The Standards: ISA/IEC 62443 and NIST SP 800-82

Standards and guidance described: the ISA/IEC 62443 series as listed by ISA on Oct. 28, 2026 (ANSI/ISA-62443-2-1-2024 and IEC 62443-2-1:2024, ISA-TR62443-2-2-2025, ISA-TR62443-2-3-2015, ANSI/ISA-62443-2-4-2018, ANSI/ISA-62443-3-2-2020, ISA-62443-3-3-2013, ANSI/ISA-62443-4-1-2018, ANSI/ISA-62443-4-2-2018); NIST SP 800-82 Rev. 3 (Sept. 28, 2023, the current final) and the NIST SP 800-82r4 initial public draft (Sept. 21, 2026, comments due Nov. 30, 2026); NIST Cybersecurity Framework 2.0 (CSWP 29); NIST IR 8183r2 initial public draft (Sept. 29, 2025); CISA Cross-Sector Cybersecurity Performance Goals 2.0 (December 2025); CISA and partner OT guidance dated Jan. 13, 2025 to Sept. 23, 2026; MITRE ATT&CK for ICS (v20 as displayed). All checked Oct. 28, 2026. Standards, guides and drafts are revised often: check the publisher's current edition before relying on any point.

Why standards matter on a plant floor

A plant floor is full of equipment that was never designed with an attacker in mind. A programmable logic controller (PLC) is a rugged industrial computer that reads sensors and drives motors, valves and heaters. A human-machine interface (HMI) is the screen an operator uses to watch and adjust the process. A supervisory control and data acquisition (SCADA) system ties together equipment spread over distance, such as wells, lift stations and pipelines. A distributed control system (DCS) runs a continuous process, such as a refinery, a paper mill or a food plant, from a central control room. A safety instrumented system (SIS) is a separate controller whose only job is to bring the process to a safe state when something goes wrong. Together these are industrial control systems (ICS), and the wider family of computers that monitor or control physical things is called operational technology (OT). Lesson 1, IT, OT and the Purdue Model, explains how they fit together and how they differ from office computers.

When a plant asks "how secure should this be, and how do we prove it," it needs a shared yardstick. Without one, the controls engineer, the IT manager, the integrator who wired the line, the equipment maker, the insurer and the customer who wants a security questionnaire answered all use different words for the same thing. Standards give everyone the same vocabulary, the same list of what "good" looks like, and a way to check it. They also let a plant push work upstream: if a PLC maker already builds its products to a recognized standard, the plant does not have to discover every weakness itself.

This lesson covers the documents that matter most for factories and plants. Two are the heavyweights: the ISA/IEC 62443 series, the international industrial standard, and NIST SP 800-82, the free U.S. government guide. Around them sit the NIST Cybersecurity Framework and its manufacturing profile, CISA's performance goals and a run of short, practical CISA guides from 2025 and 2026, MITRE's catalog of attacker behavior in industrial systems, and the free help small manufacturers can get through the NIST Manufacturing Extension Partnership, which in Idaho means TechHelp.

The business side of security frameworks, including the NIST Cybersecurity Framework basics, the CIS Controls, ISO/IEC 27001, SOC 2 reports, CMMC and PCI DSS, is already covered in Privacy and Security for Small and Medium Businesses, lesson 4: Security Frameworks and Standards. Read that lesson for the office network, the accounting system and the customer data. This lesson stays on the plant floor.

Standards, guides, goals and rules are different things

People use "standard" loosely. It helps to sort the documents in this lesson by what they are, because that decides who must follow them and what they cost.

The same idea can appear in all three layers. Network segmentation is a "conduit" in 62443, a section of SP 800-82, a goal in CISA's performance goals, and a legal requirement in TSA's current pipeline directive, Security Directive Pipeline-2021-02G (effective May 3, 2026 to May 2, 2027, read Oct. 28, 2026), which requires segmentation controls, including defined zone boundaries, so a compromise of IT does not disrupt OT.¹³ Lesson 6, Sector Rules, covers that and the other binding rules.

ISA/IEC 62443: the industrial security series

Who writes it

The International Society of Automation (ISA), a professional association for automation engineers, set up its ISA99 standards committee in 2002 to write security standards for industrial automation and control systems, which the standards call IACS. ISA describes the series as setting "requirements and processes for implementing and maintaining electronically secure" industrial automation and control systems.¹ The early documents were published as ANSI/ISA-99 and were renumbered as ISA-62443 to line up with the International Electrotechnical Commission (IEC), the Geneva-based body that writes international electrical and electronic standards. IEC's Technical Committee 65 works with ISA99, so most parts exist in two nearly matching editions: an ANSI/ISA version sold by ISA and an IEC version sold by IEC and national standards bodies.¹⁴¹⁵ The publication dates of the two editions of a part often differ, which is why you will see, for example, IEC 62443-2-1:2024 and ANSI/ISA-62443-2-1-2024 announced months apart.

Two facts give the series weight beyond any single industry. In November 2021, ISA announced that the IEC had designated 62443 a "horizontal" standard, meaning, in ISA's words, it is "proven to be applicable to a wide range of different industries" and is "technology independent."¹⁵ That status tells other IEC committees, such as those writing standards for power, rail or building systems, to build on 62443 rather than invent their own security rules. And ISA reports that the United Nations Economic Commission for Europe said in late 2018 that it would integrate 62443 into a planned common regulatory framework on cybersecurity; ISA's page now says the series is "endorsed by the United Nations."¹⁶¹ That endorsement is ISA's description; it does not make 62443 binding law anywhere in the United States.

The four groups of parts

The series is organized by audience into four groups, numbered by the first digit after "62443."²¹⁷

• 1-x, General. Terms, concepts and models shared by every other part, including the definitions of zones, conduits and security levels.
• 2-x, Policies and procedures. What an organization must do: the asset owner's security program, patch management, and the program a service provider (an integrator or maintenance contractor) must run.
• 3-x, System. How to assess the risk of a whole control system, divide it into zones and conduits, and specify the technical security requirements a system must meet at each security level.
• 4-x, Component. What a product maker must do: a secure development process, and the technical security capabilities of individual components such as controllers, network devices, host software and embedded devices.

The parts that matter most, with editions and prices

ISA's page listed these parts as published on Oct. 28, 2026. Prices are shown from one national reseller, Ireland's NSAI standards shop, in euros before value-added tax, because ISA's own page does not show list prices without a cart; ISA and IEC prices differ, and ISA members can view most ISA editions at no extra charge.¹

The IEC side has moved on in places. A secondary source lists a second edition of IEC 62443-2-4 dated 2023, a technical specification on security profiles (IEC TS 62443-1-5:2023), and an evaluation method for the service provider part (IEC TS 62443-6-1:2024), with further parts in development.¹⁴ Those IEC dates were not checked against the IEC webstore for this lesson, so treat them as a pointer, not a citation, and check the current edition before you buy.

Notice that Part 3-3 dates from 2013. Most plants buying a new system in 2026 are buying against a requirements list more than a decade old. That is not unusual for standards in this field, and the requirements are written at a level that has aged reasonably well, but it is one reason the newer free CISA guides in this lesson exist.

The roles: asset owner, integrator and product supplier

The most useful thing 62443 does for a small plant may be the simplest: it says who is responsible for what. The series defines the asset owner as the "organization that is accountable and responsible for the IACS," and it names three kinds of outside parties: the product supplier, the integration service provider and the maintenance service provider.² In practice one company can play more than one role. A machine builder who sells a packaging line, installs it and then supports it under contract is a product supplier, an integrator and a maintenance provider at once.

Why this matters: when something goes wrong in a plant, the first fight is often over whose job it was. The integrator assumed the plant would manage firewall rules; the plant assumed the integrator's remote access tool was secure; the product maker shipped a default password that nobody changed. Writing roles into contracts using 62443's terms closes those gaps before they open. Lesson 4, Remote Access, Vendors and Supply Chain, shows how to put this in vendor contracts and how CISA and the FBI's September 2026 fact sheet on industrial integrators asks owners to control integrator access.²²

Part 2-1: the asset owner's program, and its 2024 edition

Part 2-1 sets out what an asset owner's security program for its control systems should contain. The first edition dated from 2010. The IEC published the second edition on Aug. 7, 2024, a document of 189 pages, and ISA announced the U.S. edition, ANSI/ISA-62443-2-1-2024, on Jan. 28, 2025.¹⁸²³

The publisher's abstract lists three big changes. First, the requirements were reorganized into "SP elements (SPEs)," that is, security program elements, so the standard reads as a set of building blocks a plant can put in place rather than a long single list. Second, material that duplicated general information security management systems, the ISO/IEC 27001 type of management program that many companies already run for IT, was removed, so a company with an ISO 27001 program does not do the same work twice. Third, the 2024 edition added "a maturity model for evaluating requirements."¹⁸ Announcing the update, ISA99 co-chair Eric Cosman said: "Security is a balance of risk versus cost, and each situation will be different."²³

For a plant manager, the maturity model is the practical change. Instead of a yes-or-no test (do you have a patch process or not), a plant can say how mature each element is and plan to move it up one step at a time. The series uses four maturity levels, described in secondary sources as Level 1, Initial (done ad hoc, depending on individuals); Level 2, Managed (written down and repeatable); Level 3, Defined (practiced the same way across the organization, with evidence); and Level 4, Improving (measured and improved over time).¹⁴ The same idea appears in Parts 2-4 and 4-1 for service providers and product makers. Maturity is about the people and process around a system; security levels, covered below, are about the technical strength of the system itself. The two scales are separate, and confusing them is a common error in vendor marketing.

