Zero Trust for Ageing Operational Technology: Protecting Critical Infrastructure Without ...

Scope: A strategic assessment of Zero Trust implementation across United States defence and civilian operational technology environments, with comparative implications for European critical infrastructure, examining the October 2026 NSA guidance, the April 2026 CISA interagency framework, the NIST security architecture, and implementation priorities through 2031.

Executive Summary — Bottom Line Up Front

The October 2026 intervention by the United States National Security Agency marks an important evolution in operational technology cybersecurity: critical infrastructure protection can no longer depend principally upon network isolation, trusted internal connections, or the assumption that equipment controlling physical processes will remain beyond an adversary’s reach. The central security requirement is to preserve safe, authorised control of industrial operations even when an identity, engineering workstation, supplier connection, or adjacent digital system has been compromised. This represents a shift from defending the industrial network as a perimeter to defending individual operational capabilities, access pathways, and physical consequences.

The NSA’s 8 October 2026 Cybersecurity Information Sheet, Hardening Department of War Critical Operational Technology Environments with Zero Trust Principles, places particular emphasis on legacy systems whose operational importance has outlasted their original security architecture. Although directed primarily towards National Security Systems, Department of War environments and the Defence Industrial Base, the underlying risk applies to electricity networks, water treatment, transportation, industrial manufacturing, agricultural infrastructure, healthcare facilities and government buildings. The NSA explicitly identifies potentially catastrophic consequences for national security, economic security, public health and safety. NSA Releases Zero Trust Guidance for Protecting Operational Technology Systems — NSA — October 2026

The technical difficulty is structural rather than exclusively financial. Numerous operational technologies remain mechanically reliable while lacking capabilities associated with contemporary cybersecurity, including strong authentication, encrypted communications, detailed event logging, security updates and granular access enforcement. Unlike conventional enterprise computing, operational environments cannot necessarily tolerate aggressive vulnerability scanning, untested software changes, repeated authentication exchanges, additional communication latency or unscheduled shutdowns. Security measures that are appropriate for administrative networks may introduce unacceptable hazards when applied directly to industrial control systems.

The joint CISA guidance of 29 April 2026, Adapting Zero Trust Principles to Operational Technology, therefore rejects the indiscriminate transplantation of enterprise Zero Trust controls into industrial environments. Its governing principle is that security improvements must be compatible with the physical processes, availability requirements and safety constraints of the systems being protected. It recommends comprehensive asset visibility, supply-chain governance, identity and access management, network segmentation, secure remote access, tailored vulnerability management, monitoring and recoverability. Adapting Zero Trust Principles to Operational Technology — CISA, DoW, DOE, FBI and DOS — April 2026

The principal analytical judgment is that the highest immediate return will generally come from controlling pathways into legacy environments rather than attempting to retrofit every ageing controller with modern security functionality. The initial priorities should be to eliminate unmanaged external access, identify operationally consequential assets and dependencies, establish enforceable boundaries between industrial functions, protect engineering workstations, constrain privileged activity and validate that containment measures cannot interrupt essential control functions. These measures cannot eliminate vulnerabilities inside obsolete equipment, but they can reduce the opportunities for an initial compromise to become an industrial incident.

The distinction between a protected connection and an authorised physical action is particularly important. A maintenance contractor might authenticate successfully through an encrypted remote-access system yet still possess unnecessary rights to alter controller logic, disrupt adjacent devices or change operating parameters. A mature Zero Trust policy must therefore bind access to a verified identity, designated resource, permitted operation, approved maintenance purpose and defined duration, subject to operational authorisation.

The NSA’s reported selection of 26 high-impact activities from an 84-activity defence OT framework offers a potentially valuable prioritisation mechanism, particularly for organisations unable to replace legacy systems immediately. However, the existence of a defined activity catalogue must not be confused with verified implementation or demonstrated risk reduction. Regulators should distinguish control deployment from operational effectiveness and require evidence that a compromised account or workstation cannot acquire unauthorised control of critical processes.

The strongest unresolved quantitative issue is the absence of a sufficiently comparable, authoritative cross-sector inventory establishing the proportion of operational equipment that is ageing, unsupported, remotely accessible, or incapable of native Zero Trust enforcement. Without such baselines, national estimates of exposure and the effectiveness of proposed investments remain uncertain.

The resulting policy priority is a safety-led, consequence-based modernisation programme, combining near-term compensating controls with procurement requirements that progressively remove unsupported protocols, insecure configuration mechanisms, uncontrolled vendor dependencies and insufficient forensic visibility. Modernisation becomes urgent where an essential physical process cannot be adequately isolated, independently protected, safely recovered or operated within an acceptable residual-risk envelope.

