NSA Zero Trust for OT: 26 Activities That Also Suit Legacy Plants
The NSA has published a fact sheet outlining 26 high-impact zero trust activities for protecting critical OT environments, including older ones. Written for the US Department of War, the guidance is useful to any plant running brownfield PLCs and HMIs.
On October 12, 2026, Industrial Cyber reported that the NSA had published a fact sheet titled "Hardening Department of War Critical Operational Technology Environments with Zero Trust Principles". The PDF's URL is dated October 8, 2026. The document describes 26 high-impact zero trust activities for the Department of War's (DoW) critical OT environments.
A note on methodology: this article is based on Industrial Cyber's summary, not on the original PDF. The text we were able to review cuts off partway through the section on policy-based access control, so the full list of the 26 activities is not available.
An approach designed for legacy systems
The most relevant aspect is the emphasis on measures that work on older systems, which cannot natively support modern security controls, and that do not require extensive hardware changes. This is the typical situation in many plants: PLCs and HMIs with years of service, difficult to replace or upgrade.
The priority areas identified are:
- secure remote access
- OT data protection
- OT asset inventory
- improved visibility
- use of OT-specific threat intelligence
- hardening of intelligent controllers
- network segmentation and monitoring
- securing engineering workstations and HMIs
- hardening of Active Directory and domain controllers
- secure verification of zero trust controls
Specific recommendations
Among the specific measures reported:
- remove direct connections between OT and the internet where possible
- for remote access, use phishing-resistant MFA, least privilege and privileged access management (PAM)
- carefully review third-party and vendor connections
- encrypt sensitive OT communications
- monitor network activity
Testing without stopping the process
One point plant operators should note is the approach to verification. Active testing can disrupt safety-relevant systems, so the NSA favors passive assessments: configuration audits, log analysis and network monitoring. Active tests should be run only when necessary and within approved maintenance windows.
The threat landscape
The guidance cites state actors and hacktivists that have compromised water, wastewater and energy systems by exploiting misconfigured remote access, weaknesses in legacy devices and default passwords. In particular, Iran-affiliated actors have targeted PLCs in the water sector by exploiting internet-exposed devices and default administrative credentials.
According to the document, measures such as MFA, macro- and microsegmentation, secure remote access and continuous verification can disrupt several stages of the SANS ICS Cyber Kill Chain.
Why it matters beyond the DoW
The guidance is written for the DoW, but it offers a practical, retrofit-compatible checklist for any plant with brownfield PLCs and HMIs, along with an OT assessment method that respects process safety.
What to do now
As a starting point, while waiting to read the full document:
- check whether any OT devices are reachable from the internet and whether they use default credentials
- review vendor access and introduce MFA and least privilege
- build an asset inventory through passive monitoring and configuration audits
- schedule active tests only within maintenance windows