OT Security Standards Compared: Choosing and Combining IEC 62443, 800-82, CIP, CAF and 27019

Most industrial operators are told to follow more than one OT security standard at once, and the standards were never written to be read together. IEC 62443 is a role-based engineering series, NIST SP 800-82 is guidance built on the NIST risk and control catalogue, NERC CIP is an enforceable regulation for the North American bulk electric system, the NCSC Cyber Assessment Framework is an outcome-based assessment model used by UK regulators, and ISO/IEC 27019 is a sector control set that sits inside an ISO/IEC 27001 management system. This guide compares the five on what each one actually obliges, who it binds, how it is assessed, where it fails in practice and how to combine them into one programme with one evidence base. It is for OT security leads, compliance managers, control engineers and the IT teams that support them in energy, water, manufacturing and other industrial sectors.

Key takeaways

• They answer different questions. 62443 tells you how to engineer and buy secure systems, 800-82 how to apply a risk framework and control catalogue to OT, CIP what a utility must prove to an auditor, the CAF whether an essential function is resilient, and 27019 which controls an energy ISMS should select.
• Only one of the five is a law in itself. NERC CIP standards are mandatory and enforceable for registered entities; the CAF and 27019 become binding only where a regulator adopts them, and 62443 and 800-82 are voluntary unless a contract or regulator calls them up.
• Pick an engineering spine and map the rest to it. Most mature programmes use 62443 zones, conduits and security levels as the design method, then map that evidence to CIP requirements, CAF outcomes or a 27019 Statement of Applicability.
• Identity and remote access are common to all five. Interactive remote access, shared engineering accounts and vendor sessions appear in every framework, so one well-run access control design satisfies a large share of each.
• Scope and asset inventory decide the cost. CIP impact categorisation, 62443 system under consideration, CAF essential function and 27019 ISMS scope all start from the same question: which cyber assets can affect the physical process.

The five frameworks at a glance

The table is the short answer; each framework has a deep guide. See the IEC 62443 Guide, the NIST SP 800-82 OT Security Guide, the NERC CIP Guide, the NCSC Cyber Assessment Framework (CAF) Guide and the ISO/IEC 27019 Energy Utility Controls Guide.

IEC 62443: the engineering series

What it is: ISA publishes the series and states that in 2021 the IEC recognised it as a horizontal standard applicable across industries. The documents are organised by audience: asset owners use Part 2-1 (security programme requirements) and Part 3-2 (risk assessment for system design); service providers use Part 2-4; system integrators use Part 3-3 (system security requirements and security levels); product suppliers use Part 4-1 (secure product development lifecycle) and Part 4-2 (technical requirements for components).

Threat model: 62443 frames the threat through security levels, from protection against casual or coincidental violation up to intentional attack by actors with extended resources. The risk assessment in 3-2 partitions the system into zones and conduits and assigns a target security level (SL-T) to each, compared with the capability of products (SL-C) and the level actually achieved (SL-A). Requirements are grouped under seven foundational requirements, starting with identification and authentication control and use control. See the IEC 62443-3-2 OT Risk Assessment Guide.

Where it fails in practice: organisations claim "62443 compliance" without naming the part or role, buy certified components and assume the system is secure, or draw a zone diagram once and never update it after change. Brownfield gaps against SL-T need documented compensating countermeasures.

Best fit: new plants, major upgrades and procurement, where owner, integrator and supplier need shared, testable requirements.

NIST SP 800-82r3: the risk and control guide

What it is: NIST published SP 800-82 Revision 3, Guide to Operational Technology (OT) Security, in September 2023, superseding Revision 2 from 2015. It widens scope from industrial control systems to OT generally, including building automation and physical access control. NIST's publication page notes an initial public draft of Revision 4 with comments due 30 November 2026, so expect changes; Revision 3 remains the final version as of this guide.

Structure: chapters cover OT cybersecurity programme development (Section 3), risk management for OT including applying the Risk Management Framework steps Prepare, Categorize, Select, Implement, Assess, Authorize and Monitor (Section 4), OT cybersecurity architecture (Section 5) and applying the Cybersecurity Framework to OT (Section 6). Appendix F is an OT overlay that tailors SP 800-53 Rev. 5 control baselines for low, moderate and high impact OT systems.

Threat model: broad and descriptive. Appendix C catalogues threat sources, vulnerabilities and incidents rather than setting a defined adversary capability. The organisation decides how strong a control must be.

Where it fails in practice: teams apply the full SP 800-53 moderate baseline to controllers that cannot support it, or treat 800-82 as a reading list with no tracked control decisions.

Best fit: organisations already running NIST CSF or SP 800-53 in IT, US federal facilities, and anyone needing an explainer that links OT architecture to a familiar control catalogue.

NERC CIP: the enforceable regime

What it is: a family of mandatory reliability standards for the bulk electric system. CIP-002-5.1a categorises BES Cyber Systems as high, medium or low impact using bright-line criteria (for example generation of 1500 MW or more at a single plant for medium impact), and requires the CIP Senior Manager or delegate to review and approve the identifications at least once every 15 calendar months. A BES Cyber Asset is one whose loss, degradation or misuse would adversely affect reliable operation within 15 minutes.

