Frameworks
Secure operational technology with NIST SP 800-82
Applying IT security controls to operational technology without adapting them can stop a process instead of protecting it.
Tidal brings NIST SP 800-82 into your OT programme. Work from the OT overlay of the SP 800-53 controls, choose the baseline that fits each system, and keep evidence per control.
These companies run their compliance on Tidal Control
NIST SP 800-82 in depth
The OT overlay in SP 800-82 Revision 3 assigns controls to the low, moderate and high baselines, based on the impact a compromise of the system would have. A building management system and a safety instrumented system rarely belong in the same baseline.
Applying the high baseline everywhere is costly and can conflict with how OT has to run, while applying none leaves the critical systems exposed. Neither choice holds up when someone asks why.
In Tidal each OT system can be an asset with its own impact rating, so the baseline per system and the reasoning behind it are written down and the controls that follow from it are clear.
How Tidal helps you get certified
Hit the ground running
Start with our pre-built controls, policies, and risk assessment templates.
Our platform guides you through establishing your ISMS scope, identifying assets, and implementing right-sized controls that match your business needs.
Why Tidal Control
We understand your challenges because we've been there. Our team of GRC experts and security professionals built Tidal to solve the real problems compliance teams face every day.
Made in Europe
Built and hosted in Europe. Your compliance data stays in the EU for full control and peace of mind.
Continuous automation
Automated evidence collection from cloud providers and development tools working 24/7 for you.
Real security
Build secure systems that protect your business and satisfy auditors, not just check compliance boxes.
Go beyond NIST SP 800-82
Explore frameworks that complement OT security guidance.
IEC 62443
Want a certifiable OT standard? IEC 62443 sets zones, conduits and security levels for industrial automation and control systems.
NIST SP 800-53
Securing IT and OT together? SP 800-53 is the full control catalogue that the SP 800-82 overlay is built on.
NIST CSF
Reporting OT risk to the board? The NIST Cybersecurity Framework gives a common structure for IT and OT outcomes.
NIS2
Operating critical infrastructure in the EU? NIS2 sets the duty of care for the OT you run.
Integrate with your existing tools
Testimonials
What our customers say
With a single click, one Tidal test checks dozens of disks for encryption. Doing that manually would take a lot of time.
Frequently asked questions
NIST Special Publication 800-82 Revision 3, the Guide to Operational Technology Security, was published by the US National Institute of Standards and Technology in September 2023. It covers how to secure OT such as industrial control systems, building automation, and physical access and monitoring systems, while taking their performance, reliability and safety requirements into account.
Appendix F of SP 800-82 Revision 3 is an overlay of the SP 800-53 Revision 5 controls: it says which controls apply to OT at the low, moderate and high baselines and adds OT-specific guidance to them. Tidal holds the 234 controls of that overlay, across all 19 control families from access control to supply chain risk management.
SP 800-82 is guidance, not a law or a certification. US federal agencies use it for the OT they operate, and organisations in other countries use it as a reference for securing OT, often next to IEC 62443. It is useful wherever a regulator or customer asks how you secure industrial systems without naming a specific standard.
SP 800-53 is the catalogue of security and privacy controls for information systems. SP 800-82 tailors that catalogue to OT: it keeps the control identifiers and adds guidance on how to apply each control without disrupting the process. If you already work with SP 800-53 in Tidal, the evidence for shared controls carries over.
IEC 62443 is a certifiable standard built around zones, conduits and security levels. SP 800-82 is a guide built around the SP 800-53 control families. Many organisations use IEC 62443 for system design and certification and SP 800-82 for the organisation-wide controls around it. Tidal lets you run both and map them onto each other.
Tidal does not connect to industrial control systems themselves. It connects to your IT systems, identity providers and cloud platforms, and holds the evidence for OT controls as documents, tasks and test results you link to each control.