New Pentagon Guidance on Zero-Trust Cybersecurity for Operational Technology

The Department of Defense (DoD) has recently released a comprehensive document that outlines the application of zero-trust cybersecurity principles specifically tailored to operational technology (OT) systems. Posted by the Pentagon’s Chief Information Office in November, this guidance delineates the essential activities and outcomes necessary for integrating zero-trust protocols into OT environments.

Key Components of the Guidance

This directive encompasses 105 distinct zero-trust activities for implementation across OT systems, categorized as follows:

• Minimum Target Levels: 84 essential activities
• Advanced Levels: 21 activities that go beyond the foundational requirements

These activities are further segmented into seven critical pillars:

1. Users
2. Devices
3. Applications and Workloads
4. Data
5. Networks and Environments
6. Automation and Orchestration
7. Visibility and Analytics

Understanding Zero Trust in Context

The zero-trust model operates on the premise that networks cannot be inherently trusted. Organizations must continually monitor and authenticate users and devices, mitigating the risk of compromise. This has prompted the Pentagon to address cybersecurity for both Information Technology (IT) and OT environments since initiating its zero-trust strategy in 2022.

Operational technology—which encompasses programmable systems and devices that interact with the physical environment—includes a variety of critical systems, such as:

• Facility control systems
• Electrical grids
• Energy management systems
• Various transportation systems
• Certain components integral to weapon systems

For instance, while a power supply for a weapon can fall under the purview of OT systems, the internal targeting mechanisms must still adhere to different protocols.

Layered Approach to OT Environments

The guidance differentiates OT systems into two distinct layers:

1. Operational Layer: Responsible for executing real-time operations
2. Process Control Layer: Focused on the control of devices and system processes

Due to the inherent complexities and specialized nature of OT environments—often relying on legacy equipment and requiring specialized competencies—it becomes necessary to tailor the implementation of zero-trust principles specifically for OT.

Unique Challenges and Strategic Implementation

The document acknowledges that, while fundamental tenets of zero trust, such as data protection, strong authentication, and network segmentation, are relevant to OT, adapting these principles requires flexibility to address unique constraints and priorities. Notably, the challenges inherent to OT systems necessitate modifications to the activities and outcomes outlined in standard zero-trust frameworks.

• Key Considerations:
  • Legacy equipment requires distinct approaches in monitoring and authentication
  • High specialization of workforce necessitates a different training and implementation strategy

The Pentagon’s OT-focused zero-trust guidance aims to align outcomes with those of IT systems. A synergistic approach allows for smoother interoperability between IT and OT strategies, promoting a unified safeguarding method across the defense landscape.

Future Directions and Timelines

While the Pentagon has mandated that all components reach specified zero-trust target levels for IT systems by the end of fiscal 2027, no definitive timeline has been established for OT environments yet. However, an updated Zero Trust Strategy is expected to be published by early 2026, which will include additional guidance not only for OT systems but also for weapon systems and defense-critical infrastructure.

This strategic framework reflects the DoD’s commitment to adapting modern cybersecurity practices to evolving threats and the unique characteristics of operational environments, positioning the Defense Department to respond effectively amid increasing sophistication in cyber adversarial tactics.