Representative requirements: CIP-005-7 requires an Electronic Security Perimeter with identified Electronic Access Points that deny all other access by default, and, where technically feasible, an Intermediate System, encryption and multi-factor authentication for all Interactive Remote Access, plus methods to determine and disable active vendor remote access sessions (Parts 2.4 and 2.5). CIP-015-1, adopted by the NERC Board in May 2024 and approved by FERC on 26 June 2025, requires internal network security monitoring inside the ESP for high impact and medium impact systems with External Routable Connectivity, with data feeds chosen on a documented risk rationale, anomaly detection and evaluation, and protection of the monitoring data. Its effective date follows its implementation plan. Supply chain risk management sits in CIP-013; see the NERC CIP-013 guide.

Threat model: implicit and reliability-led: anything that could stop or misoperate the grid within minutes.

Where it fails in practice: evidence produced in a pre-audit scramble, low impact sites treated as out of scope when they still carry obligations, and vendor sessions that cannot be seen or cut off quickly. CIP is a floor, not a security strategy.

Best fit: mandatory for in-scope registered entities; useful elsewhere as a model of auditable, evidence-first OT control.

NCSC CAF: the outcome assessment

What it is: the NCSC Cyber Assessment Framework describes outcomes rather than prescribing technologies, and assessments rely on evidence and expert judgement. Version 4.0 has four objectives (A Managing security risk, B Protecting against cyber attack, C Detecting cyber security events, D Minimising the impact of cyber security incidents), 14 principles and 41 contributing outcomes, each rated Achieved, Partially achieved or Not achieved against indicators of good practice. Profiles, set by NCSC or a sector regulator, define the minimum achievement expected.

OT relevance: the CAF is not OT-specific, but it was built for essential services such as energy and water, and its indicators reach into OT directly. For example, assessing systems in isolation without considering interactions between IT and OT environments is listed as a Not achieved indicator under A2.a, and principle B2 Identity and Access Control covers privileged and remote access to operational systems.

Threat model: profile-driven. NCSC describes its baseline profile as aimed at moderately sophisticated adversaries, and regulators raise the bar where the threat warrants.

Where it fails in practice: self-assessments that claim Achieved without evidence, OT left out because the assessment was run by IT.

Best fit: UK operators of essential services, UK government critical systems and suppliers to them; also a strong board-level resilience lens for anyone.

ISO/IEC 27019: the energy ISMS control set

What it is: sector guidance that extends the ISO/IEC 27002 control set for energy utility process control systems: control systems and field devices, telecontrol communications, metering, protection and safety systems and remote maintenance. You do not certify to 27019 alone; you certify an ISMS to ISO/IEC 27001 and use 27019 to select and implement controls, recorded in the Statement of Applicability. The second edition (2024) aligns with ISO/IEC 27002:2022. The German Bundesnetzagentur bases its IT security catalogues on ISO/IEC 27001, 27002 and 27019 and states that mandatory use of the updated catalogues begins in October 2026.

Threat model: the ISO/IEC 27001 risk process: the organisation identifies risks and selects controls. There is no fixed adversary model, so quality depends on the risk assessment.

Where it fails in practice: ISMS scopes drawn around offices with control systems excluded, Statements of Applicability still citing the old 2017 structure, and certification audits that sample IT controls and never visit a substation or control room.

Best fit: energy utilities that already run an ISO/IEC 27001 ISMS, and any operator in a jurisdiction that mandates it.

Head-to-head: how they treat the same problems

Where identity fits

Machine identities are where OT programmes are weakest: historians and HMIs run on service accounts and shared logins, and vendor accounts outlive the contract. 62443 puts identification and authentication first among its foundational requirements, CIP-005 demands MFA for interactive remote access and the ability to cut vendor sessions, and CAF B2 explicitly includes privileged and remote access. A single design that inventories every human and non-human account touching OT, removes shared credentials where devices allow it, brokers vendor access through one Intermediate System and records each session will produce evidence for all five at once. The Colonial Pipeline ransomware attack began with a dormant VPN account with no MFA,, and the pipeline was shut down as a precaution although attackers did not touch pipeline controls. See the OT and ICS Identity and Access Guide and the OT Remote Access Guide.

Decision guidance: which to lead with

• North American electric utility: CIP is the obligation; lead with it for scope and evidence. Use 62443 zones and conduits to design the ESP well, and 800-82 for assets outside CIP scope.
• UK operator of essential services: the CAF profile set by your competent authority is the target. Use 62443 or 800-82 to decide how to meet B2, B4 and B5 in OT, because the CAF tells you the outcome, not the engineering.
• EU or German energy utility: 27001 with 27019 where the regulator requires it, plus the NIS2 national law that applies to you (see the NIS2 Directive Guide). Add 62443 for plant design and supplier requirements.
• Manufacturer, water or building operator with no sector mandate: 62443 or 800-82 depending on your IT baseline. 800-82 keeps one NIST control language; 62443 gives contractual leverage when you buy and integrate many systems.
• Product supplier or integrator: 62443-4-1, 4-2 and 2-4 are what customers ask for, and certification is the main proof. See the ISA/IEC 62443 Certification Guide.

