NIST SP 800-82 Rev. 4 draft: what we are reviewing for Labshock

NIST has released the Initial Public Draft of SP 800-82 Revision 4, Guide to Operational Technology Security. It is not yet the final revision; NIST continues to list Rev. 3 as the final publication. NIST Computer Security Resource Center

For Labshock, the next step is to review how the proposed changes translate into practical examples.

Expanded OT coverage

The draft develops its coverage of building automation, water and wastewater, food and agriculture, freight rail, maritime vessels, and IIoT/cloud convergence. This builds on the broader OT scope already established in Rev. 3. NIST Computer Security Resource Center

Our review will consider where guides need examples beyond conventional PLC and SCADA networks.

CSF 2.0 and governance

The guide is reorganized around CSF 2.0, including GOVERN, and expands the connection between OT risk management and enterprise risk management. NIST Computer Security Resource Center

We want examples that connect technical decisions to responsibility: who owns the risk, who approves a change, and who decides whether the remaining risk is acceptable.

Asset management

NIST identifies asset management as an area of expanded implementation guidance. NIST Computer Security Resource Center

For our labs, we will review whether identifying an asset also means understanding its process role, connections and dependencies. Finding an IP address should be the starting point, not the entire exercise.

Monitoring and detection

Network monitoring and detection are another area of expanded guidance. NIST

We will review examples that ask participants to identify available telemetry, explain what it shows, and document where visibility is missing.

Management access and Zero Trust

The draft’s architecture guidance addresses protecting system management functions and applying Zero Trust principles. Zero Trust was also discussed in Rev. 3. NIST

Our review will include examples around management interfaces, remote connections and engineering access—not only communication between controllers and supervisory systems.

Applying RMF to OT

The draft addresses OT application of the Risk Management Framework in Appendix F. Rev. 3 covered this in Section 4.3. NIST Computer Security Resource Center

We will look at how our content connects risk assessment, control selection and monitoring with the operational consequences of a security decision.

What happens next

Labshock will review its guides and labs against the draft and submit four proposals to NIST. These are planned updates, not a claim that the content review is complete.

NIST is accepting public comments until 30 November 2026. Teams reviewing the draft can use that window to submit implementation gaps and examples from their own OT environments. NIST