The United States is demanding stronger cybersecurity assurances from critical infrastructure operators while much of the equipment responsible for essential physical processes cannot enforce them. The National Security Agency’s intervention of 8 October 2026 exposes a contradiction with direct consequences for national security, industrial investment and public finances: governments can require tighter control over digital access, but cannot legislate modern authentication, trustworthy logging or secure configuration management into controllers designed without those capabilities. Replacing entire industrial systems is expensive and operationally disruptive; leaving them connected through insufficiently governed access arrangements creates opportunities for hostile interference. The central policy question is therefore not how quickly operators can adopt Zero Trust terminology, but whether regulators can force a measurable reduction in the authority that compromised digital systems exercise over physical infrastructure without undermining the services they are supposed to protect.

The NSA Has Changed the Standard of Protection, Not the Equipment Beneath It

On 8 October 2026, the National Security Agency published Hardening Department of War Critical Operational Technology Environments with Zero Trust Principles , placing legacy operational technology within a security framework traditionally associated with enterprise networks and sensitive information systems. Its principal audience comprises National Security Systems, Department of War environments and the Defence Industrial Base, but the implications extend to electricity, water, transportation, manufacturing and government facilities.

The underlying shift concerns the definition of security. A facility is no longer adequately protected simply because its industrial network is separated from the internet or its maintenance connections are encrypted. An authenticated supplier can still possess excessive programming permissions; a compromised engineering workstation can still reach unrelated controllers; and a trusted internal application may retain the ability to alter operating parameters beyond its legitimate purpose.

The NSA’s guidance draws on a reported selection of 26 high-impact activities from an 84-activity framework , concentrating attention on measures intended to reduce consequential industrial exposure. The published announcement establishes the agency’s policy direction, although the complete activity-level catalogue requires separate verification before its individual measures can be ranked authoritatively.

This distinction matters because Zero Trust is not a substitute for industrial engineering. NIST SP 800-207, Zero Trust Architecture , establishes the principle that access to protected resources must depend on explicit policy rather than presumed trust arising from network location. In operational technology, however, the resource may be a controller capable of changing a physical process. The resulting decision must govern not merely who can connect, but who can observe, configure, programme or command a particular machine.

The Numbers Reveal a Governance Deficit Before They Reveal an Equipment Crisis

The most revealing evidence concerns the government’s incomplete knowledge of the systems it is attempting to secure.

In its report of 30 September 2026, the United States Government Accountability Office examined networked-device inventory requirements across 22 civilian federal agencies . Fifteen had established inventories, eleven were maintaining them, ten had included all required information, and only seven had satisfied all three requirements. That final figure represents 31.8% of the agencies examined .

GAO-26-108937, Internet of Things: OMB Action Needed to Ensure Agencies Secure Their Networked Devices

These figures do not measure the proportion of vulnerable industrial controllers in the United States. They reveal something more directly relevant to implementation: even organisations subject to central federal requirements struggle to maintain dependable records of networked equipment. An infrastructure operator cannot reliably restrict access to consequential industrial assets when it cannot establish what exists, which processes the equipment controls or which external systems retain administrative authority.

The scale of the civilian problem is considerable. In May 2026, GAO described a United States water and wastewater sector comprising close to 170,000 systems , with substantial differences in staffing, financial capacity and cybersecurity maturity. Separately, the Environmental Protection Agency reported in February 2026 that cybersecurity vulnerabilities had been identified at 277 water systems during 2025 through its assistance activities.

GAO-26-109159, Critical Infrastructure Protection: Actions Needed to Address Persistent Cybersecurity Threats to the Water and Wastewater Sector

EPA, EPA Actions Help Safeguard Water Systems from Cyberattacks — February 2026

Neither the 277 systems nor the federal inventory figures provide a national vulnerability prevalence rate. Their significance lies in the relationship between exposure, fragmented responsibility and the limited resources available to correct weaknesses.

The 2024 GAO investigation into CISA’s operational technology support activities documented a threat-hunting and incident-response service staffed, at the time examined, by four federal employees and five contractors . The officials involved considered this insufficient for simultaneous major incidents across multiple OT locations. Twelve of thirteen selected nonfederal organisations nevertheless reported positive experiences with CISA’s services, indicating that the problem concerned capacity and coordination as well as technical competence.

GAO-24-106576, Cybersecurity: Improvements Needed in Addressing Risks to Operational Technology

The fiscal contradiction is evident. Governments are expanding cybersecurity expectations across enormous and heterogeneous industrial estates while the institutions responsible for asset visibility, technical assistance and regulatory oversight still face documented implementation limitations.

