What do NIST's draft OT guide and CSF 2.0 references mean for asset inventory?

What is SP 800-82 Revision 4?

SP 800-82 is NIST's guide to operational technology security. On 21 September 2026 NIST released the initial public draft of Revision 4. According to NIST, it expands guidance on OT security controls, including asset management and network monitoring. Comments are open until 30 November 2026. As a draft, it can still change, and we have not reproduced its contents beyond NIST's own summary.

Why does it matter for asset inventory?

Because asset management sits at the start of most OT security work. You cannot segment a network, monitor it or plan compensating controls for unpatchable devices without knowing what is on it. Network monitoring, the other area NIST highlights, is also how many OT devices are discovered in the first place: passive discovery identifies devices from the traffic they send.

Several vendors on this site describe that kind of discovery. runZero describes passive discovery for OT alongside active scanning for IT. Armis describes agentless, passive discovery across IT, OT and IoT, with a separate medical device module. Lansweeper covers IT, OT, cloud and IoT with passive detection by default. ServiceNow covers OT inventory through its separate Operational Technology Management product.

What should OT teams do with the draft?

Read it with the people who run the plant, compare it with the inventory you keep today, and note where your current approach would fall short. If you have views on the draft, NIST's comment period is the place for them. Avoid buying against a draft; use it to shape questions for vendors and for your own programme.

What is SP 1347?

On 25 August 2026 NIST finalized SP 1347, a quick-start guide that explains how informative references map other standards and frameworks to the outcomes in the Cybersecurity Framework 2.0, with sample use cases. In plain terms, it helps organisations that already follow one standard show how their work lines up with CSF outcomes.

Why does it matter for asset inventory?

Because inventory evidence is reused across frameworks. An auditor working from one standard and a board asking about CSF outcomes often want the same underlying proof: a list of assets, an owner for each, and evidence of the controls on them. Mapping that once, with informative references, saves producing it several times. The finder's compliance question exists for this reason: periodic audits trigger the cross-source query check, and continuous evidence triggers queries and workflows.

How do the two connect?

An OT asset inventory built to the spirit of the SP 800-82 draft produces exactly the kind of evidence that informative references let you map to CSF outcomes. If your organisation reports on CSF 2.0 and runs OT, it is worth asking whether the OT inventory and the IT inventory feed the same evidence, or two separate ones that will be reconciled by hand at audit time. The finder's first question treats OT as one place assets live among several for this reason: most estates need one view across them.

What neither document does

Neither recommends a product or an approach by name. Neither says that one of the five approaches on this site is required. They describe outcomes and controls; the approach that gets you there depends on your estate.

What should you do this quarter?

• If you run OT, read the SP 800-82r4 draft before 30 November and compare its asset management guidance with your inventory.
• If you report against CSF 2.0, use SP 1347 to map the evidence you already produce for other standards.
• In either case, write down the coverage questions an auditor would ask, and check whether your inventory can answer them. Coverage gaps explains how.