OT Threat Signal: NSA Zero Trust for OT in 7 Moves

The NSA's October 2026 Cybersecurity Information Sheet narrows 84 OT Zero Trust activities to 26 high-impact ones operators can act on now. Start with the two that buy the most risk reduction: get remote access off the public internet and inventory every asset. None of it requires replacing the control system.

On October 8, the NSA released a Cybersecurity Information Sheet titled “Hardening Department of War Critical Operational Technology (OT) Environments with Zero Trust Principles” (CSI U/OO/6070841-26, October 2026, Ver. 1.0). It’s written for defense and national security systems — but don’t let the audience line fool you. This is one of the clearest prioritizations of OT security work I’ve seen published, and it applies to any plant, utility, or manufacturer running legacy control systems. 

The headline number: 26 high-impact activities to secure OT environments today, distilled from a broader framework of 84. The NSA’s message is that you don’t need all 84 to meaningfully change your risk. You need the right 26, in the right order. 

I’ve spent the last few years deploying OT visibility platforms inside industrial environments, and before that, years in SOCs watching what actually gets exploited. Reading this CSI, my reaction was simple: yes — this is the list that can effectively get industrial plants secured. So here’s my attempt to translate it out of government speak and into the version you’d hand a plant manager on a Monday morning. 

What Is Zero Trust for OT: The One-Paragraph Version 

Assume the network is already compromised. Verify every user, device, and connection continuously instead of trusting anything just because it’s “inside.” And since most OT systems can’t do modern authentication or run security agents — some of it carrying a 50-year service life — you wrap it in compensating controls: gateways, segmentation, and monitoring that protect the asset without touching it. 

That’s Zero Trust for OT. And there are seven moves that can help you implement it. 

The 7 Moves That Matter for Zero Trust for OT 

1. Get remote access off the public internet.

This is first for a reason. The CSI is blunt: remove direct OT exposure to the internet and mediate everything through controlled, identity-aware paths. That means VPN with phishing-resistant MFA and privileged access management with session recording. Vendor and OEM access gets the same suspicion: authenticated, explicitly approved, time-bound, monitored, and terminated when the work is done. Attackers hit water-sector PLCs earlier this year and forced defrost cycles at hundreds of European supermarkets this fall the same way: internet-exposed controllers, default credentials. That attack path is a choice.  

2. Know what you actually have.

Asset inventory: devices, firmware versions, service accounts, application code, current configurations. It sounds basic until you’ve deployed an OT visibility platform and watched the “authoritative” spreadsheet miss a third of what’s actually on the wire. You can’t defend what you haven’t inventoried, and you can’t write a Zero Trust policy for an asset you don’t know exists. 

3. Watch it like it’s already compromised.

Build a baseline of normal OT communications, then monitor continuously for deviations: unauthorized protocols, unexpected paths, unusual behavior. Passive techniques first — SPAN/TAP feeds, log analysis, configuration audits — because active scanning in OT can break things that don’t forgive. Feed OT threat intelligence into your SIEM and SOAR so alerts carry adversary context, not just anomalies. 

4. Shrink the blast radius.

Micro-segmentation: VLANs, firewalls, explicitly authorized communication paths between assets, and nothing else. The NSA’s framing is a good one — think bulkheads in a ship. One compromised segment should not mean a compromised plant. 

5. Harden the controllers themselves.

Change the default credentials. Disable the insecure protocols and services you don’t need. Patch where you can; where you can’t — and in OT you often can’t without an outage window — document the exception, apply compensating controls, and plan the work for when you can. Set controllers to deny-by-default access levels so a “view” account can’t quietly become a “change” account. 

6. Lock down the workstations — and the keys to the kingdom.

Engineering workstations and HMIs are just computers with a direct line to physical processes. Turn the logging on, restrict them to OT use only, keep them physically secured, and bind every permission tightly to the role. Then harden the domain controllers behind all of it: tiered administration, least privilege, strong authentication. There is hardly a worse scenario than an adversary moving through your network looking exactly like a legitimate user. 

7. Prove it without breaking it.

Validate that all of this is actually working — but do it passively. Configuration audits, log reviews, and passive network monitoring. Save active testing for approved maintenance windows and keep it far away from Level 0 and Level 1 devices. The goal is assurance, not an outage you caused yourself. 

Where Should OT Teams Start with NSA’s Zero Trust Guidance 

If 26 activities still feels like a lot, start with moves 1 and 2: remote access and asset inventory. In my experience those two buy the most risk reduction per unit of effort, because they answer the two questions attackers ask first: “how do I get in?” and “what’s in here?” 

The other thing worth internalizing: the threat is speeding up. The CSI explicitly calls out adversaries using advanced AI to automate reconnaissance and accelerate exploit development at machine speed. Continuous verification stops being a nice-to-have when the other side’s recon runs in minutes instead of weeks. 

And none of this requires ripping out the control system. That’s the entire point of the CSI — compensating controls that achieve Zero Trust outcomes around systems that will never natively support them. 

The NSA’s CSI, “Hardening Department of War (DoW) Critical Operational Technology (OT) Environments with Zero Trust Principles” (October 2026), is public. Read the full sheet via the NSA’s press release: https://www.nsa.gov/Press-Room/Press-Releases-Statements/Press-Release-View/Article/4621936/nsa-releases-zero-trust-guidance-for-protecting-operational-technology-systems/