Attackers Exploit Industrial Authority More Easily Than Operators Can Replace It

The vulnerability of ageing operational technology does not necessarily arise from sophisticated exploitation of industrial firmware. In many cases, the decisive weakness is an access relationship that permits an authenticated or network-connected party to exercise more authority than the physical process requires.

The joint advisory concerning Iranian Islamic Revolutionary Guard Corps-affiliated CyberAv3ngers operations documented at least 75 compromised devices in the United States between November 2023 and January 2024 , including at least 34 associated with water and wastewater systems . The campaign targeted Unitronics programmable logic controllers, exploiting exposed interfaces and inadequate credential protections.

CISA Advisory AA23-335A, IRGC-Affiliated Cyber Actors Exploit PLCs in Multiple Sectors — Updated December 2024

The distinction between access and consequence remains important. Documented activity included interference with controller configurations and restoration, but the number of compromised devices cannot be converted into a national estimate of physical damage. In November 2023, an affected water authority disconnected a compromised device and continued operating manually, with no known threat to the municipality’s drinking-water supply.

That incident illustrates the industrial value of independent operating capabilities. A cyber intrusion can remain limited when local controls, manual procedures and engineering safeguards prevent access to a digital interface from becoming irreversible control over a physical process.

State- prepositioning presents a different concern. The February 2024 joint advisory on Volt Typhoon described persistent access to American critical infrastructure networks by actors associated with the People’s Republic of China. The documented techniques included legitimate administrative tools and compromised credentials, highlighting the possibility of maintaining access without immediately causing physical disruption.

CISA, NSA, FBI and International Partners, PRC State- Actors Compromise and Maintain Persistent Access to U.S. Critical Infrastructure — February 2024

The industrial consequence is that a controller can remain mechanically reliable while becoming strategically exposed through its maintenance workstation, supplier connection or supporting identity system. Replacing that controller may require software migration, commissioning, safety validation and production downtime. Restricting the pathway through which it can be reached may produce earlier protection, but only if the restriction can distinguish authorised diagnostics from unauthorised programming.

Artificial intelligence intensifies the pressure without eliminating those engineering distinctions. The NSA’s October 2026 assessment identifies AI-assisted reconnaissance and faster exploitation as emerging operational concerns. Yet automated analysis of industrial documentation does not, by itself, establish reliable knowledge of a facility’s physical behaviour. The immediate risk is that established weaknesses can be discovered and exploited more efficiently while operators remain constrained by maintenance windows and equipment compatibility.

Procurement Determines Whether Today’s Workarounds Become Tomorrow’s Liabilities

The economic mechanism connecting cybersecurity to industrial policy lies in procurement.

A controller purchased without secure configuration management, useful event logging or independently maintainable software can impose costs throughout its operating life. The infrastructure owner may subsequently require additional gateways, monitoring systems, privileged-access platforms and specialist engineering support merely to compensate for capabilities that were absent from the original equipment.

On 13 January 2025, CISA and international partners published Secure by Demand: Priority Considerations for Operational Technology Owners and Operators when Selecting Digital Products . The guidance identified twelve procurement considerations , including secure defaults, strong authentication, secure communications, configuration management, logging, vulnerability management, upgrade tooling and operator ownership.

Secure by Demand — CISA and International Partners — January 2025

The commercially significant requirement is operator independence. A utility that cannot restore controller configurations without proprietary supplier infrastructure remains exposed to the availability, contractual conduct and technical support of that manufacturer. A factory whose engineering application requires an unsupported operating system may be unable to adopt ordinary security updates without threatening production continuity.

Secure procurement therefore changes the distribution of lifecycle costs. Manufacturers must be evaluated not only on equipment performance and purchase price, but also on authentication, configuration integrity, support obligations, restoration rights and the cost of operating their products securely over time.

The transition cannot be accomplished through procurement rules alone. Existing facilities may require protocol gateways, protected engineering environments, passive monitoring or controlled remote-access systems while replacement is planned. But these compensating controls must remain accountable investments, not permanent excuses for retaining equipment whose vulnerabilities cannot be sufficiently contained.

For defence production, the consequences extend into national industrial capacity. A compromised engineering platform may interrupt manufacturing or raise doubts the integrity of critical production configurations without requiring the attacker to damage machinery directly. The NSA’s October 2026 guidance accordingly places industrial access governance within the protection of defence-related operational capabilities, rather than treating it as an ordinary administrative IT problem.

