co-authored by Tom Bier, Leader, Solutions Engineer – Splunk

You can’t protect what you can’t see—and in OT, finding out can’t mean putting operations at risk. Controllers and other industrial systems may run for decades, often without the ability to support modern security tools or tolerate disruptive changes. The National Security Agency’s (NSA) new guidance offers operators a timely way to rethink protection around those realities: apply Zero Trust principles while keeping safety and availability in view.

Why now? The NSA warns that attacks on critical infrastructure can threaten national and economic security, public health, and safety. It also points to adversaries using AI to speed up reconnaissance and exploit development, while OT environments face the enduring challenge of legacy technology. Released October 8, 2026, the guidance is a call to reduce the paths attackers could use to reach or move through critical systems—before an intrusion becomes an operational disruption. (Read the NSA announcement)

What does the NSA Information Sheet “Hardening Department of War (DoW) Critical Operational Technology (OT) Environments with Zero Trust (ZT) Principles” cover? It distills the broader DoW Zero Trust guidance into 26 prioritized activities across ten areas: remote access, OT data, asset inventory, visibility, cyber threat intelligence, smart controller hardening, network segmentation and monitoring, engineering workstations and HMIs, Active Directory and domain controllers, and safe verification of controls.

The guidance is designed to help teams strengthen protections around OT systems, including legacy assets, without assuming those systems can simply be replaced or taken offline. (Read the Information Sheet)

The seven DoW Zero Trust pillars (User, Device, Application & Workload, Data, Network & Environment, Automation &Orchestration, and Visibility & Analytics) provide an architecture lens for the NSA’s ten OT mitigation areas. They’re complementary: a single OT priority can support several pillars; Figure 1 presents an illustrative crosswalk of the NSA’s 26 activities and the 10 priority areas.  The NSA describes the pillars as interconnected.

The Cisco Security portfolio helps organizations put these priorities into practice. Cisco Cyber Vision can provide visibility into OT assets and communications, while Splunk can provide a common data fabric to bring IT, OT, user and inventory data together in support of investigation and response. Together with the broader Cisco Security portfolio and sound OT procedures, these capabilities can inform a layered approach to access, segmentation, monitoring, and risk decisions—while keeping operational requirements central.

Put visibility around systems that cannot be modernized overnight

The NSA Cybersecurity Information Sheet recognizes that OT assets may lack modern authentication, encryption, or patch support, and controller changes can affect physical processes. Zero Trust must account for these constraints. Organizations can begin by establishing what is present, what each asset does, and how it communicates.

Cyber Vision sensors use deep packet inspection (DPI) to passively observe industrial communications and identify assets, protocols, and relationships. Figure 2 shows a Cyber Vision IOx App embedded in supported Cisco switches and routers, collecting metadata for Cyber Vision. Optional active discovery sends protocol-aware queries to enrich asset information; operators should scope and validate queries with control engineers, particularly sensitive controllers.

That inventory supports NSA activity 2.1.1, which calls for a centralized and current record of OT non-person entities and attributes such as type, manufacturer, firmware, address, location, and services. Passive discovery reduces manual effort, but teams still need to verify findings, record criticality, assign owners, and include accounts, applications, and configurations. The baseline should connect each asset’s identity to its process role and expected communications.

Turn communications into a security baseline

Cyber Vision aggregates sensor data and provides inventory, communication maps, analytics, behavior monitoring, alerting, and reporting. Its maps help teams see how workstations, Human Machine Interfaces (HMIs), controllers, and servers communicate. Comparing observed paths with approved process flows can surface new assets, unusual protocols, or unexpected connections.

This supports the NSA’s visibility priority and helps inform connection policy activity 2.2.1 and log analysis activity 7.1.2. Cyber Vision provides evidence and alerts; local process knowledge is needed to distinguish suspicious behavior from maintenance or production changes. Splunk broadens this visibility to the larger ecosystem of users, devices, and workstations that interact with the OT infrastructure, providing upstream visibility where threat actors could move laterally.

