Zero Trust for Manufacturing: What the New NSA OT Guidance Means for Operational Risk

Manufacturers depend on access.

Employees need access to systems.

IT teams need administrative access.

Vendors may need remote access for support.

Applications need to communicate with one another.

Operational technology may depend on networks, servers, identity systems, cloud services, and other supporting technology.

The security challenge is making sure that access remains appropriate.

On October 8, 2026, the National Security Agency released new guidance on applying Zero Trust principles to operational technology environments. The guidance is primarily intended for National Security Systems, Department of War environments, and the Defense Industrial Base, but NSA also states that the concepts are applicable to technical leaders, IT managers, and OT managers and administrators more broadly. Read the NSA announcement

For manufacturing leaders, the important takeaway is not that every plant now needs to implement a federal Zero Trust architecture.

It is much simpler:

Do not assume a user, device, vendor, system, or network connection should be trusted solely because it is already inside the environment.

Instead, understand who is connecting, what they are connecting from, what systems they need to reach, what they are permitted to do, and how that activity can be monitored.

That makes Zero Trust a business-risk conversation, not just a cybersecurity architecture discussion.

What Does Zero Trust Mean for a Manufacturer?

Zero Trust is a security approach that requires access to be explicitly verified rather than automatically trusted because a user or system is already connected to the network.

NSA summarizes the concept as assuming compromise is possible and continuously verifying users, devices, workflows, and communications.

In a manufacturing environment, that can translate into practical questions:

• Who is requesting access?
• What device are they using?
• What system do they need?
• Why do they need access?
• What permissions should they receive?
• How long should that access remain active?
• What other systems can they reach from there?
• Is the activity being monitored?

Zero Trust does not mean assuming employees or vendors are malicious.

It means avoiding unnecessary trust assumptions.

That distinction matters because manufacturing environments can include legacy technology, remote-support connections, business systems, cloud applications, and operational systems with very different technical capabilities.

Why Did NSA Issue Zero Trust Guidance for Operational Technology?

NSA's October guidance focuses on the challenge of applying Zero Trust principles to operational technology, including environments where legacy systems may not support modern security controls directly.

NSA says the guidance is intended to help organizations move from traditional perimeter-based security toward architectures where access is more deliberately verified and controlled. Read the NSA Zero Trust OT guidance announcement

The release also follows NIST's September 2026 draft update to its Guide to Operational Technology Security, which includes expanded guidance around asset management, network monitoring, security architecture, and Zero Trust principles. Review NIST SP 800-82 Revision 4

The NIST document remains an initial public draft, with comments due November 30, 2026. It should not be presented as a new mandatory manufacturing regulation.

Together, the NSA and NIST publications point toward a broader security principle:

Operational environments should not depend entirely on a trusted network perimeter.

Manufacturers need to understand and control the identities, devices, systems, and connections operating inside that perimeter as well.

Zero Trust for Manufacturing Starts With Knowing What You Depend On

Before a manufacturer can determine what access should be trusted, leadership needs to understand what technology supports the operation.

That includes more than the machinery on the production floor.

Production may depend on:

• Identity and authentication systems
• Servers
• Network infrastructure
• Firewalls
• Remote-access systems
• Workstations
• Cloud applications
• File servers
• Microsoft 365
• ERP platforms
• Production-planning systems
• Vendor connections
• Backup infrastructure

This is where OT security and IT risk begin to overlap.

A production system may be operational technology, but the user connecting to it may authenticate through an IT-managed identity platform.

A vendor may support equipment remotely through IT-managed network infrastructure.

A production process may rely on data coming from a business application or server outside the plant floor.

That means the question should not only be:

"How secure is the machine?"

It should also be:

"What does the machine, process, or production team depend on?"

AvTek's Managed IT Services support manufacturers with monitoring, cybersecurity, network and server management, cloud infrastructure, backup and disaster recovery, and technology risk management.

Understanding those supporting dependencies is an important part of operational resilience.

Vendor Remote Access Is a Good Place to Apply Zero Trust Thinking

Manufacturers often depend on external vendors to support technology.

That support may be completely legitimate and operationally necessary.

But legitimate business need should not automatically translate into unlimited access.

Before granting or maintaining vendor remote access, manufacturers should be able to answer:

• Which vendor is connecting?
• Which individual is using the access?
• How is that person authenticated?
• Which system can they reach?
• Can they reach anything else from that system?
• Does the access remain permanently enabled?
• Is the activity monitored?
• Can access be disabled quickly?
• Is the vendor using shared credentials?
• Who approves changes to the access?

This is where Zero Trust becomes practical.

The organization is not refusing to trust the vendor.

It is defining the exact level of trust required for the task.

For manufacturers with internal IT teams, AvTek's Co-Managed IT Services include capabilities such as Privileged Access Management, Multi-Factor Authentication, password and credential management, network-device monitoring, Microsoft 365 security, endpoint management, managed detection and response, and backup support.