Regulation Can Demand Assurance, but Cannot Create Maintenance Windows

The April 2026 interagency document Adapting Zero Trust Principles to Operational Technology addresses the limitation that general cybersecurity mandates can overlook: industrial processes cannot always tolerate continuous active inspection, repeated authentication exchanges, untested software modifications or unscheduled shutdowns.

Adapting Zero Trust Principles to Operational Technology — CISA and Partner Agencies — April 2026

A security gateway that prevents unauthorised access but delays a time-critical industrial communication may introduce a new hazard. A centrally managed identity service that improves accountability but blocks emergency maintenance during an outage may weaken operational resilience. A firmware update that removes a known vulnerability but invalidates an established controller configuration may impose costs that exceed the purchase price of the equipment itself.

Regulatory performance must therefore be assessed through tested outcomes. Operators should demonstrate that a compromised supplier account cannot access unrelated controllers, that programming authority is restricted to approved engineering functions, and that critical processes remain operable or safely recoverable when supporting digital infrastructure fails.

The United States already possesses evidence that administrative requirements can outpace implementation capacity. GAO’s September 2026 findings on federal inventories illustrate this difficulty, while its separate report on cybersecurity regulatory harmonisation recorded concerns from selected industry representatives overlapping and conflicting obligations, particularly in incident reporting.

GAO-26-109197, Cybersecurity Regulations: Industry Panelists Identify Duplication and Conflicts and Ways to Address Them — September 2026

A workable regulatory model would require comparable evidence of industrial protection without mandating identical products or architectures across fundamentally different physical processes. The standard should be demonstrable restriction of unauthorised control, documented engineering compatibility and credible restoration capability, not procurement of a prescribed cybersecurity platform.

Europe Shares the Exposure but Not a Single Regulatory System

For European infrastructure operators, the American transition towards OT Zero Trust intersects with an existing legal framework rather than entering a regulatory vacuum.

Directive (EU) 2022/2555, NIS2, establishes cybersecurity risk-management obligations for covered entities, addressing incident handling, business continuity, supply-chain security, asset management, access control and measures for evaluating cybersecurity effectiveness. Its requirements can support Zero Trust outcomes, but the Directive does not prescribe one identical technical architecture for every industrial installation.

Directive (EU) 2022/2555, Article 21 — European Parliament and Council — December 2022

The industrial implications differ across national economies. Italy must reconcile cybersecurity investment with the requirements of energy infrastructure, manufacturing and public-service operators managing heterogeneous equipment. France faces the interaction between industrial control security, critical energy functions, transport and defence-related facilities. Germany’s extensive manufacturing automation makes the relationship between supplier ecosystems, equipment compatibility and industrial maintenance particularly consequential. The United Kingdom shares many of the same technical exposures but operates through its own national regulatory arrangements.

The European Union’s Cyber Resilience Act, Regulation (EU) 2024/2847, adds a product-security dimension through horizontal cybersecurity requirements for products with digital elements within its scope. Its significance for industrial procurement is the movement towards stronger security responsibilities at the product level, although individual applicability and compliance dates must be determined under the Regulation rather than inferred from American guidance.

Regulation (EU) 2024/2847, Cyber Resilience Act — European Parliament and Council — October 2024

The January 2025 Secure-by-Demand initiative already involved cybersecurity authorities from several allied countries and European institutional participation. This creates scope for compatible procurement expectations and shared technical assurance, without eliminating differences in national law, industrial safety requirements or regulatory competence.

The industrial cost of divergence would arise where multinational manufacturers face inconsistent security specifications, while infrastructure operators must maintain incompatible evidence and reporting systems for equipment performing comparable functions. Regulatory convergence is valuable only if it reduces these costs while preserving demonstrable protection of physical processes.

The Twenty-Four Months Will Expose Who Has Authority Over Industrial Risk

Between October 2026 and October 2028, the decisive measure of progress will be whether infrastructure operators can move from declarations of cybersecurity maturity to verifiable control over access, configuration integrity and recovery.

The proposed 30-, 90- and 180-day implementation sequence offers a practical starting point: establish accountability and identify consequential exposure; restrict and validate the principal access pathways; then demonstrate containment and restoration under controlled compromise scenarios. These intervals are an analytical implementation proposal, not statutory deadlines or a verified NSA activity schedule.

The medium-term investment decision is equally concrete. Equipment that can be reliably isolated, maintained and restored may remain operational under tested compensating protection. Equipment whose configuration cannot be verified, whose privileged access cannot be controlled or whose recovery depends on unavailable supplier capabilities becomes a candidate for accelerated replacement.

