NIST CSF Manufacturing Profile (IR 8183) Guide

Manufacturers that adopt the NIST Cybersecurity Framework quickly find that generic CSF outcomes say little about controllers, production lines, safety and integrators, which is the gap the CSF Manufacturing Profile, NIST IR 8183, was written to fill. The profile translates each CSF outcome into guidance for manufacturing systems, tied to five mission objectives and to Low, Moderate and High impact levels, so a plant can decide what "good" looks like for its own risk. NIST published a CSF 2.0 version, IR 8183 Rev. 2, as an initial public draft on 29 September 2025; Rev. 1 (October 2020, based on CSF 1.1) remains the final edition, so check NIST's page for status before you cite a version. This guide explains what the profile contains, how its impact levels work, what it asks of identity and non-human accounts, how to implement and evidence it, and how it lines up with IEC 62443, NIST SP 800-82 and ISO/IEC 27001. It is for OT security leads, plant and engineering managers, and the IT security and audit teams that support manufacturing sites. Status checked on 27 October 2026.

Key takeaways

It is a CSF Community Profile for manufacturing. Voluntary and risk-based, it supplements existing standards rather than replacing them, and Rev. 2 is aligned to CSF 2.0 including the Govern function.
Five mission objectives drive priorities. Environmental safety, human safety, production goals, product quality and sensitive information, deliberately not listed in priority order so each manufacturer ranks them.
Impact levels scale the guidance. Systems are categorised Low, Moderate or High using FIPS 199; Low is the baseline and Moderate and High add requirements for each subcategory.
Identity guidance is explicit at the higher levels. Rev. 2 calls for unique credentials bound to each user, device and process at High, MFA for remote access at High, and documented, authorised remote access types at Moderate.
Supply chain and integrators are first-class. GV.SC guidance asks third-party providers to report personnel changes, suppliers to disclose vulnerabilities and maintain bills of materials, and monitoring of provider activity under DE.CM-06.

What it is and who it applies to

NIST describes the profile as a voluntary, risk-based approach to managing cybersecurity activities and reducing cyber risk to manufacturing systems, intended to supplement, not replace, existing standards and industry guidelines. It applies to any manufacturer, discrete or process, of any size; there is no regulatory mandate attached to it. Its stated audience includes control engineers, integrators and architects, system, network and security administrators, physical security and OT operators and engineers, managers responsible for manufacturing systems, and senior management building the case for a programme.

Publication	Status (checked 27 October 2026)	Basis	Use it for
NIST IR 8183 Rev. 2, Cybersecurity Framework 2.0 Manufacturing Profile	Initial Public Draft, 29 September 2025; comment period closed (comments were due 17 November 2025)	CSF 2.0: 22 categories, 106 subcategories	Planning new programmes against CSF 2.0; expect changes in the final
NIST IR 8183 Rev. 1, Cybersecurity Framework Version 1.1 Manufacturing Profile	Final, October 2020	CSF 1.1: 23 categories, 108 subcategories	The current final reference; existing assessments and contracts
NIST IR 8183A Vols. 1 to 3, Low Impact Level Example Implementations Guide	Final, September 2019	CSF 1.1 profile	Proof-of-concept examples: Vol. 1 general guidance, Vol. 2 process-based, Vol. 3 discrete-based environments

Rev. 2 realigns guidance to CSF 2.0's six functions, adds Govern, and adds new guidance for the supply chain risk management, platform security and technology infrastructure resilience categories. For CSF 2.0 itself and how Community Profiles work, see the NIST CSF 2.0 Guide and the NIST CSF 2.0 Community Profiles Catalogue Guide.

Structure and key requirements

The Rev. 2 draft has five main sections: an introduction, an overview of manufacturing systems, an overview of the CSF functions, the profile development approach (mission objectives, categorisation and risk management) and the subcategory guidance, which is the bulk of the document.

Mission objectives

Mission objective	What it protects	Typical plant question
Maintain Environmental Safety	The environment, from accidental and deliberate damage	Could a cyber event cause a release or discharge?
Maintain Human Safety	Workers and the public	Which systems can move machinery or bypass safety functions?
Maintain Production Goals	Output and assets	How long can we tolerate a line or site outage?
Maintain Quality of Product	Process and data integrity	Could recipe or parameter tampering ship bad product?
Maintain Sensitive Information	Intellectual property, designs, business data	Where do drawings, recipes and customer data live?

GV.OC-01 ties these together: prioritise cyber risk by the organisation's mission objectives.

Impact levels

Section 4.2 defines Low, Moderate and High impact levels based on FIPS 199, each tied to the potential adverse effect of a loss of integrity, availability or confidentiality. The draft's example tables use outage scope, national infrastructure impact, cost as a percentage of revenue, legal exposure, public confidence, product type and industry to help categorise. Section 5 then gives guidance for each subcategory at Low, with Moderate and High adding requirements. See the NIST SP 800-53 Privacy Controls and FIPS 199/200 Categorisation Guide for the categorisation method.

