The Cybersecurity and Infrastructure Security Agency, along with the Department of War, Department of Energy, Department of State and the FBI, have released new guidance to help organizations apply zero trust principles to operational technology, or OT, systems.
Zero trust is a major point of discussion at the 2026 Cyber Summit, a GovCon event hosted by the Potomac Officers Club on May 21. Learn more about the evolving cyberthreat landscape and the push toward zero trust ahead of the 2027 deadline. Secure your spot today!
What Does the New CISA Guidance Cover?
CISA said Wednesday the document, titled “Adapting Zero Trust Principles to Operational Technology,” offers practical guidance for OT owners, operators and zero trust practitioners on addressing challenges and prioritizing key areas for integrating zero trust into OT environments.
The guide outlines how organizations can address challenges such as legacy system limitations, operational constraints and safety requirements associated with physical processes. It highlights priorities including defining zones and conduits, managing supply chain risks and strengthening identity and access controls.
“The Department of War is driving Zero Trust for operational technology at an accelerated pace,” said Kirsten Davies, DOW chief information officer and 2026 Wash100 Award winner. “In lockstep with our federal and industry partners, we are fortifying the infrastructure and interconnected weapon systems our Warfighters demand to fight and win.”
Why Is Zero Trust Adaptation Necessary for OT?
As OT systems become more interconnected, digitally monitored and remotely operated, they face expanding attack surfaces and heightened cyber risks. Threat actors can potentially access IT and OT networks through weakly secured pathways. CISA Acting Executive Assistant Director for Cybersecurity Chris Butera noted activity from groups such as Volt Typhoon targeting OT systems to gain persistent access.
Butera will be a keynote speaker at the 2026 Cyber Summit. Don't miss his enlightening comments and the chance to engage with him in Q&A! Register now for the May 21 event.
Other CISA Cybersecurity Efforts
CISA recently released an alert warning organizations of malicious cyber activity targeting endpoint management systems. The agency recommended strengthening configurations against potential threats. In January, CISA issued new recommendations to help critical infrastructure entities and state, local, tribal and territorial governments address insider threats.
