Your Building Systems Are Computers Too: NIST’s Draft OT Security Guide (SP 800-82r4)

On September 21, 2026 NIST released the initial public draft of SP 800-82 Revision 4 — a Guide to Operational Technology security that finally speaks to HVAC, badge readers, plant floors, and other “not the laptop” systems small businesses already run.

Most owners I meet think cybersecurity means email, laptops, and the cloud. Fair. Then something in the building — a thermostat network, a door controller, a packaging line, a cold-storage monitor — gets mentioned in a vendor questionnaire or an insurance form, and the room goes quiet.

That quiet is operational technology (OT): programmable systems that interact with the physical world. On September 21, 2026, NIST published the initial public draft of Special Publication SP 800-82 Revision 4, Guide to Operational Technology (OT) Security. Comments are open through November 30, 2026.

You do not need to be a defense plant or a federal agency to care. If you have building automation, physical access control, industrial or warehouse equipment, or Internet-connected sensors that move air, water, doors, or product, this draft is written for organizations like yours — not only traditional factories.

What Changed in Revision 4 (Owner-Readable)

• Broader OT map. NIST expands sector examples to include Building Automation and Control Systems (BACS), water and wastewater, food and agriculture, freight rail, maritime vessels, and Industrial Internet of Things (IIoT) with cloud convergence — not only classic ICS.
• Structured around CSF 2.0. The draft reorganizes around the NIST Cybersecurity Framework 2.0, including a stronger focus on the Govern function for OT risk.
• Enterprise risk, not a silo. It discusses aligning OT risk management with broader enterprise risk (NIST IR 8286r1) and points to Risk Management Framework adoption in an appendix.
• Practical controls emphasis. Expanded guidance on asset management, network monitoring and detection, protecting system management functions, and applying zero-trust principles where they fit OT constraints.

What it is: A draft guide — overview of OT topologies, threats, typical vulnerabilities, and recommended safeguards while respecting performance, reliability, and safety constraints unique to physical processes.

What it is not: A finished mandatory checklist, a CMMC substitute, or a reason to rip out every controller this week. Drafts invite comment; they also give you a shared vocabulary with vendors and insurers now.

Why SMBs Outside “Industry” Still Need This

• Your landlord or facilities vendor may own the risk path. Shared HVAC or badge systems still touch your people and sometimes your network.
• Customer and insurer questions are catching up. “Do you have OT / ICS / building systems on the corporate network?” is showing up more often than owners expect.
• IT patches and OT uptime collide. You cannot treat a production controller like a laptop. SP 800-82r4 exists because safety and availability constrain how you change things.
• Asset blindness is the usual failure. You cannot protect what you have never listed. The draft’s asset-management emphasis is the right first habit.

A Practical Sequence I Recommend

1. Name the OT you actually have. HVAC panels, badge/door controllers, warehouse scanners, packaging equipment, cold-chain monitors, camera NVRs that control doors — write the list.
2. Ask how each connects. Standalone? Vendor VPN? Same Wi-Fi as laptops? Flat network with the file server? Draw one ugly diagram.
3. Separate “who can change settings” from “who can read data.” System management functions deserve extra protection — the draft calls that out for a reason.
4. Pick one monitoring gap. Even a simple alert when a building controller becomes reachable from the internet is progress.
5. Skim the draft or the NIST news summary. Bring one page of notes to your next MSP or facilities meeting. Comment to NIST if a sector example is missing your reality — deadline November 30, 2026.

This week’s action: Create a one-page OT inventory: system name, physical location, vendor, network path (isolated / shared / unknown), and who can administer it. Date the page. That artifact beats another year of “we don’t have OT.”

If an MSP or Facilities Vendor Runs the Gear

Ask in one sentence: “Please list every building, plant, or physical-process system you support for us (HVAC, access control, cameras that control doors, industrial or warehouse controllers), how each connects to our network or the internet, and what monitoring or segmentation is in place today.” You want a written list — not a hallway shrug.

Soft Next Step

If you want help turning SP 800-82r4’s OT ideas into a right-sized inventory and segmentation conversation for your building or plant — without an enterprise ICS program tax — Security Medic can walk it with you and your MSP.

Laptops will keep getting patches. The quiet systems that move air, doors, and product need a name on the map first.

References

1. NIST CSRC News, “Guide to Operational Technology (OT) Security: NIST Requests Comments on Draft SP 800-82r4” (Sep 21, 2026): csrc.nist.gov/news/2026/draft-guide-to-ot-security
2. NIST SP 800-82 Rev. 4 (initial public draft) publication details: csrc.nist.gov/pubs/sp/800/82/r4/ipd
3. Draft PDF: NIST.SP.800-82r4.ipd.pdf · DOI doi.org/10.6028/NIST.SP.800-82r4.ipd