Cisco documents posture features that can include vulnerability information, risk scoring, intrusion detection on supported platforms, and behavior monitoring. These signals help prioritize investigation and remediation when patching is constrained. They do not mean that every OT vulnerability is exploitable, that a risk score is a compliance determination, or that patching can be skipped. The NSA recommends a risk-based patch process that accounts for testing, vendor support, maintenance windows, and operational impact.

Teams should use Cyber Vision findings to inform that process and document compensating controls when a timely fix is not safe or available.

Use the asset map to plan segmentation, then enforce it

The NSA prioritizes segmentation that limits lateral movement and permits only required communications. features include segmentation policy definition and simulation. By grouping assets into functional zones and reviewing observed flows, teams can develop policies based on how the industrial process operates. This can support IEC 62443 zone-and-conduit planning and the NSA’s OT micro-segmentation activity 5.4.1.

Visibility and policy design are not the same as enforcement. Cyber Vision can help identify assets, relationships, and candidate rules; enforcement is carried out by the network and security controls selected for the site, such as supported Cisco smart switching infrastructure, Cisco ISE, or Cisco Secure Firewall. Start with a documented allowed-flow model, test proposed rules against operational requirements, and roll out changes in controlled stages with rollback plans. In a safety-critical environment, an overly broad or incorrect block can disrupt production just as a permissive rule can expose it.

An effective Zero Trust design uses the inventory and observed behavior as inputs to access decisions. It does not treat a device as trusted simply because it sits on an OT subnet. Where supported, policy can account for asset identity, role, zone, communication need, and operational context. Human approval should remain part of changes that could affect critical processes, consistent with the NSA’s emphasis on safe validation and availability.

Constrain remote maintenance to the asset and task

Third-party and vendor access is a recurring path into industrial environments. The NSA recommends removing direct Internet connections to OT, requiring strong authentication, limiting access to approved users and resources, making sessions time-bound, monitoring activity, and terminating access when work is complete. Those controls matter even when a vendor has a legitimate maintenance need.

The architecture diagram shows a Cyber Vision Remote Access Broker for defining and enforcing remote access policy. Cisco’s current product materials describe OT-oriented Zero Trust Network Access capabilities powered by Cisco  with least-privilege access based on identity and context. Depending on the deployment and supported hardware, Cyber Vision sensors and a remote-access gateway can run on the same network device. Cisco describes controls such as MFA or SSO, time schedules, protocol restrictions, and user posture checks; capabilities depend on the selected product, platform, and configuration.

This design can mediate access to specific OT assets. Organizations still need identity lifecycle processes, approved vendor accounts, suitable MFA—including phishing-resistant MFA where required—and session oversight and emergency access procedures. Validate controls against site policy and mission requirements; governance determines who may connect, for what purpose, and with whose approval.

Extend a local view across sites and security operations

The Site Manager tier supports multisite health monitoring and centralized software updates, with a cloud proxy option for air-gapped deployments. This helps coordinate distributed centers; disconnected environments still need an update process that respects their security boundaries.

Splunk as an OT telemetry and correlation layer

Splunk is an important component for fully realizing Zero Trust in an OT environment.  It provides a mechanism to combine, visualize and correlate data from the broader IT ecosystem, acknowledging the increasingly connected nature of OT systems.  Utilizing the Cyber Vision Splunk App, OT data can be visualized on its own for compliance reporting or combined with other data sources including threat intel.  See Cisco’s Cyber Vision and Splunk integration guide for supported versions and setup details. This common data fabric across IT and OT directly supports several of the NSA priorities including:

• For activity 2.1.1 (Inventory NPEs in OT Environments), Cyber Vision device profiles give Splunk an OT asset context that can be combined with enterprise inventories; teams still need to validate criticality, ownership, and completeness.
• For activity 7.1.2 (Log Parsing in OT Environments), searches can parse and correlate Cyber Vision events and flows with identity, firewall, remote-access, and workstation logs to help define normal behavior and surface deviations.
• For activities 7.5.1 and 7.5.2 (OT Cyber Threat Intelligence Program Parts 1 and 2), Splunk can bring OT telemetry together with authorized threat-intelligence feeds and help route prioritized alerts into response workflows. Splunk supplies the analysis and coordination layer.
• File activity under activity 4.4.3 (OT File Prioritization and Monitoring) also requires logs from an appropriate workstation or file-monitoring source; Cyber Vision alone does not establish file integrity monitoring.

