NIST SP 800-82r4 and Zero Trust: What the New Guidance Means for OT Security

NIST SP 800-82r4 brings Zero Trust principles into its updated OT security architecture guidance, but it does not require organizations to implement a complete Zero Trust Architecture (ZTA). Instead, the draft connects Zero Trust for OT with controls such as per-session authorization, privileged access management (PAM), strong identity, content verification, and continuous monitoring—while recognizing that many OT devices cannot fully participate in ZTA and that security controls must preserve operational availability and safety.

What Is NIST SP 800-82r4?

Published as an initial public draft on September 21, 2026, Revision 4 of NIST's Guide to Operational Technology (OT) Security updates NIST's guidance for securing OT while accounting for the performance, reliability, and safety requirements that distinguish industrial environments from traditional IT. The revision is structured around the NIST Cybersecurity Framework (CSF) 2.0 and expands guidance in areas including asset management, network monitoring and detection, enterprise risk management, Industrial Internet of Things (IIoT) and cloud convergence, and OT security architecture.

For Zero Trust specifically, the key addition is Section 5.3, “Integrating Zero Trust Principles in OT.” Its treatment is notably more nuanced than simply bringing an enterprise IT Zero Trust model onto the plant floor.

Revision 4 is still an initial public draft, with public comments open through November 30, 2026. SP 800-82 Revision 3 remains the current final version.

What Does NIST SP 800-82r4 Say About Zero Trust for OT?

NIST SP 800-82r4 states: “A zero trust architecture (ZTA) is a cybersecurity paradigm that focuses on protecting resources… by authorizing access decisions closer to the resource being requested and continuously evaluating them rather than implicitly granting access.” 

At its core, NIST frames Zero Trust around reducing implicit trust and making authorization more granular and continuous.

The draft contrasts this with conventional perimeter-oriented approaches, where users considered trusted within the network may receive relatively broad access, creating opportunities for lateral movement.

NIST also recognizes that network boundaries are becoming less distinct thanks to “the growing prevalence of distributed computing, wireless and cellular communications, and cloud and hybrid cloud environments.”

In this context, NIST says organizations “might consider incorporating the principles of zero trust” into their security architecture.

This language is important: NIST does not mandate Zero Trust for OT. It also does not suggest organizations need to start from scratch. The draft notes that existing OT controls may already embody Zero Trust principles and could provide a foundation for broader ZTA implementation.

How Does NIST SP 800-82r4 Apply Zero Trust Principles to OT?

In SP 800-82r4, NIST explicitly states:

• Organizations may consider incorporating Zero Trust principles into their OT security architecture

• Privileged access management is the “clearest expression of zero trust”

• Strong, verifiable identity is a basis for authorization decisions

• Continuous monitoring supports ongoing evaluation of trust

• “Many OT components (e.g., PLCs, controllers, HMIs) do not support the technologies or protocols required to fully integrate with a ZTA implementation.”

Together, these points show that NIST treats Zero Trust in OT as a combination of identity, privileged access, continuous evaluation, and selective implementation based on what the underlying technologies can support.

In practical terms, this means NIST does not suggest ripping out existing infrastructure simply to accommodate ZTA. Instead, it recognizes that many OT components cannot fully participate and points toward applying Zero Trust principles where they make sense within the existing environment.

Privileged Access Management: A Starting Point for OT Zero Trust

One of the clearest statements in the new guidance concerns privileged access.

What NIST says: SP 800-82r4 describes privileged access management (PAM) as the “clearest expression of zero trust.” NIST describes an access manager that authorizes privileged sessions individually. Controls can include least-privilege entitlements, time-bounded authorization, and the ability to terminate a live session.

The draft also says extending this continuous-evaluation model to non-privileged access is a natural next step toward ZTA.

What this means for OT teams: Authentication does not have to create broad or standing trust. Access can instead be controlled around the individual session: who needs access, which resource they need, what privileges are required, and how long that access should remain available.

