NIST Draft SP 800-82r4 of 21 September 2026: What the Operational Technology Security Guide Asks on Post-Quantum Cryptography for Water, Rail and Ship Controllers
In January 2024 a district heating company in Ukraine lost control of part of its system in the middle of winter. According to the account NIST now includes in its own guidance, a Russia-linked group used malware known as FrostyGoop to send Modbus commands directly to the company's heating controllers, falsifying temperature measurements. More than 600 apartment buildings were left without heat in sub-zero temperatures for nearly two days. The controllers did what they were told, because nothing in the protocol they spoke let them check who was giving the orders. No quantum computer was involved, and post-quantum algorithms alone would not have stopped the attack.
That incident appears in the appendix of a document NIST released on 21 September 2026: the initial public draft of Special Publication 800-82 Revision 4, the Guide to Operational Technology (OT) Security. Most of the draft is about the problem FrostyGoop exposed, which is authentication and control in systems that move water, heat, trains and ships. One short passage looks further ahead, to the day when the cryptography now being added to those systems could itself be broken. It is the first time the OT guide has addressed quantum computing.
Practical takeaway. The draft SP 800-82r4 lists the absence of post-quantum planning as an architecture vulnerability in OT and recommends cryptographic agility as a procurement requirement for new systems. Because controllers stay in service for decades, the purchase decisions made in the next few years will largely determine which plants can change algorithms in place. Comments on the draft close on 30 November 2026.
What NIST published on 21 September 2026: the 321-page draft of SP 800-82 Revision 4
SP 800-82 is the federal reference text for securing industrial and physical-world systems. Revision 3 appeared in September 2023, replacing the 2015 edition. The new draft runs to 321 pages and is written by Keith Stouffer, Michael Pease and CheeYee Tang of NIST with six co-authors from MITRE. NIST's announcement lists the main changes. The scope now extends explicitly to building automation and control systems, water and wastewater, food and agriculture, freight rail, maritime vessels, and the convergence of industrial IoT with cloud services. The whole guide is reorganized around the Cybersecurity Framework 2.0, with risk management moved under the framework's Govern function and aligned with enterprise risk management as described in NIST IR 8286r1. A new Appendix F covers use of the Risk Management Framework, and a new architecture chapter applies zero trust principles.
The sector list matters because each of those industries buys equipment on long cycles. A pump controller at a water utility, a signalling unit on a freight line or a propulsion controller on a ship is typically specified once and then maintained for as long as it keeps working. Security guidance for these systems has always had to account for devices that cannot be rebooted at will, patched on a monthly schedule or replaced when a vulnerability is found.
What section 4.2.2.2.1 says about post-quantum cryptography in operational technology
The passage sits in the data security chapter, under the use of cryptography. It is one paragraph long. It states that a sufficiently capable quantum computer could make RSA and elliptic-curve cryptography vulnerable, and that OT faces "a particular challenge" in moving to post-quantum standards "since many OT devices have life cycles measured in decades and cannot be easily patched or replaced." It then asks organizations to begin assessing their cryptographic inventory now: identify the systems that rely on public-key cryptography, understand each vendor's roadmap for PQC support, and prioritize migration planning for the highest-risk systems.
A text search of Revision 3 finds no reference to quantum computing at all. NIST's general transition document, draft IR 8547 of November 2024, proposes deprecating quantum-vulnerable RSA and elliptic-curve schemes at the 112-bit security level after 2030 and disallowing them entirely after 2035. The OT guide does not repeat those dates and adds nothing to the algorithm choices. Its contribution is operational: in industrial settings, the replacement cycle of the hardware sets the pace of migration.
Why the draft makes procurement the migration point: Table 12 and cryptographic agility
The stronger language is in Appendix C. Table 12 lists architecture and design vulnerabilities, and the draft adds a row titled "Lack of post-quantum cryptography consideration in OT architecture." The row says quantum computing is expected to make widely used asymmetric algorithms obsolete, "posing a long-term risk to OT systems that cannot be updated or replaced," and recommends that organizations "consider cryptographic agility as a requirement when procuring new OT systems to ensure that cryptographic standards can be updated without requiring full hardware replacement."
