NSA issues Zero Trust guidance for critical operational technology

The National Security Agency (NSA) has released new guidance aimed at hardening critical operational technology (OT) environments using Zero Trust (ZT) principles. The guidance, released October 8, 2026, addresses the growing threat of adversaries using AI to accelerate reconnaissance and exploit development against industrial systems.

Because many OT controllers and industrial systems are legacy technologies that cannot easily support modern security tools or tolerate downtime, the NSA's approach focuses on reducing attacker pathways without requiring the immediate replacement of assets. The guidance distills Zero Trust principles into 26 prioritized activities across ten key areas, including remote access, asset inventory, network segmentation, and the hardening of smart controllers.

The framework is built upon seven Zero Trust pillars: User, Device, Application & Workload, Data, Network & Environment, Automation & Orchestration, and Visibility & Analytics. This architecture is intended to help operators protect national and economic security, public health, and safety by preventing intrusions from becoming operational disruptions.