The National Security Agency (NSA) is urging operational technology owners in national security and defense settings to apply Zero Trust principles. Its October 8, 2026 Cybersecurity Information Sheet (CSI) identifies 26 high-impact activities from the Department of War’s (DoW) OT Zero Trust framework. The goal: replace implicit trust with verified identities and explicitly authorized connections across modern and legacy infrastructure.
What you’ll learn
- What the NSA’s 26 priority activities mean for OT operators
- Which attack paths Zero Trust can help disrupt
- How to protect modern and legacy assets within operational constraints
- How Xage supports access control, macro- and microsegmentation, data protection, visibility, and resilience
- Where to start without disrupting critical operations
What does the NSA’s OT Zero Trust guidance say?
The NSA prioritizes 26 high-impact activities for their ability to provide immediate compensating protection, particularly around legacy assets that cannot support modern security capabilities. The recommendations span ten priorities, from secure remote access and asset protection to safe validation of controls, and emphasize continuous verification and control of authorized actions.
The CSI, titled “Hardening Department of War (DoW) Critical Operational Technology (OT) Environments with Zero Trust (ZT) Principles,” primarily addresses National Security Systems, DoW, and Defense Industrial Base operators. Its principles are relevant to critical operations running modern equipment, legacy systems, or a combination of both. Newer assets also need protection against stolen credentials, excessive permissions, and unauthorized connections.
The ten priorities are:
- Secure remote access
- Protect OT data
- Inventory OT assets
- Enhance OT visibility
- Use OT cyber threat intelligence
- Harden smart controllers
- Strengthen macro- and microsegmentation and monitoring
- Secure engineering workstations and human-machine interfaces (HMIs)
- Harden Active Directory and domain controllers
- Verify and assess controls safely
Together, these priorities combine verified access, macro- and microsegmentation, data protection, and monitoring. Controls must preserve operational safety, availability, and reliability. The NSA recommends passive validation wherever possible to avoid disrupting sensitive equipment.
Which attacks is the guidance designed to disrupt?
The NSA highlights attacks that exploit implicitly trusted relationships, exposed devices, and static access controls:
- Volt Typhoon: The PRC-sponsored group uses native administration tools to spread laterally through compromised networks, pivot from IT toward OT, and maintain covert access for potential disruption.
- Iran-affiliated actors: Attacks on water-sector programmable logic controllers (PLCs) exploited internet exposure and default credentials on assets.
- Hacktivists: Remote-access misconfigurations and default passwords on assets opened paths into critical systems.
The NSA also warns that advanced AI can accelerate reconnaissance and exploit development. AI introduced into OT can also create new attack surfaces. Zero Trust helps disrupt the paths from initial access to physical-process manipulation.
Why do modern and legacy OT systems need layered protection?
Modern security features do not eliminate risk. Attackers can abuse stolen credentials or excessive privileges, or exploit software vulnerabilities without credentials. External access controls and macro- and microsegmentation help protect controllers, workstations, applications, and their communications regardless of equipment age.
Legacy systems add constraints: limited authentication, encryption, vendor support, or capacity for security agents. Even supported equipment may require extensive testing and a planned outage before patching. Gateways, protective enclaves, macro- and microsegmentation, and monitoring reduce exposure within these limits.
For controllers, digital commands become physical actions. Both new and aging equipment need controls over who can reach them and change configurations while hardening, patching, and upgrades proceed.
CSI recommends steps you can take now:
- Change default administrative credentials and disable unnecessary insecure services.
- Limit controller access to viewing only unless a role requires changes.
- Disable unused controller logic that attackers could repurpose.
- Apply macro- and microsegmentation to restrict controller communications; document exceptions and use compensating controls until hardening can be completed safely.
Why is access control central to OT Zero Trust?
A successful login should not grant access to an entire OT network. Access policies should specify which assets a user, device, or application may reach and which actions are permitted. Macrosegmentation separates operational zones; microsegmentation restricts connections between individual assets, including those in the same zone.
Authentication verifies identity; authorization limits permissions. If an attacker steals a valid account, asset-specific policies can restrict its reach and actions. Segmentation also reduces the paths available for exploiting vulnerabilities that require no credentials.
How Xage turns NSA guidance into enforced access controls
The Xage Fabric Platform overlays existing infrastructure with distributed, identity-based controls for modern and legacy OT assets. Central management provides consistent policy and visibility, while local enforcement supports distributed sites. Xage combines privileged access management (PAM), secure remote access, macro- and microsegmentation, asset protection, and secure data exchange to control interactions that put critical processes at risk.
How does Xage control remote and third-party access?
The CSI warns that remote access for vendors, original equipment manufacturers (OEMs), system integrators, and maintenance personnel “presents a significant risk to OT environments and has been a common vector in confirmed OT intrusions.” It recommends removing direct internet connections to OT, requiring phishing-resistant multifactor authentication (MFA), and making vendor access explicitly approved, time-bound, continuously monitored, and terminated as soon as the work is complete.
