The U.S. National Security Agency has released new cybersecurity guidance urging defence organisations and critical infrastructure operators to apply zero trust principles to operational technology, warning that systems supporting essential physical processes remain exposed to increasingly sophisticated cyber threats.
The NSA’s cybersecurity information sheet focuses on protecting industrial and facility systems whose age, limited security capabilities and demanding availability requirements make conventional cybersecurity measures difficult to implement.
The agency’s central recommendation is to strengthen protection around vulnerable equipment through controlled access, segmentation, monitoring and other compensating controls. This gives operators a practical route to improving security while planning longer-term modernisation.
Although primarily aimed at National Security Systems, the Department of War and the defence industrial base, the guidance has wider relevance to organisations operating essential services. The NSA identifies risks spanning energy, water, agriculture, public health and government facilities.
Ageing Equipment Creates a Persistent Security Challenge
Operational technology, or OT, includes the programmable systems and devices that monitor or control physical processes. Its scope extends beyond factory production lines to building automation, backup power, transportation systems and other infrastructure on which organisations depend.
Securing these environments requires a different operational approach from protecting office computers. An industrial controller may need to run continuously, communicate within strict timing limits and remain compatible with equipment installed many years earlier.
The National Institute of Standards and Technology’s Guide to Operational Technology Security explicitly addresses these performance, reliability and safety requirements. Security decisions must account for how a change could affect the physical process being controlled.
The NSA describes a recurring problem: legacy equipment can remain useful mechanically while lacking modern authentication, encryption or straightforward patching capabilities. Replacing it may require engineering assessments, vendor involvement, extensive testing and a scheduled shutdown.
This creates a difficult management decision. Leaving equipment unchanged preserves familiar operating conditions but can prolong cyber exposure. Introducing new security controls without understanding process dependencies can also create operational risk.
The guidance therefore emphasises protecting legacy assets through surrounding controls, alongside carefully planned maintenance and replacement.
Zero Trust Changes How Access Is Granted
Zero trust removes the assumption that a user or device should be trusted simply because it is already inside an organisation’s network.
Under NIST’s Zero Trust Architecture guidance, access decisions focus on users, devices and protected resources. Network location and organisational ownership alone do not establish trust. Authentication and authorisation are separate requirements that must be addressed before access is established.
For industrial environments, the practical implication is that access to one system should not automatically provide permission to reach other controllers, change engineering files or administer unrelated equipment.
Consider a maintenance contractor who needs to inspect a particular machine. A zero trust approach would connect that access to an identified person, an approved device, a defined task and the resources needed to complete it. Permission to inspect operating information would not inherently include permission to rewrite control logic.
This example illustrates why zero trust is an architectural and operational discipline. Installing a gateway or requiring an additional login can support it, but neither establishes a complete approach on its own. The surrounding policies must define who can do what, under which conditions, and how that activity is checked.
A Focused Starting Point for Industrial Operators
The NSA selects 26 high-impact activities from a broader framework of 84 OT zero trust activities. These priorities cover remote access, data protection, inventories, visibility, threat intelligence, controller hardening, network segmentation, engineering workstations, identity infrastructure and safe validation.
The aim is to provide a manageable starting point for organisations facing large legacy estates and limited opportunities for intrusive changes.
The wider federal approach is set out in Adapting Zero Trust Principles to Operational Technology, published in April by CISA and partner agencies. That guidance stresses that applying IT-focused security capabilities indiscriminately to industrial environments is neither reasonable nor feasible.
Instead, it calls for collaboration among OT engineers, IT architects and cybersecurity personnel, with safety and uninterrupted operations central to implementation.
For organisations translating these documents into programmes, this means security priorities should follow operational consequences. A system supporting an essential safety or production function may require a different implementation sequence from a less critical monitoring service.
Remote Access Requires Clear Ownership and Limits
Remote maintenance is an important operational capability, but it also creates routes through which external accounts, support systems and service providers can reach sensitive infrastructure.
The April interagency guidance recommends controlled remote access through mechanisms such as jump hosts and privileged access management. It also calls for multifactor authentication for privileged access entering OT from remote or external environments.
The management challenge goes beyond whether a connection is encrypted. Operators also need to understand who approved it, which systems it reaches, whether the account remains necessary and who can terminate the session if its behaviour becomes suspicious.
A useful distinction is between a connection that is technically secure and an activity that is operationally authorised. An encrypted session can still carry an unauthorised configuration change if the account has excessive privileges.
