The National Security Agency (NSA) outlined 26 high-impact zero-trust activities to strengthen cybersecurity across Department of War (DoW) critical operational technology (OT) environments, including legacy systems that cannot natively support modern security capabilities. In a cybersecurity information sheet, Hardening Department of War Critical Operational Technology Environments with Zero Trust Principles, the agency prioritizes measures that protect mission-essential functions without requiring extensive hardware modifications.
To maintain the security of legacy OT environments, the agency says a comprehensive evaluation of current infrastructure is required, followed by prioritization of the high-impact measures. These include securing remote access, protecting OT data, inventorying OT assets, enhancing OT environment visibility and utilizing OT cyber threat intelligence. They also include hardening smart controllers, strengthening networks with segmentation and monitoring, securing engineering workstations and human-machine interfaces, enforcing security through hardened Active Directory and domain controllers, and verifying and assessing zero-trust controls safely. By focusing on these strategic priorities, organizations can bridge the architectural gap, shielding legacy hardware within a resilient, verifiable zero-trust environment.
The NSA guidance focuses on securing remote access, protecting OT data, maintaining accurate asset inventories, improving network visibility, hardening smart controllers and strengthening network segmentation and monitoring to reduce risks from unauthorized access and malicious activity. The document was developed in furtherance of NSA’s cybersecurity missions, including its responsibilities to identify and disseminate threats to National Security Systems, Department of War, and Defense Industrial Base information systems, and to develop and issue cybersecurity specifications and mitigations. This information may be shared broadly to reach all appropriate stakeholders.
The NSA recommends removing direct internet connections to OT environments where possible and enforcing stronger controls for remote access, including phishing-resistant multifactor authentication, least-privilege access and privileged access management. It also urges organizations to scrutinize third-party and vendor connections, encrypt sensitive OT communications, monitor network activity and protect engineering workstations and human-machine interfaces.
Since active testing can disrupt safety-sensitive industrial systems, the guidance calls for prioritizing passive assessments, such as configuration audits, log analysis and network monitoring, and conducting active tests only when necessary during approved maintenance windows. The measures aim to strengthen the security and resilience of legacy OT systems while preserving the safety, reliability and availability of critical operations.
The guidance says attacks by nation-state actors and hacktivist groups show why OT environments need to be secured and Zero Trust (ZT) principles implemented. These actors have compromised water and wastewater systems and energy infrastructure by exploiting remote-access misconfigurations, legacy device weaknesses and default passwords, apparently aiming to disrupt operations, demonstrate capability and highlight the potential for physical harm. It says ZT measures such as complex passwords, multifactor authentication, macro- and microsegmentation, secure remote access, and continuous verification of users, devices, workloads and machine-to-machine communications can disrupt multiple phases of the SANS ICS Cyber Kill Chain, reducing opportunities for adversaries to establish persistence, move laterally and affect industrial processes.
Campaigns by Iran-affiliated actors reinforce that hackers targeted programmable logic controllers in the water and wastewater sector by exploiting Internet-exposed devices and default administrative credentials. The guidance says policy-based access control built on attribute-based access control principles lets organizations continuously verify users, devices, assets and resources before granting access, mitigating the primary attack vectors in such disruptions.
The guidance adds that these threats are evolving and increasingly using advanced superintelligence, including frontier models that can automate complex analysis and decision-making, to speed up attacks on OT environments. Adversaries with these capabilities may rapidly identify previously unknown vulnerabilities, automate exploit development, generate convincing social engineering campaigns, coordinate attacks across numerous targets at once and optimize attack paths through complex cyber-physical environments.
As these capabilities become more accessible, critical infrastructure owners and operators should expect increasingly adaptive threats to both digital systems and the physical processes they control. Because adversaries can act with greater speed, precision and scale, the guidance says ZT’s continuous verification, policy-based decision-making and visibility across human and non-human identities become increasingly essential to protecting OT environments and keeping operations resilient.
The DoD CIO Zero Trust Framework utilizes seven Pillars to categorize key functional domains (User, Device, Data, etc.) and 45 Capabilities to define the specific technical requirements and security functions necessary to achieve a ZTA. The CSI identifies 26 high-impact Activities that serve as the tactical ‘How-To,’ outlining the specific tasks and process changes necessary to meet many of the needed Outcomes and Capability requirements of the Zero Trust Framework to reduce risk in legacy OT environments substantially.
