NIST SP 800-82 Revision 3: Guide to Industrial Control Systems (ICS) Security
OT Incident Response and Recovery
NIST SP 800-82 Revision 3: Guide to Industrial Control Systems (ICS) Security NISTSP82-7: OT Incident Response, Forensics, Recovery, and Continuity
Operate OT incident response + forensics + recovery + continuity per NIST SP 800-82 Rev 3 Chapter 6 + Chapter 7 + integration with NIST SP 800-61 Rev 2 IR methodology. OT IR must address (a) OT-specific incident response plan with OT scenarios (ransomware on OT + malware on engineering workstation + unauthorised PLC change + safety system tamper + vendor compromise + insider sabotage + supply chain compromise), (b) IR team including IT cybersecurity + OT engineering + plant operations + safety + legal + communications + executive leadership, (c) containment strategies adapted to OT (network isolation + asset cordoning + manual operation fallback) considering safety constraints first, (d) preservation of forensic evidence with OT-specific challenges (PLC volatile memory + transient protocol traffic + historian time-series + safety system event logs), (e) recovery procedures including known-good backup restoration + safety system re-certification where applicable + regulator notification per sector requirements, (f) business continuity covering manual operation modes + alternate facility + parts inventory + vendor escalation, (g) post-incident lessons-learned with engineering + operations + safety + cybersecurity. Tabletop exercises annually + technical recovery test biennially + integrate with sector exercises (CISA + ISAC + regulator-led).
What else in your programme already covers this
This control maps to 330 controls across 135 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
NIST-CSF-DE.AE-08 Incidents are declared when adverse events meet the defined incident criteria
NIST-CSF-ID.IM-04 Incident response plans and other cybersecurity plans that affect operations are established, communicated, maintained, and improved
NIST-CSF-PR.AA-05 Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties
NIST-CSF-RC.RP-01 The recovery portion of the incident response plan is executed once initiated from the incident response process
NIST-CSF-RC.RP-06 The end of incident recovery is declared based on criteria, and incident-related documentation is completed
NIST-CSF-RS.MA-01 The incident response plan is executed in coordination with relevant third parties once an incident is declared
NIST-CSF-RS.MA-05 The criteria for initiating incident recovery are applied
3.6.1 Procedures are defined and implemented to protect cryptographic keys used to protect stored account data against disclosure and misuse that include: • Access to keys is restricted to the fewest number of custodians necessary.
3.6.1 Procedures are defined and implemented to protect cryptographic keys used to protect stored account data against disclosure and misuse that include: • Access to keys is restricted to the fewest number of custodians necessary.
2.2.2 Vendor default accounts are managed as follows: • If the vendor default account(s) will be used, the default password is changed per Requirement 8.3.6. • If the vendor default account(s) will not be used,