Analysts can use the combined view to investigate whether an OT alert aligns with a remote vendor session, a new enterprise identity event, or an unexpected path to a critical controller. Splunk SOAR provides an automation capability to improve analyst productivity while keeping a human in the loop for OT related changes.  Many serious threats are the progression of low-level attacks over a long period of time.  By automating the investigation of routine low severity attacks, SOAR provides a mechanism to correlate seemingly separate incidents over time.  Threat response actions can then be coordinated via automated ticket creation in various help desk systems while still requiring a human to perform actual changes to production systems

Cyber Vision also integrates with Cisco XDR. Response procedures should account for physical consequences: isolating a device or blocking a flow requires clear authorization, impact assessment, and recovery steps.

Validate controls without putting production at risk

The NSA explicitly recommends passive validation where possible, including configuration audits, log analysis, and SPAN or TAP monitoring. Cyber Vision’s passive traffic analysis fits this approach by observing communications without injecting packets into normal industrial traffic. Active discovery is a separate capability and should be used only when appropriate, scoped, and coordinated. More intrusive testing should follow approved maintenance windows and protect sensitive Level 0 and Level 1 equipment.

Level 0 (The Process Level): This is the physical equipment that performs the actual industrial process. It includes the sensors, valves, motors, actuators, and transducers that interact directly with the environment. These devices are purely physical and generally have no computing power or network connectivity of their own.

Level 1 (The Basic Control Level): This level consists of the controllers that communicate directly with the Level 0 devices. This includes Programmable Logic Controllers (PLCs), Remote Terminal Units (RTUs), and Distributed Control System (DCS) controllers. These devices execute the logic that runs the machines and processes.

The NSA guidance prioritizes passive monitoring. By using Cisco Cyber Vision to monitor traffic via SPAN/TAP, you gain full visibility into the communications of Level 1 controllers and their interactions with the network without ever needing to “touch” the controllers directly, effectively eliminating the risk of accidental disruption.

A practical sequence is:

• To establish an asset baseline, identify critical equipment and owners, document normal communications, review remote access, and model segmentation changes.
• Test policies in simulation or a controlled environment, obtain OT and safety approval, and deploy incrementally.
• Monitor operational effects and verify expected access after each change.
• Build a measurable path to stronger OT security

The NSA Cybersecurity Information Sheet presents Zero Trust as a complementary approach to existing cybersecurity practices in order to strengthen legacy OT through compensating controls. Cyber Vision helps implement ZT principles by contributing asset and communications visibility, posture insights, segmentation planning, controlled remote access, and OT context for security operations.

Operators still need authoritative inventories, identity and account governance, controller hardening, patch and configuration management, enforcement points, safe change control, and trained OT personnel. Joined to current visibility, these practices support better-informed access decisions and focused investigations while keeping safety, reliability, and mission continuity central.

Summary

The NSA’s new OT guidance turns Zero Trust into practical direction for protecting critical OT operations: 26 prioritized activities across 10 areas, aligned to the DoW’s seven pillars. Cisco’s Security Portfolio can help organizations translate those priorities into a plan grounded in their own environment. Cisco Cyber Vision can help teams build visibility into OT assets and communications, while Splunk can bring relevant security data into investigation and response workflows.

Start by identifying what is connected and how it communicates, then use those insights to prioritize gaps, coordinate protections across the seven pillars, and track progress against the NSA’s activities.

Sources

• NSA, Hardening Department of War Critical Operational Technology Environments with Zero Trust Principles (October 2026)
• Cisco Cyber Vision Data Sheet
• Cisco Cyber Vision At a Glance
• Cisco Cyber Vision sensor deployment documentation
• Cisco Cyber Vision and Splunk integration guide
• Cisco Comply 2 Connect (C2C)