OT zero trust: are identity controls and segmentation keeping up?

TL;DR: New federal guidance for operational technology makes Zero Trust the operational baseline, according to Xage Security, but only when it is adapted for high availability, legacy equipment, and safety constraints that can be broken by active scanning, dynamic isolation, or direct IT and OT identity coupling. The real governance shift is that OT trust must be enforced at access time and asset level, not assumed at the perimeter.

Editorial analysis by NHI Mgmt Group, based on content published by Xage Security: “Navigating the New 2026 US Government Interagency Guidance: Adapting Zero Trust for OT with Xage Security”.

Key questions

Q: What breaks when Zero Trust is applied to OT without safety-aware design?

A: Zero Trust fails in OT when it assumes enterprise-style flexibility.

Q: Why does weak third-party software oversight increase risk in converged IT and OT environments?

A: Weak third-party oversight increases risk because modern operational environments depend on external software, device stacks, and remote connectivity that can become attack paths.

Q: How should security teams handle third-party remote access to industrial systems?

A: Treat third-party access as a governed exception, not a permanent support channel.

Practitioner guidance

• Define OT trust boundaries by asset and protocol Document which PLCs, RTUs, edge systems, and control applications need separate policy zones, then enforce access based on process criticality and protocol sensitivity rather than broad network membership.
• Separate OT identity from enterprise directory paths Review where Active Directory or other shared identity systems are used directly in OT, then break cross-domain coupling with layered ICAM, MFA, and tightly scoped roles.
• Restrict third-party remote access to controlled entry points Require hardened termination hosts, session recording, and JIT access for vendors and contractors so that remote support does not become a standing lateral-movement path.

Bottom line: The article argues that OT Zero Trust has to be adapted to safety, uptime, and legacy constraints rather than copied from enterprise networks.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →