ICS & OT Security
Zero Trust in OT: Why classic IT concepts are not enough
Key takeaways
- Zero Trust in OT fails when IT assumptions — constant authentication, aggressive isolation, fast remediation — are applied without regard for availability and safety.
- CISA OT Zero Trust guidance (April 2026) and ISA/IEC 62443 outcomes provide a shared target: explicit trust boundaries, asset visibility and controlled conduits — not generic “never trust” slogans.
- In OT, a breach is often a process deviation or unauthorised parameter change — not data exfiltration first; passive monitoring is therefore often the only practical entry point.
- Safety first remains the guardrail: security measures that weaken safety functions or emergency-stop chains are unacceptable regardless of Zero Trust maturity.
- Delivery-ready OT security profiles connect network segmentation, identity discipline and operational approvals — without integrators and production, Zero Trust stays theoretical.
Zero Trust in OT appears in nearly every 2026 security strategy — and often fails for the same reason: teams transfer office-IT logic to production networks without accounting for availability, safety and decades-old plant architecture. Zero Trust is not a product or VPN replacement; it is a model of explicit trust boundaries. In OT that means different priorities, different metrics and often a different starting point than in IT.
This article explains why classic IT concepts alone are insufficient, what CISA OT Zero Trust guidance (April 2026) and ISA/IEC 62443 outcomes contribute — and how passive monitoring works under safety-first constraints.
Why IT Zero Trust fails in OT
Office IT follows a familiar pattern: verify identity, check device, minimise access, isolate quickly on suspicion. In OT the same measures collide with hard operational realities:
- Availability often beats confidentiality — a wrongly triggered cutover stops production.
- Legacy protocols (Modbus, PROFINET, OPC) lack modern per-message authentication.
- Safety systems must not be slowed by security tooling in response time.
- Maintenance windows do not allow “always-on” patch and policy cycles.
Zero Trust does not fail on “never trust, always verify” but on wrong speed and granularity. Enforcing corporate-LAN controls in OT creates either operational blockades or shadow access through integrators.
IT vs. OT — Zero Trust decision logic
- Breach definition: IT — data exfiltration; OT — process deviation, parameter change, logic modification.
- Isolation: IT — fast quarantine VLAN; OT — only with operational approval and safety check.
- Identity: IT — SSO and MFA everywhere; OT — shared engineering accounts historically entrenched.
- Monitoring: IT — active scans; OT — often passive only to avoid process disruption.
CISA April 2026: what changes for OT
CISA OT Zero Trust guidance (April 2026) clarifies a central misunderstanding: Zero Trust in OT is not a copy-paste of five IT pillars but an outcome-oriented model built on visible assets, controlled communication paths and demonstrable governance.
For European operators CISA is not directly binding — but the guidance reflects experience from critical infrastructure and manufacturing relevant under NIS2 and IEC 62443:
- Asset visibility before micro-segmentation — segmentation without inventory is blind.
- Conduit control instead of blanket “air gap” myths — see IEC 62443 zone model.
- Supply-chain identities — remote maintenance and integrators as persistent risk paths.
- Incident response with OT owners — not SOC tickets alone.
Our OT security landscape shows why asset visibility and delivery-ready teams belong together.
ISA/IEC 62443 Zero Trust outcomes
ISA explicitly links IEC 62443 to Zero Trust outcomes: explicit zones, documented conduits, Security Levels and Foundation Requirements — especially FR1 (identification), FR2 (integrity) and FR5 (data flow restriction). That is operational vocabulary, not marketing overlay:
- Zone = trust domain with defined SL,
- Conduit = controlled path between zones,
- SL2 as a common manufacturing starting point — ambitious enough without SL4 complexity.
62443 supplies the architecture grammar IT Zero Trust frameworks often lack in OT. Deeper reading on roles: IEC 62443 in recruiting.
Breach in OT: different definition, different alerts
In IT, breach often means unauthorised access plus exfiltration. In OT, critical impact frequently starts with:
- a parameter change on a controller,
- a logic download outside the change window,
- a new engineering path via remote maintenance,
- anomalous process values without obvious malware signal.