Where feasible, the NSA recommends routing vendor access through controlled gateways or privileged access management tools with session recording, auditing, and real-time oversight. Xage Extended Privileged Access Management (XPAM) and Secure Remote Access (SRA) provide that oversight, along with granular access policies, phishing-resistant MFA, just-in-time access, and credential management, for remote and local access across OT, IT, and cloud environments.
How does Xage contain lateral movement?
Lateral movement turns a single foothold into a broader operational incident. The NSA recommends both macro- and microsegmentation, including OT Plane Segmentation (Activity 5.3.1), Implement Micro Segmentation (Activity 5.4.1), and connection policies for authorized protocols and paths (Activity 2.2.1).
Xage Zero Trust Segmentation supports macrosegmentation between zones and microsegmentation down to individual assets. Teams can define zones and conduits aligned with IEC 62443, grouping assets by security requirements and controlling communications between groups. Identity-based, deny-by-default policies limit users, machines, and applications to approved assets, protocols, and paths—within zones as well as between them—to help contain compromise.
How does Xage shield assets while patches are pending?
Xage Critical Asset Protection hides protected assets from unauthorized discovery, brokers access, and restricts interactions to approved identities and communication paths. Its virtual patching approach reduces exposure by limiting how vulnerable systems can be reached without changing their underlying software. This applies to modern and legacy assets while teams test and schedule permanent fixes.
How does Xage protect OT data in motion?
Xage Zero Trust Data Exchange (ZTDE) controls which users, devices, and applications may exchange data across OT, IT, and cloud boundaries. Encrypted transfers, data fingerprinting, and integrity verification help protect confidentiality, authenticity, and integrity. Operators can share approved data without granting direct access to the segment or the asset that produced it.
How does Xage preserve control across directories and disconnected sites?
Xage supports multiple Active Directory instances and identity providers, with separate authentication and access policies across IT, DMZ, and OT layers. A user authenticated in IT can be required to authenticate again against the directory governing an OT segment. This helps prevent compromise of one directory from automatically granting access across other protected layers.
At appropriately deployed sites, Fabric nodes retain the credential and policy information needed for local authentication and approved access enforcement when cloud with WAN or local site LAN connectivity is unavailable.
How does Xage create evidence of controlled access?
Xage links access activity to the initiating identity, target asset, and privileged session. XPAM session recordings, transcriptions, and access logs help teams investigate who accessed which systems, when, and what occurred. This supports the NSA’s emphasis on passive validation through logs and configuration reviews, with active testing reserved for approved maintenance windows.
Xage Visibility-to-Policy (V2P) Studio discovers assets and shows their interactions so administrators can assign identities, group assets, and build macro- and microsegmentation and access policies from observed behavior. Blocked policy violations highlight potential threats, such as attempts to reach unauthorized assets or use disallowed communication paths, for investigation. Alongside XPAM’s session attribution, this connects visibility to enforceable access decisions.
Where should you start with OT Zero Trust?
Begin with one critical operational workflow, establish its access requirements, and expand based on evidence:
- Choose the operational function whose disruption would create the greatest safety, mission, or business impact.
- Inventory the employees, vendors, service accounts, devices, and applications that can affect it.
- Remove unnecessary exposure, default credentials, and dormant accounts.
- Enforce deny-by-default policies and macro- and microsegmentation, limiting access to required assets, protocols, permissions, and time windows.
- Validate through logs, configuration reviews, and passive monitoring; schedule active testing during approved maintenance windows.
- Expand to the next critical workflow after confirming safe operation and effective controls.
Key takeaways
- The NSA’s 26 priority activities provide a practical starting point for OT Zero Trust.
- Combine macrosegmentation across IT and OT zones with microsegmentation between individual assets to constrain lateral movement as AI accelerates attacks.
- Protect modern and legacy assets with PAM, phishing-resistant MFA, and layered controls, including when patches are delayed.
- Preserve safety and availability while validating that controls work.
- Xage combines identity-based access, macro- and microsegmentation, asset visibility, secure data exchange, and local enforcement.
Final thoughts
The NSA’s direction is clear: verify identities, authorize specific actions, and validate controls safely. Combine macrosegmentation between zones with microsegmentation around individual assets to limit an attacker’s reach. Xage helps apply these principles across modern and legacy OT. Start with one critical workflow and measure reduced exposure, clearer accountability, and stronger control over critical processes.
Ready to put the new NSA Zero Trust for OT Guidance into action?
- Learn more about how Xage helps federal agencies strengthen mission resilience from the strategic core to the tactical edge.
- Download the report to explore Xage’s support for the DoW Zero Trust Roadmap. Published as “Xage Support for DoD Zero Trust Roadmap,” the report details Xage’s support or applicability to each activity and function, with 90% full or conditional support across the roadmap.
- Talk to an expert about your OT priorities and identify a practical next step for your mission.
