NIST SP 800-82

NIST SP 800-82
Name	NIST SP 800-82
Subject	Industrial Control Systems security
Author	National Institute of Standards and Technology
Published	2015 (rev. 2)
Discipline	Cybersecurity, Information Technology, Control Systems

NIST SP 800-82 NIST SP 800-82 provides guidance for securing Supervisory Control and Data Acquisition and Distributed Control System environments used in critical infrastructure such as Electrical grid, Water supply, Chemical industry, and Transportation security. It synthesizes practices from organizations like National Institute of Standards and Technology, Department of Homeland Security, Federal Energy Regulatory Commission, International Electrotechnical Commission, and International Organization for Standardization to align industrial control systems with broader standards such as NIST Cybersecurity Framework and ISO/IEC 27001.

Overview

NIST SP 800-82 describes cybersecurity measures for industrial control systems (ICS) including SCADA, DCS, and Programmable Logic Controller installations found in environments operated by entities like Department of Energy, Environmental Protection Agency, United States Navy, General Electric, and Siemens. It addresses technical topics drawn from events like the Stuxnet incident, standards such as IEC 62443, and guidance from bodies including National Cybersecurity Center of Excellence and Center for Internet Security. The publication situates ICS cybersecurity alongside practices referenced by North American Electric Reliability Corporation and incident responses exemplified by MITRE ATT&CK.

Scope and Objectives

The document targets operators in sectors represented by North American Industry Classification System, including utilities under Federal Energy Regulatory Commission oversight, facilities regulated by the Environmental Protection Agency, and transportation hubs overseen by the Department of Transportation. Objectives include threat reduction informed by intelligence from agencies like Federal Bureau of Investigation, National Security Agency, and Department of Homeland Security, harmonization with standards produced by International Organization for Standardization, International Electrotechnical Commission, and interoperability goals championed by firms such as Schneider Electric and Rockwell Automation. It aims to enable asset owners to defend ICS consistent with guidance from Presidential Policy Directive 41 and reporting frameworks used by Financial Stability Oversight Council.

Key Controls and Recommendations

The guidance emphasizes controls including network segmentation influenced by architectures in ARPANET research, access control policies aligned with recommendations from National Institute of Standards and Technology, patch management practices used by Microsoft Corporation, and intrusion detection approaches described by MITRE. It recommends secure remote access practices comparable to those in National Security Agency advisories, authentication mechanisms similar to FIDO Alliance standards, and cryptographic protections referencing Advanced Encryption Standard and Federal Information Processing Standards. Operational recommendations mirror incident handling workflows from CERT Coordination Center and resilience principles discussed in Presidential Policy Directive 8.

Implementation Guidance and Best Practices

Implementation guidance covers deployment patterns utilized by companies such as Siemens, ABB Group, and Honeywell International and integrates process safety dialogues from American Petroleum Institute and Occupational Safety and Health Administration. Best practices include asset inventory methods referenced in ISO/IEC 27001, risk assessment techniques used by Committee on National Security Systems, and change management aligned with IT Infrastructure Library processes championed by Gartner, Inc.. The guidance also maps monitoring strategies to tools and playbooks used by SANS Institute, Mandiant, and incident responders modeled on United States Computer Emergency Readiness Team exercises.

Compliance and Assessment

Assessment guidance suggests controls testing and compliance approaches consistent with audit standards like U.S. Government Accountability Office checklists, reporting frameworks from Securities and Exchange Commission, and certification schemes discussed by International Organization for Standardization. It describes vulnerability assessment processes used by NCC Group and penetration testing approaches similar to methodologies from Offensive Security and Open Web Application Security Project. The document supports alignment with regulatory requirements enforced by entities such as Federal Energy Regulatory Commission and voluntary frameworks adopted by North American Electric Reliability Corporation.

Updates and Version History

The publication has undergone revisions reflecting lessons from incidents like Stuxnet and developments in standards by IEC 62443 and harmonization efforts with ISO/IEC 27001; contributors include staff from National Institute of Standards and Technology, interagency partners such as Department of Homeland Security, and industry stakeholders like General Electric and Schneider Electric. Historical updates correspond to evolving threats cataloged by MITRE Corporation and advisories issued by National Security Agency and Cybersecurity and Infrastructure Security Agency; subsequent editions incorporated feedback from conferences such as RSA Conference and workshops organized by Industrial Control Systems Joint Working Group.

Category:Computer security standards