Manufacturing security must protect safety, reliability, product quality, and business operations alongside confidentiality. IT controls cannot be copied into operational technology without understanding process consequences, vendor constraints, downtime, and recovery. The right sequence starts with asset and dependency evidence.
Current as of 2026-08-15
NIST SP 800-82 Revision 3 remains NIST’s final operational-technology security guide. NIST has begun work toward a future revision, but organizations should not treat preliminary activity as a final replacement.
Decision summary
- Put human safety and process reliability into every security decision.
- Inventory OT assets, communications, owners, dependencies, and recovery requirements.
- Segment by required flows and enforce controlled remote access.
- Test changes and recovery with operations and engineering approval.
Build an operations-owned inventory
Record controllers, HMIs, engineering workstations, historians, safety systems, remote-access paths, protocols, firmware, vendors, support status, and business dependencies. Include passive discovery where active scanning could disrupt equipment. Assign an owner and criticality based on process impact, not only device type.
Define zones, conduits, and required flows
Separate enterprise, industrial DMZ, supervisory, control, safety, vendor, and management functions according to the real architecture. Document allowed source, destination, protocol, direction, owner, and business reason. Deny unnecessary paths, monitor exceptions, and keep fail-safe behavior in scope.
Control identity and remote access
- Use named accounts and MFA where supported.
- Broker vendor access through approved, monitored paths.
- Limit access by asset, task, and maintenance window.
- Remove shared and dormant access where operations allow.
- Record emergency access and test revocation.
Patch, monitor, and recover safely
Use CISA’s Cross-Sector Cybersecurity Performance Goals as a prioritized baseline, then adapt it to the facility. Validate firmware, logic, backups, golden configurations, spare parts, restore steps, and communications. An untested backup is not evidence that a production line can recover.
Next step for your environment
Run a joint plant, engineering, IT, and security workshop to validate the OT inventory, critical flows, remote-access paths, safety constraints, and recovery sequence. If you need a documented baseline before changing production systems, start with an ITECS technology and security assessment.
Record the accountable owner, current baseline, source date, decision, exceptions, acceptance evidence, and review trigger. Test consequential changes in a bounded environment, maintain a rollback path, and verify the real result before closing the work. Product names, model availability, pricing, legal requirements, and security guidance can change; recheck the primary sources whenever the decision is renewed or the environment changes.
Sources and update trigger
- NIST — SP 800-82 Rev. 3: Guide to Operational Technology Security
- CISA — Cross-Sector Cybersecurity Performance Goals
Review trigger: Review after architecture, vendor, firmware, process, remote-access, safety, or NIST/CISA guidance changes.