Loading story…
NIST released an initial public draft of Special Publication 800-82 Revision 4, Guide to Operational Technology Security. Reorganized around the NIST Cybersecurity Framework 2.0, the draft addresses OT environments including industrial control systems, building automation, transportation, and physical access control. It expands guidance on aligning OT and enterprise risk management, the Risk Management Framework, asset management, network monitoring, detection, security controls, security architecture, and zero-trust practices while accounting for operational performance, reliability, and safety requirements.
Separately, CISA and the FBI warned critical-infrastructure operators that third-party ICS integrators can create significant exposure because of their broad access to industrial processes and customer environments. The agencies cited a March–April 2025 intrusion at a U.S. industrial-automation solutions company, where foreign malicious actors accessed its network and staged sensitive SCADA and customer data that could enable downstream disruptive attacks. NIST is accepting public comments on the draft through November 30, 2026.
See the reporting duties and controls this puts on the clock.
3 events from the most recent confirmed update back to the earliest known activity.
Between March and April 2025, foreign malicious cyber actors accessed an unnamed U.S. industrial automation solutions company's network, searched for SCADA and customer information, and staged nine archive files containing about 800 network schematics, device configurations, and customer details. The information could support disruptive downstream attacks against the company's customers.
CISA and the FBI issued a fact sheet warning critical-infrastructure operators that third-party industrial control system integrators with extensive access to industrial processes can create cyber risk. The agencies recommended least privilege, cybersecurity and supply-chain contract requirements, controlled remote access, and monitoring of integrator connections.
NIST released the initial public draft of SP 800-82 Revision 4, Guide to Operational Technology Security. The revision is reorganized around the NIST Cybersecurity Framework 2.0 and expands guidance on sectors, risk management, security controls, architecture, monitoring, detection, and zero trust.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See what this changes for your reporting obligations and which controls it puts on the clock.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
U.S. **operational technology (OT)** security specialists urged **NIST** to make its forthcoming update to *Special Publication 800-82* significantly more practical and granular, arguing that OT owners and operators need actionable guidance rather than high-level frameworks. The feedback was provided as NIST begins its **fourth revision** of SP 800-82 and solicits private-sector input, reflecting growing maturity and urgency in OT cybersecurity governance. Vendors and practitioners emphasized that OT environments require different approaches than conventional IT, particularly for **vulnerability management**, where standard IT practices may be ineffective or counterproductive in industrial settings. Commenters also called for more **sector-specific guidance** for emerging OT verticals such as **smart building management** and **distributed energy systems** (including **EV charging networks**), and broadly supported NIST’s proposal to move several SP 800-82 appendices online—covering OT security organizations, tools and threats, and catalogs of vulnerabilities and incidents—to keep reference material more current.
Jun 29, 2026
NIST released new guidance to help organizations secure **Building Automation & Control Systems (BACS)** as cyber risk grows across operational technology environments in critical infrastructure, commercial properties, and federal buildings. The agency said BACS are increasingly connected to corporate networks and cloud services, expanding the attack surface for systems that manage **HVAC, lighting, access control, fire alarms, and energy management**. To support owners and operators with limited resources, NIST published a quick-start infographic with immediate defensive steps and pointed readers to broader OT security materials. The release aligns with NIST’s wider sector-focused cybersecurity work, including the NCCoE’s **Transit Cybersecurity Framework Community Profile**, which maps cybersecurity practices for transit environments. NIST also said it is revising **SP 800-82**, the federal guide to operational technology security, and expects to publish a draft update for public comment later in 2026, signaling continued emphasis on practical protections for connected physical systems.
Aug 19, 2026
CISA, the UK **NCSC**, and multiple international partners released **Secure Connectivity Principles for Operational Technology (OT)** guidance aimed at reducing risk created by increased connectivity into industrial environments (e.g., industrial control systems, sensors, and other critical services). The guidance is positioned for operators of essential services facing business and regulatory pressure to enable remote monitoring and management, and it emphasizes that formerly *air-gapped* OT is now more exposed due to expanded remote access and IT/OT convergence. The guidance highlights that insecure or exposed OT connectivity is being targeted by a broad range of adversaries, including **ransomware groups**, **state-backed actors**, and **pro-Russia hacktivists** conducting opportunistic attacks against global critical infrastructure. Recommended defensive themes include **network segmentation**, **strong authentication**, continuous monitoring, and minimizing remote access paths to prevent disruptive incidents with potential real-world safety and service-delivery impacts; CISA also solicited stakeholder feedback via a product survey. Separate opinion pieces discussing AI in critical infrastructure and power redundancy risks in OT, and an industry roundup of Chinese cybersecurity companies, do not provide additional reporting on this specific guidance release.
Jun 29, 2026