Frameworks for OT Security

Faculty who start building an OT security course almost always hit the same wall: there are four widely cited bodies of guidance — IEC 62443, NIST SP 800-82, the NIST Cybersecurity Framework (CSF), and ISO/IEC 27001 — and they all sound authoritative, they all use overlapping vocabulary, and none of them announces which one a course should be built around. The usual result is a syllabus that samples all four, confuses students, and produces graduates who can name standards but cannot apply one.

This lesson takes the opposite approach. We treat the four documents as tools with different jobs, learn the internal logic of the one that is genuinely OT-native (IEC 62443), and then use the others as supporting material rather than competing curricula. By the end you will have drafted a one-page crosswalk you can hand to your own students.

Learning objectives

By the end of this 4-hour session, you will be able to:

1. Explain the scope, intended audience, and structure of IEC 62443, NIST SP 800-82 Rev. 3, NIST CSF 2.0, and ISO/IEC 27001, and state the job each one does best.
2. Identify zones and conduits in a given plant network description and justify each boundary in terms of shared risk and required communication.
3. Differentiate target, capability, and achieved Security Levels (SL-T, SL-C, SL-A) and assign an SL-T to a zone with written rationale.
4. Compare the four frameworks across scope, unit of analysis, certification pathway, and classroom usability using a structured comparison.
5. Evaluate which framework should serve as the spine of a specific course, given a program's constraints, and defend the choice.
6. Design a one-page student-facing framework crosswalk that maps supporting standards onto your chosen spine.

The four documents exist because four different communities needed something. Understanding who wrote each one and for whom resolves most of the apparent conflict between them.

• IEC 62443 is a multi-part series developed through ISA99 and published jointly by ISA and the IEC. Its customer is the industrial automation and control system (IACS) community: asset owners, system integrators, and product suppliers. Its unit of analysis is the system under consideration (SUC) — a defined piece of a plant — broken into zones and conduits.
• NIST SP 800-82 is a U.S. federal special publication, now in Revision 3 (2023), titled Guide to Operational Technology (OT) Security. Its customer is anyone who has to apply general-purpose security controls (NIST SP 800-53) to OT without breaking the process. Its unit of analysis is the control overlay: which of the general controls apply, how they must be tailored, and what to do when they cannot be applied.
• NIST CSF, now at version 2.0 (2024), is not a control catalog at all. It is an outcome-based common language organized into six Functions: Govern, Identify, Protect, Detect, Respond, Recover. Its customer is leadership and cross-organizational communication. Its unit of analysis is the outcome ("Assets are managed consistently with their criticality"), deliberately silent on how you achieve it.
• ISO/IEC 27001 is a certifiable international standard for an Information Security Management System (ISMS). Its customer is an organization that must demonstrate governance discipline to auditors, insurers, or trading partners. Its unit of analysis is the management system: scope, risk process, Statement of Applicability, internal audit, management review.

A zone is a grouping of logical or physical assets that share common security requirements. A conduit is the controlled communication path between zones — and critically, a conduit is itself a special kind of zone whose only members are the communication assets. Partitioning happens in IEC 62443-3-2, which defines the risk assessment process; the technical requirements those zones then inherit live in IEC 62443-3-3 (system requirements) and IEC 62443-4-2 (component requirements).

Two rules drive nearly every partitioning decision students will make:

1. Group by shared risk, not by network topology. Two devices on the same VLAN may belong in different zones if their consequence of compromise differs sharply.
2. Separate assets performing safety functions. IEC 62443-3-2 requires that safety-related assets be placed in a zone separate from non-safety assets. A safety instrumented system does not share a zone with basic process control just because they sit in the same cabinet.

Worked example — Meridian Water District, Pump Station 4

A fictional municipal water utility operates a pump station with the following assets. Read it the way an assessor would: consequence first, wiring second.

A defensible partition looks like this. Note that SIS-401 gets its own zone even though it lives in the same building, and that the vendor's cellular RTU is not allowed to be "just another device on the control LAN":

A Security Level in IEC 62443 is not a maturity score for an organization. It is a statement about the capability of an adversary that a zone or component is expected to withstand, expressed on a 0-to-4 scale and evaluated against seven foundational requirements (FR 1 through FR 7): identification and authentication control, use control, system integrity, data confidentiality, restricted data flow, timely response to events, and resource availability.

The three flavours students confuse

Each card is a button: press Enter or Space to flip it. All four definitions also print in full.

Worked example — reading an SL gap

Back at Pump Station 4, the assessment team sets SL-T 3 for the Control Zone. They then inventory what is actually installed:

• PLC-401 ships with SL-C 2 for FR 1 (identification and authentication control) — it supports a single shared engineering password, not per-user accounts.
• The VFDs accept unauthenticated Modbus/TCP writes to their speed-reference registers. Modbus/TCP has no authentication in the protocol at all, so FR 1 capability at the component level is effectively SL-C 0.
• The zone therefore achieves roughly SL-A 1 for FR 1 against a target of SL 3.