Small versus large: a single-site operator can run 800-82 or a 62443-2-1 programme with a short risk register; a multi-site utility needs a crosswalk, an owner per framework and one evidence repository.

Worked scenario: one utility, three frameworks

A generation company runs plants in the United States and the United Kingdom and holds an ISO/IEC 27001 certificate for corporate IT. Its US plants include medium impact BES Cyber Systems; its UK plants are operators of essential services assessed against a CAF profile.

1. One asset inventory: it builds a single OT asset register with fields for CIP impact rating, CAF essential function and 62443 zone, so each asset is categorised once and reported many ways.
2. One design method: it uses 62443-3-2 to define zones and conduits at every plant. In the US the ESP boundary follows the zone boundary for medium impact systems.
3. One access pattern: all remote access, staff and vendor, goes through a brokered Intermediate System with MFA and session recording. This meets CIP-005 R2, is evidence for CAF B2 and implements the remote maintenance controls in 27019.
4. One monitoring design: passive OT network monitoring inside each zone satisfies CIP-015 in the US and supplies evidence for CAF objective C in the UK.
5. Crosswalk and gaps: a crosswalk table maps each control to CIP requirement parts, CAF contributing outcomes and SoA entries. Gaps unique to one regime, such as CIP evidence retention, stay as local tasks.

Implementing a multi-framework OT programme

1. Confirm obligations first: list which frameworks are legally or contractually binding at each site and which are chosen. Record the version of each (CAF 4.0, 800-82r3, each CIP standard version) and set a review date.
2. Choose the spine: usually 62443 for design and supplier requirements, or 800-82 where the organisation lives in NIST language.
3. Inventory and categorise: one asset register, categorised under every applicable scheme. See the OT Asset Visibility Guide.
4. Build the crosswalk: map spine controls to each binding framework. Mark the requirements with no spine equivalent (CIP evidence formats, CAF profile targets).
5. Pilot at one site: run the crosswalk against a real assessment or mock audit before rolling out.
6. Roll out by risk: remote access and segmentation first, then monitoring, then supplier assurance.
7. Change control and rollback: every OT change goes through management of change with a tested rollback, so security improvements never become safety incidents. See the OT Management of Change for Cyber.

Detection and measurement

• Crosswalk coverage: percentage of binding requirements mapped to a spine control with named evidence.
• Remote access assurance: percentage of OT remote sessions through the broker with MFA and recording; target 100 per cent.
• Vendor session control: median time to see and disable an active vendor session, tested quarterly.
• Zone coverage: percentage of zones with current SL-T, documented conduits and monitoring feeds.
• Assessment honesty: number of CAF outcomes or CIP requirement parts where internal ratings were downgraded at external review; falling is good.
• Shared account reduction: count of shared or generic OT accounts remaining, by site.

Framework mapping

Mappings to enterprise reporting frameworks:

Common failure patterns

• Running each framework as a separate project: three inventories and auditors who find inconsistencies between them.
• Treating a certificate as coverage: a 27001 certificate whose scope excludes control systems, or certified 62443 components installed in an uncertified system design.
• Leaving IT-side identities out of OT scope: VPN, jump host and directory accounts that reach OT are part of the OT attack path, as the Colonial Pipeline case shows.
• Copying IT controls into OT unchanged: active scanning, forced patch cycles or account lockouts applied to controllers without the tailoring that 800-82 and 62443 call for.
• Version drift: crosswalks and Statements of Applicability that still reference superseded editions such as 800-82r2 or 27019:2017.

Practitioner checklist

• List every OT framework that is binding at each site and record its version and status date.
• Name one framework as the engineering spine and record why.
• Maintain one OT asset register with CIP, CAF and 62443 categorisation fields as applicable.
• Build and own a crosswalk from spine controls to each binding framework.
• Route all OT remote access, including vendors, through one brokered path with MFA and recording.
• Inventory shared, generic and service accounts in OT and set a removal plan.
• Deploy internal OT network monitoring with a documented feed rationale.
• Specify 62443-4-1 and 4-2 or equivalent requirements in OT procurement. See the OT Product Procurement Guide.
• Test vendor session disable and remote access revocation at least quarterly.

Standards and references

• ISA: ISA/IEC 62443 Series of Standards
• NIST: SP 800-82 Rev. 3, Guide to Operational Technology (OT) Security
• NERC: CIP-002-5.1a BES Cyber System Categorization
• NERC: CIP-005-7 Electronic Security Perimeter(s)
• NERC: CIP-015-1 Internal Network Security Monitoring
• NCSC: Cyber Assessment Framework
• NCSC: Cyber Assessment Framework 4.0
• Bundesnetzagentur: IT security in the energy sector

Related NHI Mgmt Group resources: IT Security vs OT Security, OT Network Segmentation, Purdue Model and IEC 62443 Zones and Conduits Guide, OT Security Maturity Model and Secure Development Frameworks Compared. This guide summarises OT security standards and regulations and is not legal advice.