Standards and regulations
OT cybersecurity standards: United States
US requirements combine voluntary NIST frameworks with mandatory sector rules for electricity, pipelines, water and the defense supply chain.
Key standards and regulations
| Standard | Who it applies to | What it covers | OTVista modules |
|---|---|---|---|
| NIST CSF 2.0Cybersecurity FrameworkFramework | Any organization | Six functions (Govern, Identify, Protect, Detect, Respond, Recover) used as a common language for cyber programs. | Standards & ComplianceDashboards & ReportingGovernance & Policy |
| NIST SP 800-82 Rev. 3Guide to Operational Technology SecurityGuidance | OT operators | Detailed OT security guidance, including an OT overlay of NIST SP 800-53 controls. | Zones & ConduitsStandards & Compliance |
| NERC CIPCritical Infrastructure Protection standardsMandatory standards | Bulk electric system entities in North America | Enforceable requirements covering asset categorization, access, change control, patching, incident response and supply chain. | Asset VisibilityIdentity & Access ReviewChange ManagementPatch & Firmware Management |
| TSA Security DirectivesPipeline and rail cybersecurityDirective | Designated pipeline and rail operators | Requirements for segmentation, access control, monitoring, patching and incident response plans. | Zones & ConduitsPatch & Firmware Management |
| AWIA 2018America's Water Infrastructure Act, section 2013Law | Community water systems | Risk and resilience assessments and emergency response plans, including cyber. | OT Risk ManagementGovernance & Policy |
| CISA CPGsCross-Sector Cybersecurity Performance GoalsGuidance | Critical infrastructure owners and operators | A prioritized baseline of practices with high risk-reduction value for IT and OT. | Standards & Compliance |
| DOE C2M2Cybersecurity Capability Maturity ModelMaturity model | Energy and other sectors | A maturity self-evaluation used widely by energy companies to plan program improvements. | Standards & ComplianceDashboards & Reporting |
| CMMC 2.0Cybersecurity Maturity Model CertificationCertification program | US defense industrial base suppliers | Being phased into Department of Defense contracts; relevant to manufacturers in the defense supply chain. | Evidence & Audit Trail |
Summaries are for orientation only and are not legal advice. Applicability depends on your sector, size and jurisdiction, and regulations change. Confirm obligations with the official texts and your legal or compliance advisers. OTVista does not certify compliance.
Other regions
International
ISA/IEC 62443, ISO/IEC 27001 & 27002, ISO/IEC 27019, IEC 62351, IEC 61511, ISO 31000
ViewEuropean Union
NIS2, CRA, NCCS, CER, Machinery Regulation, CLC/TS 50701
ViewUnited Kingdom
NIS Regulations 2018, Cyber Security and Resilience Bill, NCSC CAF, HSE OG86, Cyber Essentials
ViewMiddle East
NCA ECC-2:2024, NCA OTCC-1:2022, NCA CSCC, SACS-002, UAE IA Regulation, Dubai ISR, Qatar NIA
View
From the blog
Insights on United States requirements
-
Technology6 min
AI in OT security: where it helps and where it needs guardrails
AI can take the paperwork out of OT security, but control decisions must stay with engineers. A grounded look at useful applications and necessary guardrails.
Read the article -
Best practice5 min
Secure remote access for OT vendors: a 2026 baseline
Remote access remains one of the most common routes into OT. A clear, achievable baseline for vendor and engineering access in 2026.
Read the article
Preparing for NIST CSF 2.0 or another requirement?
We combine the OTVista Platform with compliance readiness services to get you audit-ready.