OT Security Guidance: NIST Drafts Updated Guide, CISA/FBI Advise on ICS Integrators
NIST releases updated OT security guide draft; CISA/FBI warn on ICS integrator risks.
NIST has published a draft of its Special Publication 800-82 Revision 4, an updated guide for operational technology (OT) security, which is open for public comment until November 30, 2026. The revision expands sector coverage and aligns with NIST Cybersecurity Framework 2.0. Concurrently, CISA and the FBI issued a fact sheet advising critical infrastructure operators to exercise caution with third-party ICS integrators, highlighting risks of excessive access and recommending least privilege, following an incident where foreign actors accessed sensitive data from a US industrial automation company.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Special Publication 800-82 Revision 4?
Get an email when a new story names Special Publication 800-82 Revision 4, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonForeign actors were able to access sensitive data from a US industrial automation company by exploiting excessive privileges granted to third-party ICS integrators — a classic supply chain trust abuse scenario. Organizations frequently extend broad access to vendors and integrators for convenience, but fail to enforce least privilege or monitor that access adequately. This incident underscores that operational technology (OT) environments are high-value targets where a single compromised third party can expose critical industrial systems. The convergence of IT and OT networks amplifies the blast radius when perimeter trust is misplaced, making strict access governance and segmentation non-negotiable.
What helps against this
How we list vendors- Privileged access management (PAM)
Admin accounts stop being one stolen password away from control of everything.
- Cyber asset inventory
You cannot patch, monitor or protect the devices, cloud resources and accounts you do not know you have.
- Third-party risk management (TPRM)
You know which suppliers could hurt you, and you hear quickly when one of them is breached.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- mitre_attack — T1560.001
- mitre_attack — T1071.001