The load-bearing documents for a DIB program — CMMC / DFARS regulatory text (eCFR), federal rulemaking, NIST publications and OIRA review — organized as a library. Pick a document; the reader shows the dex dossier: what it says, why it matters, and the concrete obligations it imposes. Originals open at the source.
SP 800-82 Rev. 4, Guide to Operational Technology (OT) SecurityInitial Public Draft
NIST SP 800-82 Rev. 4 (IPD) provides updated guidelines for securing Operational Technology (OT) systems while addressing their unique performance, reliability, and safety requirements.
This document provides an overview of OT and typical system topologies, identifies common threats and vulnerabilities to these systems, and offers recommended security countermeasures to mitigate the associated risks in alignment with the NIST Cybersecurity Framework (CSF) 2.0. Updates in this revision include expanded introduction to OT sectors, restructured around NIST CSF 2.0, expanded discussion of OT risk management alignment with enterprise risk management, adoption of NIST RMF in Appendix F, expanded guidelines for implementing OT security controls, and security architecture guidelines focused on protecting system management functions and applying zero trust principles.
DIBs must understand how OT security guidelines align with NIST CSF 2.0 and RMF to properly scope and implement controls for industrial control systems, building automation, and IIoT environments within their supply chains.