Part 2-1 is the part most like the management programs covered in Privacy and Security for Small and Medium Businesses, lesson 18: Running the Program. A company that already has a written security program for its office network should extend that program to cover the plant, with the plant's own risk owner, rather than starting a separate paper empire.

Part 2-4: service providers and integrators

Part 2-4 is written for the companies that build and maintain control systems for someone else. It sets out the security capabilities a service provider should be able to show in the work it does on a customer's system, from how it staffs and designs a project to how it handles remote access, accounts, patches and backups. Because it uses the same maturity scale as Part 2-1, an asset owner can ask an integrator not only "do you do this" but "how consistently do you do it." The current U.S. edition is ANSI/ISA-62443-2-4-2018, which adopts IEC 62443-2-4:2015 with its 2017 amendment.¹ A later IEC edition and an IEC evaluation method for this part are reported in secondary sources.¹⁴

For a small plant, Part 2-4 is most useful as a source of interview questions. You do not need to own the standard to ask an integrator: Who on your team will have access to our system, and how is that access granted and removed? Where will our project files, network drawings and passwords be stored, and who can see them? How will you connect to us remotely after startup, and can we see and stop that connection? Will you deliver the system with default passwords changed and unused services turned off? Can you show us a certificate or assessment against 62443-2-4? The CISA and FBI integrator fact sheet of Sept. 23, 2026, makes the same points in government language, urging least-privilege access, contracts with security and supply chain requirements, and having integrators access equipment "using routes you are able to monitor."²²

Part 3-2: risk assessment, zones and conduits

Part 3-2 explains how to assess the cyber risk of a control system while it is being designed or changed, and it introduces the two ideas the whole series is known for.

• A zone is a "grouping of logical or physical assets based upon risk or other criteria."² In plain terms: a set of equipment that shares the same security needs and can be protected as a group. A packaging line's PLCs and HMIs might be one zone; the boiler controls another; the safety system a third, with the strictest rules.
• A conduit is a "logical grouping of communication channels that share common security requirements connecting two or more zones."² In plain terms: the controlled paths between zones, with the rules for what may cross them. The link between the packaging line and the plant historian is a conduit; so is the remote access path a vendor uses.

The ISA Global Cybersecurity Alliance's free Quick Start Guide shows the Part 3-2 workflow as a numbered series of zone and conduit requirements (ZCRs). They begin by identifying the "system under consideration," that is, drawing a boundary around what is being assessed; then an initial high-level risk assessment; then partitioning the system into zones and conduits; then a decision whether the initial risk is above what the organization can tolerate; then a detailed risk assessment for zones where it is; then documenting the security requirements, assumptions and constraints; and finally asset owner approval.² (The exact numbering of the middle steps in the guide's figure is hard to read in the copy reviewed for this module; the order above follows the guide's description.)

The output of Part 3-2 is a set of documented zones and conduits, each with a target security level, and that output is what the integrator builds to. Zones and conduits are not the same as the Purdue model's levels covered in lesson 1. Purdue sorts equipment by function, from field devices up to business systems; zones sort equipment by risk and security need. Many plants use Purdue levels as a first cut and then split or merge zones where risk differs. NIST makes the link explicit: it says grouping components into levels, tiers or zones "is a precursor activity" to placing firewalls and other boundary devices, and that firewall rules should allow connections only between adjacent levels, tiers or zones, adding that "a similar concept would be applied to ISA/IEC 62443" architectures.²⁴ CISA used 62443 zones and conduits to build its sample asset taxonomies in its 2025 inventory guide.⁶

This lesson only introduces the idea. Lesson 7, A Plant-Floor Segmentation Plan, walks through drawing zones and conduits for a real-sized plant, step by step, with a sample plan.

Part 3-3: system requirements

Part 3-3 lists the technical security requirements a control system must meet, organized under seven foundational requirements and graded by security level. It is the part an asset owner points to in a purchase specification ("the system shall meet 62443-3-3 at security level 2 for the line control zones") and the part a system supplier uses to describe what its product line can do. ISASecure's System Security Assurance certification tests whole systems against it.²⁵ The 2013 edition is still the one ISA lists.¹

Parts 4-1 and 4-2: secure products

Part 4-1 sets out how a product maker should develop products securely: security requirements from the start, secure design and coding, testing for vulnerabilities, handling of security problems reported after release, patch delivery, and documentation that tells the buyer how to install and run the product securely. Part 4-2 lists the technical capabilities individual components should have, by type: embedded devices such as PLCs, network devices, host devices such as HMI and engineering workstations, and software applications.²¹

These parts matter to a manufacturer in two ways. If you buy automation equipment, they give you a yardstick for comparing suppliers. NIST's Manufacturing Extension Partnership points small manufacturers to ISASecure's list of products certified to the ISA/IEC 62443 standards.⁹ If you make equipment, especially equipment you sell into Europe, they describe what your customers will increasingly ask for; lesson 6 covers the European Union's Cyber Resilience Act and related rules.

The seven foundational requirements

Every technical requirement in Parts 3-3 and 4-2 sits under one of seven foundational requirements (FRs). ISA's alliance lists them as: FR 1 Identification and Authentication Control; FR 2 Use Control; FR 3 System Integrity; FR 4 Data Confidentiality; FR 5 Restricted Data Flow; FR 6 Timely Response to Events; and FR 7 Resource Availability.² The names are formal, but each one answers a plain question a maintenance lead would recognize.

Two of the seven deserve extra attention in factories. FR 5, Restricted Data Flow, is the home of segmentation: zones, conduits, firewalls and one-way gateways. FR 7, Resource Availability, captures the difference between plant and office priorities. In an office, losing confidentiality is often the worst outcome; on a plant floor, a control system that stops responding can stop production or remove a layer of protection, so availability and safety usually rank first. NIST's guide makes the same point at length when it compares OT and IT.²⁶

Security levels: target, capability and achieved

62443 grades security by the kind of attacker a system should be able to resist, not by a checklist score. As described by ISA's alliance, the levels are:²

• SL 1: protection against casual or coincidental violation, such as an employee who plugs in the wrong laptop or changes a setting by mistake.
• SL 2: protection against intentional violation "using simple means with low resources, generic skills, and low motivation," such as a criminal using common tools against an exposed device.
• SL 3: protection against intentional violation using sophisticated means with moderate resources, skills specific to industrial systems, and moderate motivation.
• SL 4: protection against sophisticated means with extended resources, industrial-system-specific skills and high motivation, the profile of a well-funded state program.

A level 0, meaning no special requirement, is also described in secondary sources.¹⁴ Note what the scale does not mean: SL 4 is not "four times as secure" as SL 1, and nobody should want SL 4 everywhere. Higher levels cost more, and some older equipment cannot reach them without added protections around it.

The series uses three versions of the security level, and the difference between them is where most real-world confusion lives:²

• Target security level (SL-T): "the desired level of security for a particular Automation Solution," set by the asset owner's risk assessment under Part 3-2, zone by zone.
• Capability security level (SL-C): what a product or system can deliver when properly configured, without extra countermeasures. This is what a supplier can claim, and what certification against Parts 3-3 and 4-2 tests.
• Achieved security level (SL-A): what the system actually delivers once installed and commissioned, measured in the field.

The plain-language rule: a certified product does not make a secure plant. A controller with SL-C 2 that is installed with a default password and an open internet connection will have an achieved level far below 2. The gap between target and achieved is closed by the integrator's design, the asset owner's operation, and compensating measures such as firewalls, monitoring and physical locks around equipment that cannot meet the target on its own.

ISASecure and other certification

Because 62443 is a consensus standard, a third party can test against it. The best-known program is ISASecure, run by the ISA Security Compliance Institute. NIST's OT guide describes ISASecure as a certification scheme for off-the-shelf automation and control systems.¹⁷ As of Oct. 28, 2026, ISASecure's certification page listed six schemes:²⁵

The asset owner scheme is new. On June 9, 2026, ISA announced that a consulting firm had become an accredited certification body for ACSSA, which ISA called "ISASecure's newest conformance scheme," covering 62443-2-1, 2-4, 3-2 and 3-3 for asset owners.²⁷ Earlier sources described the program as announced in 2023; the June 2026 accreditation shows it is now open, but this lesson found no count of plants certified under it. ISASecure also lists a separate site assessment program for OT that it does not present as a certification. An older scheme for embedded devices, EDSA, was phased out after Part 4-2 was published in 2018.¹⁴

ISASecure is not the only route. Testing laboratories and certification bodies around the world issue certificates or assessment reports against 62443 parts under various programs and accreditations, and suppliers often advertise "62443 compliant" without any third-party test at all. When a supplier makes a claim, ask four questions: Which part (4-1, 4-2, 3-3 or 2-4)? Which security level, if any? Who certified it, and under which scheme? Does it cover the exact product version and firmware you are buying? A process certificate under 4-1 says the supplier develops products carefully; it does not by itself certify any particular controller's capabilities under 4-2.

ISASecure's page does not publish prices, and certification costs are set by the certification bodies, so this lesson does not state a figure.²⁵ People can also earn training certificates: ISA lists an ISA/IEC 62443 Cybersecurity certificate program among its training offerings.¹ A personal training certificate shows someone studied the standard; it is not a certification of any plant or product.

Cost and how to get the standards

62443 is sold, not free. ISA sells each part as a PDF and offers the series as a bundle at a discount, and ISA membership includes viewing of most ISA standards in ISA's online library, though not of parts that are identical IEC adoptions.¹ The IEC editions are sold by the IEC and by national standards bodies. One reseller's prices, read Oct. 28, 2026: EUR 416.46 for the 189-page IEC 62443-2-1:2024, EUR 181.67 for the 40-page ANSI/ISA-62443-3-2-2020, EUR 205.36 for the 84-page ANSI/ISA-62443-3-3-2013, and EUR 232.22 for the 98-page ANSI/ISA-62443-4-2-2018, all before VAT.^18192021 A small plant that wanted the core asset owner and system parts would pay several hundred to over a thousand dollars, depending on the seller and exchange rates. That is real money for a 40-person shop, but it is small next to the cost of an integrator's day.