Examples of how guidance scales

Subcategory	Low	Moderate	High
ID.AM-01 hardware inventory	Component inventory	Adds named owners and change detection	Automation where safe and feasible
ID.RA-01 vulnerabilities	Vulnerability scanning, with caution over active scanning traffic	As Low	Adds penetration testing, often in planned outages
PR.PS-01 configuration	Baseline configuration	Periodic checks for unauthorised changes	Automated change management
PR.PS-02 software maintenance	Routine and emergency vulnerability mitigation	Managed remote maintenance platform, access restricted to assets being serviced	As Moderate
PR.IR-01 network protection	Segmentation and boundary devices such as data diodes	Deny-all, permit-by-exception traffic policy	Adds physical access controls for critical components
PR.IR-03 resilience	No Low guidance given	Find and mitigate single points of failure	High-availability components such as redundant controllers
PR.DS-11 backups	Protect and test backups, including control setpoints	Geographically separate backup site	Restoration testing; critical backups stored offline and offsite
DE.CM-01 network monitoring	Monitor boundary deviations	Continuous monitoring with alerts	Tools that analyse industrial protocols
DE.AE-03 correlation	Aggregate logs, including from critical OT devices	Event correlation	SIEM, SOAR or XDR tooling
RS.MA-01 incident response	Designated incident lead; coordination with integrators and vendors	Adds automated coordination tools	As Moderate

Supply chain guidance applies at every level: a C-SCRM programme for manufacturing systems agreed by IT, operations, legal, HR and engineering (GV.SC-01); third-party providers notifying personnel changes (GV.SC-02); suppliers ranked by criticality (GV.SC-04); suppliers disclosing security features and known vulnerabilities and current software and hardware bills of materials for critical components (GV.SC-05); and a documented risk assessment for each critical supplier before acquisition (ID.RA-10).

Identity and NHI requirements

The PR.AA category is where the profile meets identity, and it reaches machines and processes as well as people. PR.AA-01 covers credentials for "authorized users, services, and hardware". The Rev. 2 draft guidance includes:

Level	Guidance in the Rev. 2 draft	What it means in a plant
Low	Enforce password strength and MFA policies; identify actions that can be performed without authentication, such as emergency stop	Document which HMI actions must stay unauthenticated for safety, so nobody adds a login to an E-stop
Moderate	Disable credentials after inactivity where safe and feasible; minimise privileged users; establish and document usage restrictions and configuration requirements for each type of remote access and authorise each type before connection (PR.AA-05)	Dormant vendor and integrator accounts disabled; an approved list of remote access methods; fewer engineering admins
High	Unique credentials bound to each user, device and process (PR.AA-02); MFA for remote access (PR.AA-03); restrict and manage privileged non-local access (PR.AA-05)	No shared operator or engineering logins; unique service and device identities; brokered, MFA-protected remote sessions

The draft does not address shared accounts or service accounts by those names, but "unique credentials bound to each user, device and process" at High is a clear signal. In practice, manufacturing NHIs include historian and MES service accounts, OPC UA client certificates, PLC programming passwords, robot controller accounts, vendor remote access tokens and API keys used by cloud analytics. Inventory them under ID.AM, give each an owner, and manage them under PR.AA. See the Manufacturing Identity and OT Access Guide and the Service Account Security Guide.

Implementation steps

Choose the edition: use Rev. 1 where contracts or prior assessments reference CSF 1.1; plan new work on the Rev. 2 structure and record that it is a draft.
Rank the mission objectives: with operations, engineering, EHS and quality, rank the five objectives for each site or line. A pharmaceutical plant may put quality first; a chemical plant human and environmental safety.
Categorise systems: assign Low, Moderate or High to each manufacturing system or zone using FIPS 199 and the profile's example criteria. Most organisations have a mix.
Build a Current Profile: assess each subcategory at the target level for that system, with evidence. Start with ID.AM, because nothing else can be scoped without an inventory; see the OT Asset Visibility Guide.
Set the Target Profile: the guidance for the system's impact level, adjusted for the ranked mission objectives and risk tolerance (GV.RM).
Plan the gaps: prioritise by mission objective and consequence, not by subcategory count. Remote access, segmentation, backups and inventory usually come first.
Test changes safely: pilot on one line or in a maintenance window, use passive methods before active scanning (the profile itself urges caution with active scanning), and keep rollback configurations; see the Safe Active Scanning and Testing in OT Guide.
Repeat: reassess at least annually and after major changes; use the CSF tiers to describe programme maturity. See the NIST CSF 2.0 Profiles and Tiers Guide.

