Guidance for resilient networks, Wi-Fi, firewalls, cabling, power, exposure reduction, and connected-device planning.
Guidance for resilient networks, Wi-Fi, firewalls, cabling, power, exposure reduction, and connected-device planning.
NIST explicitly includes physical access-control systems in OT and frames their security around mapped data flows, segmentation, controlled remote access, and availability.
Read the guideNIST SP 1339 treats OT recovery as more than copying configuration files: tools, licenses, compatible spares, documentation, integrity, and restore tests all matter.
Read the checklistProfile G standardizes important recording and retrieval interfaces, but a resilient edge-recording design still needs capacity, outage, recovery, and evidence tests.
Read the guideProfile M standardizes analytics metadata and events between products. It does not certify analytic accuracy, lawful use, model quality, or every conditional feature.
Read the explainerONVIF is ending new v1.0 conformance submissions on March 31, 2027. Version 2.0 is scheduled, not yet a final conformance target, so plans need vendor evidence.
Read the briefingProfile D standardizes communication between access peripherals and a securely located client. It does not certify the complete door, credential, or life-safety design.
Read the guideAxis documents distinct certificate roles for HTTPS server identity and 802.1X network authentication. Each needs ownership, expiry monitoring, renewal, and recovery testing.
Read the guideONVIF will end Profile S support on March 31, 2027, but deployed systems do not simply stop on that date. Inventory authentication and codec dependencies before testing Profile T.
Read the briefingRemote monitoring and access tools need explicit authorization, strong identity controls, restricted paths, independent logging, provider accountability, and tested containment.
Read the checklistModern network-access guidance asks organizations to examine broad remote connectivity and compare risk-based, resource-level approaches without assuming every VPN requires replacement.
Read the guide