For leadership teams, remote access reviews therefore provide an opportunity to examine both technical controls and contractual arrangements. Vendor support requirements, emergency maintenance procedures and account ownership should fit the same access governance process.
Visibility Must Explain What Equipment Does
Asset inventories are essential to industrial security, but a list of addresses and model numbers provides only part of the picture.
NIST’s OT security guidance places security controls in the context of system architecture and operational requirements. That broader perspective matters because the importance of an asset depends on the process it supports and the consequences of losing it.
For example, two controllers may use identical hardware but perform functions with very different safety and service implications. Treating them as interchangeable entries in a vulnerability report can lead to poor prioritisation.
An operationally useful inventory should help engineers and security personnel answer concrete questions: What does this device control? Which systems depend on it? Who maintains it? What communications are necessary? What would happen if it became unavailable?
These questions also improve incident handling. When suspicious traffic is detected, responders need enough context to decide whether disconnecting a device would contain the threat, interrupt an essential service or create an unsafe condition.
Segmentation Can Limit the Reach of a Compromise
Network segmentation remains a foundational protection for OT. The April interagency guidance explains that separating operational functions can reduce the extent to which a single compromise affects other systems. It also recognises the importance of separating control systems from safety systems.
The operational value lies in enforcing boundaries that reflect genuine process requirements.
A useful review should establish which systems need to communicate, what information they exchange and which connections exist only because they were convenient during installation or maintenance.
For example, if a workstation needs to receive production data, that requirement should not automatically justify unrestricted administrative access to every device producing it.
Segmentation also creates a verification task. A network diagram may show separate zones, but operators still need evidence that routing, firewall rules, remote access paths and maintenance arrangements preserve those boundaries in practice.
Procurement Decisions Shape Future Exposure
Protecting existing equipment is only one part of the challenge. Organisations also need to avoid introducing another generation of systems that are difficult to secure.
In its Secure by Demand guidance for OT buyers, CISA and international partners warn that weaknesses such as poor authentication, limited logging, insecure defaults and legacy protocols can make industrial products difficult and costly to defend.
The guidance encourages owners and operators to incorporate security into purchasing decisions, giving manufacturers clearer expectations before products enter operational environments.
An accompanying procurement fact sheet identifies practical questions for buyers. These include whether products support authenticated configuration backups, detect tampering, record security-relevant events and enable recovery without excessive dependency on the manufacturer.
It also highlights secure defaults, data protection and interoperability.
For executives, the implication is that purchase price alone provides an incomplete measure of value. A cheaper device that requires years of additional monitoring, access workarounds and specialist support may create substantial costs throughout its operating life.
Procurement, engineering and security teams therefore have a shared interest in specifying maintainable security capabilities before deployment.
AI Adds Urgency to Established Security Problems
The NSA’s release also warns that advanced AI capabilities can accelerate reconnaissance, exploit development and cyber campaigns. It notes that organisations integrating AI into OT may introduce additional attack surfaces and opportunities for disruption.
The immediate operational question is how much authority any connected system receives.
An analytical service that reads equipment telemetry presents a different risk from a system permitted to issue commands, alter operating parameters or initiate maintenance actions. Those distinctions should be explicit in access policies and engineering reviews.
The same principle applies to human and machine identities: access should correspond to an approved operational purpose, and changes in behaviour should be visible to the people responsible for the process.
AI adoption therefore increases the importance of understanding existing dependencies and privileges. Adding automation to an environment whose access relationships are poorly documented can make those relationships harder to supervise.
Resilience Depends on Operational Evidence
Taken together, the NSA, CISA and NIST guidance points towards a security programme that can demonstrate how critical processes remain protected.
For senior leaders, useful questions include:
Can the organisation identify the systems essential to safe operation and service continuity?
Is external access linked to named owners and specific operational needs?
Are permissions proportionate to the work being performed?
Can engineers explain and verify the boundaries between critical systems?
Do purchasing requirements address security throughout equipment lifecycles?
Can teams introduce security changes without undermining process safety?
These are practical governance questions derived from the guidance, rather than a separate compliance checklist.
The significance of the NSA’s publication is its focus on achievable improvements in environments where replacement is difficult. Industrial operators can reduce exposure by controlling access, improving their understanding of operational dependencies and verifying that protective measures work under real operating conditions.
For organisations responsible for essential services, progress will be measured in their ability to preserve safe control of physical processes—even when an account, workstation or connected system is compromised.