The financial burden will fall unevenly. Large industrial and defence operators may be able to integrate security improvements into scheduled capital programmes. Smaller water utilities, municipal infrastructure organisations and financially constrained essential-service providers may face recurring expenditure on specialist support and protective systems without possessing the capital needed for comprehensive renewal.

Governments will face a corresponding choice between funding targeted technical assistance and accepting uneven implementation across operators delivering essential services. Regulators will bear the institutional burden of distinguishing documented compliance from demonstrated effectiveness, while manufacturers will face increasing pressure to include security and recovery capabilities in baseline equipment.

The cost of inaction will not be confined to the balance sheets of infrastructure owners. Where a successful intrusion interrupts electricity, water, transportation, healthcare support or defence production, the consequences can extend to customers, taxpayers, industrial supply chains and public authorities responsible for maintaining essential services.

The NSA’s October 2026 intervention has therefore made the underlying industrial contradiction harder to ignore: critical infrastructure remains dependent on equipment designed for long operational lives, while its digital access arrangements were not necessarily designed to withstand persistent adversarial compromise. Over the following twenty-four months, the credible measure of policy will be the number and significance of physical functions demonstrably protected—not the number of organisations claiming to have adopted Zero Trust.

Navigational Index — Three Strategic Pillars

Pillar I — Strategic Exposure, Adversarial Threats and the Legacy OT Constraint

Chapter 1. Strategic Context and Threat Environment

State- cyber operations, ransomware, AI-assisted threats, legacy infrastructure exposure, defence-specific requirements and sectoral risk across essential services.

Chapter 2. Technical and Operational Challenges of Legacy OT

Industrial controllers, SCADA systems, engineering workstations, insecure protocols, deterministic process requirements, unsupported equipment, safety systems and operational risk trade-offs.

Pillar II — Zero Trust Architecture, Compensating Controls and Industrial Modernisation

Chapter 3. Zero Trust Architecture Applied to Operational Technology

NIST architectural principles, NSA high-impact activities, identity and policy enforcement, resource-level authorisation, access governance and staged implementation.

Chapter 4. Compensating Controls, Segmentation and Operational Visibility

Industrial zones and conduits, controlled vendor access, privileged access management, passive monitoring, dependency inventories, safety separation, continuous verification and containment assurance.

Chapter 5. Procurement, Secure-by-Demand Requirements and Technology Improvement

Modernisation strategies, secure industrial procurement, protocol mediation, gateways, data diodes, equipment replacement, supplier accountability and governance of AI-enabled industrial analytics.

Pillar III — Government Implementation, Regulatory Assurance and Strategic Intelligence

Chapter 6. Implementation Roadmap, Risk Prioritisation and Governance

Risk-based sequencing, 30/90/180-day priorities, multiyear modernisation, engineering change control, sector-specific requirements, performance indicators, residual risk and regulatory oversight.

Chapter 7. Evidence Architecture, Analytical Methods and Priority Intelligence Questions

Primary-source hierarchy, OT dependency and consequence mapping, attack-path assessment, operational validation, programme evaluation, national exposure measurement and the priority intelligence requirements for regulators and national security authorities.

Master Abstract — The Strategic Transition from Network Trust to Physical-Process Assurance

The structural vulnerability of ageing industrial infrastructure

The fundamental cybersecurity problem facing operators of essential services is the growing divergence between the operational longevity of industrial technology and the security assumptions under which that technology was originally designed. Industrial equipment frequently remains economically useful long after its communications architecture, operating system, authentication mechanisms or vendor support arrangements have become obsolete. A controller that reliably operates a pump, regulates electrical equipment, supervises a railway subsystem or coordinates a building’s backup power supply may continue to satisfy its original engineering requirements while presenting vulnerabilities that cannot be resolved through conventional software maintenance.

This distinction matters because the consequences of compromised operational technology are not confined to information loss. An adversary who successfully penetrates an operational environment might interfere with industrial commands, manipulate measurements, interrupt supervisory visibility, alter equipment configurations or prevent personnel from restoring normal operations. The resulting effects depend upon the process architecture, existing protective systems, engineering safeguards and the degree of authority available to the attacker. Consequently, cybersecurity assurance must extend beyond the prevention of unauthorised network entry to the preservation of safe physical operation when some components can no longer be trusted.

