NIST has released a draft update to its main operational technology security guide, while CISA and the FBI warned critical infrastructure owners about risks from third-party industrial control system integrators. The draft revision of NIST Special Publication 800-82 expands coverage to sectors including water, freight rail, maritime, building automation, and food and agriculture, and aligns the guidance with NIST Cybersecurity Framework 2.0 and zero trust principles. Separately, CISA and FBI said foreign actors breached a U.S. industrial automation solutions company between March and April 2025 and staged nine archives containing about 800 SCADA network schematics, device configurations, and customer details.
Why it matters: This matters because utilities, transport operators, and other critical-infrastructure organizations often give vendors deep remote access to sensitive control systems. Defenders should review third-party integrator privileges, remote-access paths, internet exposure, logging, and contract security requirements, and OT teams may want to comment on the new NIST guidance before the November 30 deadline.
Eduard Kovacs
2026.09.24
100% relevant
This article establishes a distinct story because it combines a newly published NIST OT security draft with a new CISA/FBI fact sheet tied to a specific previously undisclosed 2025 intrusion at an ICS integrator, rather than updating an existing tracked incident.
← Back to all stories