Cryptographic device identity, secure boot and signed firmware built into field controllers and smart final-control elements themselves, not bolted on at the network layer.
Zero Trust architecture for OT networks
Industrial IT / OT / Critical Control Information Infrastructure
Over-Promise
Near-term · 2–5 yrs
Evidence E3 · First production use
Applying zero trust principles, verify every user, device and connection and grant only the access needed, to industrial control networks. CISA published dedicated OT guidance in April 2026; in practice most of what is sold as zero trust OT is good segmentation and remote-access control, which is worth having under any name.
What zero trust means
Traditional plant networks rely on a perimeter: a firewall between the business network and the control network, and broad trust for anything inside. Zero trust, as defined for IT in NIST SP 800-207 (2020), drops the idea of a trusted inside. Every request for access is authenticated and authorised on its own merits, access is limited to what is needed, and activity is monitored continuously.
Industrial networks are a hard place to apply that literally. Many controllers, drives and field devices cannot authenticate users or encrypt traffic, cannot be patched without an outage, and must keep running for decades. Adding a security check to a time-critical control path can itself cause an incident.
What the new OT guidance says
In April 2026, CISA, together with the US Departments of War, Energy and State and the FBI, published "Adapting Zero Trust Principles to Operational Technology" for OT owners and operators 12. Its recommendations are practical rather than radical: build comprehensive asset visibility, manage supply-chain risk, strengthen identity and access controls, and segment systems using zones and conduits, the model from the IEC 62443 series 12. It explicitly acknowledges legacy systems, operational constraints and safety requirements, and warns that security changes can affect physical processes and must account for availability 2.
Read that way, zero trust in OT is less a product category than a direction: shrink the areas of implicit trust step by step, starting where the risk is highest.
| Principle | IT form | Realistic OT form |
|---|---|---|
| Verify every user | Single sign-on and MFA for every application | MFA and named accounts for remote access and engineering workstations |
| Verify every device | Device certificates and health checks | Asset inventory; certificates on new devices; wrapping legacy devices |
| Least privilege | Per-application access policies | Zones and conduits; allow-listed protocols and commands between zones |
| Continuous monitoring | Endpoint and identity analytics | Passive OT network monitoring at conduits |
Where to start
- Remote access. Replace shared VPN accounts and always-on vendor connections with brokered, recorded, time-limited sessions that require multi-factor authentication. This addresses one of the most common real-world entry points.
- Engineering workstations. Treat them as the most privileged assets on the network, with named accounts, restricted software and controlled paths to controllers.
- Segmentation. Define zones by function and consequence, and restrict the conduits between them to the protocols and directions actually needed.
- Visibility. Passive monitoring at those conduits shows whether policy matches reality and detects the exceptions.
The limits
A legacy PLC that accepts any command on its port cannot verify anything. Zero trust then has to be applied around it, by restricting which devices can reach it and from where, not in it. Newer controllers and devices with secure identity and signed firmware will gradually allow trust decisions closer to the process, but the installed base will take decades to turn over.
There is also a labelling problem. "Zero trust" is attached to firewalls, remote-access products and monitoring tools alike. Buyers should ask which specific principle a product implements, for which assets, and how it behaves when its own components fail, because a security control that stops the plant when it loses contact with a cloud service is not acceptable in OT.
Evidence timeline
- Aug 2020NIST publishes SP 800-207, Zero Trust Architecture. 3
- Apr 2026CISA and federal partners publish "Adapting Zero Trust Principles to Operational Technology". 1
Why it sits at the Over-Promise stage
Supplier and analyst attention is high, and the label is applied broadly. Genuinely zero-trust OT deployments, as opposed to well-executed segmentation and remote-access control under a new name, are still a minority. That keeps the entry at the Over-Promise stage, with evidence level E3.
The new CISA guidance is likely to speed up practical adoption by giving owners a reference that reflects OT constraints. We expect the useful core, identity-based remote access, zones and conduits, and monitoring, to become routine within the near-term horizon, while the full model remains limited by legacy devices.
Adoption signals to watch
- Regulators and insurers referring to the CISA OT zero trust guidance in requirements.
- Controllers and field devices with built-in secure identity becoming standard in new projects.
- Published case studies with measured outcomes, such as reduced standing remote access or contained incidents.
Questions to ask before committing
- Which zero trust principle does this product implement, and for which of our assets?
- What happens to plant operations if the product, or a cloud service it depends on, fails?
- How are legacy devices that cannot authenticate protected?
- Who approves and reviews access policies between zones, and how often?
- How does this fit our IEC 62443 zone and conduit design?
Terms used on this page
- NIST SP 800-207
- The reference definition of zero trust architecture.
- Microsegmentation
- Dividing a network into small zones so that each device can reach only what it needs.
- Policy enforcement point
- The component that allows or blocks each connection according to policy.
Sources
- Federal zero trust guide puts OT security under IT scrutiny
- CISA, federal partners release zero trust guide for operational technology
- SP 800-207, Zero Trust Architecture
Related technologies
See this entry on the full maturity map · All IT/OT & CCII entries · How placements are made. Stage and time-horizon placements are editorial judgements based on the public sources listed above, as of October 2026. They are not engineering, safety or investment advice; see the Terms of Use.