CISA and Partners Publish Zero Trust Guidance For OT Security

A multi-agency CISA-led guide recommends adapting zero-trust principles for operational technology (OT), highlighting that legacy systems, limited visibility, and strict availability requirements make IT-centric controls insufficient. The guidance outlines OT risks from IT/OT convergence (including examples of disruptive malware), emphasizes assessing physical and digital impacts, and recommends a layered approach: comprehensive asset inventory, network segmentation/microsegmentation, adapted identity and access controls, secure remote access with MFA, supply-chain risk management, enhanced monitoring, and IT–OT collaboration to balance security with operational continuity.