Zero Trust for OT is the application of Zero Trust architecture principles to operational technology networks. It means no connection to an industrial asset is trusted by default. Every user, device, and session must be authenticated and authorized before accessing PLCs, HMIs, SCADA systems, or any other OT resource.
How It Differs from IT Zero Trust
IT Zero Trust typically relies on endpoint agents, cloud identity providers, and software-defined perimeters. OT environments cannot use this approach because:
- PLCs and industrial controllers run proprietary firmware that cannot host third-party agents
- Real-time constraints prevent the CPU overhead and timing jitter agents introduce
- Legacy equipment may run firmware from 10 or 20 years ago with no update path
- Air-gapped environments have no connectivity to cloud identity providers
- Certification requirements may prohibit installing unauthorized software on safety-critical equipment
OT Zero Trust must work at the network layer, enforcing identity and access control through proxies rather than on the devices themselves.
Key Capabilities
- Identity-based access control: Every session authenticated with MFA before reaching the OT asset
- Network segmentation: Overlay networking creates microsegments without VLAN reconfiguration
- Session logging: Every connection logged with user identity, timestamp, protocol, and payload
- Encryption: TLS on CUI paths between user and proxy
- Deny by default: Only explicitly authorized connections are allowed
Compliance Alignment
Zero Trust for OT maps to multiple compliance frameworks:
- CMMC Level 2: Addresses AC, AU, IA, and SC control families
- NIS2: Satisfies Article 21 network segmentation and access control requirements
- IEC 62443: Aligns with zone and conduit security architecture
- DoD DTM 25-003: Addresses all 7 OT-ZT pillars at Target Level
Related Terms
- CMMC — Certification framework requiring Zero Trust controls for defense contractors
- CMMC Enduring Exception — Mechanism for OT assets that cannot comply natively
- CMMC Shared Responsibility Matrix — Maps controls to responsible parties
- Programmable Logic Controllers — Primary OT asset type protected by Zero Trust enforcement
