A security check that interrupts a factory’s control system can create a physical problem as well as a computer problem. That constraint sits at the center of federal guidance released April 29 on applying zero-trust principles to operational technology.
CISA and its partners urged operators to strengthen asset visibility, network separation and identity controls as industrial systems become more connected and accessible remotely. The approach challenges the assumption that access should be trusted simply because it comes from inside a network.
Operational technology includes systems that sense or control physical processes: industrial controls, building automation and transportation equipment, among others. NIST’s baseline guidance treats safety, reliability and performance as central requirements.
That changes how security work must be carried out. The April guide describes equipment that can remain in service for decades, sometimes using protocols that cannot safely tolerate routine active scanning or penetration testing. Sparse event logs can make it harder to reconstruct an intrusion.
Security begins in the purchasing specification
One practical route out of those constraints is procurement. The guide encourages buyers to seek logging, secure communications and identity-management features when they replace equipment, coordinating those choices with the people who operate the process.
A device that cannot record important events creates a lasting visibility problem. Buying a replacement that can record them gives defenders better evidence throughout its service life. That makes the equipment specification part of cybersecurity work, even when the next replacement is years away.
For existing systems, the agencies emphasized collaboration among engineers, operators and security teams. Remote maintenance and emergency access require particular care: restrictions must be designed around how authorized staff actually restore or sustain operations.
Sources
- CISA and U.S. Government Partners Unveil Guide to Accelerate Zero Trust Adoption in Operational Technology — CISA · 2026-04-29.
- Adapting Zero Trust Principles to Operational Technology — CISA and federal partners · 2026-04-29.
- Guide to Operational Technology (OT) Security — NIST · 2023-09-28.