Zero Trust programmes that feed only IT IOC streams into the SOC miss these patterns. OT needs process-adjacent detection — baselines for communication, configuration changes and physically plausible limits.
Passive monitoring as a pragmatic entry point
Active scans and inline policy enforcement are often operationally unsuitable in OT networks — latency, protocol break, safety risk. Passive monitoring (SPAN/TAP, OT-specific DPI, configuration monitoring) is therefore the realistic Zero Trust entry:
- visibility without touching production flow,
- history for forensics and NIS2 reporting windows,
- foundation for later conduit hardening — when maintenance windows allow.
Passive monitoring does not replace segmentation — but it provides evidence of where trust boundaries are missing. Without that data, Zero Trust becomes expensive architecture without prioritisation.
Mini roadmap: Zero Trust in OT in 90 days
Days 1–30: define SuC and critical zones, passive visibility on core switches, inventory integrator access.
Days 31–60: baselines for engineering traffic, remote maintenance and process alarms; first conduit policy drafts with operations.
Days 61–90: tabletop with OT leads, prioritise by safety and availability impact, staff monitoring and change-control roles.
Safety first: the non-negotiable guardrail
No OT Zero Trust programme succeeds if security measures weaken safety functions: longer emergency-stop chains, delayed protective relays, missing redundancy after segmentation. Every architecture decision needs explicit safety review — not a late checkbox.
Governance-wise, Zero Trust belongs in the same steering as overall cyber resilience — see cybersecurity board governance 2026. Boards and plant leadership must understand: Zero Trust in OT is a risk trade-off programme, not a compliance sticker.
Identity and remote maintenance: the hardest pillar
IT Zero Trust assumes identity as perimeter. In OT, technical accounts, long-lived engineering sessions and integrator access paths dominate. A pragmatic OT approach:
- Jump servers with session recording instead of direct PLC reachability,
- Time-bound remote-maintenance approvals with operations sign-off,
- Separate paths for production engineering and office IT — never blindly link the same identity system,
- Supplier identities in asset inventory and conduit rules — not only internal users.
Zero Trust here means every path is explicit, time-limited and monitored — not “MFA everywhere tomorrow”.
Segmentation under maintenance-window constraints
Micro-segmentation is IT’s centrepiece — in OT often incremental. A sensible sequence:
- separate core production from office and internet (conduit level 1),
- isolate engineering networks from process zones (level 2),
- touch safety networks only where evidence shows real lateral movement (level 3).
Each stage needs rollback plan and operations approval. Skipping that creates downtime — and acceptance problems with plant leadership.
People and execution
Zero Trust strategies fail for lack of interface roles: who translates CISA outcomes into conduit rules, who calibrates SOC alerts for OT protocols, who negotiates maintenance windows with production? That talent pool is tight — cybersecurity recruitment with outcome-based profiles accelerates execution.
Suggested next steps
Conclusion
Zero Trust in OT fails on IT transfer without OT outcomes — not on the concept itself. CISA guidance (April 2026) and ISA/IEC 62443 provide a credible target: asset visibility, conduit control, passive monitoring as entry, safety as guardrail and a breach definition that takes process integrity seriously. Combined with delivery-ready roles and operational approvals, organisations build real trust boundaries — instead of declaring Zero Trust on slides.
Further reading: OT security landscape, cybersecurity board governance. Hiring: Cybersecurity recruitment.
Source
Nozomi Networks — Zero Trust in OT: Why It’s Been Hard — and Why New CISA Guidance Changes Everything
FAQ
- Yes — we define search profiles around OT-specific outcomes: passive monitoring competence, conduit design per IEC 62443, change-control experience with operations and integrators. Candidates are assessed on real trade-off scenarios.
- OT network architects with segmentation experience under maintenance-window constraints, SOC analysts with OT protocol literacy, identity specialists who treat engineering stations and remote maintenance differently, and programme owners with a safety interface.
- We separate architecture, operations and governance accountability, test whether candidates can translate IT Zero Trust into OT — not only present buzzwords — and calibrate expectations to passive monitoring paths and approval processes.