The National Security Agency (NSA) has released new guidance aimed at strengthening the security of critical operational technology (OT) environments, particularly those with legacy systems that cannot easily support modern security tools. The guidance, published on October 8, 2026, emphasizes applying Zero Trust principles to reduce attack paths in OT systems, which often operate for decades without updates. The NSA warns that adversaries are using AI to accelerate attacks, making it crucial to protect critical infrastructure that supports national security, economic stability, and public safety.
The NSA's Information Sheet, titled "Hardening Department of War (DoW) Critical Operational Technology (OT) Environments with Zero Trust (ZT) Principles," outlines 26 prioritized activities across ten key areas. These include remote access, OT data, asset inventory, visibility, cyber threat intelligence, smart controller hardening, network segmentation, and engineering workstations. The guidance is designed to help operators secure OT systems without assuming they can be replaced or taken offline.
Cisco Security and Splunk offer solutions to implement these recommendations. Cisco Cyber Vision provides visibility into OT assets and communications, while Splunk integrates IT, OT, user, and inventory data for investigation and response. Together, these tools support a layered approach to access, segmentation, monitoring, and risk management, ensuring operational requirements remain central. The NSA's seven Zero Trust pillars provide a framework for these activities, emphasizing interconnected security measures.
One challenge highlighted is the need to secure systems that lack modern authentication, encryption, or patch support. Cyber Vision sensors use deep packet inspection to passively observe industrial communications, identifying assets and protocols. This inventory supports NSA activity 2.1.1, which calls for a centralized record of OT assets. Teams must verify findings, record criticality, and assign owners to build a comprehensive security baseline.