NIST SP 800-82

Industrial Control Systems (ICS/SCADA) security: asset inventory, patch management, supply chain.


Short name	SP 800-82
Region	Americas
Country or scope	United States
Sector	Energy
In your workspace	On unless you switch it off in Compliance › Manage.

How Safeguard covers SP 800-82

Scan requirements: 6, all decided by a scan.
Controls: the scan requirements below, plus 12 controls from Safeguard's control catalog for SP 800-82.
Automated tests: none map to it directly. You can link any automated test to its controls yourself (how).
Policy templates: 25: 3 written for SP 800-82 and 22 from the standard set.

How each kind of coverage works, and what the readiness score counts: Compliance frameworks.

What a scan checks

Each scan of a product checks these 6 requirements against what the scan found, including the product's software inventory (SBOM).

Requirement	What Safeguard checks	Decided by
`NIST82-CM-8` OT Asset and Software Inventory	OT operators must maintain a current inventory of hardware and software assets in the control environment, tailored from the CM-8 component inventory control (SP 800-82r3, OT overlay of SP 800-53 CM-8)	Scan
`NIST82-SI-2` OT Patch Management	A patch and flaw-remediation program for OT requires knowing the exact version of every software component so patch applicability can be assessed before scheduled maintenance windows (SP 800-82r3 patch management guidance, OT overlay of SI-2)	Scan
`NIST82-RA-5` OT Vulnerability Identification	Because active scanning is often unsafe on ICS networks, vulnerability identification relies on matching inventoried components against advisories, requiring standard identifiers on components (SP 800-82r3 vulnerability management guidance, OT overlay of RA-5)	Scan
`NIST82-SI-7` Control System Software Integrity	Integrity of software and firmware deployed to control systems must be verifiable, which requires integrity hashes for delivered components (SP 800-82r3, OT overlay of SI-7)	Scan
`NIST82-SR` OT Supply Chain Protection	OT supply chain risk management requires knowing the vendor/supplier of each software component in the control environment to evaluate supplier trustworthiness (SP 800-82r3, OT overlay of the SR family)	Scan
`NIST82-DOC` Documented System Baseline	OT security programs must document system baselines in a form usable for change detection and incident response, favoring a machine-readable inventory format (SP 800-82r3 asset management guidance)	Scan

More controls in the catalog

The framework's Controls tab lists its scan requirements and these controls from Safeguard's control catalog. Evidence them with automated tests, uploaded evidence, policies or an attestation.

Control	Name
`ICS-AC-1`	ICS Access Control Policy and Procedures
`ICS-SI-3`	Malicious Code Protection for ICS
`ICS-SC-7`	ICS Network Boundary Protection
`ICS-CM-6`	ICS Configuration Management
`ICS-IR-4`	ICS Incident Handling
`ICS-MA-4`	Secure Remote Maintenance of ICS
`ICS-PE-3`	Physical Access Control for ICS Facilities
`ICS-AU-2`	ICS Audit Event Logging
`ICS-RA-5`	ICS Vulnerability Scanning
`ICS-CP-9`	ICS Information System Backup
`ICS-SA-9`	External ICS Service Providers
`ICS-AT-3`	Role-Based ICS Security Training

Policy templates

Written for SP 800-82:

Industrial Control System Security Policy
OT/ICS Cyber Incident Response Policy
OT Network Architecture and Segmentation Policy

And 22 from the standard set, adapted to SP 800-82.