The interagency CISA guidance documents these difficulties explicitly, identifying long equipment lifecycles, insecure industrial protocols, limited opportunities for intrusive testing, restricted maintenance windows and inadequate logging as persistent obstacles to modern cybersecurity implementation. These limitations make an unmodified enterprise security model inappropriate for many industrial environments. Adapting Zero Trust Principles to Operational Technology, pp. 6–8 — CISA and Partner Agencies — April 2026

The architectural significance of Zero Trust

The transition towards Zero Trust changes the basis on which access is granted. Under the framework established by NIST SP 800-207, the presence of a user, device or service inside a supposedly trusted network cannot, by itself, justify access to a protected resource. Access decisions must instead account for the identity of the requesting subject, the resource being accessed, relevant security conditions and the policy governing the intended operation. Applied to industrial environments, this model can significantly reduce excessive privileges and lateral movement, provided that policy enforcement does not introduce unacceptable hazards or impede legitimate industrial control.

The principal complication is that a substantial proportion of operational equipment cannot independently evaluate modern credentials, enforce granular authorisation or communicate securely. NIST SP 800-82 Revision 3 recognises that full Zero Trust integration may be impractical for certain programmable logic controllers, human-machine interfaces and other legacy components. Accordingly, it identifies the possibility of applying Zero Trust enforcement to compatible systems at higher architectural levels and around operational boundaries rather than requiring every industrial device to implement the same controls natively.

This creates a practical distinction between native Zero Trust capability, in which a resource can participate directly in identity and policy enforcement, and compensating Zero Trust protection, in which appropriately engineered gateways, segmentation controls, privileged-access mechanisms and monitored intermediary systems restrict access to a vulnerable resource. The distinction is essential for procurement, regulatory assessment and modernisation planning because the existence of a protective boundary must never be represented as proof that the underlying device has become intrinsically secure.

NIST SP 800-207, Zero Trust Architecture — NIST — August 2020 – NIST SP 800-82 Revision 3, Guide to Operational Technology Security, Section 5.2.3.4 — NIST — September 2023

Why implementation sequencing determines the security outcome

The highest-leverage implementation strategy is not necessarily the one that deploys the greatest number of security controls in the shortest period. Industrial safety and continuity require a sequence that first establishes what equipment exists, what physical process it supports, which communications are essential, who possesses the authority to change its state, and what consequences would follow from unauthorised access or loss of service. Without this knowledge, segmentation policies may interrupt necessary process communications, authentication changes may compromise emergency access, and security tools may create additional dependencies whose failure could affect normal control.

A defensible initial sequence therefore concentrates on establishing operational ownership, identifying critical dependencies, eliminating uncontrolled remote entry, isolating unnecessary pathways, protecting engineering workstations and creating passive visibility into relevant network and process activity. Subsequent stages can introduce more granular policy enforcement, stronger device identity, improved logging, protocol protections and replacement of unsupported components, subject to engineering verification and documented maintenance constraints.

The priority must be the demonstrated containment of physical consequences rather than the nominal deployment of products. A security programme should be judged by whether a compromised supplier account can still alter controller logic, whether an infected engineering workstation can communicate with unrelated safety-critical equipment, whether emergency operations remain possible during identity-system failure, and whether operators can restore a verified configuration without depending exclusively upon a compromised vendor environment.

The strategic importance of procurement, AI integration and institutional accountability

Cybersecurity improvements implemented around vulnerable equipment constitute a transitional protection strategy, not a permanent substitute for secure industrial design. Procurement requirements must progressively favour equipment supporting authenticated maintenance, trustworthy software and firmware updates, secure configuration management, adequate event recording, reliable recovery procedures and reduced dependence on unrestricted supplier access. The CISA interagency guidance specifically identifies procurement and supply-chain management as mechanisms for addressing security limitations that cannot be economically or safely eliminated from existing systems.

An additional challenge arises from connecting advanced analytics and artificial intelligence systems to industrial operations. Such systems may improve anomaly detection, maintenance planning and operator situational awareness, but they can also create new pathways between enterprise infrastructure, external data sources and equipment capable of affecting physical processes. The appropriate governing distinction is between systems that observe and recommend and systems that can independently authorise or execute physical control actions. For safety-critical operations, automated authority should remain bounded by independently enforced engineering constraints, approved operating envelopes, explicit change-control procedures and validated recovery arrangements.

The resulting requirement for government and regulators is to develop assurance regimes that evaluate whether cybersecurity controls preserve physical-process safety under realistic compromise conditions. Certification of individual products, the presence of a Zero Trust architecture, or a high percentage of completed implementation activities cannot independently establish this outcome. Effective regulatory oversight must combine technical evidence, engineering assessment, incident exercises, vendor accountability and measurable demonstrations of containment and recovery.

Key Evidence Table — Verified Institutional Baseline

Evidence integrity: The official NSA announcement was verified, but the complete underlying information sheet could not be directly retrieved for activity-by-activity validation during this research. The reported 26-of-84 selection is therefore not treated here as a fully audited activity catalogue. The NIST Revision 4 document remains a public draft, not a replacement final standard.

