Zero trust removes implicit trust from network location and requires access decisions to be based on verified identity, device or service condition, policy and context. NCSC guidance emphasises knowing the architecture and identities, assessing health and behaviour, authorising through policy, authenticating and authorising across the environment, monitoring users/devices/services and not trusting any network by default.[4]
Those principles remain useful in operational technology, but their implementation must respect a different order of priorities. OT controls physical processes. A security change that interrupts protection, control or visibility can create consequences more serious than the cyber risk it was intended to reduce. The objective is therefore not to force every controller, sensor or safety system to behave like a modern enterprise endpoint. It is to remove unnecessary trust at the safest enforceable points around the process.
Identity first does not mean identity everywhere
Many legacy devices cannot support modern authentication, endpoint agents, strong cryptography or rapid certificate rotation. Some protocols were designed for deterministic behaviour on isolated networks. Retrofitting controls directly onto them can be unsupported, untestable or unsafe.
The practical pattern is to strengthen identity at the points where people, services and zones meet: privileged access workstations, jump hosts, remote-access gateways, engineering workstations, management servers, API brokers and controlled conduits. These become policy enforcement points. Behind them, older assets can remain stable while access to them becomes attributable, time-bound, least-privileged and observable.
Sequence matters
| Phase | Purpose | Actions |
|---|---|---|
| 1. Discover | Know what must not be interrupted | Map assets, flows, owners, safety dependencies, vendors, remote access and recovery constraints; observe passively where possible |
| 2. Stabilise access | Remove unmanaged entry paths | Inventory accounts; close direct vendor links; introduce controlled remote access, MFA where supportable, approvals and session recording |
| 3. Segment | Limit lateral movement and fault propagation | Define zones and conduits by process consequence; enforce only required flows; preserve safety and deterministic communications |
| 4. Add identity context | Make access decisions attributable | Use named identities, PAM, device certificates or workload identity at gateways and management tiers |
| 5. Monitor safely | Detect misuse without destabilising control | Centralise gateway, identity and network telemetry; baseline behaviour; tune alerts with operators |
| 6. Exercise and improve | Prove isolation and recovery | Test isolation plans, break-glass access, manual operation, backups and staged restoration during agreed windows |
Segment by consequence, not by organisational chart
Good segmentation groups assets and communications according to process function, safety consequence, exposure and required interaction. The resulting zones may not align with sites, departments or IP subnets. Conduits between zones should carry only known flows, through controlled and monitored paths.
Start with the highest-consequence boundaries: enterprise-to-OT access, internet or supplier connectivity, inter-site links, safety-related systems, engineering access and management tiers. NCSC secure-connectivity guidance for OT emphasises balancing risk and opportunity, limiting exposure, centralising and standardising connections, hardening boundaries, limiting the impact of compromise, logging connectivity and establishing an isolation plan.[5]
Microsegmentation can add value, but it is not the opening move in an estate with incomplete asset knowledge. Enforcing a policy against an unknown dependency can stop a process. Build visibility, validate flows with engineers and introduce controls in monitor-only or staged modes before blocking.
Design for degraded identity and disconnected operation
A central identity provider can strengthen control and simultaneously become an operational dependency. The architecture must state what happens when identity, DNS, time, certificate validation, logging or the WAN is unavailable. Critical functions may need locally cached decisions, bounded offline credentials, resilient local authorities or carefully controlled break-glass procedures.
These mechanisms should not become permanent bypasses. They need constrained scope, dual authorisation where proportionate, strong recording, periodic exercise and automatic review after use. The question is not whether exceptions exist; it is whether they are deliberate, bounded and recoverable.
What to leave alone
| Asset or condition | Why direct change may be wrong | Safer compensating pattern |
|---|---|---|
| Unsupported PLC, RTU or protection device | Firmware or agent change may invalidate support or safety evidence | Isolate the zone; restrict engineering paths; monitor passively; retain tested spares |
| Deterministic or latency-sensitive control flow | Inline inspection may introduce jitter, delay or failure modes | Enforce at an upstream conduit; allowlist known flows; use out-of-band monitoring |
| Safety instrumented system | Cyber change can affect certified safety function and independence | Preserve separation; tightly govern maintenance access; validate with safety authority |
| Vendor-dependent legacy system | Unapproved hardening can prevent support or recovery | Contractual controls; mediated remote access; session recording; tested recovery image |
| Stable isolated enclave with no business requirement to connect | Connectivity may add more risk than value | Keep it isolated; control media and maintenance; document and periodically verify the boundary |
Controls that usually deliver early value
- One controlled route for remote and third-party access, with named identities, approval, time limits and recording.
- Dedicated privileged access workstations or hardened jump services for engineering and administration.
- Removal of shared or default accounts where technically safe; vaulting and rotation where removal is not possible.
- Network zones and allowlisted conduits around high-consequence processes and management tiers.
- Passive asset discovery and network monitoring, validated with site engineers.
- Protected offline configuration backups, golden images, spares and rehearsed restoration.
- An isolation plan that states who can disconnect what, under which conditions, and how safe operation continues.
Measures that show whether it is working
| Measure | What it reveals |
|---|---|
| Percentage of OT access paths under managed identity and recording | Whether unmanaged entry routes are actually disappearing |
| Number and age of shared, default and dormant privileged accounts | Identity debt and accountability gaps |
| Approved versus observed flows across critical conduits | Policy drift, hidden dependencies and anomalous connectivity |
| Time to isolate a zone while maintaining safe operation | Whether containment is operationally credible |
| Successful restoration of representative controller/configuration backups | Whether recovery evidence exists beyond backup completion |
| Third-party sessions attributable to an individual and work order | Whether supplier access is governed in practice |
About TIS Global
TIS Global helps organisations design, assure and deliver secure digital transformation in complex and regulated environments. We bring together strategy, enterprise architecture, cyber security, cloud and operational delivery to turn policy into services that work in the real world.
References and further reading
[1] Ministry of Defence, “Secure by Design - a new way to manage cyber risk in capabilities” (30 May 2023).
[2] Ministry of Defence, “Secure by Design: User-centred guidance on Digital MOD.UK” (10 February 2025).
[3] Ministry of Defence, “Secure by Design: Two Years of Building a More Resilient MOD” (13 August 2025).
[4] National Cyber Security Centre, “Zero Trust” collection, reviewed 16 January 2026.
[5] National Cyber Security Centre, “Secure connectivity principles for operational technology (OT)”.
[6] National Cyber Security Centre, “Cyber Assessment Framework”.
© TIS Global 2026 | These papers provide general guidance and does not replace legal, safety or system-specific assurance advice.