The guidance says applying ZT principles in a large, complex operational environment such as a military base requires rigorous planning, coordinated governance and continuous verification that every access and interaction is authorized. It offers a scenario to show how this works in practice. All personnel and devices must authenticate using biometric identification, RFID badges or multifactor authentication tokens, and devices must pass Comply to Connect checks, with proxy-based posture validation for remote devices whose legacy hardware cannot support those agents.
Privileges are limited to what is needed, so a cybersecurity analyst patching a radar system, for example, receives elevated access for two hours before it expires automatically, with just-in-time controls limited by time and location applied to all accounts. Systems are compartmentalized, much like bulkheads in a ship, so one breach does not affect all of them. Badge scans are unique to each person and trigger alerts and automatic lockdowns if used in unauthorized areas, and behavior analytics revoke access and flag for investigation when, say, a user who normally logs in from Maryland suddenly tries to connect from overseas and downloads large volumes of flight data.
The guidance notes that although ZT was initially designed to improve IT security architectures, its principles can address cybersecurity challenges in emerging technologies, operational environments and expanded cyber terrain, including OT. Many OT environments have been slower to adopt and modernize than IT environments, however, because of operational constraints, safety requirements and the long lifecycles of legacy systems.
Even though legacy OT assets may lack the processing capability to support modern security agents, ZT can be adapted for OT as part of a holistic approach that ties cybersecurity to operational processes, governance, mission requirements and risk-based decision-making. Technologies such as ZT-enabled gateways, ruggedized network devices, micro-segmentation and continuous monitoring can improve the security posture of legacy environments, but they must be integrated into the broader operational context to enable effective authorization, access control and protection of critical processes across hybrid IT/OT environments.
NSA prioritizes 26 high-impact ZT activities for OT environments, chosen because they can provide immediate compensating controls for aging infrastructure. The selection draws on the user, device, data, network and environment, application and workload, and visibility and analytics pillars, favoring activities that wrap legacy assets in protective enclaves without intrusive hardware modifications. By starting with these target-level activities, organizations can reach a foundational ZT posture that secures the most vulnerable mission-essential functions first. The guidance says the activities mitigate critical vulnerabilities by replacing implicit trust with continuous, evidence-based verification, strengthening the ability to verify and control authorized actions and reducing the operational risk from unauthorized access, unapproved process flows and unauthorized configuration changes.
Among the steps highlighted, organizations should restrict remote access to authorized actors, encrypt all outbound OT data or use security brokers, secure enclaves, gateways or tunnels where protocols cannot support encryption, and maintain an accurate OT asset inventory as the foundation of a defensible architecture. They should also continuously identify and categorize assets and monitor network communications to establish operational baselines and detect abnormal or malicious activity, use threat intelligence to understand adversary tactics, and harden smart controllers while meeting availability requirements.
Further steps include strengthening segmentation and monitoring across networks, systems and devices, protecting engineering workstations and human-machine interfaces through authorization, least privilege and monitoring, and enforcing security policies through hardened Active Directory and domain controllers. To avoid disrupting sensitive OT assets, the guidance advises validating ZT controls through passive techniques such as configuration audits, log analysis and network monitoring where possible, reserving active testing for approved maintenance windows.
The guidance says visibility in OT environments starts with knowing the assets in inventory, along with their function, criticality and communication pathways, and keeping that operational baseline current. Organizations should assign ownership for the inventory and baseline, categorize assets by criticality and security requirements, and maintain a secure, authoritative repository, whether centralized or federated, with consistent naming conventions and clear views of asset dependencies to support ZT policy decisions.
It also urges the Department of War and its service components to use OT cyber threat intelligence by feeding relevant telemetry into an OT-focused Security Information and Event Management (SIEM) system, and, where applicable, linking it with Security Orchestration, Automation and Response (SOAR) capabilities and access enforcement points to coordinate analysis, alerting and response.
On smart controllers, which are the primary link between the cyber and physical domains in legacy environments, the guidance says they lack modern onboard security and must be shielded with external ZT controls so digital compromises do not become physical failures. Initial steps include configuring built-in security features and verifying that configurations match approved functionality and process logic, taking a risk-based approach that prioritizes the greatest risk reduction with the least disruption.
Patching is challenging in OT, so organizations should use test environments, schedule low-impact maintenance windows, patch the most exposed controllers first and apply compensating controls when patches must wait. They should also change default passwords, disable insecure services, use secure protocols where feasible, document and plan to resolve any exceptions, limit controller access to view-only where possible, monitor configuration changes in device logs, and disable unused logic that an attacker could repurpose.