That sentence moves the question from the security team to the purchasing department. Where a controller's cryptography is fixed in hardware or in firmware the vendor will not update, a later algorithm change can mean replacing the device, which in a water plant or on a locomotive involves planned downtime, requalification and capital budget. Whether a device can instead be migrated in place depends on several things a buyer can ask about in advance: spare processing and memory, protocols that can carry the new algorithms, an upgradeable chain of trust for signed updates, and a vendor willing to support it. Specifying and verifying cryptographic agility during procurement can reduce the risk of later hardware replacement, though feasibility and cost remain specific to each device. Medicine has the same problem: a post-quantum chip supplier has pointed to fifteen-to-twenty-year service lives for medical devices, and long-lived equipment of any kind pushes the cryptographic decision to the front of the life cycle.
The same table carries a second new row that points in a related direction. It flags AI systems integrated into OT, noting that prompt injection and compromised training data can lead models to miss unsafe conditions, and that the data pipelines AI needs can open new network paths into the plant. Both rows describe technologies that arrive through vendors and change the trust assumptions of a system designed years earlier.
Where the draft limits encryption: the "encryption exposure radius" and zero trust at Purdue Levels 3 to 5
The draft is careful about how far cryptography can reach in OT. It says encryption should be scoped deliberately "rather than treating it as uniformly deployable," because legacy devices may lack cryptographic capability, processing power or tolerance for added latency. It introduces the idea of an encryption exposure radius: identify the systems, data flows and storage locations whose exposure carries the highest risk, encrypt those first, and document where encryption is not feasible along with the compensating controls. It also warns that key management grows harder as a system spreads geographically, and suggests remote key management where site visits to change keys become too costly.
The zero trust chapter follows the same logic. Many PLCs, controllers and HMIs cannot support the protocols a full zero trust architecture needs, so the draft recommends applying it at the higher levels of the plant, Purdue model Levels 3, 4 and 5 and the OT DMZ, where servers and engineering workstations can carry it. For post-quantum planning this suggests one possible sequence, depending on each plant's architecture and risk: upper-level links such as remote access, historians and vendor connections could move first, while field devices at the bottom of the architecture keep their current cryptography, or none, until they are replaced.
How Quentir Reads It
The draft adds one paragraph and one table row on post-quantum cryptography, and together they carry a clear message for anyone who owns physical infrastructure. In OT, post-quantum migration becomes a capital planning question, because the hardware bought between now and the end of the decade will still be in service when NIST's proposed disallowance date arrives. Specifying field-updatable cryptography in a tender, and verifying it before acceptance, can reduce the risk of a later replacement program, although what that costs and whether it is feasible differ from one device to the next.
The civic stake is the one FrostyGoop made visible: heat, drinking water, rail freight and ships are the services people notice only when they stop. The draft also has limits worth naming. It sets no dates for OT, names no algorithms, and leaves open how an operator should verify a vendor's PQC roadmap. Those are fair subjects for the comment period, and the question Quentir expects operators to take to it is whether an equipment supplier's roadmap can be made a contractual commitment. Our earlier read of a federal agency's 50-year records schedule reached the same conclusion from the data side: the lifetime of what is protected decides how early the cryptography has to change.
Quentir's free posts, including the two linked here, follow this thread across standards, defense and medicine. The paid publications go further, and the All-access membership brings every paid publication, both Evidence Registers and the archive of published editions under one organization-wide license for a year. Comments on SP 800-82r4 are due to NIST by 30 November 2026.
Sources: NIST, SP 800-82r4 (Initial Public Draft), "Guide to Operational Technology (OT) Security" (K. Stouffer, M. Pease, C. Tang, A. Hahn, J. Gilsinn, D. Rebori-Carretero, O. Alexander, M. Fialk, Z. L. Silva; published 21 September 2026; comments due 30 November 2026; PDF), for Sec. 4.2.2.2 and 4.2.2.2.1 (cryptography, encryption exposure radius, key management, PQC considerations), Sec. 5.3 and 5.3.1 (zero trust, Purdue Levels 3-5), Appendix C Table 12 (post-quantum and AI vulnerability rows) and the FrostyGoop incident account; NIST CSRC, "Guide to Operational Technology (OT) Security: NIST Requests Comments on Draft SP 800-82r4" (21 September 2026), for the list of changes; NIST, SP 800-82 Rev. 3 (September 2023), for the prior revision; NIST, IR 8547, "Transition to Post-Quantum Cryptography Standards" (initial public draft, 12 November 2024), for the proposed deprecation after 2030 and disallowance after 2035 of quantum-vulnerable public-key schemes; Quentir Medicine Monitor, SEALSQ QS7001 and medical device lifetimes; Quentir, Peace Corps notice PC-38 (25 September 2026).
Published intelligence, built to inform your own decisions. Published: September 26, 2026.