-10 Server application hardening (Very Good) ASD37-11 Operating system hardening (Very Good) ASD37-20 Multi-factor authentication (Essential) ASD37-37 Personnel management (Very Good) CAT-D1-2 Risk management CAT-D1-4 Training and culture CAT-D3-3 Corrective controls CAT-D5-4 Resilience planning and testing CAT-ML-2 Evolving IM8-DAT.2 Data Protection IM8-DSS.2 Service Reliability Standards IM8-RES.2 Disaster Recovery IM8-RES.4 Resilience Testing IM8-TPM.4 Supply Chain Risk Management API1164-14 Physical Security API1164-19 Safety Instrumented Systems Interface API1164-21 TSA Pipeline Security Directive Alignment API1164-22 Configuration management for OT systems CPS234-14 Definition of Information Security Roles and Responsibilities CPS234-15 Information Security Capability CPS234-16 Assessment of Related Party and Third Party Capability CPS234-20 Information Asset Classification FEDRAMP-CM-1 Configuration Management Policy FEDRAMP-CM-2 Baseline Configuration FEDRAMP-CM-6 Configuration Settings FEDRAMP-CP-9 System Backup 60601-1.3 Terminology and definitions 60601-1.4.1 General requirements 60601-1.4.2 Risk management process 60601-1.5.1 General requirements for testing ISO-15189-5.1 Legal entity ISO-15189-5.4 Structure and authority ISO-15189-5.6 Risk management ISO-15189-6.7 Service agreements ISO-22320-4.3 Risk-based approach ISO-22320-5.1 General process requirements ISO-22320-5.3 Incident management structure (command) ISO-22320-5.4 Roles and responsibilities NISTPF-2 Govern-P - Governance Policies, Risk Management Strategy, Awareness Training, and Monitoring NISTPF-6 Protect-P Data Security (PR.DS-P) NISTPF-7 Protect-P Maintenance and Protective Technology (PR.MA-P, PR.PT-P) NISTPF-8 Protect-P Information Protection Processes (PR.PO-P) CPS230-16 Internal Audit Review of the Business Continuity Plan CPS230-37 Service Provider Management Policy CPS230-46 Ongoing Risk Management of Each Material Arrangement 4.3.2 Legal and Other Requirements 4.4.1 Resources, Roles, Responsibility, and Authority 4.4.2 Competence, Training, and Awareness AWWA-1.1 Security Policy and Governance AWWA-1.3 Security Awareness and Training AWWA-4.3 Configuration Management BS65000-RM-01 Resilience Journey BS65000-RM-02 Integrated Approach BS65000-RM-03 Leadership and Culture BSI-23 Baseline configuration establishment BSI-24 Configuration change control BSI-26 System component inventory IS.D.OR.210 Information Security Risk Treatment IS.I.OR.210 Information Security Risk Treatment IS.I.OR.220 Information Security Risk Management CJIS-19 Supply Chain Risk Management CJIS-2 Security Awareness Training CJIS-7 Configuration Management ICP-1 Objectives, Powers and Responsibilities of the Supervisor ICP-16 Enterprise Risk Management for Solvency Purposes ICP-8 Risk Management and Internal Controls 62351-12 Resilience and security recommendations for DER 62351-13 Cyber-physical generation and storage resilience 62351-2 Glossary of terms IEC62443-14 System security hardening IEC62443-21 Supply chain risk management for critical components IEC62443-22 Configuration management for OT systems ISO-19650-1-4 Information management concepts ISO-19650-1-7 Common Data Environment (CDE) concept ISO-19650-3-5.3 Trigger events for information exchange ISO-20400-4.2 Principles of sustainable procurement ISO-20400-4.5 Key considerations for sustainable procurement ISO-20400-7.2 Integrating sustainability into specifications ISO28001-PI-01 Personnel