(TLP:CLEAR) NIST Seeks Comments on Draft OT Security Guide with New Water Sector Section

Summary: NIST is accepting public comments through November 30, 2026 on the initial public draft of Special Publication (SP) 800-82 Revision 4, Guide to Operational Technology (OT) Security, released in September. SP 800-82 is one of the most widely referenced U.S. resources for securing industrial control systems. The revision restructures the guide around the NIST Cybersecurity Framework (CSF) 2.0. It also adds guidance on asset management, network monitoring, and applying zero trust principles to OT environments.

For the water sector, the most notable change is a new section (2.5.5) dedicated to water and wastewater systems. According to a recent review by the International Society of Automation (ISA), the section covers treatment processes, pump stations, and telemetry dependencies. It also acknowledges that smaller utilities rely on managed service providers (MSPs) and recommends defining cybersecurity responsibilities in MSP contracts. Remote access, authentication, monitoring, and patching are addressed as well, and cybersecurity decisions are tied to water safety and reporting obligations.

Analyst Note: NIST guidance often shapes the frameworks, assessments, and vendor expectations that utilities later encounter. Section 2.5.5 is still a draft, so the comment period gives water sector practitioners a direct opportunity to make sure the final guidance reflects how utilities actually operate, particularly small and rural systems with limited staff.

WaterISAC encourages members to review Section 2.5.5 before the deadline and consider the following:

• Compare the draft’s description of water and wastewater system architectures and challenges against your own environment, and note any gaps or unrealistic assumptions.
• Share the MSP contract recommendations with procurement staff and integrators, since these may influence future service agreements.
• Submit feedback using NIST’s comment template to sp**********@**st.gov by November 30.

As the International Society of Automation (ISA) notes, the ISA/IEC 62443 series complements the draft. ISA/IEC 62443-2-4 is especially relevant here because it sets security requirements for the service providers that install and maintain control systems. Utilities working through MSP accountability can use both documents together.

Original Source: https://csrc.nist.gov/pubs/sp/800/82/r4/ipd

Additional Reading:

• Growing Attention to Water Security Underscores the Value of Risk-Based Cybersecurity and Global Standards
• NIST SP 800-82 Rev. 4 (Initial Public Draft) PDF
• ISA/IEC 62443 Series of Standards

Related WaterISAC PIRs: 12