OT and ICS Security for Manufacturers: A Practical Guide Based on NIST SP 800-82 Rev. 3 and CISA Guidance

Why the plant floor is different

A manufacturer runs two kinds of technology. Information technology (IT) is the office: email, laptops, accounting and ERP. Operational technology (OT) is what makes the product: programmable logic controllers (PLCs), sensors, drives, human-machine interfaces, SCADA servers and the networks that link them. NIST defines OT as programmable systems and devices that interact with the physical environment, detecting or changing it by monitoring or control.

The two worlds have different priorities. NIST's Guide to Operational Technology (OT) Security, SP 800-82 Revision 3 (September 2023), says OT security objectives typically prioritize integrity and availability, followed by confidentiality, and that safety is an overarching priority. An IT team may be happy to reboot a server at night. A plant manager may not be able to stop a furnace line for weeks. The guide notes that the life span of an OT system can exceed 20 years, so many systems run hardware and software their vendors no longer patch.

The consequences of a failure are physical. The guide lists incidents such as loss of view and loss of control, unauthorized changes to instructions, commands or alarm thresholds that could damage equipment or endanger people, false information sent to operators, modified software or malware, and interference with safety systems.

What the two documents are

NIST SP 800-82 Rev. 3 is a free guide that explains OT systems and their typical architectures, describes threats and vulnerabilities, and recommends countermeasures. It includes an OT overlay for the NIST SP 800-53 Rev. 5 security controls in its Appendix F, which tailors the control catalog to OT. NIST has published an initial public draft of Revision 4, with comments open until November 30, 2026, so check the NIST page for the current status before you build a program around the text.

CISA, the Cybersecurity and Infrastructure Security Agency, publishes advisories, alerts and fact sheets for owners and operators of industrial control systems. Its ICS page has role-specific guidance for asset owners, integrators and vendors, a program that works with equipment makers to help secure internet-exposed devices, and recent items such as a CISA and FBI fact sheet on working with third-party ICS integrators (September 2026). In May 2025, CISA, the FBI, EPA and DOE issued a short list of primary mitigations that is the best place for a manufacturer to begin.

The five primary mitigations

The May 2025 joint fact sheet says that owners and operators should act now against threats that target internet-connected OT. It gives five actions, in an order that reflects how attackers actually get in.

• Remove OT connections from the public internet. OT devices are easy targets when exposed, and search tools can find them quickly. Identify public-facing assets and remove any exposure that is not deliberate.
• Change default passwords and use strong, unique ones. The agencies found that targeted systems used default or easily guessed passwords. Start with internet-facing devices that can control OT processes.
• Secure remote access. If remote access is essential, use a private network connection and a VPN with a strong password and phishing-resistant multi-factor authentication. Apply least privilege by asset, user role and scope of work, and disable dormant accounts.
• Segment IT and OT networks. Segmentation limits the impact of a threat and lowers the risk to essential operations. Isolate critical systems and use a DMZ to pass control data to enterprise logistics.
• Practice and maintain the ability to operate manually. Reverting to manual control is vital for restoring operations quickly after an incident. Test business continuity and disaster recovery plans, fail-safe mechanisms, software backups and standby systems.

The sheet also tells owners to coordinate with their managed service providers, system integrators and equipment makers, because misconfigurations often arise during integration, managed services or from default product settings.

Architecture: layers, a DMZ and one-way flows

NIST recommends a defense-in-depth strategy, which means layering controls so that the failure of one does not expose the plant. Its list for a typical OT system includes the following elements.

• A network built in layers, with the most critical communication in the most secure and reliable layer.
• Logical separation between the corporate and OT networks, using stateful firewalls or unidirectional gateways, and a DMZ so that no traffic passes directly between the two.
• Separate authentication and credentials for OT and corporate users, so that OT accounts are not corporate accounts.
• Multi-factor authentication for remote access to the OT system.
• Role-based access with least privilege, and physical access control to cabinets and devices.
• Redundant critical components and networks, and designs that degrade gracefully instead of failing all at once.
• Disabling unused ports and services after testing that the change does not affect operations.
• Monitoring and audit trails on critical areas, with malware controls where technically feasible.
• Security patches deployed expeditiously, but only after testing under field conditions on a test system when possible.

