NSA Advocates Zero Trust for Aging Critical Infrastructure Security

• •NSA's guidance emphasizes zero trust for aging operational technology systems.
• •Legacy systems are particularly vulnerable due to outdated security measures.
• •The recommendations apply to critical infrastructure sectors like energy and healthcare.

On October 8, 2026, the NSA released guidance urging the implementation of zero trust principles to protect aging operational technology systems, which are increasingly vulnerable to cyber threats. The guidance highlights the need for controlled access, segmentation, and monitoring to secure critical infrastructure sectors, including energy, water, and healthcare. It emphasizes that legacy systems often lack modern security capabilities, making them susceptible to attacks. The NSA's recommendations are particularly aimed at National Security Systems and the Department of War, but they also apply broadly to operators of essential services. The guidance reflects a shift from traditional network isolation to a focus on securing individual operational capabilities. The NSA warns of potentially catastrophic consequences for national security and public safety if these systems remain unprotected. The report aligns with previous CISA guidance from April 2026, which also addressed the unique challenges of securing operational technology environments.