Small and large manufacturers

Small manufacturers: treat everything as Low first and do it well: inventory, baseline configurations, segmentation with a boundary device, tested backups including setpoints, password and MFA policy, and an incident lead who knows which integrator to call. NIST IR 8183A gives worked Low examples with open-source and commercial tools.
Large or multi-site manufacturers: categorise per site and line, run a central Target Profile with local Current Profiles, and use the Moderate and High identity and monitoring guidance for critical lines.

Evidence and assessment

The profile is not a certification scheme, so evidence is whatever convinces your board, customers and auditors that each subcategory meets its target. Useful evidence by area:

Area	Evidence that holds up
ID.AM inventory and data flows	Asset inventory export with owners; approved data flow diagrams including maintenance providers
PR.AA identity	Account lists per system with owners and last use; remote access register with approved types; MFA configuration screenshots
PR.PS configuration	Baselines and change detection reports reconciled to MOC records
PR.IR segmentation	Firewall rule sets showing deny-all, permit-by-exception at Moderate; zone drawings
PR.DS-11 backups	Restore test records, including controller logic and setpoints, and offline copy locations at High
DE.CM and DE.AE monitoring	Monitoring coverage maps, alert samples, log source list including OT devices
GV.SC supply chain	Supplier criticality list, contract clauses, SBOMs or HBOMs for critical components
RS.MA response	Incident plan naming integrators and vendors; exercise reports

Metrics: percentage of systems categorised; subcategories meeting target per impact level; remote access types documented and authorised; accounts without owners on manufacturing systems; backup restore tests passed; critical suppliers assessed before acquisition.

Mapping to other frameworks

The Rev. 2 draft takes its subcategory statements from NIST SP 800-53 Rev. 5 and draws on NIST SP 800-82 Rev. 3 and ISA/IEC 62443. A practical crosswalk:

Profile area	NIST SP 800-53 Rev. 5	Related OT and ISO references
PR.AA identity and remote access	AC-2, AC-17, IA-2, IA-3, IA-5	IEC 62443-3-3 identification and authentication requirements; ISO/IEC 27001:2022 Annex A 5.16, 5.17, 8.5
PR.PS-02 remote maintenance	MA-4, SI-2	IEC 62443-2-4 service provider requirements
PR.IR-01 segmentation	SC-7	IEC 62443-3-2 zones and conduits; ISO/IEC 27001 Annex A 8.22
ID.RA risk assessment	RA-3, RA-5	IEC 62443-3-2; NIST SP 800-82 Rev. 3
PR.DS-11 backups	CP-9	ISO/IEC 27001 Annex A 8.13
GV.SC supply chain	SR-3, SR-6	IEC 62443-2-4; ISO/IEC 27001 Annex A 5.19 to 5.22

For the informative reference mechanism behind these mappings, see the NIST CSF 2.0 Informative References and OLIR Guide; for CSF to ISO, the NIST CSF to ISO 27001 Mapping Guide; for OT controls, the NIST SP 800-82 OT Security Guide and the IEC 62443 Guide.

Common pitfalls

Citing the draft as final: Rev. 2 is an initial public draft; say so in policies and contracts, and plan to re-baseline when the final appears.
One impact level for the whole company: a single High rating makes every line unaffordable; a single Low rating under-protects safety-critical processes.
IT scoring OT: assessments done without engineering and operations miss what matters, and recommendations break production.
Adding authentication where safety needs none: the profile explicitly asks you to identify actions such as emergency stop that must be possible without authentication.
Ignoring integrators: remote maintenance platforms, provider monitoring (DE.CM-06) and personnel change notices (GV.SC-02) are where many plants have no evidence.
Backups without setpoints: the profile's Low guidance includes control setpoints; restoring servers without controller logic and parameters does not restore production. See the OT Backup, Recovery and Golden Image Guide.

Practitioner checklist

Confirm which edition you are using (Rev. 1 final or Rev. 2 draft) and record the date checked.
Rank the five mission objectives per site with operations, engineering, EHS and quality.
Categorise each manufacturing system or zone as Low, Moderate or High using FIPS 199.
Build a Current Profile per system with evidence, starting with ID.AM inventory and data flows.
Give every user, device and process its own credential on High systems and remove shared logins.
Document and authorise each remote access type and require MFA for remote access on High systems.
Apply deny-all, permit-by-exception at Moderate zone boundaries.
Test restores including controller logic and setpoints, and keep offline copies for High systems.
Rank suppliers by criticality and require vulnerability disclosure and bills of materials for critical components.
Reassess annually and when the final Rev. 2 is published.

NIST CSF Manufacturing Profile Guide: Applying NIST IR 8183 to plants by impact level