Zero Trust for OT applies Zero Trust architecture to operational technology networks. No connection to an industrial asset is trusted by default. Every user, device, and session is authenticated and authorized before it reaches a PLC, HMI, SCADA system, or any other OT resource, and every connection is logged. The catch is that OT cannot be secured the way IT is, so the mechanisms all move to the network layer.
How is Zero Trust for OT different from IT Zero Trust?
They share the principle and diverge almost everywhere in practice. IT Zero Trust leans on endpoint agents and cloud identity. OT has neither luxury: you cannot install an agent on a 15-year-old PLC, and a control loop cannot wait on a cloud identity provider. The table below lays out the structural differences.
| Dimension | IT Zero Trust | OT Zero Trust | |-----------|---------------|---------------| | Enforcement point | Endpoint agent + identity-aware proxy | Network proxy only (no agents on assets) | | Identity source | Cloud IdP (Entra, Okta, Google) | On-prem IdP, often sovereign (Keycloak, PIV) | | Session posture | Device health signals from agent | Device role + source segment + flow pattern | | Latency tolerance | Hundreds of ms acceptable | Single-digit ms required on control loops | | Failure mode | Block access, retry | Must fail safe for safety-critical flows | | Update cadence | Continuous, automated | Change-controlled, maintenance window only | | Typical deployment | SaaS or inline | Non-inline overlay, on-premise |
The through-line: OT Zero Trust cannot use endpoint agents, cannot depend on cloud identity, and cannot tolerate inline enforcement that fails closed on a safety-critical flow.
How does Zero Trust for OT work without agents?
Since you cannot put software on the asset, enforcement lives in the network in front of it. The core capabilities:
- Identity-based access control: every session authenticated with MFA before it reaches the OT asset.
- Network segmentation: overlay networking creates microsegments without VLAN reconfiguration.
- Session logging: every connection recorded with user identity, timestamp, protocol, and payload.
- Encryption: TLS on CUI paths between the user and the proxy.
- Deny by default: only explicitly authorized connections are allowed.
Who needs Zero Trust for OT?
Any operator whose industrial network can be reached by a remote user, a vendor, or a compromised IT segment, which today is nearly all of them. It is most urgent for defense manufacturers under CMMC, utilities under NERC CIP, and any critical-infrastructure operator subject to NIS2. Volt Typhoon and similar campaigns have shown that flat OT networks with implicit trust are exactly what advanced attackers exploit once they land.
Which compliance frameworks does Zero Trust for OT support?
- CMMC Level 2: addresses the AC, AU, IA, and SC control families.
- NIS2: satisfies Article 21 network segmentation and access-control requirements.
- IEC 62443: aligns with zone-and-conduit security architecture.
- DoD DTM 25-003: addresses all seven OT Zero Trust pillars at Target Level.
Related terms
- Zero Trust Architecture, the parent model Zero Trust for OT adapts
- Network Segmentation, the foundation of OT Zero Trust
- CMMC Shared Responsibility Matrix, which maps these controls to responsible parties
- Programmable Logic Controllers, the primary asset type OT Zero Trust protects
- Overlay Networking (OT), the mechanism that creates agentless microsegments