Two free routes cover most of what a small plant needs to get started. ISA says its Global Cybersecurity Alliance offers free resources on the 62443 standards to the general public, including the Quick Start Guide this lesson cites.¹² And the free NIST and CISA documents later in this lesson carry many of the same ideas: NIST's guide cites 62443 throughout, and CISA's 2025 inventory guide uses 62443's zones and conduits for its examples.¹⁷⁶

One more rule about these documents: ISA's page states that "ISA prohibits the entry of any ISA intellectual property" into AI tools, and it bars creating derivatives of ISA material with AI without written permission.¹ If your plant buys the standards, check that rule before anyone pastes a clause into a chatbot to "summarize" it. This lesson describes the standards from public sources; it does not reproduce them.

What 62443 does not do

• It does not make anything legal or illegal. No U.S. federal rule found for this lesson requires private manufacturers to comply with 62443. It becomes binding through contracts, customer requirements, certification you choose to seek, or rules in other countries that adopt it.
• It is not a quick checklist. The parts are long and cross-referenced. A plant that tries to "do 62443" all at once usually stalls. Use it to set direction and specify purchases; use the short CISA guides to act this month.
• It does not replace safety engineering. Safety systems are governed by functional safety standards and process safety rules. Lesson 5, Patching and Safety Together, covers how the two lifecycles meet.
• It does not protect old equipment by itself. A 1990s controller has no authentication to configure. The standard tells you to protect it from outside, with zones, conduits and compensating measures.

NIST SP 800-82: the free OT guide

What Rev. 3 is

The National Institute of Standards and Technology (NIST), part of the U.S. Commerce Department, publishes free security guidance. Its Special Publication 800-82 Revision 3, Guide to Operational Technology (OT) Security, was published Sept. 28, 2023, replacing Revision 2 of June 2015. It was written by NIST engineers Keith Stouffer, Michael Pease, CheeYee Tang, Timothy Zimmerman, Victoria Pillitteri and Suzanne Lightman with MITRE staff.³ Earlier editions were titled as guides to industrial control systems; the third revision widened the title to "operational technology" to cover building automation, transportation systems, physical access control and other systems that monitor or control the physical world. The PDF runs 316 pages.²⁶

Rev. 3 is still the current final edition as of Oct. 28, 2026. A draft of Rev. 4 is out for comment, covered below; until NIST finalizes it, cite Rev. 3.

What is inside Rev. 3

The guide has six main sections and seven appendices:²⁶

1. Introduction.
2. OT overview. How SCADA systems, distributed control systems, PLC-based systems, building automation, physical access control, safety systems and the Industrial Internet of Things are built, and how OT security differs from IT security.
3. OT cybersecurity program development. Making the business case, writing a charter, setting governance and building a cross-functional team that includes operations, engineering, IT and safety.
4. Risk management for OT. How to assess and manage risk where the consequences include physical damage, injury and environmental harm, and how to apply control baselines.
5. OT cybersecurity architecture. Segmentation, demilitarized zones (DMZs), firewalls, monitoring and zero trust.
6. Applying the Cybersecurity Framework to OT. Practical guidance organized by the framework's functions, including remote access (Section 6.2.10) and flaw remediation and patch management (Section 6.2.11).

The appendices cover acronyms, a glossary, threats and incidents, OT security organizations and research, security capabilities and tools, the OT overlay, and a change log. The glossary is a good free source of plain definitions; lesson 1 draws on it.

The executive summary alone is worth printing for a plant manager. It lists recommended practices that read like a first-year plan, including a DMZ architecture that prevents "direct traffic between the corporate and OT networks," multifactor authentication for remote access to the OT system, and "Disabling unused ports and services on OT devices after testing."²⁸ Note the words "after testing." NIST, like every source in this lesson, assumes that changes to control systems are tested first. Any change the documents in this lesson suggest should be planned with the equipment vendor, your safety lead and qualified controls engineers, and tried on a test system or during a planned outage before it touches production.

The OT overlay of SP 800-53

NIST SP 800-53 Revision 5 is NIST's master catalog of security and privacy controls, used by every federal agency and many companies. A baseline is a starting set of those controls for a system of low, moderate or high impact. An overlay is a tailored version of the baselines for a particular kind of system.

Appendix F of SP 800-82 Rev. 3 is the OT overlay. NIST describes it as "a partial tailoring of the controls and control baselines" in SP 800-53 Rev. 5 with supplementary guidance specific to OT, "intended to be applicable to all OT systems in all industrial sectors," with room for further tailoring for a sector such as pipelines or energy, or even for a single company.²⁹ It gives low, moderate and high baselines for OT; in its control table, bold marks controls with OT-specific discussion, underlining marks controls the overlay adds beyond the standard baselines, and strikethrough marks controls it removes. Privacy-only controls were removed.²⁹ NIST says overlays "are intended to reduce the need for ad hoc tailoring of baselines" and that the OT baselines "are starting specifications and recommendations."³⁰

Who uses the overlay? Federal agencies that run OT (dams, labs, military bases, prisons, hospitals) must apply SP 800-53, and the overlay tells them how to do it for control systems. Large private operators and their auditors also use it as a detailed control list. A small manufacturer usually does not need it on day one; the CISA goals and the manufacturing profile are lighter. But if a defense customer, a federal facility or an auditor asks how your plant controls map to "800-53," the overlay is the answer key.

Risk and program guidance

Sections 3 and 4 of Rev. 3 are the parts small plants most often skip and most often need. They explain how to build an OT security program as a business function with an owner, a budget and a team, rather than as a side job for whoever knows the PLCs. The guide expects operations, engineering, IT, safety and management to sit at the same table, and it treats physical consequences (injury, environmental release, equipment damage) as part of risk, not only data loss.²⁶

On architecture, Rev. 3 does not require the Purdue model. It says organizations "may also consider using an industry-recognized model," naming Purdue, ISA-95 levels, the three-tier IIoT architecture "or a combination."²⁴ It treats grouping into levels, tiers or zones as the first step, then firewall rules that "only permit connections between adjacent levels, tiers, or zones."²⁴ For threats, its appendix uses MITRE ATT&CK for ICS to describe threat events such as denial of control and manipulation of control.³¹ And on patching, it warns that "not all vendors report known vulnerabilities to CISA," so plants should also subscribe to their vendors' own security notices.³²

The Rev. 4 draft of September 2026

NIST began revising the guide in January 2026 with a pre-draft call for comments (due Feb. 23, 2026) that proposed covering more kinds of OT and newer technology such as anomaly detection, digital twins, AI and machine learning, zero trust, cloud, 5G and edge computing.³³ On Sept. 21, 2026, it released the initial public draft of SP 800-82r4, a 321-page PDF, with public comments open through Nov. 30, 2026.⁴³⁴ NIST lists these changes:⁴³⁴

• An expanded overview of OT sectors, adding building automation and control systems, water and wastewater, food and agriculture, freight rail, maritime vessels, and the Industrial Internet of Things and cloud convergence.
• A restructuring around CSF 2.0. In the draft's table of contents, Section 3 is "OT Risk Management and Governance," labeled with the framework's Govern function, and Section 4 covers outcomes under Identify, Protect, Detect, Respond and Recover.
• More on how OT risk fits into enterprise risk management, referring to NIST IR 8286r1.
• Expanded control guidance, including asset management and network monitoring and detection.
• Architecture guidance on protecting system management functions and applying zero trust principles.
• A plan to move the threat and organization appendices to web pages that can be updated faster, and to move the OT overlay and an appendix on applying NIST's Risk Management Framework to OT into separate documents in the final publication.

That last change matters to anyone who uses the overlay: in the final Rev. 4, it is expected to live in its own document rather than in the guide. Comments go to sp800-82rev4@nist.gov by Nov. 30, 2026.³⁴ A plant, integrator or trade group that thinks the draft asks too much of small operators, or not enough of product makers, can say so in a comment. Until NIST publishes a final Rev. 4, Rev. 3 remains the edition to cite and audit against.

NIST CSF 2.0 and the Manufacturing Profile

CSF 2.0 for a plant

The NIST Cybersecurity Framework 2.0 (published as NIST CSWP 29) organizes security into six functions: Govern, Identify, Protect, Detect, Respond and Recover. Govern was added in version 2.0, released Feb. 26, 2024.³⁵ The framework's structure, its tiers and how a business uses it are taught in lesson 4 of the small and medium business course, and this lesson does not repeat that.

What a plant needs to know is that CSF 2.0 has become the common spine for almost everything else in this lesson. CISA's performance goals 2.0 are organized by its six functions.³⁶ The SP 800-82 Rev. 4 draft is restructured around it.³⁴ NIST's manufacturing profile is built on it.⁸ So a manufacturer that already uses CSF for its office systems can extend the same program to the plant, using the manufacturing profile to translate the framework's general outcomes into plant terms. A profile, in CSF language, is a framework tailored to a sector or situation: which outcomes matter most, and how much.