Preliminary Implementation Priorities — Analytical Assessment

The following sequencing is an analytical proposal derived from the documented constraints and controls in NSA, CISA and NIST guidance. It is not presented as the NSA’s official ranking of its 26 activities.

The proposed sequence must be modified where local engineering assessment identifies unacceptable physical consequences, particularly for safety instrumented systems, critical electrical protection, emergency shutdown functions and systems whose communications or timing requirements cannot tolerate additional enforcement components.

Compensating Controls Versus Replacement — Decision Framework

The principal decision is not whether compensation or replacement is intrinsically superior. It is whether the residual consequences of compromise remain tolerable under actual operating conditions, including loss of identity infrastructure, malicious access through a trusted vendor, failure of a security gateway and recovery from a compromised engineering workstation.

Principal Data Gaps and Watch Indicators

National exposure and equipment age. The available guidance establishes the existence and operational importance of legacy technology but does not provide a statistically representative inventory of obsolete controllers, unpatchable workstations, unsupported building automation systems or critical devices lacking authenticated communications. National-level regulatory planning requires a consistent measurement method distinguishing chronological age, end-of-support status, exploitable configuration and operational consequence.

Effectiveness of the NSA activity catalogue. The specific contribution of the 26 high-impact activities should be evaluated against actual compromise scenarios rather than inferred from implementation status. The decisive evidence would include controlled exercises, independently assessed containment outcomes and documented operational compatibility across different industrial architectures.

Remote-access governance. Regulators require evidence distinguishing access channels protected by encryption and multifactor authentication from sessions subject to genuine task-level authorisation, destination restrictions, operator approval and revocation. A technically protected connection may still confer excessive operational authority.

Safety and availability during enforcement failure. The most consequential test is whether enforcement infrastructure can fail without compromising necessary control, protection or emergency operations. Validation must distinguish the failure behaviour of monitoring gateways, access-policy services, identity dependencies, remote support infrastructure and controllers themselves.

Procurement and supplier dependency. Operators need evidence of whether manufacturers can supply security event logs, authenticated configuration mechanisms, secure updates, independently restorable backups, vulnerability information and supportable migration pathways without unacceptable cost or operational constraints.

AI-enabled operational authority. The principal emerging assurance issue is whether analytical or automated systems can indirectly acquire control authority through management interfaces, orchestration tools, maintenance platforms or engineering applications. Effective assurance must account for indirect control pathways, not only direct access to controllers.

Priority Intelligence Questions for Governments and Regulators

1. What proportion of safety-critical and high-consequence OT assets cannot support modern authentication, logging, encryption or reliable security maintenance?

2. Which of the NSA’s 26 high-impact activities are already implemented across defence, energy, water, transport, manufacturing and government facilities, and how consistently are their outcomes validated?

3. To what extent do privileged vendor connections create unmanaged pathways between enterprise networks and equipment capable of changing physical processes?

4. Which combinations of segmentation, controlled access and passive monitoring demonstrably prevent lateral movement without interfering with necessary communications?

5. What residual attack paths remain after compensating controls are implemented around unsupported industrial equipment?

6. How frequently do actual OT incident exercises demonstrate that safe operations can continue following compromise of an account, workstation, remote-access gateway or associated identity service?

7. Which supplier dependencies prevent operators from independently restoring controllers, verifying logic integrity or replacing unsupported software?

8. What procurement requirements would most effectively improve native security capabilities without creating disproportionate costs or excluding viable industrial suppliers?

9. What measurable differences exist in incident detection, containment, restoration time and physical consequences between mature and immature OT access-governance programmes?

10. Under what technical, economic and safety conditions should regulators require accelerated equipment modernisation rather than continued reliance upon compensating controls?

Net Assessment — Decision Consequences

The available official evidence supports a high-confidence judgment that ageing operational technology creates a persistent cybersecurity challenge that cannot be resolved through conventional enterprise security measures alone. The NSA’s October 2026 intervention, the April 2026 CISA interagency guidance and the NIST security publications converge on the need for layered protection, reduced implicit trust, controlled access and explicit consideration of safety and availability.

There is moderate confidence that prioritising remotely accessible pathways, engineering workstation integrity, industrial segmentation and operational visibility will yield substantial early risk-reduction benefits across many ageing installations. That judgment rests on the relationship between common attack pathways and the controls designed to restrict them, rather than on a verified cross-sector measurement of implementation outcomes.