The gap is not closed by buying a firewall and declaring victory. Realistic compensating measures, in the order an engineer would consider them, are: move VFD control behind the PLC so no supervisory device writes Modbus registers directly; enforce per-user authentication at the conduit through a brokered jump host; and add monitoring that alarms on any Modbus write function code (function 6 or 16) originating outside the Control Zone. Documenting the residual gap is itself a valid outcome — 62443 expects an assessment record, not a perfect score.

NIST SP 800-82 Revision 3

Revision 3 broadened the title from "Industrial Control Systems" to "Operational Technology," reflecting that building automation, physical access control, and transportation systems face the same problem as a refinery. Its most classroom-useful contribution is the OT overlay: for each control family in NIST SP 800-53, it states whether the control applies to OT, how it must be tailored, and what compensating control to use when the standard approach would endanger the process.

Worked example. Corporate policy mandates automatic screen lock after 10 minutes of inactivity. Applied literally to HMI-401 at Pump Station 4, an operator watching a developing over-pressure condition loses the screen at the worst moment. The SP 800-82 tailoring pattern is: keep the control's intent (prevent unauthorized use of an unattended console), change the implementation (physical access control to the operator room, session lock on the engineering workstation but not the alarm display, and camera coverage), and document the deviation with its rationale. Students should learn the phrase "the control's intent survives; the implementation is negotiable."

NIST CSF 2.0

CSF 2.0's headline change is the addition of GOVERN as a sixth Function, sitting alongside Identify, Protect, Detect, Respond, and Recover. Govern covers organizational context, risk management strategy, roles and responsibilities, policy, oversight, and — newly prominent — cybersecurity supply chain risk management.

For an OT course, CSF's value is communicative rather than technical. A plant manager who will never read IEC 62443-3-3 will happily discuss whether the site is weak on DETECT. Use CSF as the reporting surface and 62443 as the engineering underneath.

ISO/IEC 27001 specifies requirements for establishing, implementing, maintaining, and continually improving an Information Security Management System. Its numbered clauses (context, leadership, planning, support, operation, performance evaluation, improvement) are the certifiable part; Annex A lists reference controls, organized in the 2022 edition into four themes — organizational, people, physical, and technological. Detailed implementation guidance lives in the companion standard ISO/IEC 27002.

Worked example — the scope statement trap. Meridian Water District's certificate reads "the ISMS covering corporate IT services delivered from the administration building." That scope excludes every pump station. A student who sees the certificate on the wall and concludes the SCADA network is covered has made exactly the mistake this lesson exists to prevent. Teach students to read the Statement of Applicability and the scope statement before they read anything else.

Where they genuinely overlap

All four require you to know what you own, assess risk against consequence, apply proportionate controls, monitor, and improve. Roughly 70–80 percent of the activity is common; what differs is the vocabulary and the depth of engineering specificity. This is why teaching four at once is wasteful — you repeat the same activity four times in four dialects.

Where they genuinely differ

• Only IEC 62443 gives you a repeatable method for partitioning a plant and expressing required adversary resistance per zone.
• Only SP 800-82 systematically addresses what to do when a standard IT control would harm the process.
• Only CSF 2.0 is designed to be readable by someone with no security background, which makes it the right artifact for a board slide.
• Only ISO/IEC 27001 produces an auditable certificate, which is why procurement departments ask for it.

⚠ Simulation only — no live equipment, no network traffic, no real plant data.

This planner models the fictional Northline Bottling Plant, Line 2. Assign every asset to a zone, then choose Evaluate my partition. The tool derives the conduits your design implies and checks it against four IEC 62443-3-2 partitioning principles. It is deliberately opinionated: there is more than one defensible answer, and the findings are prompts for discussion, not a grade.

A spine is the framework whose vocabulary and structure organize your syllabus. Everything else becomes a supporting reference introduced when it is needed. One spine, cited consistently, beats four surveyed.

Decision procedure

1. Name the graduate. What job title is the student walking into? A controls technician, an OT analyst in a SOC, or a compliance coordinator? The job decides the dialect.
2. Check the constraints. Can students access the documents? IEC 62443 parts are paid; SP 800-82 and CSF are free downloads. This constraint is real and it shapes what you can assign.
3. Check the downstream credential. If your program feeds into a certification pathway or an articulation agreement, align to whatever that pathway uses.
4. Pick the spine, then demote the rest to references and write that decision into the syllabus so it survives adjunct turnover.

Standards and framework pages

Downloadable documents

• 📄 Download: NIST SP 800-82 Rev. 3 — Guide to Operational Technology (OT) Security. Assign the OT overlay section, not the whole document.
• 📄 Download: NIST CSF 2.0 — the framework core, including the GOVERN Function.
• 📄 Download: ISAGCA Quick Start Guide — a short orientation to the 62443 series, useful when the full parts are behind a paywall.