As plants connect OT systems to corporate networks and contractors gain more remote access, the idea that "inside the network means safe" no longer holds. Zero Trust is relevant to OT, but it must be adapted, because OT exists to protect people and keep production running, not just to protect data.

INFOGRAPHIC
A Zero Trust access path into OT
01
User or contractor
Not trusted by default, even inside the organization
02
One remote access point
MFA, time and permission limits, session recording
03
Intermediate zone (DMZ)
Only defined communication allowed (deny by default)
04
Control zone
PLCs and HMIs sit behind controlled conduits
INFOGRAPHIC
A step-by-step Zero Trust start for OT
1
Know what is on the network
Passive asset inventory, no active scanning of old devices
2
Define zones and conduits
Separate IT from OT first, then sub-zones per IEC 62443
3
Control remote access
One entry point with MFA, limited rights, session recording
4
Monitor with OT awareness
Learn normal behavior before writing alert rules
5
Expand zone by zone
Do it in maintenance windows and review each time

Why OT differs from IT, and why Zero Trust can't be copied as-is

  • Availability and safety come first: stopping a production line or disturbing the control process affects lives and assets
  • Old equipment with long lifecycles: many PLCs and HMIs run for decades and can't be patched, or only during maintenance shutdowns
  • Protocols without authentication: older industrial protocols such as Modbus were designed without authentication or encryption
  • No agents on devices: most controllers can't run the monitoring software used on ordinary computers
  • Vendors and contractors need remote access: a path attackers often use

Zero Trust principles that adapt to OT

  • Know what is on the network: build an asset inventory by passively observing traffic first, rather than actively scanning, which can freeze old devices
  • Define zones and conduits: the approach in IEC 62443 states which zone may talk to which, through which conduit, and blocks everything else (deny by default)
  • Control remote access: route everyone through one controlled entry point with MFA, per-task time and permission limits, and session recording
  • Least privilege by role: control engineers, operators, and contractors should reach only what they need
  • Monitor with OT-aware tools: detect abnormal commands or communication against the process's normal behavior
  • Use compensating controls when patching isn't possible: for example, place risky devices behind an internal firewall and limit communication to what is necessary

Cautions when applying Zero Trust to OT

  • Never let cybersecurity measures affect process safety: test off the line or during maintenance shutdowns
  • Be careful with active scanning: some older devices respond abnormally or stop when scanned
  • MFA where fast response matters: stations that need immediate access in an emergency need a purpose-built process, not the same rule as office staff
  • Change one zone at a time: segmenting the whole plant at once risks cutting communication the process depends on

How to start Zero Trust in OT

  • Build a passive asset inventory: know which devices exist and who talks to whom
  • Segment by criticality: start by clearly separating IT from OT, then create sub-zones within OT
  • Close uncontrolled remote access: send everyone through one entry point with MFA and session recording
  • Deploy passive monitoring: learn normal behavior before writing alert rules
  • Expand by risk: go zone by zone during maintenance windows and review the results each time

The best first step: control remote access

Find out who can reach your OT systems remotely and by which paths, then consolidate them into one path with MFA and session recording. It is the highest-value step with the least impact on production.

Before changing segmentation in OT, rehearse in a lab or digital twin. See the overview in Network and Cyber Security Simulators: Types and Uses.

For the broader enterprise architecture, see Zero Trust Architecture: Components and Roadmap.

For passive network monitoring that does not require installing software on devices, see NDR Explained: Network Detection and Response.

For an overview of the IEC 62443 standard this article cites, covering its structure, roles and security levels, see IEC 62443 Explained: Industrial Control System Security.

When OT devices cannot be patched, compensating controls are needed. For how to plan patching and group assets, see Patch Management Best Practice: Fast, Without Outages.

References and further reading