Security Screening ISO28001-PI-02 Security Awareness and Training ISO28001-SA-04 Security Risk Treatment Planning ISO-25012-4.13 Availability ISO-25012-5.2 Defining data quality measures ISO-25012-5.3 Planning and performing data quality evaluations ISO27003-4.3 Determining the scope of the information security management system ISO27003-6.1 Actions to address risks and opportunities ISO27003-8.3 Information security risk treatment 27004-3 Terms and definitions 27004-A.2 Patching and Vulnerability Measures 27004-B.1 Example measurement definitions 27011-1 Scope 27011-3 Terms and definitions 27011-6.3 Awareness and Training ISO27019-14 System security hardening ISO27019-21 Supply chain risk management for critical components ISO27019-22 Configuration management for OT systems 27031-5.1 IRBC Policy 27031-8.1 Exercising and Testing 27031-B High availability embedded systems 29100-1 Scope 29100-3 Terms and definitions 29100-4.1 Actors and roles OCCHS-1 Scope, Applicability, and Definitions of Heightened Standards OCCHS-3 Risk Appetite Statement, Risk Limits, Concentration Risk, and Limit Breach Protocols OCCHS-7 Risk Data Aggregation, Reporting, Talent, Compensation, and Strategic Planning DSOMM-1 Culture, Organization, Education, and Governance DSOMM-2 Implementation Practices, Secure Coding, and Threat Modelling DSOMM-3 Build, Deployment, Infrastructure Hardening, and Secrets Management ISMSP-MS-02 Risk Management ISMSP-SYS-01 System Hardening and Patch Management ISMSP-SYS-04 Vulnerability Management 58.1 Scope 58.3 Definitions AL-DPA-1 Scope and Definitions AL-DPA-3 Lawful Basis for Processing AT-DSG-2 Section 2 - Scope and application AT-DSG-8 Section 22 - Functions and powers of the DPA MLE.1 Machine Learning Requirements Analysis MLE.3 Machine Learning Training COBIT-BAI02 Managed requirements definition COBIT-BAI04 Managed availability and capacity DA-1 Enterprise Data Architecture DIQ-2 Data Quality Management FTC-Safeguards-Scope-Defs Scope, Definitions and Financial Institution Applicability (16 CFR 314.1, 314.2) FTC-Safeguards-ServiceProvider-Evaluation Service Provider Oversight + Program Evaluation + Personnel Training (16 CFR 314.4(d-g)) FDBR-702 Definitions (§501.702) FDBR-Scope-Defs Scope, Applicability Thresholds and Definitions (Fla. Stat. 501.701, 501.702, 501.703, 501.704) IATA-IOSA-Section1-ORG-Organization-ManagementSystem-SMS IATA IOSA Section 1 - ORG Organization and Management System + Safety Management System (SMS) + Safety Policy + Hazard ID + Quality IATA-IOSA-Section8-SEC-SecurityManagement-AVSEC IATA IOSA Section 8 - SEC Security Management + Aviation Security Programme (AVSEC) + ICAO Annex 17 Alignment ICAO-ANX17-Chap2-ThreatAssessment-RiskManagement-Cyber-GASeP ICAO Annex 17 Chapter 2 - Threat Assessment + Risk Management + Cyber Threats to Critical Aviation Systems (Amendment 17/18) ICAO-ANX17-Chap4-Cargo-Mail-Catering-Stores-Supplies-RegulatedAgent-KnownConsignor ICAO Annex 17 Chapter 4 - Cargo + Mail + Catering + Stores + Supplies Security + Regulated Agent + Known Consignor + Supply Chain ISO-26262-3-5 Item definition ISO-26262-8-7 Configuration management ISO-41001-4.1 Understanding the organization and its context ISO-41001-4.3 Determining the scope of the FM management system ISO-56002-4.3 Determining the scope of the innovation management system ISO-56002-8.3.4 Develop solutions ISO8000-DQM-02 Data Quality Dimensions ISO8000-MDG-03 Continuous Improvement ISO-17025-5.1 