RESOURCE
NIST released the initial public draft of SP 800-82 Revision 4, its Guide to Operational Technology Security, restructured around Cybersecurity Framework 2.0 with expanded guidance on asset management, network monitoring and zero trust. Comments are due November 30, 2026.
Fabric Networks
Start with a conversation about your cryptographic posture.
On September 21, 2026 NIST published the initial public draft of Special Publication 800-82 Revision 4, Guide to Operational Technology (OT) Security. SP 800-82 is the reference most Canadian utilities, pipelines and manufacturers already lean on for industrial control system security, and this revision widens its scope to building automation, water and wastewater, food and agriculture, freight rail, maritime vessels, and the convergence of industrial IoT with cloud services.
The draft is restructured around the NIST Cybersecurity Framework 2.0, with the risk management material reorganized under the Govern function and aligned with enterprise risk management. It expands the guidance on implementing OT security controls, including asset management and network monitoring and detection, and adds security architecture guidance focused on protecting system management functions and applying zero trust principles. The comment period runs to November 30, 2026.
Every revision of SP 800-82 starts in the same place: you cannot protect what you have not inventoried. The draft's emphasis on asset management and network monitoring is the Detect phase of our Discovery Program, and it is where the cryptographic inventory for a long lived OT estate begins. Long lived equipment, long lived secrets. Read the draft with your control network diagram beside it, and note where the guidance expects evidence you cannot yet produce.