NIST SP 800-82 Rev. 4 Moves OT Security Closer to Enterprise Risk Governance

OT is being governed as enterprise risk without becoming IT

Revision 4 expands the sectors covered by the guide and restructures the material around NIST CSF 2.0, including the Govern function. It also connects OT risk management more explicitly with enterprise risk management.

That is useful only if governance preserves the engineering constraints that make OT different. Availability, deterministic behaviour, process safety, maintenance windows and legacy dependencies still determine whether an IT-style control can be deployed safely.

Architecture and visibility become management evidence

The draft expands guidance on asset management, network monitoring and detection, system-management functions and zero trust. These are not isolated technical controls. Together they provide evidence that management knows what exists, who can change it and whether abnormal behaviour can be detected.

For industrial organisations, the practical opportunity is to connect board-level cyber risk, plant architecture and operational evidence without forcing one control model onto every site. The governance layer should define outcomes and accountability; engineering should prove how each plant achieves them safely.

Related context. Enterprise OT governance still has to preserve architecture-specific constraints, as shown by legacy OT access boundaries and the operational-resilience consequences examined in water-sector cyber-physical incidents.