The Department of Defense has issued new guidance detailing how its components must implement zero trust principles across operational technology environments.
The 28-page document titled Zero Trust for Operational Technology offers activities and outcomes that are specific to zero trust adoption for department-owned OT systems, DOD said.
Get updates on DOD’s zero trust journey at the Potomac Officers Club’s 2026 Cyber Summit on May 21. The event will bring together leaders from across the private and public sectors to network and discuss threats to American systems and innovations to defeat adversaries in the cyber domain. Reserve your spot at this critical GovCon conference by purchasing your tickets today.
What Is the Scope of the New Zero Trust Guidance?
The document applies to a wide range of operational technology, including industrial control systems, building automation, transportation and physical access control. These systems support functions in energy management, water treatment, logistics handling and facility operations.
According to the Pentagon, applying traditional IT security methods to OT may be ineffective or may create risk. OT environments, the document explained, rely on legacy equipment, specialized engineering expertise and safety-driven requirements.
The guidance comes a few months after DOD issued its Directive-Type Memorandum 25-003, which requires components to achieve Target Level Zero Trust across unclassified and classified systems.
It also aligns with existing DOD and U.S. government cybersecurity policies, including the Zero Trust Overlays, the Cybersecurity Reference Architecture and the National Institute of Standards and Technology’s Special Publication 800-82 for improving OT security.
