CISA's April 2026 guidance on adapting zero trust principles to OT says implicit trust and perimeter only defence do not protect networked industrial systems. Its focus areas are asset visibility, supply chain risk, strong identity and access management, and layered security, within legacy, operational and safety constraints.
What zero trust means here
Zero trust removes implicit trust and requires continuing verification of access based on identity, context and risk. Applied to a plant, that means a connection is not trusted because it comes from inside the network. Who is asking, to which asset, for what task, and is it expected?
Why OT needs a version of its own
The summary page says OT systems that were once isolated or manually operated are now networked, digitally monitored and remotely controlled. This IT and OT convergence creates risks that perimeter models do not handle well. The guidance is attributed to CISA in coordination with the Department of War, the Department of Energy, the FBI and the Department of State.
The constraints it acknowledges
- Legacy infrastructure with technology gaps.
- Operational constraints.
- Safety requirements.
These are why a literal copy of an IT zero trust program does not fit. You cannot put an agent on a controller or add a login prompt that delays a safety action.
The four focus areas
- Asset visibility. You cannot verify what you do not know about. See CISA's separate inventory guidance.
- Supply chain risk. Vendors, integrators and the products themselves are part of your trust boundary.
- Identity and access management. Individual accounts, strong authentication and least privilege, including for remote and third party access.
- Layered security. Network segmentation, secure communication protocols and vulnerability management.
The web page is a summary. The full guide is a linked PDF with detail that this post does not cover, so read it before building a plan.
A first set of moves
- Inventory and zone your assets.
- Replace shared accounts with named ones at the IT and OT boundary.
- Gate every remote path through a monitored intermediary.
- Decide which flows between zones are allowed and deny the rest.
- Log and review the decisions.
What to avoid
Do not treat zero trust as a product to buy. The guidance describes principles applied through inventory, identity, segmentation and monitoring. Be cautious of any plan that adds checks directly on safety critical devices without testing.
How to measure progress
Pick a handful of counts: percentage of OT assets in the inventory, number of shared accounts at the IT and OT boundary, number of remote paths without MFA, and number of conduits with a named owner. Review them monthly. Falling counts of the bad cases show real movement without a vendor scorecard.
Quick check
Does zero trust mean no firewalls and no segmentation?
No. The guidance lists segmentation as part of layered security. Zero trust adds continuing verification on top.
Can legacy controllers take part?
They usually cannot verify themselves, so you place verification in front of them, at the zone boundary and the access path.
Sources
Last reviewed: 19 October 2026.