The Manufacturing Profile, NIST IR 8183

NIST first published a Cybersecurity Framework Manufacturing Profile as NIST IR 8183 in 2017 and revised it as IR 8183 Rev. 1 for CSF 1.1.³⁷⁹ On Sept. 29, 2025, NIST released the initial public draft of NIST IR 8183 Rev. 2, the CSF 2.0 Manufacturing Profile, with comments due Nov. 17, 2025. Its authors are NIST's Keith Stouffer, Michael Pease, CheeYee Tang and Timothy Zimmerman with MITRE staff, the same core team behind SP 800-82.⁸ As of Oct. 28, 2026, NIST's OT security project page listed no final version, so Rev. 2 remains a draft and Rev. 1 is the latest final.³⁸

What the draft does:⁸³⁹

• It realigns the profile to CSF 2.0, adding the Govern function. The number of framework categories in scope drops from 23 to 22 and subcategories from 108 to 106, reflecting CSF 2.0's own reorganization.
• It adds coverage of supply chain risk management, platform security and technology infrastructure resilience.
• It ties the profile to five manufacturing "business/mission objectives," which NIST says are not in priority order: maintain environmental safety, maintain human safety, maintain production goals, maintain quality of product, and maintain sensitive information.
• It defines three impact levels, low, moderate and high, based on the federal FIPS 199 method. Impact is low if a loss "could be expected to have a limited adverse effect" on operations, product, assets, brand, finances, people, the public or the environment; moderate if "a serious adverse effect"; high if "a severe or catastrophic adverse effect." Requirements build up from the low baseline.

NIST says the profile "is meant to enhance but not replace current cybersecurity standards and industry guidelines."⁸ In other words, it is a map, not a new rulebook: it points to SP 800-82, 62443 and other references for the detail.

The profile's companion documents are where small plants get the most practical value. NIST IR 8183A, in three volumes, gives example implementations for a low-impact manufacturer, which describes most small shops. NIST's Manufacturing Extension Partnership points to Volume 2 (for process-based manufacturing such as food, chemicals and plastics) and Volume 3 (for discrete manufacturing such as machining and assembly) for incident response and recovery plan templates, and to NIST IR 8428, a digital forensics and incident response framework for OT.⁹ NIST's OT project also lists SP 1800-10, a 2022 practice guide on protecting information and system integrity in manufacturing control systems, and SP 1339, an "OT Backup Quick Start Guide" published June 17, 2026.³⁸ For a plant that has never tested whether it can restore a PLC program after a failure, the backup guide is a good first read.

CISA's goals and OT guidance, 2025 and 2026

The Cybersecurity and Infrastructure Security Agency (CISA), part of the Department of Homeland Security, does not write consensus standards. It writes short, free, practical documents, often jointly with the FBI, NSA, EPA, the Energy Department and allied governments. Since January 2025 it has issued a run of OT guides that, taken together, form a plain-language program a small plant can follow. In date order: Secure by Demand for OT (Jan. 13, 2025), Primary Mitigations (May 6, 2025), asset inventory guidance (Aug. 13, 2025), CPG 2.0 (December 2025), zero trust for OT (April 29, 2026), CI Fortify (July 28, 2026) and the integrator fact sheet with the FBI (Sept. 23, 2026).

Cross-Sector Cybersecurity Performance Goals and CPG 2.0

CISA's Cross-Sector Cybersecurity Performance Goals (CPGs) are a short list of the protections CISA thinks every critical infrastructure organization, large or small, should have. CISA describes them as "a minimum set of practices and protections that CISA and NIST recommend all organizations implement."⁵ The first version used goals labeled by number and letter codes; CISA's May 2025 OT fact sheet, for example, ties network segmentation to goal 2.F, least-privilege remote access to 2.H and password practices to 2.A through 2.C under that first version.⁵

CISA released CPG 2.0 in December 2025 (the alert is dated Dec. 11, 2025). CISA said the new version "aligns with the most recent National Institute of Standards and Technology Cybersecurity Framework revisions" and "includes a new component focused on the essential role of governance," adding that "effective governance is the cornerstone of a resilient cyber posture."⁷ A law firm summary reports that CPG 2.0 is organized under the six CSF 2.0 functions, merges the former OT-only goals into goals that apply to both IT and OT so smaller entities can use a single list, adds four new goals (including risks from third-party providers with deep system access and zero trust ideas to limit lateral movement), and rates each goal for cost, impact and ease of implementation. CISA cautions, according to that summary, that the cost and ease ratings "do not necessarily extend to OT systems."³⁶ This lesson did not open the CPG 2.0 document itself and does not state its total goal count; because the codes changed between versions, check that you are using CPG 2.0's own numbering when you cite a goal.

For a small manufacturer, the CPGs are the best one-page answer to "what is the minimum?" They are voluntary, free, and short enough to review in a staff meeting. Their weakness is the flip side: they are a floor, not a design method. They will tell you to segment IT from OT; 62443 and SP 800-82 tell you how.

Primary Mitigations for OT (May 6, 2025)

On May 6, 2025, CISA, the FBI, EPA and the Energy Department issued a short fact sheet (two pages of guidance plus a page of resources), Primary Mitigations to Reduce Cyber Threats to Operational Technology, after becoming "aware of cyber incidents affecting the operational technology (OT) and industrial control systems (ICS)" of U.S. critical infrastructure. It lists five actions:⁵

1. "Remove OT connections to the public internet." The agencies note that attackers find exposed devices "by searching for open ports on public IP ranges" with readily available tools.
2. "Change default passwords immediately and use strong, unique passwords."
3. "Secure remote access to OT networks": if remote access is essential, use a private connection and a VPN with a strong password and "phishing-resistant multifactor authentication (MFA)," apply least privilege, and disable dormant accounts.
4. "Segment IT and OT networks," including "introducing a demilitarized zone for passing control data to enterprise logistics."
5. "Practice and maintain the ability to operate OT systems manually," with tested continuity plans, fail-safes, software backups and standby systems.

It also urges plants to stay in regular contact with managed service providers, integrators and manufacturers, because a weak setting can come from any of them.⁵ If a small plant does nothing else this year, these five steps are the place to begin. Each one is a change to plant systems, so plan it with the vendor, your safety lead and qualified controls engineers, and test before production. The events of 2026 showed why the first step comes first: the joint advisory AA26-097A (April 7, 2026, updated July 22, 2026) describes actors disrupting internet-exposed PLCs across several sectors and tells owners to "Remove PLCs from direct internet exposure."⁴⁰

Asset inventory guidance (Aug. 13, 2025)

You cannot protect equipment you do not know you have. On Aug. 13, 2025, CISA, EPA, NSA, the FBI and partners in Australia, Canada, Germany, the Netherlands and New Zealand published Foundations for OT Cybersecurity: Asset Inventory Guidance for Owners and Operators, a 31-page guide.⁶ It defines an asset inventory as "an organized, regularly updated list of an organization's systems, hardware, and software," and lays out five steps: define scope and objectives; identify assets and collect attributes, combining "a physical inspection and logical survey"; create a taxonomy that sorts assets by function and criticality; manage and collect the data; and keep it current through the life of each asset. It names 14 high-priority attributes to record for each asset, from manufacturer, model, operating system and physical location to network addresses, protocols, ports and services, user accounts, logging and criticality. Its sample taxonomies for oil and gas, electricity, and water use 62443 zones and conduits.⁶

The UK's National Cyber Security Centre followed on Sept. 29, 2025, with CISA, the FBI and partners, in a guide on keeping a single authoritative record of OT architecture, which it called "essential for effective risk management."⁴¹ Both documents fit the 62443 order of work: inventory first, then zones and conduits, then controls.

Secure by Demand for OT buyers (Jan. 13, 2025)

Most plants do not write control software; they buy it. CISA and 11 other U.S. and allied agencies published Secure by Demand: Priority Considerations for Operational Technology Owners and Operators when Selecting Digital Products on Jan. 13, 2025.¹⁰ Its central observation is that attackers "target specific OT products rather than specific organizations," and that many OT products ship with "weak authentication, known software vulnerabilities, limited logging, insecure default settings and passwords, and insecure legacy protocols." It lists 12 security elements buyers should put first: configuration management; logging in the baseline product; open standards; ownership; protection of data; secure by default; secure communications; secure controls; strong authentication; threat modeling; vulnerability management, including a hardware and software bill of materials delivered with the product; and upgrade and patch tooling, including a path to a supported operating system "at no extra cost."¹⁰

Secure by Demand and Parts 4-1 and 4-2 of 62443 point the same way from different ends. 62443 tells the maker what to build; Secure by Demand tells the buyer what to ask for. A small plant can attach the 12 elements to a request for quotation as plain-English questions, then ask whether the product holds an ISASecure or other 62443 certificate as evidence.

Zero trust for OT (April 29, 2026)

Zero trust means no user or device is trusted just because it is inside the network; every connection is checked. On April 29, 2026, CISA, the Department of War, the Energy Department, the FBI and the State Department released Adapting Zero Trust Principles to Operational Technology.⁴² CISA's summary says it focuses on establishing zones and conduits to segment OT, addressing supply chain risk, strong identity and access management, and making changes carefully so mission-critical operations are not disrupted. The FBI's Brett Leatherman put it simply: "Resilience in OT isn't achieved through any single control."⁴² NIST's Rev. 3 had already noted that many OT devices cannot support zero trust technology and suggested applying it first at the higher levels of the architecture and the OT DMZ.²⁴ The 2026 guide is a sign that the government now expects zero trust ideas in OT, built on 62443's zones and conduits rather than replacing them.

CI Fortify (July 28, 2026)

On July 28, 2026, CISA and Australia's cyber agency, with the FBI and international partners, released CI Fortify: Advice for Isolating Vital Systems.⁴³ It starts from a blunt warning, "State-sponsored cyber threat actors are increasingly targeting critical infrastructure for pre-positioning," and asks owners to prepare to cut vital OT off from other networks during a crisis: map critical assets and every connection, build separation points in advance, write graduated isolation plans and test them, and use temporary measures where full physical isolation is not possible. It states that "physical isolation remains the most risk-effective solution."⁴³ In 62443 terms, CI Fortify asks you to know your conduits well enough to close them on purpose. Lesson 7 builds isolation steps into its segmentation plan.

