What happened
On 21 September 2026 NIST published the Initial Public Draft (IPD) of SP 800-82 Revision 4, 'Guide to Operational Technology (OT) Security' (NIST.SP.800-82r4.ipd, DOI 10.6028/NIST.SP.800-82r4.ipd, superseding Rev. 3), with public comments due 30 November 2026. The revision updates OT/ICS security guidance for a broad range of programmable systems (industrial control systems, building automation, maritime/freight, water & wastewater, IIoT, cloud environments), aligned to NIST CSF 2.0, and reflects the modern threat landscape including AI-driven attacks and OT/IT convergence.
Why it matters
SP 800-82 is the de-facto U.S. national baseline for OT/ICS security and is in the seed's explicitly tracked NIST SP 800-series list. Rev 4 is the first major refresh in this window and a public draft open for comment; it will shape how critical-infrastructure operators (energy, water, manufacturing, transportation) secure OT and converge IT/OT/AI workloads. Its CSF 2.0 alignment also informs how organisations map AI-enabled OT security controls.
Action needed
OT/ICS security practitioners, assessors, and critical-infrastructure operators should review the IPD and submit comments by 30 November 2026 (comment template available); start mapping existing OT security programs to the revised recommendations and CSF 2.0 alignment.