NIST SP 800-82 Revision 3: Guide to Industrial Control Systems (ICS) Security
OT Access Control and IAM
NIST SP 800-82 Revision 3: Guide to Industrial Control Systems (ICS) Security NISTSP82-4: OT Access Control, Identity, Authentication, and Remote Access
Implement OT access control per NIST SP 800-82 Rev 3 Chapter 6 (Security Architecture) + Chapter 7 (Applying the Cybersecurity Framework) covering identity + authentication + access management + remote access. Identity and access management must support (a) role-based access aligned to OT operational roles (operator + engineer + maintenance + vendor + reader-only + administrator), (b) multi-factor authentication for human users at every level above the field network (Level 2 and above) with hardware-token preferred for engineering and administrative roles, (c) emergency-bypass procedures documented and authorised that retain audit trail, (d) shared accounts only for legacy systems that genuinely cannot support individual identification + with compensating monitoring, (e) certificate-based machine-to-machine authentication where feasible, (f) directory federation between OT and IT only via dedicated identity broker not direct trust. Remote access (vendor + maintenance + remote engineering) must use (a) jump host or bastion architecture, (b) privileged access management with credential vaulting, (c) session recording for accountability and forensics, (d) just-in-time access with time-bounded approval workflow, (e) MFA at the jump host even when downstream targets cannot support MFA, (f) explicit network policy revoking access on session end. Authentication credentials and tokens specific to OT must be managed via OT-aware secrets management aligned with safety system requirements.
What else in your programme already covers this
This control maps to 199 controls across 80 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
NIST-CSF-PR.AA-01 Identities and credentials for authorized users, services, and hardware are managed by the organization
NIST-CSF-PR.AA-02 Identities are proofed and bound to credentials based on the context of interactions
NIST-CSF-PR.AA-05 Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties
NIST-CSF-PR.AA-06 Physical access to assets is managed, monitored, and enforced commensurate with risk