Free CISA tools and training

CISA's Cyber Security Evaluation Tool (CSET) is "a stand-alone desktop application" that walks owners through a structured review of OT and IT against recognized standards; it runs on your own computer, so plant data does not leave the building.⁴⁴ CISA's free Cyber Hygiene service scans internet-facing systems for known weaknesses, which is a fast way to learn whether any plant equipment is exposed to the internet.⁴⁴ And CISA's advanced industrial control systems course, ICS301, is a four-day, in-person class held at "a facility in Idaho Falls, Idaho," with no tuition; it requires passing the online ICS300 course first.¹² Idaho National Laboratory, which helps run the training, says the 301 course has hosted more than 200 sessions.⁴⁵

MITRE ATT&CK for ICS

MITRE, a nonprofit that runs federally funded research centers, publishes ATT&CK, a public knowledge base of how real attackers behave. It released ATT&CK for ICS in January 2020 as a common vocabulary for attacks on industrial systems.⁴⁶ The current ICS matrix (version 20 as displayed on Oct. 28, 2026) is organized into 12 tactics, which are the attacker's goals at each stage: Initial Access, Execution, Persistence, Privilege Escalation, Evasion, Discovery, Lateral Movement, Collection, Command and Control, Inhibit Response Function, Impair Process Control, and Impact.⁴⁷ Under each tactic are techniques drawn from documented incidents.

ATT&CK is not a standard and nobody complies with it. Defenders use it in three ways. First, to read threat reports: CISA advisories and vendor reports tag what attackers did with ATT&CK technique names, so a plant can see which behaviors to watch for. Second, to test coverage: a plant or its monitoring provider can ask, for each technique that applies to its equipment, "would we see this?" Third, to plan exercises: a tabletop scenario built from real techniques is more useful than one built from movie plots. NIST's SP 800-82 Rev. 3 uses ATT&CK for ICS for its own list of threat events.³¹ The last three tactics, Inhibit Response Function, Impair Process Control and Impact, are what make industrial attacks different: they describe attackers stopping alarms or safety functions, changing what the process does, and causing physical or production harm. Lesson 3, Threats and Real Cases, describes incidents that match them, at the level government reports use.

Sector bodies and where manufacturing sits

Standards are only part of the support structure around a plant. The federal government sorts critical infrastructure into sectors, each with a lead agency. CISA runs the Critical Manufacturing Sector, which it says "identifies, assesses, prioritizes, and protects manufacturing industries with national significance," and which covers four core industries: primary metals; machinery; electrical equipment, appliances and components; and transportation equipment such as vehicles, ships, aircraft and rail equipment.⁴⁸ Other manufacturing falls into other sectors: chemical makers are in the Chemical Sector, drug and device makers in Healthcare and Public Health, food processors in Food and Agriculture, and defense producers in the Defense Industrial Base. That background matters because each sector has its own agency contacts, guidance and, in some cases, rules (covered in lesson 6).

Information Sharing and Analysis Centers (ISACs) are member groups that share threat warnings within an industry. Those most relevant to plants include the Manufacturing ISAC (MFG-ISAC), the Electricity ISAC run by NERC, WaterISAC, the Oil and Natural Gas ISAC, and the Multi-State ISAC for public bodies such as city water departments. Federal funding for the Multi-State ISAC was canceled for the rest of fiscal 2025 on March 6, 2025, which the Congressional Research Service said cut about half of its operating budget for that period.⁴⁹ For a small manufacturer, an ISAC membership or a vendor's security notification list is often the fastest way to hear that a product you run has a new flaw.

Help for small manufacturers: NIST MEP and TechHelp

The Manufacturing Extension Partnership

The NIST Manufacturing Extension Partnership (MEP) was "initially authorized in 1988." It works through state-designated MEP centers across the country and in Puerto Rico, with "more than 450 MEP service locations" and "nearly 1,400 trusted manufacturing advisors and experts," and its mission is "to enhance the productivity and technological performance of U.S. manufacturing."⁵⁰ MEP's cybersecurity page says centers can help manufacturers "assess your business's current risk posture, identify any gaps, and implement solutions," and it gives a contact address, mepcyber@nist.gov.⁵¹

MEP's Where to Start page is the best short reading list for a small plant, because it sorts free resources by CSF function:⁹

MEP also reminds companies that sell to the government that they "may be required to comply with the minimum cybersecurity standards set by FAR and DFARS," the federal and defense acquisition rules.⁹ Lesson 6 covers those rules and CMMC.

TechHelp, Idaho's MEP center

Idaho's MEP center is TechHelp, which Boise State University calls "Idaho's official Manufacturing Extension Partnership Center." It is based at Boise State, with partners at Idaho State University, the University of Idaho and the Idaho Manufacturing Alliance. On March 25, 2026, Boise State announced that NIST had awarded TechHelp a new cooperative agreement to keep serving Idaho manufacturers.¹¹ Boise State describes TechHelp's specialists as helping "Idaho manufacturers, food processors and entrepreneurs improve their competitiveness."⁵² In 2021, Boise State said its Institute for Pervasive Cybersecurity, Energy Policy Institute and TechHelp were working together to make Boise State the first Idaho university to join the Cybersecurity Manufacturing Innovation Institute (CyManII), a national partnership on manufacturing cybersecurity that includes Energy Department national laboratories.⁵³

What this lesson could not confirm: the public pages read for this lesson do not list the specific cybersecurity services TechHelp offers today, such as assessments or CMMC preparation, or what they cost. A small Idaho plant should ask TechHelp directly what cyber help it provides and whether it can connect the plant to MEP's national cybersecurity resources.

Idaho has a reason to care. The state had about 77,500 manufacturing jobs in September 2026 (seasonally adjusted, preliminary), about 8.7 percent of its 890,100 nonfarm jobs, according to Bureau of Labor Statistics data.⁵⁴ Most of those employers are small. Nationally, Verizon's 2025 breach report found that among manufacturing breaches in its data, "more than 90% of breached organizations were SMBs with fewer than 1,000 employees."⁵⁵ And the free, in-person ICS301 course in Idaho Falls is one of the best training opportunities in the country for plant staff, a short drive for many eastern Idaho operators.¹²

How the standards map to each other

These documents were written by different groups at different times, but they fit together. A simple way to see it: CISA's goals tell you the minimum; the CSF and the manufacturing profile give you a program structure; SP 800-82 explains how to do it in OT, with a detailed control list in its overlay; 62443 gives you the engineering method, the roles and a way to certify products and services; and ATT&CK for ICS tells you what attackers actually do, so you can check your defenses against it.

A crosswalk for common plant topics

The table below shows where the same topic lives in each document, so a team can read the free version first and buy the paid standard only where it needs the detail. Section numbers for SP 800-82 refer to Rev. 3.

This crosswalk is this module's own summary for orientation. It is not an official mapping, and the paid parts were described from public summaries rather than read in full. For official mappings between CSF 2.0 and other documents, NIST publishes informative references on its framework site.³⁵

Where a small manufacturer should start

The documents in this lesson add up to well over a thousand pages. A 40-person machine shop, a family food processor or a small rural water system does not need to read them all, and should not wait until it has. The comparison below sorts them by who they are for, what they cost, how big they are and the best first use.

Sizes are from the documents read for this lesson; the IR 8183r2 draft PDF runs about 76 pages and the SP 800-82 Rev. 4 draft about 321.³⁹³⁴

A first-year path for a small plant

Here is one realistic order of work for a plant with no dedicated security staff, drawn from the documents above. It is a sketch, not a compliance plan. Every step that changes a control system should be planned with the equipment vendor, your safety lead and qualified controls and process safety engineers, run through your management-of-change process, and tested before it touches production.

1. Name an owner. Pick one person, often the plant or maintenance manager working with whoever runs IT, to own plant security, and give that person a modest budget and a standing slot at management meetings. CPG 2.0's governance goals and CSF's Govern function both start here.⁷³⁵
2. Find what is exposed. Ask CISA for its free external vulnerability scan, and ask every vendor and integrator how they connect to your equipment today. Close or control what you find, following Primary Mitigations 1 and 3.⁴⁴⁵
3. Change default passwords and turn on multifactor sign-in for remote access, starting with remote access paths and anything reachable from the business network.⁵
4. Build the inventory. Walk the floor and record each controller, HMI, switch, engineering laptop and remote connection with the CISA guide's attributes. A spreadsheet is fine to start.⁶
5. Draw rough zones and conduits. Group equipment by line or function and by risk, and list every path between groups. This is the 62443-3-2 idea in its simplest form; lesson 7 shows how to turn it into a plan.²
6. Prove you can run by hand and restore. Test that operators can run critical processes manually for a set period, and that you can restore PLC programs and HMI projects from backups. NIST's SP 1339 OT backup quick start guide (June 17, 2026) and the IR 8183A templates help.³⁸⁹
7. Write security into the next purchase. Attach the Secure by Demand questions to the next request for quotation, ask integrators about their 62443-2-4 practices, and ask product makers for 62443-4-1 or 4-2 certification evidence.¹⁰⁹
8. Get help and training. Contact TechHelp or MEP, run CISA's CSET self-assessment, and send a controls technician to CISA's free online courses and, when ready, the ICS301 class in Idaho Falls.¹¹⁴⁴¹²
9. Write it down. Fold the plant into the company's written security program and 90-day plans, using the approach in Small Business Data Security, lesson 11: Policies, Training and a 90-Day Plan.