Those types of controls can help support a more deliberate approach to privileged and remote access without requiring the internal IT team to give up control of strategy or risk decisions.

Identity Matters Even When the System Is Operational Technology

Zero Trust places significant emphasis on identity.

That includes human identities, such as employees and vendors, as well as devices, applications, and services.

In practice, a manufacturer should understand:

Who is connecting?

How are they proving their identity?

What are they authorized to access?

What actions can they perform after access is granted?

These are different questions.

A user may successfully authenticate but still have more access than they need.

A legitimate administrator account may become dangerous if its credentials are compromised.

A vendor employee may legitimately work for an approved partner but still not need permanent access to every system.

That is why identity verification and authorization should work together.

Privileged Access Deserves Additional Attention

Some accounts can make changes that ordinary users cannot.

They may be able to:

• Modify system configurations
• Create accounts
• Change permissions
• Install software
• Alter security controls
• Manage network equipment
• Access servers
• Change backup settings
• Modify authentication methods

Those accounts carry greater authority.

A manufacturer should know:

• Who has privileged access
• Why they need it
• How that access is authenticated
• Whether privileged credentials are shared
• When permissions were last reviewed
• Whether activity can be logged
• How access is removed when it is no longer needed

AvTek's Cybersecurity Services include controls around MFA, privileged access, identity monitoring, network security, endpoint protection, and security assessments.

The goal is not to prevent administrators from doing their jobs.

It is to make sure elevated authority is intentional and reviewable.

Network Location Should Not Automatically Equal Trust

Traditional security models often placed significant emphasis on the boundary between the internal network and everything outside it.

If a device was inside the perimeter, it might receive broader trust.

Zero Trust challenges that assumption.

A device or account already inside the environment can still be compromised.

A poorly segmented system may allow an authorized connection to reach more technology than intended.

A remote-access account may provide access beyond the system the vendor actually needs.

The practical manufacturing question becomes:

If this user, device, or account were compromised, how far could the access travel?

That is where network architecture, segmentation, identity, permissions, and monitoring begin to work together.

NIST's September draft OT guidance specifically expands its discussion of security architecture, network monitoring, and Zero Trust concepts while recognizing OT's unique performance, reliability, and safety requirements. Review the NIST OT security draft

Zero Trust Does Not Mean Applying IT Controls Blindly to OT

This distinction is important.

Operational technology is not simply another office workstation.

NIST's OT security guidance specifically recognizes that OT environments have unique requirements involving performance, reliability, and safety.

That means a cybersecurity control that works perfectly in a corporate IT environment may not be appropriate to deploy in exactly the same way on a production system.

For example, security changes may need to account for:

• Production schedules
• Equipment availability
• Vendor support requirements
• Legacy-system limitations
• Safety requirements
• Maintenance windows
• Reliability expectations

That is why the objective should not be:

"Apply every modern security tool directly to every machine."

The better objective is:

"Understand the risk and determine where appropriate security controls can be applied without creating unacceptable operational consequences."

Sometimes that means controls around the system rather than changes to the system itself.

Legacy Technology Does Not Mean "Do Nothing"

Manufacturers may operate equipment designed to remain in service for many years.

Some systems may not support:

• Modern authentication
• Endpoint security agents
• Current encryption methods
• Frequent patching
• New operating systems

That can make security more complicated.

It does not make security impossible.

The NSA guidance specifically addresses applying Zero Trust principles in OT environments with technical limitations and legacy technology. It emphasizes protective approaches that can strengthen security even when the underlying equipment cannot easily be modified. Read the NSA announcement

Manufacturers can still evaluate:

• Remote-access controls
• Identity management
• Network architecture
• Segmentation
• Monitoring
• Administrative access
• Vendor connectivity
• Backup and recovery
• Supporting IT infrastructure

The presence of legacy equipment makes understanding those surrounding controls more important, not less.

Monitoring Is Part of the Trust Decision

Zero Trust is not only about deciding whether access should be granted.

Organizations also need visibility into what happens after access is granted.

Depending on the environment, manufacturers may want to understand:

• Which user connected
• Which device was used
• When access occurred
• Which system was reached
• Whether administrative changes were made
• Whether activity was unusual
• Whether a vendor connected outside an approved window
• Whether an account attempted to reach unexpected systems

NIST's current OT security draft specifically includes expanded guidance around network monitoring and detection. Review NIST SP 800-82 Revision 4

Monitoring helps turn access decisions into something the organization can verify rather than simply assume.

For internal IT teams that need additional monitoring capacity, AvTek's Co-Managed IT Services include infrastructure monitoring, managed detection and response, network-device monitoring, alerting, and incident-response escalation.

Zero Trust and Backup Are Different Controls, but Both Support Resilience

Zero Trust focuses on reducing inappropriate access and limiting what happens when an account, device, or connection cannot automatically be trusted.

Backup and recovery answer a different question:

What happens if an incident still disrupts the systems the business depends on?