This is particularly relevant to OT environments where employees, administrators, OEMs, contractors, and other third parties may require privileged access to critical systems but do not necessarily need unrestricted access to the surrounding network.

Why Shouldn’t IT Trust Automatically Extend to OT?

Zero Trust depends on knowing who or what is requesting access, but in OT this raises an additional question: whose identity should the OT environment trust?

What NIST says: SP 800-82r4 recognizes strong, verifiable identity as the basis for authorization decisions and specifically discusses credential separation between enterprise IT and OT.

The draft contends identity verification for OT access should not simply inherit trust from the enterprise identity domain. It describes a dedicated OT authentication server as one possible way for a ZTA policy engine to evaluate identity independently, reducing the possibility that a compromised enterprise credential could automatically satisfy an OT authorization check.

NIST acknowledges shared credentials as a challenge for Zero Trust. ZTA depends on being able to identify the person or non-person entity requesting access, which becomes more difficult when credentials are shared.

What this means for OT teams: Identity integration can simplify administration, but organizations must consider the consequences if the enterprise identity environment is compromised. Zero Trust should reduce implicit trust between IT and OT rather than just extending an authenticated IT user's trust into operational systems.

For organizations still heavily dependent on shared or generic OT accounts, identity and privileged-access controls may therefore be prerequisites for more advanced Zero Trust capabilities.

Integrating IT and OT identity systems may simplify administration, but it can also create a trust path between the two environments. NIST therefore emphasizes that OT access decisions should not automatically inherit trust from the enterprise identity domain.

Organizations that still depend heavily on shared or generic OT accounts may need to reduce that reliance before they can apply Zero Trust effectively.

Continuous Monitoring Makes Authorization an Ongoing Decision

In a Zero Trust Architecture, authorization is not a one-time decision made when a session begins. Access is continuously reassessed as user behavior, session activity, and other relevant conditions change.

In a Zero Trust Architecture, authorization is not a one-time decision made when a session begins. Instead, access is continuously reevaluated based on ongoing monitoring rather than relying solely on the initial authorization decision.

What NIST says: SP 800-82r4 describes continuous monitoring as the feedback loop that allows a Zero Trust model to reconsider access after the initial authorization decision. Monitoring provides information that can be used to adjust or revoke trust in near real time.

What this means for OT teams: For privileged and third-party sessions, authentication is only the starting point. Teams also need visibility into what the user is doing, which systems they are touching, and whether their activity still matches the approved purpose of the session. If that activity falls outside the approved policy, access can be restricted or terminated.

Zero Trust Does Not Have to Reach Every PLC or HMI

Perhaps the most important qualification in the new guidance is NIST's acknowledgement that Zero Trust cannot necessarily be implemented directly on every industrial asset.

What NIST says: Many PLCs, controllers, and HMIs simply do not support the technologies or protocols required to fully integrate with a ZTA implementation.

In light of this reality, NIST suggests organizations should consider applying ZTA to compatible technologies, particularly at the functionally higher levels of an OT architecture. The draft gives Purdue Model Levels 3, 4, and 5 and the OT DMZ as examples.

What this means for OT teams: Implementing Zero Trust does not require every legacy industrial asset to become a modern Zero Trust endpoint.

Organizations can apply Zero Trust controls at compatible points in the architecture, including around systems that can’t support modern identity and security capabilities themselves. This makes a phased approach much more realistic for industrial environments where legacy and modern technologies routinely coexist.

Zero Trust Controls Must Not Become an Operational Risk

NIST also makes clear that the security architecture itself needs to respect OT requirements.

What NIST says: Organizations should consider whether ZTA implementation could adversely affect operations, including through increased latency when responding to resource requests or loss of availability if ZTA components become unavailable.

Recognizing OT’s non-negotiable priorities, NIST says implementations should minimize latency and provide adequate redundancy to reduce risks to safety and system availability.

What this means for OT teams: Zero Trust cannot be evaluated on security functionality alone. The architecture also has to meet the availability, reliability, performance, and safety requirements of the environment it protects.