Legal entity ISO-17025-5.4 Personnel for the management system ISO20000-03 Capacity and availability management ISO20000-10 Configuration management 27007-5.2 Audit Programme Objectives 27007-5.4 Establishing the Programme Resources 27014-1 Scope 27014-3 Terms and definitions 27400-3 Terms and definitions 27400-6.4 Default Configuration Security 29147-3 Terms and definitions 29147-9.2 Contact mechanisms and scope 30111-3 Terms and definitions 30111-5.1 Organizational policy ITIL4-03 Capacity and availability management ITIL4-10 Configuration management STANAG-1 STANAG 4774 Confidentiality Label Schema and XML Structure STANAG-2 STANAG 4778 Metadata Binding Mechanism and Cryptographic Binding NISTSP34-1 Contingency Planning Policy, Programme, and Plan Coordination NISTSP34-2 Business Impact Analysis (BIA): Critical Resources, Recovery Priorities NDPA-2 Consumer Rights - Access, Correct, Delete, Portability, Appeal NDPA-5 Privacy Notice, Data Minimisation, and Purpose Limitation ASTWO-7 Deficiency Evaluation, Material Weakness, and Communication ASTWO-8 ICFR Opinion, Basis, Definition, Limitations, Combined vs Separate Reports PAKPDPB-7 NCPDP, Registration, Records, Processor Contracts, DPO PAKPDPB-8 Enforcement, Penalties, Complaints, Retention, Training PSPF24-1 Security Culture, Governance, Risk Management PSPF24-2 Information Security, Cybersecurity Maturity, Essential Eight C1 Organizational Boundary C3 Scope 1 and 2 Coverage CFR211-A-3 Section 211.3 - Definitions AMLCTF-82 Part A Compliance AS9100D-8.1 Operational Planning and Control AZ-DPA-2 Article 2 - Basic Concepts CA-ITSG33-SC-01 Security Control Catalogue CA-9 Internal System Connections CA-9 Internal System Connections Sapin2-Pillar1-Code-of-Conduct Pillar 1 - Anti-Corruption Code of Conduct ISO-14064-1-5.1 Organizational boundaries ISO27799-09 Security awareness and training program ISO27043-04 Roles and responsibilities definition 27050-1.4 Terms and definitions 29115-3 Terms and definitions 29134-3 Terms and definitions ISO21434-04 Roles and responsibilities definition BIPA-SEC5-1 Biometric Identifier Definition NZISM-1 NZISM Governance, Documentation, and Classification System AUNDB-A3 Eligible Data Breach Determination and Serious Harm Threshold OWASPAPI-6 Security Misconfiguration and Secure API Design OWASPASVS-1 Architecture, Design and Threat Modelling (V1) 2.2.2 2.2.2 Vendor default accounts managed EHDSREG-1 Mandatory Requirements for EHR Systems (Articles 14-29) SWIFTCSCF-1 Restrict Internet Access and Protect Critical Systems (Objective 1) AIGF-1.1 Risk Management and Internal Controls KRCSAP-1 CSAP Certification Tiers (IaaS, SaaS, DaaS, AI) PIPA-Data-Subject-Rights-Access-Correction-Erasure-Portability-Automated-Decisions-Articles-35-37-2 Korea PIPA Data Subject Rights + Access + Correction + Erasure + Portability + Article 35-37 GT-4 Social Engineering Attacks FADP-5 Definitions (Article 5) TEFCAREC-1 Common Agreement Conformance and Onboarding CRM-3 Risk Management Framework CERT-1 RRA Certification to EPA 15 U.S.C. § 78dd-2(h) Definition of Domestic Concern USMCADIGITAL-1 Cross-Border Data Flows and Localisation VIETNAMCYBER-2 Prohibited Acts (Access, Interception, Forgery, Content) W3CVCDM-1 Three-Party Ecosystem (Issuer, Holder, Verifier) Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected .
Query this from an agent The graph holds this control, the 326 it maps to, and the evidence behind each claim, over MCP and REST.