Manufacturers should understand both.

A strong access-control strategy does not eliminate the need for recovery.

A good backup does not eliminate the need for identity and access security.

AvTek's Data Backup and Disaster Recovery Services support manufacturing and other businesses with backup monitoring, recovery planning, off-site protection, reporting, and business-continuity support.

For manufacturing leadership, the important question is broader than:

"Do we have backups?"

It is:

"Can we restore the IT systems and information the operation depends on when we need them?"

That makes recovery planning part of operational risk management.

Zero Trust Should Include Service Accounts and Non-Human Access

Not every connection is made by an employee.

Applications, services, automated processes, and other technologies may also authenticate and communicate.

Manufacturers should understand:

• Which service accounts exist
• What systems they can access
• Whether their credentials are managed
• Whether they have excessive permissions
• Whether anyone still knows what they are used for
• What would happen if the account were compromised

These accounts can become easy to overlook because no employee logs into them every morning.

But they may still have meaningful authority within the environment.

The same Zero Trust principle applies:

Access should have a purpose, a defined scope, and appropriate oversight.

Start With an Access and Dependency Map

Manufacturers do not need to start a Zero Trust initiative by replacing every system.

A more practical starting point is understanding the environment.

Map:

Critical Business and Production Functions

Which functions would materially affect production if unavailable?

Supporting Technology

Which IT and operational systems support those functions?

Users

Which employees need access?

Vendors

Which external providers can connect?

Privileged Accounts

Which identities can make administrative changes?

Connections

How do users, vendors, systems, and applications connect?

Dependencies

What identity, network, cloud, server, or business systems need to work for the critical process to operate?

Recovery

What needs to be restored first after a disruption?

This creates a clearer picture of risk before deciding what needs to change.

AvTek's vCISO Services specifically support construction, manufacturing, and engineering organizations with cybersecurity risk management, protecting critical systems, policy development, vendor-risk discussions, incident-response planning, security recommendations, and structured cybersecurity programs.

That can help manufacturers move from isolated security decisions toward a broader risk-management strategy.

What Should Manufacturers Review After the New NSA Guidance?

The NSA guidance does not mean every manufacturer needs to launch a large Zero Trust transformation project.

It does provide a useful reason to review several practical areas.

1. Remote Access

Who can connect from outside the organization?

2. Vendor Access

Which vendors have active credentials or persistent connectivity?

3. Privileged Accounts

Who can make significant system or security changes?

4. Authentication

How are sensitive users and connections verified?

5. Permissions

Do users and services have more access than they need?

6. Network Paths

Can a compromised account or device reach systems beyond its intended purpose?

7. Monitoring

Can the organization determine who connected and what they did?

8. Legacy Systems

Which systems cannot support modern controls directly, and what protections exist around them?

9. Dependencies

Which IT systems support production-critical operations?

10. Recovery

Can critical supporting systems be restored after an incident?

The point is not to check a "Zero Trust" box.

It is to reduce unnecessary trust and make access more intentional.

Zero Trust Is Also a Leadership and Governance Issue

Technical teams can implement controls.

Leadership still needs to decide what level of risk is acceptable.

Manufacturing leaders should understand:

• Which operations are most critical
• Which systems support those operations
• Which vendors create important dependencies
• How much remote access is necessary
• Who owns cybersecurity decisions
• What downtime the organization can tolerate
• Who leads the response when something goes wrong

Those are business decisions.

Zero Trust provides a security model.

Risk management determines how that model should be applied to the organization.

This is especially important when IT and operational teams have different priorities.

IT may prioritize confidentiality and security controls.

Operations may prioritize availability, reliability, and safety.

A good cybersecurity program has to account for both.

Frequently Asked Questions About Zero Trust for Manufacturing

The Goal Is Not Zero Trust Everywhere. It Is Less Unnecessary Trust.

"Zero Trust" can sound like a large technical transformation.

For many manufacturing leaders, the useful idea is much simpler.

Do not assume a connection is safe because it already exists.

Do not assume an account should keep its permissions because it had them last year.

Do not assume a vendor needs permanent access because they occasionally provide support.

Do not assume a device is trustworthy solely because it is located inside the plant.

And do not assume production security stops at the production equipment.

The technology supporting manufacturing operations increasingly crosses IT, networks, identity, vendors, cloud systems, remote access, and operational technology.

The stronger question is:

Who or what can reach the systems our operation depends on, and have we intentionally decided that they should?

That is where Zero Trust becomes operational risk management.

AvTek Solutions helps manufacturers strengthen that foundation through Managed IT Services, Co-Managed IT Services, Cybersecurity Services, Data Backup and Disaster Recovery, and vCISO Services.

If your manufacturing environment has grown over time through new systems, vendors, remote connections, and legacy technology, this is a good time to review which identities and systems have access to the technology your operation depends on.

Talk with AvTek about your manufacturing cybersecurity risk