Common mistakes

• Treating a product certificate as a secure plant. A component's capability level says what it can do when configured properly. The 2023 Unitronics PLC defacements show the gap: IRGC-affiliated actors got in by compromising default credentials on devices reachable from the internet, and the joint advisory told owners to "Check PLCs for default passwords."⁵⁶ The products' features did not help when the defaults were never changed.
• Leaving old remote access out of the inventory. Colonial Pipeline's CEO testified that the attacker "exploited the legacy VPN profile that was not intended to be in use," and that it had only single-factor authentication.⁵⁷ An inventory that lists controllers but not every remote access path misses the doors attackers actually use.
• Putting control equipment on the internet "temporarily." The 2026 advisory AA26-097A describes actors disrupting PLCs across several sectors, with the July 2026 update widening the warning to "potentially all internet exposed PLCs."⁴⁰ Primary Mitigation 1 exists because this keeps happening.⁵
• Writing zones on paper but not enforcing them. Dragos, a security vendor, reported that 81 percent of its 2025 field assessments found poor IT and OT segmentation and only 46 percent found adequate OT network monitoring.⁵⁸ A zone diagram without matching firewall rules and monitoring is decoration.
• Leaving the safety system out of security scope. CISA's 2017 analysis of malware aimed at a safety controller recommended keeping controller keyswitches out of program mode except when needed and putting safety systems on isolated networks.⁵⁹ Many plants treat the safety system as its own zone with the strictest target. Lesson 5 covers safety and security together.
• Confusing maturity levels with security levels. A vendor that says it is "level 3" may mean its development process is at maturity level 3 (Defined) or that a product reaches security level 3. They measure different things. Ask which.¹⁴²
• Citing a draft as final. SP 800-82 Rev. 4 and the IR 8183 Rev. 2 manufacturing profile are drafts as of Oct. 28, 2026. Audits, contracts and policies should cite Rev. 3 and IR 8183 Rev. 1 until NIST publishes finals, and note the drafts as direction of travel.⁴³⁸
• Trying to do all of 62443 at once. Plants that buy the whole series and start at Part 1-1 often stall before changing anything. Start with the free CISA steps, then use the paid parts where they earn their cost: specifying a new system, contracting an integrator, or maturing a working program.
• Pasting purchased standards into AI tools. ISA's terms prohibit entering ISA intellectual property into AI tools.¹ Read the parts yourself, or use ISA's free summaries.

Questions people ask

Do we have to comply with ISA/IEC 62443?

Not by any U.S. federal rule found for this lesson, for an ordinary private manufacturer. It becomes a requirement when a customer writes it into a contract, when you choose to certify a product or service against it, when you sell into a market whose rules point to it, or when an insurer or auditor asks for it. Sector rules such as TSA's pipeline directives set their own requirements, some of which, like zone boundaries, use the same ideas.¹³ Lesson 6 covers who must follow what.

Should we start with NIST or with 62443?

For a small plant, start with the free CISA and NIST documents, which are shorter and cost nothing, and bring in 62443 when you specify, buy or contract for control systems. The two are designed to work together: NIST's guide describes 62443 and says its segmentation advice applies to 62443 architectures, and NIST's manufacturing profile says it is meant to "enhance but not replace" industry standards.¹⁷²⁴⁸ Larger plants and integrators usually use both: NIST for the program and the control list, 62443 for the engineering method and supplier requirements.

Is SP 800-82 Rev. 4 in effect?

No. It is an initial public draft released Sept. 21, 2026, with comments due Nov. 30, 2026. Rev. 3 (Sept. 28, 2023) remains the final guide. Read the draft to see where NIST is heading, especially the CSF 2.0 structure, the added sectors and the plan to move the OT overlay into its own document, and send comments if you have them.⁴³⁴³

What is the difference between the CSF and SP 800-82?

The CSF is a general framework for any organization: six functions and a set of outcomes, with no OT-specific detail. SP 800-82 is an OT engineering guide: it explains how control systems are built, what makes them different, how to segment and monitor them, and which SP 800-53 controls to apply. Rev. 3 already applies the framework to OT in its Section 6, and the Rev. 4 draft is organized around CSF 2.0 throughout.²⁶³⁴

Our integrator says the new system is "62443 compliant." What should we ask?

Ask which parts and which security level; whether a third party certified it, under which scheme, and for which product versions; whether the integrator's own practices have been assessed against Part 2-4; what the target security level was for each zone and who set it; and what the achieved level is after commissioning, with the evidence. Ask for the documentation the supplier must provide under Part 4-1 on configuring the product securely. ISASecure publishes lists of certified products and organizations you can check.²⁵

We already have ISO 27001 for IT. Does that cover the plant?

Partly. An ISO 27001 management system gives you the program machinery: risk assessment, policies, internal audit and management review. The 2024 edition of 62443-2-1 removed requirements that duplicated that kind of management system, so the two fit together better than before.¹⁸ But ISO 27001 does not tell you how to segment a control network, protect a safety system or handle a controller that cannot be patched. Extend the existing program to cover OT, and use 62443 and SP 800-82 for the plant-specific parts. The business-side frameworks are compared in the SMB course's framework lesson.

We are a 30-person shop with one part-time IT person. What is realistic?

The five Primary Mitigations, a basic inventory, tested manual operation and backups, and security questions in your next equipment purchase are realistic within a year for most small plants, and they address the ways small manufacturers are most often hurt.⁵⁶ Ask TechHelp what help it can provide, use CISA's free scan and CSET tool, and treat 62443 as something you ask your suppliers and integrators to meet rather than something you implement in full yourself.¹¹⁴⁴

Where can we learn 62443 without buying it?

ISA's Global Cybersecurity Alliance offers free material to the public, including the Quick Start Guide.¹² NIST's SP 800-82 Rev. 3 describes the series and its certification program.¹⁷ CISA's asset inventory guide shows zones and conduits in use.⁶ ISA members can view most ISA editions online. Public libraries and university libraries sometimes provide access to standards databases; ask your library.

Hard questions

Should standards like 62443 be mandatory for manufacturers?

The case for mandates. Voluntary guidance has existed for two decades, yet weak practices remain common: Dragos reported poor IT and OT segmentation in 81 percent of its 2025 field assessments.⁵⁸ A plant's failure can hurt neighbors, customers and supply chains that had no say in its security spending, which is the classic argument for regulation. The pipeline sector is an example of the federal government moving from voluntary guidelines to binding directives after Colonial Pipeline; TSA's current directive requires segmentation with defined zone boundaries and says TSA "intends to permanently codify these requirements through notice-and-comment rulemaking."¹³

The case against. Manufacturing is enormously varied, from a bakery to a semiconductor fab, and a single mandated standard could force small firms to spend on paperwork rather than on the few controls that matter most. 62443 is long, paid and partly dated, and its full application needs specialist skills small plants do not have. The administration's March 6, 2026 cyber strategy calls for streamlining cyber rules to cut compliance burden.⁶⁰ Supporters of the voluntary approach point to the free, short CISA guides as a better fit for small firms, and to customer contracts and insurance as market pressure that already pushes standards down supply chains.

What the evidence shows. The available evidence shows that practice lags guidance, but it does not settle whether mandates or market pressure close the gap faster for small manufacturers. What can be said is that the basic controls in CISA's Primary Mitigations address the failures in the advisories cited in this lesson, internet-exposed PLCs, default passwords and weak remote access, and that those controls are cheap compared with a full standard.⁵⁴⁰⁵⁶

Should standards that matter this much be free to read?

The case for free access. When a standard shapes the safety of water, power and food, and when governments point to it, people affected by it should be able to read it. Paid access falls hardest on the smallest firms and on the public, reporters and local officials who want to check a utility's claims. U.S. agencies sometimes incorporate paid standards into binding rules: FDA's quality management rule for medical devices, effective Feb. 2, 2026, incorporates ISO 13485:2016 by reference.⁶¹

The case for the current model. Standards bodies pay for committee work, editing and maintenance partly through sales, and ISA's committee, as NIST describes it, brings together industrial cybersecurity experts from across the globe.¹⁷ Without sales revenue, someone else, often government, would have to pay. ISA already provides free summaries through its alliance and member viewing of most editions.¹

What the evidence shows. For 62443, a middle path exists: the core ideas are freely described by ISA's alliance, by NIST and by CISA, so a plant can learn and act on them without buying the text.²¹⁷⁶ The cost of the parts, a few hundred euros each at one reseller, is modest for a mid-size firm but not trivial for the smallest ones.¹⁹²⁰

Who should carry the burden: the plant that buys equipment, or the company that makes it?

The case for putting it on makers. U.S. and allied agencies say attackers "target specific OT products rather than specific organizations," and that many products ship with weak authentication, insecure defaults and old protocols.¹⁰ A small plant cannot fix a design flaw in a controller; only the maker can. The 2023 Unitronics attacks succeeded through default credentials, a choice made at the factory as much as at the plant.⁵⁶ Secure by Demand tells buyers to look for products that support moving to a supported operating system "at no extra cost."¹⁰

The case for keeping it with owners. The asset owner decides how equipment is connected, who gets remote access and whether defaults are changed. Even the most secure product can be installed badly, which is why 62443 separates capability from achieved security.² Makers also note that plants often run equipment for decades and decline upgrades that would stop production.

What the evidence shows. The standards assign real duties to both, and the documented incidents cited here involved both product weaknesses and owner choices. The European Union is moving toward binding duties on product makers (lesson 6), while U.S. policy for private plants still relies mainly on buyer demand and guidance.

Is certification worth the cost for small suppliers and plants?

For certification. A certificate gives buyers independent evidence instead of a sales claim, and NIST's MEP tells small manufacturers to look for ISASecure-certified products.⁹ For a small supplier selling into larger manufacturers, utilities or Europe, a certificate can open doors.