There is limited confidence in any universal quantitative estimate of the national ageing-equipment population, the effectiveness of the 26 selected activities or the financial return from particular modernisation strategies. Those questions require additional sector-specific evidence, actual asset inventories and controlled operational validation.

For the European Union, Italy, France, Germany and the United Kingdom, the same technical principles are materially relevant, but U.S. national security guidance cannot be treated as automatically establishing European regulatory obligations. Subsequent analysis must distinguish the legal applicability of European and national cybersecurity requirements from the operational value of American guidance and international industrial-security standards.

The decisive strategic conclusion is that Zero Trust for operational technology must be understood as an engineering and governance discipline designed to preserve authorised physical control under conditions of digital compromise. Its effectiveness will ultimately depend upon the ability of public authorities and infrastructure operators to demonstrate that a successful intrusion into one component does not automatically confer the ability to disrupt an essential service.

The governing choice for policymakers is therefore not between maintaining ageing infrastructure and introducing new cybersecurity technology. It is between continuing to accept poorly characterised dependencies and establishing a measurable, safety-compatible transition towards infrastructure whose critical functions remain protected even when individual digital components cease to be trustworthy.

Trust boundaries around an ageing control estate

Conceptual topology, not a site design: authorised access, policy enforcement and industrial control must remain distinct.

Safety instrumented functions require independently engineered protections; do not assume the identity layer can replace physical safety barriers.

From network entry to task authority

Illustrative access policy proposed by this assessment, not a verbatim NSA policy rule.

Implementation priority, by intervention

The illuminated 3D bars show four qualitative stages of recommended sequencing , not effectiveness measurements or risk scores. Earlier-stage designation reflects the proposed order of implementation, not a quantified benefit.

Column positions, left to right: Stage 1 — initial controls; Stage 2 — boundary assurance; Stage 3 — capability upgrades; Stage 4 — major lifecycle changes. Exceptions may require immediate replacement if safety cannot be assured.

Compensating controls versus equipment replacement

Use the tabs to examine two documented decision dimensions. Content represents policy analysis grounded in the cited NIST/CISA framework, not measured comparative performance.

Sector-specific consequences and design focus

Select a sector to inspect process dependencies, the first protective boundary and the key assurance question. These are illustrative considerations, not sector incident rates.

Operational programme: from initial containment to secure procurement

Illustrative phases, contingent upon site maturity, safety assessment and authorised maintenance windows.

Chapter 1. Strategic Context and Threat Environment

Principal Strategic Judgment: Critical Infrastructure Cybersecurity Has Become a Question of National Operational Sovereignty

The strategic significance of operational technology cybersecurity in October 2026 extends well beyond the protection of industrial networks against unauthorised access. The central national security concern is the possibility that an adversary may acquire sufficient access to the digital systems governing physical infrastructure to influence the availability, integrity, reliability or safety of services upon which government authority, military readiness, economic production and civilian welfare depend. This exposure is particularly consequential in ageing industrial environments, where essential equipment often continues operating long after the manufacturers’ original cybersecurity assumptions, software support arrangements and communications technologies have become obsolete.

The National Security Agency’s cybersecurity information sheet, Hardening Department of War Critical Operational Technology Environments with Zero Trust Principles, published on 8 October 2026, should therefore be interpreted within a broader transition in national infrastructure protection policy. The agency’s emphasis on continuous verification, the assumption of possible compromise and the prevention of unauthorised lateral movement reflects recognition that industrial security cannot depend solely on the historical distinction between external networks and internally trusted control systems.

The NSA explicitly identifies consequences extending to national security, economic security, public health and safety, and highlights the possibility that hostile cyber operations may seek to deny, degrade, disrupt, deceive or destroy critical infrastructure capabilities. Its guidance is primarily directed at National Security Systems, Department of War environments and organisations within the Defence Industrial Base, although its technical implications extend to civilian infrastructure operators. The NSA also identifies the integration of advanced intelligent systems into operational technology as a source of additional attack surfaces and potential disruption opportunities.

NSA Releases Zero Trust Guidance for Protecting Operational Technology Systems — National Security Agency — October 2026

The importance of this development lies in the changing relationship between digital compromise and physical consequences. An enterprise network intrusion may expose confidential information, interrupt administrative services or enable financial extortion. A compromise involving operational technology may produce those same effects while also interfering with the physical processes that generate electricity, treat drinking water, regulate industrial temperatures, maintain transportation infrastructure, provide emergency power or protect hazardous industrial equipment.

These consequences are not automatic. Their severity depends on the design of the affected installation, the engineering authority available to the attacker, the presence of independent protective systems, the integrity of proc...