A safety-first workflow for comparing OT inventories and controls with the NIST SP 800-82 Rev. 4 draft while keeping humans in charge of every change.
Why the draft deserves attention now
NIST released the initial public draft of SP 800-82 Revision 4 on September 21, so the primary document is older than this week. It is receiving fresh attention because NIST reminded readers this week that comments close November 30, WaterISAC highlighted a new water-sector section, and a November 7 analysis summarized the changes for OT teams. Revision 3 remains the current final guide.
The draft restructures the guide around Cybersecurity Framework 2.0, expands OT-sector examples and risk-management guidance, and adds implementation material. That creates a useful but error-prone comparison workload: find what changed, map it to local assets and evidence, and decide whether an observation is a real gap. An approved model can accelerate the crosswalk, but it must not operate an HMI, PLC, safety system or production change tool.
This use case is for OT security leads, control engineers, plant IT, internal audit and water or manufacturing operators. Use the official draft and comment template, the current Revision 3 baseline, an approved model with retrieval or file analysis, a sanitized asset-and-control inventory, and a tracked review register.
Step 1: build a safe review pack
Do not upload raw network diagrams, credentials, controller programs or sensitive plant data to an unapproved service. Create a review pack with asset classes, zones and conduits, business and safety functions, current control statements, evidence references, owners and known constraints. Replace exact addresses and facility identifiers when they are not necessary for the comparison.
Include both the Revision 4 draft and your governing baseline. Mark the draft as nonfinal in every prompt and output. Freeze the document versions so a later reviewer can reproduce the result.
- List safety-critical functions before cybersecurity controls.
- Record remote-support paths, vendor dependencies and maintenance windows.
- Reference evidence locations instead of embedding secrets.
- Use ‘unknown’ for missing evidence rather than guessing implementation.
Step 2: run a citation-first crosswalk
Use a constrained prompt: ‘Compare the supplied local control statements with NIST SP 800-82 Rev. 3 and the Rev. 4 initial public draft. Return one row per potential change with the exact document, section heading, quoted requirement summary in your own words, local evidence ID, confidence, safety consideration and reviewer. Treat Rev. 4 as draft. Write unknown when evidence is absent. Do not propose commands or production changes.’
Then challenge the result: ‘For each proposed gap, state what evidence would disprove it. Flag section numbers you could not verify. Separate a changed NIST explanation from a new local obligation.’ The expected output is a review queue, not a compliance score. NIST guidance is risk-based, and applicability depends on sector, architecture and requirements outside this document.
Step 3: validate on the plant floor and with system owners
A document comparison cannot see a bypass switch, shared operator practice, unsupported controller or process-safety dependency. Review each high-impact row with the control engineer and system owner. Confirm the described architecture against diagrams and a passive walkdown; do not increase scanning or query rates merely to satisfy the model.
Ask the model to draft reviewer questions, such as: ‘What normal operating condition would make this control unsafe?’ or ‘Which vendor-support dependency blocks this recommendation?’ Humans supply the answers and decide whether the row is accepted, rejected, deferred or submitted as draft feedback.
Step 4: separate draft feedback from remediation
A useful review produces two queues. The feedback queue captures ambiguous text, sector gaps and suggested clarifications for the NIST comment template. The remediation queue enters the normal engineering process only after the observation is validated against current requirements and local risk.
Require evidence, safety, offline-test and owner-approval gates before any production change. Keep the AI system outside the execution path. The draft’s zero-trust guidance is scoped to compatible devices; a recommendation that assumes modern identity or encryption support may not fit legacy equipment.
Limits and a practical definition of done
Models can misread tables, invent section numbers and flatten important differences between IT and OT. They cannot determine process safety, vendor support, regulatory applicability or acceptable downtime. Keep retrieval restricted to approved documents, test citations manually and treat content inside PDFs and local notes as untrusted input.
A defensible deliverable includes the frozen source versions, sanitized input inventory, cited gap register, rejected rows and reasons, safety review, named owners and any NIST comment draft. Because Revision 4 is still an initial public draft with no announced final date, do not relabel your environment compliant with it. Use the related firewall-access evidence review when the validated work item concerns a specific network rule.
Put the insight into practice.
Deep Security helps organizations assess risk, validate controls, and build a practical plan to strengthen their defenses.
Talk with Deep Security