Against. Certification bodies set the fees, which ISASecure's page does not publish, and the work to prepare can be large for a small firm.²⁵ A certificate covers a product version at a point in time, and it says nothing about how the product is installed. For an asset owner, the new site scheme (ACSSA) may be out of reach for small plants, and this lesson found no public count of plants certified under it.²⁷

What the evidence shows. This lesson found no public study measuring whether certified products or certified plants suffer fewer incidents. Buyers should treat certification as one piece of evidence, alongside how the supplier handles reported flaws and how the system is configured on site.

Where to go next

• CISA, Primary Mitigations to Reduce Cyber Threats to Operational Technology: Free short fact sheet from CISA, FBI, EPA and DOE (May 6, 2025). For any plant or utility: the five first actions. Print it and check each item with your vendor and controls engineers.
• ISAGCA Quick Start Guide to ISA/IEC 62443: Free overview from ISA's Global Cybersecurity Alliance (June 2020) of the 62443 parts, roles, zones and conduits and security levels. For anyone deciding whether to buy the paid parts.
• NIST SP 800-82 Rev. 3, Guide to OT Security: Free 316-page NIST guide (Sept. 28, 2023), the current final edition. For engineers, security staff and auditors: read the executive summary first, then the sections you need. The Rev. 4 draft is linked from the same page, comments due Nov. 30, 2026.
• NIST IR 8183r2 draft, CSF 2.0 Manufacturing Profile: Free NIST draft (Sept. 29, 2025) that tailors the Cybersecurity Framework to manufacturers, with low, moderate and high impact levels. Use it to organize a plant program.
• NIST MEP, Where to Start: Free NIST page for small and mid-size manufacturers listing tools by CSF function, including CSET, Malcolm and incident response templates, and how to reach an MEP center such as TechHelp.
• CISA, #StopRansomware: Services (CSET and Cyber Hygiene): Free CISA services: the CSET self-assessment desktop tool and Cyber Hygiene external vulnerability scanning. For any critical infrastructure organization, including small plants.
• CISA ICS301: Advanced Cybersecurity for Industrial Control Systems: Free four-day in-person course in Idaho Falls, Idaho, after the free online ICS300 course. For controls engineers, technicians and IT staff who support plant systems.
• MITRE ATT&CK for ICS: Free knowledge base of attacker tactics and techniques against industrial systems. For security staff and monitoring providers checking whether defenses would see real behavior.

Still being checked (7 items)

These points could not be fully confirmed against a primary source when this lesson was written and fact checked in October 2026. The text above states each one as uncertain.

• Newer IEC editions not on ISA's list (IEC 62443-2-4 Ed. 2.0 of 2023, IEC TS 62443-1-5:2023, IEC TS 62443-6-1:2024) are from a secondary source and were not checked in the IEC webstore.
• The numbering of the middle steps of the Part 3-2 zone and conduit workflow in the ISAGCA guide's figure could not be read clearly; the order of steps is given as described.
• The total number of goals in CISA's CPG 2.0 was not confirmed (the CPG 2.0 document was not opened); its structure is described from CISA's bulletin and a law firm summary.
• TechHelp's current cybersecurity services and fees could not be confirmed from public pages.
• ISASecure certification costs, the launch date of the ACSSA asset owner scheme, and the number of sites certified under it were not found.
• Descriptions of individual 62443 parts rely on ISA's free summaries and NIST's description; the paid standards themselves were not read for this lesson.
• Prices are from one Irish reseller in euros before VAT on Oct. 28, 2026, not ISA's U.S. list prices.

Last verified October 28, 2026. General education, not legal, engineering, safety or compliance advice; rule versions and dates are stated in the text, and the sources used are listed in the Notes and Sources below. Check the regulator's current text before relying on any point.

