The U.S. National Institute of Standards and Technology has published an initial public draft of Special Publication 800-82 Revision 4, its updated guide to operational technology security. Dated September 21, the draft retains the central requirement to protect industrial systems without ignoring their safety, reliability and availability constraints.
What changes in the draft
NIST reorganizes the guidance around Cybersecurity Framework 2.0 and expands coverage of asset management, monitoring, system administration, risk assessment and zero-trust concepts. The publication addresses operational environments that include industrial control systems, building automation, transportation systems and other technologies whose physical consequences make conventional IT-only security assumptions inadequate.
The draft does not imply that every zero-trust control can be copied directly into a plant or utility network. Instead, organizations are expected to adapt identity, segmentation, policy enforcement and monitoring practices to equipment lifecycles, deterministic communications and safety requirements. NIST has opened the document for public comment through November 30, 2026.
Why it matters
Asset owners can use the draft as a review framework for inventories, remote access, network architecture and incident response. Those subjects also intersect with industrial safety and monitoring, where cybersecurity decisions must support rather than disrupt safe operations.
