The US National Security Agency has released new guidance on applying zero-trust principles to operational technology—the industrial control systems and connected equipment used across energy, water, agriculture, public health and government facilities.
The guidance, published on 8 October, is aimed primarily at US national-security systems, defence organisations and the defence industrial base. The NSA says it is also relevant to technology leaders and administrators responsible for operational technology in other critical environments.
From trusted perimeter to continuous verification
Traditional industrial networks often rely on strong perimeter defences and implicit trust inside the network. Zero trust starts from a different assumption: compromise may already have occurred. Users, devices, workflows and communications therefore need continuing verification rather than one successful check at the boundary.
In an operational environment, that shift is not a simple copy of office IT security. Industrial systems may include legacy devices, specialist protocols, limited computing capacity and processes that cannot be interrupted without safety or service consequences. The NSA’s approach focuses on tailoring zero-trust outcomes to those constraints and identifying a manageable route away from perimeter-only protection.
The security objective is to make unauthorised access, lateral movement and long-term attacker persistence more difficult. Segmentation, verified identity and device state, tightly controlled communication paths and better visibility can limit how far an intruder travels after gaining an initial foothold.
Why the timing matters
The NSA warns that adversaries are using advanced automation to accelerate reconnaissance, exploit development and cyber campaigns. At the same time, operators are adding more intelligent and connected capabilities to industrial systems to improve efficiency and resilience. Both trends expand the potential attack surface.
The consequences in operational technology also differ from a conventional data breach. An attack can deny, degrade, disrupt, deceive or destroy physical processes. That can turn a cyber incident into an interruption of power, water, food production, healthcare or public services.
The implementation test
The strongest part of the guidance is its recognition that critical infrastructure cannot be secured by slogans or wholesale replacement. Organisations need phased controls that respect safety, availability and engineering realities.
For operators, a practical starting point is an accurate inventory of assets and communication paths, followed by risk-based segmentation and explicit verification of the identities and devices permitted to cross trust boundaries. Monitoring should be designed around normal operational behaviour, while recovery plans must account for physical processes as well as data.
The broader lesson is that zero trust is becoming an engineering model, not merely an identity-management product. Success will depend on cooperation between security teams, network administrators, control engineers, equipment vendors and operational leadership. In critical infrastructure, the quality of those interfaces may matter as much as any individual security tool.