Notes

1. International Society of Automation (ISA), ISA/IEC 62443 Series of Standards, series page listing the published parts and editions, member viewing access, the ISA Global Cybersecurity Alliance's free resources, the statement that the series is endorsed by the United Nations, and ISA's notice prohibiting entry of ISA intellectual property into AI tools (read Oct. 28, 2026). Read it online. ↩
2. ISA Global Cybersecurity Alliance, Quick Start Guide: An Overview of ISA/IEC 62443 Standards, June 2020: the four groups of parts, roles, the seven foundational requirements, security level definitions, target, achieved and capability security levels, zone and conduit definitions, and the Part 3-2 workflow in Figure 3 (read Oct. 28, 2026). Read it online. ↩
3. NIST Computer Security Resource Center, SP 800-82 Rev. 3, Guide to Operational Technology (OT) Security, publication page: published Sept. 28, 2023, superseding Rev. 2 (June 3, 2015), authors Keith Stouffer, Michael Pease, CheeYee Tang, Timothy Zimmerman, Victoria Pillitteri and Suzanne Lightman (NIST) and Adam Hahn, Stephanie Saravia, Aslam Sherule and Michael Thompson (MITRE), with a Sept. 21, 2026 planning note pointing to the Rev. 4 draft (read Oct. 28, 2026). Read it online. ↩
4. NIST, news release, Guide to Operational Technology (OT) Security: NIST Requests Comments on Draft SP 800-82r4, Sept. 21, 2026, comments due Nov. 30, 2026 (read Oct. 28, 2026). Read it online. ↩
5. CISA, FBI, EPA and DOE, Primary Mitigations to Reduce Cyber Threats to Operational Technology, fact sheet, May 6, 2025 (read Oct. 28, 2026). Read it online. ↩
6. CISA, EPA, NSA, FBI and international partners, Foundations for OT Cybersecurity: Asset Inventory Guidance for Owners and Operators, Aug. 13, 2025, 31 pages (read Oct. 28, 2026). Read it online. ↩
7. CISA, GovDelivery bulletin, Cybersecurity Performance Goals 2.0 for Critical Infrastructure, December 2025, and CISA alert of Dec. 11, 2025 (read Oct. 28, 2026). Read it online. ↩
8. NIST CSRC, NIST IR 8183 Rev. 2 (Initial Public Draft), Cybersecurity Framework 2.0 Manufacturing Profile, Sept. 29, 2025, comments due Nov. 17, 2025, with the description of changes (22 categories and 106 subcategories, supply chain risk management, platform security, technology infrastructure resilience) (read Oct. 28, 2026). Read it online. ↩
9. NIST Manufacturing Extension Partnership, Where to Start, cybersecurity resources for manufacturers organized by CSF function, including its pointer to ISASecure's list of products certified to the ISA/IEC 62443 standards and the description of the Malcolm tool (read Oct. 28, 2026). Read it online. ↩
10. CISA, NSA, FBI, EPA, TSA and international partners, Secure by Demand: Priority Considerations for Operational Technology Owners and Operators when Selecting Digital Products, Jan. 13, 2025, 22 pages (read Oct. 28, 2026). Read it online. ↩
11. Boise State University, TechHelp receives federal award to continue supporting Idaho manufacturers, March 25, 2026 (read Oct. 28, 2026). Read it online. ↩
12. CISA, Advanced Cybersecurity for Industrial Control Systems (ICS301) course page: four days in person in Idaho Falls, no tuition, ICS300 prerequisite (read Oct. 28, 2026). Read it online. ↩
13. TSA, Security Directive Pipeline-2021-02G, Pipeline Cybersecurity Mitigation Actions, Contingency Planning, and Testing, effective May 3, 2026 to May 2, 2027, section III.B (network segmentation, including zone boundaries) and footnote 2 (intent to codify through rulemaking) (read Oct. 28, 2026). Read it online. ↩
14. Wikipedia, IEC 62443, used only as a secondary source for edition history (IEC 62443-2-4 Ed. 2.0 of 2023, IEC TS 62443-1-5:2023, IEC TS 62443-6-1:2024), the meaning of security level 0, the four maturity levels and the history of the ISASecure programs; check the IEC webstore for current editions (read Oct. 28, 2026). Read it online. ↩
15. ISA, press release, The International Electrotechnical Commission Designates ISA/IEC 62443 as a Horizontal Standard, Nov. 17, 2021 (read Oct. 28, 2026). Read it online. ↩
16. ISA, InTech, Jan./Feb. 2019, United Nations commission to integrate ISA/IEC 62443, reporting UNECE's statement at its late-2018 annual meeting (read Oct. 28, 2026). Read it online. ↩
17. NIST SP 800-82 Rev. 3, Appendix D.1.5.2 (ISA99) and D.1.5.3 (ISASecure), pp. 190 to 191, describing the 62443 series in four categories and ISASecure as a certification scheme for off-the-shelf automation and control systems (read Oct. 28, 2026). Read it online. ↩
18. NSAI Standards shop (Ireland), listing for IEC 62443-2-1:2024, published Aug. 7, 2024, 189 pages, replacing the 2010 edition, EUR 416.46 excluding VAT; the publisher abstract lists the reorganization into security program elements, removal of duplication with ISMS requirements, and a maturity model (read Oct. 28, 2026). Read it online. ↩
19. NSAI Standards shop, listing for ANSI/ISA-62443-3-2-2020, 40 pages, status current, EUR 181.67 excluding VAT (read Oct. 28, 2026). Read it online. ↩
20. NSAI Standards shop, listing for ANSI/ISA-62443-3-3 (99.03.03)-2013, 84 pages, status current, EUR 205.36 excluding VAT (read Oct. 28, 2026). Read it online. ↩
21. NSAI Standards shop, listing for ANSI/ISA-62443-4-2-2018, published Aug. 13, 2018, 98 pages, status current, EUR 232.22 excluding VAT (read Oct. 28, 2026). Read it online. ↩
22. CISA and FBI, Considerations for Critical Infrastructure Operators Working With Third-Party ICS Integrators, fact sheet, Sept. 23, 2026 (read Oct. 28, 2026). Read it online. ↩
23. ISA via PR Newswire, Update to ISA/IEC 62443 Standards Addresses Organization-Wide Cybersecurity in Industrial and Critical Infrastructure Operations, Jan. 28, 2025, announcing ANSI/ISA-62443-2-1-2024 and quoting ISA99 co-chair Eric Cosman (read Oct. 28, 2026). Read it online. ↩
24. NIST SP 800-82 Rev. 3, Section 5.2.3, Layer 3: Network Security, pp. 71 to 75, on segmentation models (Purdue, ISA-95, IIoT tiers), grouping into zones as a precursor activity, and firewall rules between adjacent levels, tiers or zones, with the note that a similar concept applies to ISA/IEC 62443 architectures (read Oct. 28, 2026). Read it online. ↩
25. ISASecure (ISA Security Compliance Institute), Certification page listing the CSA, ICSA, SSA, SDLA, ACSSA and HCSA schemes and the 62443 parts each covers, with links to certified products and organizations; no prices are stated (read Oct. 28, 2026). Read it online. ↩
26. NIST SP 800-82 Rev. 3, Table of Contents, pp. iv to x (Sections 1 to 6 and Appendices A to G); the PDF runs 316 pages (read Oct. 28, 2026). Read it online. ↩
27. ISA, press release, Perseus Information Security Consulting accredited as a certification body for the ISASecure ACSSA scheme for asset owners (ISA/IEC 62443-2-1, 2-4, 3-2 and 3-3), June 9, 2026 (read Oct. 28, 2026). Read it online. ↩
28. NIST SP 800-82 Rev. 3, Executive Summary, p. 4, list of recommended practices including a DMZ architecture, multifactor authentication for remote access and disabling unused ports and services after testing (read Oct. 28, 2026). Read it online. ↩
29. NIST SP 800-82 Rev. 3, Appendix F, OT Overlay, pp. 213 to 215, including the note that the overlay is a partial tailoring of SP 800-53 Rev. 5 intended for all OT systems in all industrial sectors, and the Table 22 conventions for added and removed controls (read Oct. 28, 2026). Read it online. ↩
30. NIST SP 800-82 Rev. 3, Section 4, Risk Management for OT Systems, p. 60, on overlays and OT baselines as starting specifications (read Oct. 28, 2026). Read it online. ↩
31. NIST SP 800-82 Rev. 3, Appendix C.3, Table 21, threat events drawn from MITRE ATT&CK for ICS, such as denial of control and manipulation of control (read Oct. 28, 2026). Read it online. ↩
32. NIST SP 800-82 Rev. 3, Section 6.2.11, Flaw Remediation and Patch Management, p. 125, noting that not all vendors report known vulnerabilities to CISA (read Oct. 28, 2026). Read it online. ↩
33. NIST CSRC, SP 800-82 Rev. 4 pre-draft call for comments, Jan. 22, 2026, comments due Feb. 23, 2026 (read Oct. 28, 2026). Read it online. ↩
34. NIST SP 800-82r4 initial public draft, Guide to OT Security, September 2026, front matter (Note to Reviewers, p. ii, listing the updates; public comment period Sept. 21 to Nov. 30, 2026, comments to sp800-82rev4@nist.gov) and Table of Contents (Section 3 organized under the CSF 2.0 Govern function, Section 4 under Identify, Protect, Detect, Respond and Recover); the PDF runs 321 pages (read Oct. 28, 2026). Read it online. ↩
35. NIST, Cybersecurity Framework home page, CSF 2.0 (NIST CSWP 29, released Feb. 26, 2024, per its CSRC publication page), with profiles, quick-start guides and informative references; the page marks two years of CSF 2.0 on Feb. 24, 2026 (read Oct. 28, 2026). Read it online. ↩
36. Covington and Burling, Global Policy Watch, CISA Releases Cybersecurity Performance Goals 2.0 for Critical Infrastructure, December 2025: alignment to the six CSF 2.0 functions, merged IT and OT goals, four new goals, and cost, impact and ease ratings that CISA says do not necessarily extend to OT (read Oct. 28, 2026). Read it online. ↩
37. NIST IR 8183, Cybersecurity Framework Manufacturing Profile, 2017 (read Oct. 28, 2026). Read it online. ↩
38. NIST CSRC, Operational Technology Security project news page, listing SP 1800-10 (March 16, 2022) and SP 1339, OT Backup Quick Start Guide (June 17, 2026), with no final IR 8183r2 listed (read Oct. 28, 2026). Read it online. ↩
39. NIST IR 8183r2 ipd, Sections 4.1 and 4.2, pp. 9 to 10: the five manufacturing business and mission objectives and the low, moderate and high impact definitions based on FIPS 199 (read Oct. 28, 2026). Read it online. ↩
40. FBI, CISA, NSA, EPA, DOE and partners, advisory AA26-097A, Iranian-Affiliated Cyber Actors Exploit PLCs Across US Critical Infrastructure, April 7, 2026, updated July 22, 2026 (read Oct. 28, 2026). Read it online. ↩
41. ExecutiveGov, Oct. 2, 2025, on the UK NCSC-led guide Creating and Maintaining a Definitive View of Your Operational Technology Architecture (Sept. 29, 2025) with CISA, FBI and partners (read Oct. 28, 2026). Read it online. ↩
42. CISA, GovDelivery bulletin, Adapting Zero Trust Principles to Operational Technology, April 29, 2026, a joint guide with the Department of War, DOE, FBI and Department of State; guide at cisa.gov/resources-tools/resources/adapting-zero-trust-principles-operational-technology (read Oct. 28, 2026). Read it online. ↩
43. CISA, GovDelivery bulletin, CI Fortify: Advice for Isolating Vital Systems, July 28, 2026, with ASD's ACSC, the FBI and international partners; guidance at cisa.gov/resources-tools/resources/ci-fortify-advice-isolating-vital-systems (read Oct. 28, 2026). Read it online. ↩
44. CISA, #StopRansomware: Services, describing free Cyber Hygiene vulnerability scanning and the Cyber Security Evaluation Tool (CSET) (read Oct. 28, 2026). Read it online. ↩
45. Idaho National Laboratory, Industrial Control Systems Cybersecurity Training (read Oct. 28, 2026). Read it online. ↩
46. WaterISAC, MITRE Releases ATT&CK for ICS as Common Lexicon for Industrial Cyber Defense Strategy, January 2020 (read Oct. 28, 2026). Read it online. ↩
47. MITRE, ATT&CK for ICS matrix (ATT&CK v20 as displayed), 12 tactics (read Oct. 28, 2026). Read it online. ↩
48. CISA, Critical Manufacturing Sector page, naming the sector's four core industries (read Oct. 28, 2026). Read it online. ↩
49. Congressional Research Service, Critical Infrastructure: Emerging Trends and Policy Considerations for Congress, R48878, March 10, 2026, on NSM-22, the 2025 executive changes and the March 6, 2025 cancellation of federal MS-ISAC funding for the rest of FY2025 (read Oct. 28, 2026). Read it online. ↩
50. NIST MEP, About NIST MEP (read Oct. 28, 2026). Read it online. ↩
51. NIST MEP, Cybersecurity Resources for Manufacturers, last updated Sept. 30, 2025, contact mepcyber@nist.gov (read Oct. 28, 2026). Read it online. ↩
52. Boise State University, Institute for Pervasive Cybersecurity, Partnerships page, TechHelp entry (read Oct. 28, 2026). Read it online. ↩
53. Boise State University, Boise State to join Cybersecurity Manufacturing Innovation Institute, Sept. 3, 2021 (read Oct. 28, 2026). Read it online. ↩
54. U.S. Bureau of Labor Statistics, Current Employment Statistics, Idaho manufacturing (series SMS16000003000000001) and total nonfarm (SMS16000000000000001), seasonally adjusted, September 2026 preliminary (pulled Oct. 28, 2026). Read it online. ↩
55. Verizon, 2025 Data Breach Investigations Report, Manufacturing section, pp. 79 to 80 (read Oct. 28, 2026). Read it online. ↩
56. FBI, CISA, NSA, EPA and Israel National Cyber Directorate, advisory AA23-335A on IRGC-affiliated actors exploiting Unitronics PLCs, Dec. 1, 2023 (read Oct. 28, 2026). Read it online. ↩
57. U.S. Senate Committee on Homeland Security and Governmental Affairs, Threats to Critical Infrastructure: Examining the Colonial Pipeline Cyberattack, June 8, 2021, S. Hrg. 117-429, testimony of Joseph Blount (read Oct. 28, 2026). Read it online. ↩
58. Dragos, Launched: 9th Annual Dragos OT Cybersecurity Year in Review, Feb. 17, 2026 (vendor data covering 2025 assessments; 81 percent with poor IT and OT segmentation, 46 percent with adequate OT network monitoring) (read Oct. 28, 2026). Read it online. ↩
59. CISA (NCCIC), Malware Analysis Report MAR-17-352-01, HatMan: Safety System Targeted Malware, Dec. 18, 2017 (read Oct. 28, 2026). Read it online. ↩
60. Covington and Burling, Inside Privacy, on President Trump's Cyber Strategy for America (March 6, 2026) and its pillar to promote common-sense regulation, March 10, 2026 (read Oct. 28, 2026). Read it online. ↩
61. FDA, Quality Management System Regulation: Final Rule Amending the Quality System Regulation, Frequently Asked Questions: the rule amending 21 CFR Part 820 incorporates ISO 13485:2016 by reference and became effective Feb. 2, 2026 (read Oct. 28, 2026). Read it online. ↩
62. Idaho Statesman via East Idaho News, Sept. 8, 2026, on the state's Cyber Resilience Operation Center and the July 2026 water attacks (read Oct. 28, 2026). Read it online. ↩