NSA issues Zero Trust guidance for operational technology

The National Security Agency (NSA) has issued new guidance urging owners of operational technology (OT) systems within national security, defense, and defense industrial base networks to adopt Zero Trust principles. This approach operates on a ‘never trust, always verify’ model, assuming that adversaries may already have breached a network. The goal is to strengthen protections against unauthorized access, lateral movement, and adversary persistence within critical infrastructure.

The guidance highlights the growing risks posed by artificial intelligence. As organizations integrate AI into OT to improve efficiency, adversaries are simultaneously using AI to automate reconnaissance, accelerate exploit development, and scale cyber campaigns. These adversarial attacks are evolving from simple espionage toward efforts aimed at disrupting or destroying critical infrastructure.

Implementing Zero Trust in these environments addresses the technical challenges of continuous authorization. Traditional security models often rely on session cookies or access tokens, which can create security gaps if an organization needs to instantaneously revoke access or if the conditions behind an initial access decision change dynamically. While strategies like using short-lived tokens or re-validating at every request exist, they often present significant technical burdens on identity providers.