Breaking down the DoD’s new zero trust guidance for OT systems

The U.S. DoD released “ZT for OT Activities and Outcomes” (Nov 18, 2025) to guide Zero Trust implementation across OT systems under DTM 25-003, mandating at least Target-level adoption for classified and unclassified environments while excluding internal components of weapon systems and defense critical infrastructure. The guidance tailors ZT to OT’s safety- and availability-oriented constraints, introduces an abstracted two-layer model (Operational Layer and Process Control Layer), and differentiates Target vs Advanced maturity. It emphasizes layered physical security alongside cyber controls and highlights that IT/OT convergence expands the attack surface, with tools like runZero positioned to support alignment.