An air gap used to be enough. Now the same fiber that streams production data to the cloud can carry an attacker straight to a PLC.
Zero trust doesn't remove that connectivity. It just stops trusting it by default.
Zero trust architecture for OT networks means no user, device, or application is trusted by default, even inside the plant network, and every access request gets verified before it's allowed.
Traditional OT security leaned on the perimeter. Firewalls, air gaps, and physical isolation kept the plant floor separate from the outside world.
That model is breaking down. IIoT devices, remote vendor access, and IT/OT convergence mean the perimeter has holes in it whether anyone planned them or not.
The 5 CISA Zero Trust Pillars, Applied to OT
CISA's Zero Trust Maturity Model organizes everything into five pillars. Here's what each one means on the plant floor.
Identity
Every engineer, vendor, and service account gets verified, not just trusted because they're on the plant network.
Devices
PLCs, HMIs, and engineering laptops get inventoried and checked for health before they're allowed to communicate.
Networks
Micro-segmentation replaces one flat network with many small zones, limiting how far an attacker can move.
Applications and Workloads
SCADA, historian, and engineering software get access controls scoped to exactly what each user needs.
Data
Process data and recipes get classified, encrypted, and access logged, whether at rest or in transit.
IT Zero Trust vs OT Zero Trust
The principle is the same. The execution has to change for the plant floor.
IT Zero Trust
Assumes devices can run modern agents, get patched regularly, and re-authenticate frequently without disrupting the business.
OT Zero Trust
Must respect legacy PLCs that can't run agents, real-time control loops, and safety systems that can't tolerate disruption.
Where Zero Trust Fits Into the Purdue Model
Most plants already segment by level, from field devices up to the enterprise. Zero trust doesn't replace that structure, it reinforces it.
Only a subset of zero trust principles applies to field devices and instrumentation at Level 0. Continuous re-authentication doesn't make sense for a pressure transmitter. It makes complete sense for the engineering workstation talking to it.
Traditional Perimeter Security vs Zero Trust
The shift in thinking comes down to a handful of core differences.
| Aspect | Traditional Perimeter | Zero Trust |
|---|---|---|
| Trust basis | Network location (inside = trusted) | Verified identity and device health, every time |
| Lateral movement | Easy once inside the perimeter | Blocked by micro-segmentation |
| Remote vendor access | Shared VPN, broad network access | Scoped, time-limited, fully logged sessions |
| Assumption | The network can be made secure | The network is already assumed compromised |
Zero Trust Maturity Stages
CISA defines four stages every pillar moves through, from basic to fully automated.
| Stage | What It Looks Like |
|---|---|
| Traditional | Static credentials, flat networks, manual asset tracking |
| Initial | Some automation, early segmentation, basic MFA |
| Advanced | Centralized identity, enforced micro-segmentation, continuous monitoring |
| Optimal | Fully automated policy enforcement across all five pillars |
Key Standards Behind OT Zero Trust
NIST SP 800-207
Foundational zero trust architecture principles for federal systems.
ISA/IEC 62443
The core industrial cybersecurity standard, pairs naturally with zero trust.
NIST CSF 2.0
Govern, Identify, Protect, Detect, Respond, Recover, now includes zero trust.
CISA ZTMM 2.0
The 5-pillar maturity model used across this article.
SANS ICS 5 Critical Controls
OT specific controls that map closely to zero trust practices.
Purdue Enterprise Reference Architecture
The level-based model zero trust reinforces rather than replaces.
Real Threats Zero Trust Is Built to Stop
Ransomware
OT-targeting ransomware groups grew significantly in recent years.
Insider Threats
Overprivileged accounts that no longer match current job roles.
Remote Vendor Access
Shared VPN credentials used across multiple third party technicians.
IT to OT Breach
Most OT compromises actually start as an IT network breach first.
Supply Chain Compromise
Malicious firmware or software updates from a trusted vendor channel.
Nation State Campaigns
Advanced persistent threats using valid stolen credentials to stay hidden.
Do's and Don'ts of OT Zero Trust Implementation
✓ Do
- Start with an accurate, passive asset inventory before anything else
- Pilot micro-segmentation on one cell or line before plant-wide rollout
- Prioritize the Identity pillar first, it strengthens every other pillar
- Build incident playbooks that respect safety and availability constraints
✗ Don't
- Force continuous re-authentication onto Level 0 field devices
- Use active vulnerability scanners that can disrupt fragile legacy PLCs
- Copy an IT zero trust rollout plan without OT specific adjustments
- Treat zero trust as a single product instead of a multi-year program
OT Zero Trust Maturity Self-Check
Check off what's already in place across your OT environment.
Reference Materials on Zero Trust for OT
FAQs on Zero Trust Architecture for OT Networks
External References
- NIST Special Publication 800-207, Zero Trust Architecture
- ISAGCA Whitepaper: Zero Trust Outcomes
- Zero Trust OT Cybersecurity Architecture, Rockwell Automation
- Adapting Zero Trust Principles to Operational Technology, NIST/CISA/FBI
- Guide to Applying Zero Trust Concepts in OT Environments, Dragos
What we learn today
- Zero trust architecture for OT networks removes implicit trust from every user, device, and connection, even inside the plant network.
- CISA organizes zero trust into 5 pillars: Identity, Devices, Networks, Applications and Workloads, and Data.
- OT zero trust has to respect legacy PLCs, real-time control, and safety constraints that IT zero trust never has to consider.
- The Purdue Model and Industrial DMZ aren't replaced by zero trust, they're reinforced by it, especially at the IT/OT boundary.
- Zero trust maturity advances through 4 stages, Traditional, Initial, Advanced, and Optimal, and it's a multi-year program, not a single product purchase.