A manufacturer can apply this in steps. First, draw the network as it is, not as the diagram says. Second, put a firewall pair and a DMZ between the ERP and the plant, and let only the specific historian or data collector cross it. Third, give vendors a controlled remote access path that records sessions and expires when the job is done. Fourth, place monitoring on the OT side that can see traffic without sending commands to controllers.

Legacy equipment and patching

NIST is realistic about old equipment. Where controls are not supported by a legacy system, the program should consider compensating controls. A PLC that cannot run anti-malware, for example, can be protected by isolating its network, restricting who can program it, and monitoring what talks to it. Patching also needs a process: test, schedule downtime in a maintenance window, keep a rollback, and record the change. Some patches cannot be applied at all, and the risk must then be accepted, mitigated or removed by replacing the equipment.

Third parties and integrators

Many plant incidents begin with a vendor connection. Integrators, equipment makers and managed service providers often have standing access. CISA's May 2025 guidance asks owners to coordinate with them, and its September 2026 fact sheet with the FBI gives questions to ask integrators. Write the following into every contract: what access the vendor needs, how it is authenticated, how long it lasts, what is logged, who is notified of a change, and what the vendor must do if it is compromised.

Know what is exposed and what is happening

CISA's ICS page lists current advisories, including a warning issued in August 2026 about an active threat to Siemens S7 series PLCs. You do not need to track every advisory by hand. You do need an inventory of your controllers, their models and firmware, and a person or service that matches new advisories to your inventory. That inventory also answers the first question after any incident: what do we have, and where is it connected?

Backups and manual fallback

A ransomware attack on the office network often stops production even when the plant is untouched, because scheduling, labels and shipping depend on IT. The fifth CISA mitigation addresses this. Keep offline or immutable backups of PLC programs, HMI projects and configuration files. Store the vendor software and licenses needed to rebuild a workstation. Write the manual procedure for each line, and run it as an exercise. Our articles on ransomware readiness and on backups that restore describe the general method.

A first-90‑days plan

• Days 1-30: inventory OT assets and every connection to them. Check what is reachable from the internet. Change default credentials. Turn on MFA for every remote path.
• Days 31-60: separate IT from OT with a firewall and a DMZ. Replace shared accounts. Back up controller programs and test a restore. Start logging at the boundary.
• Days 61-90: write and rehearse the manual fallback and the incident plan with operations, maintenance and IT in the same room. Review vendor access. Set a patch and advisory review rhythm.

How Clayton Cybernetics can help

Our team has built plant-floor systems as well as secured them. We moved a textile weaving factory onto custom software with real-time machine monitoring built on Raspberry Pi devices, measuring temperature, humidity and vibration, in industrial enclosures with custom electronics. Sensors that only observe have no need to write to controllers, and we keep that principle, and a separation from the office network, in mind when we design monitoring. Through our Cyber Automation and Cybersecurity practices we can map your OT network, close internet exposure, set up segmentation and remote access, and help your operations team rehearse manual fallback. Call (305) 404-9404 to arrange an assessment.

Sources

• NIST — SP 800-82 Rev. 3, Guide to Operational Technology (OT) Security (Sept. 2023), publication page
• NIST — SP 800-82 Rev. 3, full text (PDF)
• CISA, FBI, EPA, DOE — Primary Mitigations to Reduce Cyber Threats to Operational Technology (May 6, 2025)
• CISA — Industrial Control Systems

This article is general information, not engineering or legal advice. Changes to a production control system can affect safety and output; plan them with your operations and safety teams and your equipment vendors. Confirm the current status of NIST SP 800-82 (a Revision 4 draft is open for comment) before building a program around it. Last reviewed November 8, 2026.

Keep reading

Next · SecurityZero Trust for Mid-Size Firms: A Practical Path Using NIST SP 800-207 and the CISA Zero Trust Maturity ModelZero trust is not a product you buy. NIST SP 800-207 defines it as a set of principles, and CISA's Zero Trust Maturity Model gives a staged way to apply them. This article translates both for a mid-size firm with limited staff and a mix of cloud and office systems.9 min read

• Penetration Testing Explained for Executives: Scope, Reports and How Often to Test8 min
• Ransomware Readiness and Incident Response: A Checklist Based on the CISA #StopRansomware Guide9 min