For an industrial organization, a security control that becomes a single point of failure or interferes with legitimate access to a critical system can introduce operational risk of its own. This is one of the most important differences between implementing Zero Trust in an enterprise IT setting and applying the same principles to OT.

What Does NIST SP 800-82r4 Say About ZTNA and Remote OT Access?

Remote access is one area where NIST explicitly discusses Zero Trust technology.

In its discussion of cloud and IIoT convergence, SP 800-82r4 identifies a “remote access/ZTNA architecture” in which cloud-hosted identity, broker, or Zero Trust access services sit between remote users and the OT environment. NIST cites remote engineering, vendor support, and administrative access as common use cases.

Still, ZTNA is presented as one option within a broader remote-access architecture, rather than as a universal replacement for VPNs.

When evaluating remote-access approaches, organizations should consider what they want to happen after a user is authenticated. Should the connection provide broad access to the OT environment, or should connectivity be limited to the specific systems and privileges required for the task? The answers to these questions will help determine whether ZTNA or a VPN-based approach is more appropriate for a given use case.

How Cyolo Supports Zero Trust Principles in OT

The Cyolo PRO (Privileged Remote Operations) access solution supports many of the principles highlighted in SP 800-82r4 with an architecture that’s purpose-built for OT and the legacy systems, availability requirements, and operational constraints common in industrial environments.

Identity-based, least-privilege access. Cyolo PRO uses identity-based access policies to connect employees, vendors, and other remote users directly to approved OT assets rather than extending broader network access. Access can be limited by resource, time, privilege, and session, with controls such as Just-in-Time and supervised access helping organizations apply least-privilege and Zero Trust principles.

Consistent with NIST’s guidance that OT authorization should not automatically inherit trust from the enterprise identity domain, Cyolo PRO’s decentralized architecture allows organizations to keep enterprise identity and OT access decisions separate. The platform can integrate with enterprise identity providers, while OT teams retain control over who can access their environments and under what conditions.

Continuous session visibility and control. Cyolo PRO extends controls beyond the initial authentication decision with session monitoring, recording, supervision, and auditing. Administrators can monitor activity and terminate sessions when necessary, allowing access to be supervised and revoked even after a session has begun. The recently introduced Session Intelligence capability further improves visibility by turning session recordings into searchable transcripts and structured timelines, helping teams investigate incidents faster.

Verification of files entering the OT environment. Cyolo PRO can intercept files transferred during active RDP, SSH, SFTP, and SMB sessions and scan them with multiple OPSWAT MetaDefender AV engines before they reach OT assets. Depending on the policy decision, the file can then be blocked or delivered, with the action captured in session logs.

Zero Trust controls for legacy OT. NIST notes that many PLCs, controllers, HMIs, and other OT components cannot support Zero Trust capabilities on their own. To address this challenge, Cyolo PRO extends identity-based access, multi-factor authentication (MFA), and session controls to legacy systems without requiring agents on target assets or forcing organizations to replace or upgrade existing OT infrastructure.

Availability-conscious architecture. NIST also warns that Zero Trust controls should not introduce unacceptable latency or availability risks. Cyolo PRO is designed around OT requirements, with a decentralized architecture intended to avoid single points of failure and support low-latency, high-availability operation across on-premises, cloud-connected, hybrid, and offline environments. 

The Bottom Line: Zero Trust for OT Must Reflect OT Reality

NIST SP 800-82r4 gives industrial organizations a more practical framework for applying Zero Trust principles to OT. Rather than assuming every device can participate in a complete Zero Trust Architecture, the draft emphasizes strong identity, granular access, continuous evaluation, and implementation that accounts for legacy technology and operational constraints.

For OT teams, the goal is not to implement Zero Trust everywhere at once. It is to reduce unnecessary trust where doing so meaningfully improves security—without introducing new risks to the availability and safety of critical operations.

Frequently Asked Questions About NIST SP 800-82r4 and Zero Trust