Identify ID.AM: Put OT on the Asset Map — Mapping NIST SP 800-82r4 to CSF 2.0
Map NIST SP 800-82r4 draft OT security guidance (Sep 21, 2026) to NIST CSF 2.0 Identify ID.AM — asset management for building systems, plant floors, and physical-process tech SMBs already run.
NIST’s new OT security draft expands what “assets” means. Before Govern policies and Protect controls, Identify ID.AM asks a simpler question: what physical-process systems do you actually own?
Key Takeaways
- NIST released the SP 800-82r4 initial public draft on September 21, 2026 — Guide to OT Security, comments due November 30, 2026.
- In NIST CSF 2.0, knowing those systems lives under Identify → ID.AM (Asset Management).
- Staff four ID.AM outcomes: OT inventory, network path classification, admin ownership, and “unknown” burn-down.
- Pair with Govern (risk appetite for plant/building change) and Protect (segmentation) so Identify is not a forgotten spreadsheet.
Most SMBs invent their asset list from the IT invoice: laptops, servers, SaaS seats. Operational technology — HVAC controllers, badge systems, warehouse scanners, packaging lines, cold-chain monitors — often lives on a facilities or vendor spreadsheet that never joins the cyber conversation.
SP 800-82r4’s draft widens the OT map (building automation, water, food and agriculture, IIoT/cloud convergence, and more) and expands guidance on asset management and network monitoring. You do not need to finish reading every appendix to act. You need ID.AM discipline: name the thing, name how it connects, name who can change it.
Why ID.AM Before More Controls
Protect without Identify is how teams buy fancy tools for the wrong VLAN. Detect without Identify is how alerts fire on systems nobody claimed. Respond without Identify is how incident calls start with “what is that box?” SP 800-82r4’s emphasis on topologies and asset management is CSF Identify wearing OT clothes.
Four ID.AM Workstreams SMBs Can Staff
1. OT inventory (physical + logical)
List building, plant, and physical-process systems: vendor, model/firmware if known, physical location, business function (comfort, access, production, safety). Include landlord- or vendor-owned gear that sits on your floor or network.
2. Network path classification
For each entry: isolated / shared with IT / vendor VPN / cloud-connected / unknown. Flat networks where badge controllers share a switch with file servers deserve a red flag, not a shrug.
3. Administrative ownership
Who can change setpoints, open doors remotely, push firmware, or reset credentials — internal facilities, MSP, OEM, landlord? Write names and contracts. ID.AM includes people and permissions, not only serial numbers.
4. Unknown burn-down
Every “unknown” network path becomes a ticket with an owner and due date. The draft’s value is not a perfect CMDB on day one; it is refusing to leave mystery systems forever.
This week’s ID.AM drill: (1) One-page OT inventory. (2) Network path for each row. (3) Named admin owner. (4) Top three “unknown” paths scheduled for discovery with your MSP or facilities vendor.
What “Done” Looks Like for an SMB
| ID.AM outcome | Evidence |
|---|---|
| OT listed | Dated inventory with locations and functions |
| Paths classified | Isolated / shared / vendor / cloud / unknown |
| Admins named | Internal + vendor contacts per system |
| Unknowns scheduled | Tickets with owners and due dates |
Soft Next Step
If you want CSF 2.0 Identify ID.AM translated into a living OT asset map for your building or plant — without an enterprise ICS program tax — CyberIntelPro / Security Medic can help you staff the four workstreams above.
References
- NIST CSRC News, Draft SP 800-82r4 OT Security (Sep 21, 2026): csrc.nist.gov/news/2026/draft-guide-to-ot-security
- NIST SP 800-82 Rev. 4 ipd publication details: csrc.nist.gov/pubs/sp/800/82/r4/ipd
- Draft PDF / DOI: doi.org/10.6028/NIST.SP.800-82r4.ipd
- NIST Cybersecurity Framework 2.0: nist.gov/cyberframework