Zero trust below Level 3: what to apply, what to adapt, and what to enforce at the conduit

The request came from group IT with a deadline and a slide: every user authenticated, every access request validated, every device verified, from the office down to the filling line. The automation engineer printed the slide and walked to the cell panel. The controller that runs the capper has no user accounts. It accepts a program download from anything that can reach its port and speak its protocol, and it will be running the same firmware long after the slide is forgotten.

The scene is a composite of what we hear on industrial sites, and both people in it are right. Zero trust suits a plant’s operational technology (OT), but it cannot live inside the controller. Below Level 3 of the Purdue model it is enforced at the conduit, at the jump host and in the change process, around devices that will never take part. The work is sorting its tenets into what a cell applies, adapts or replaces.

What the government guide says that the brochures did not

Trade features of 2021 to 2023 sold zero trust to industry with confidence. One, in AUTOMATION in 2023, called critical infrastructure an ideal environment for it because its traffic is predictable. Another, in the December 2021 issue, presented network segmentation as its core. Both were written by product vendors, and both skip the part a plant engineer worries about.

On 29 April 2026 the US Cybersecurity and Infrastructure Security Agency (CISA) published Adapting Zero Trust Principles to Operational Technology, with the Department of War, the Department of Energy, the FBI and the Department of State. Its introduction is blunt: “The blanket application of traditional information technology (IT)-focused ZT capabilities to OT is neither reasonable nor feasible”. The 28 pages are arranged along the six functions of the NIST Cybersecurity Framework 2.0, from Govern to Recover.

The document the tenets come from, NIST Special Publication (SP) 800-207 of August 2020, says it protects resources “not network segments”, and admits in §2.1 that its seven tenets “are the ideal goal, though it must be acknowledged that not all tenets may be fully implemented in their purest form for a given strategy.” Its companion practice guide, NIST SP 1800-35 of June 2025, built 19 example implementations with 24 collaborators, all for enterprise resources spread across on-premises and cloud environments. CISA’s own Zero Trust Maturity Model, version 2.0, grades five pillars, identity first, from traditional to optimal. All of it is useful above Level 3. The cell is a different world.

What a Level 1 device can take part in

Start with the controller. Many in service have no notion of a user. Their protocols carry no authentication: the CISA guide notes that most OT networks operate without authentication or encryption, and that secure extensions such as Common Industrial Protocol (CIP) Security or Modbus over Transport Layer Security (TLS) are often disabled for simpler integration or backwards compatibility. Whoever reaches the port is trusted.

Then look at what tenet 6 of SP 800-207 asks: authentication and authorisation that are “dynamic and strictly enforced before access is allowed”, in “a constant cycle” of reevaluating trust. Between a human-machine interface (HMI) and its controller, a request leaves every few hundred milliseconds, all day, for years. Placing a policy decision in that path adds a component whose failure stops the line. SP 800-207 says so itself in §5.2: if an attacker disrupts the enforcement or decision points, it can adversely impact operations. On a plant, adversely means a lost batch.

The standard also offers the way out. Its enclave-based deployment (§3.2.2) puts the gateway at the boundary of a group of resources that may not be able to communicate directly to a gateway, such as a legacy system. In IEC 62443 vocabulary that boundary is the conduit, and the requirements behind it are in IEC 62443-3-3:2013: system requirements (SR) 5.1 network segmentation and SR 5.2 zone boundary protection, under foundational requirement 5, restricted data flow. Zones and conduits drawn from the risk, not from the switch are the precondition.

Seven tenets, sorted for the cell

The table takes the seven tenets of SP 800-207 §2.1 in their order and asks the same question of each: can it run inside the cell, and if not, what takes its place at the boundary? The verdicts are EUCALEX’s reading, checked against the CISA guide.

Two lines deserve a word. Tenet 4 is the one IT teams find hardest to give up: in an office, policy that adapts to context is the point. In a cell, a rule that changes by itself is a configuration change nobody approved. The CISA guide puts updates to zero trust policies inside the formal management of change process, like any other change to the plant.

Tenet 2 is adapted in the other direction. The guide reads integrity and authentication as more critical than confidentiality in OT, and gives a reason any maintenance manager will recognise: with signatures, an expired certificate does not halt operations if communications remain in the clear. Where a protocol cannot be secured, it suggests wrapping it in a tunnel through TLS-enabled gateways, so the cryptography happens outside the controller.

Four measures that do the work

Identity at the conduit. The guide strongly recommends a jump host in the OT demilitarised zone as the sole entry point for remote access, with multifactor authentication (MFA), session recording and time-based access, and asks for MFA “where feasible, even if only at the jump host level.” The directory matters as much: “Do not directly connect IT and OT ICAM systems,” it says of identity, credential and access management, and Active Directory in OT should sit in a separate forest or domain. The guide gives the reason: actors tracked as Volt Typhoon escalate by exfiltrating Active Directory credentials, and shared domains are one way into the OT network.

Explicit allow-lists. On the conduit, a rule names the source, the destination and the protocol, and where the firewall understands the industrial protocol, the function: read, write, program download. The guide takes microsegmentation down to read and write permissions on individual data points inside controllers, where the device supports it. The vocabulary has to be exact here; isolated, virtual LAN (VLAN) and security zone are not the same promise, and only the last one has a border where a decision is taken.

Just-in-time engineering access. This is per-session access, moved to where it can run. The guide notes that operators frequently use it to restrict remote vendor connections to narrowly specified maintenance and support windows, and asks for MFA to restrict firmware or logic changes on critical systems. It also observes that physical access is a common second factor in existing OT. The key switch on the controller is exactly that, and most plants already own one per rack.

Continuous monitoring. The guide describes two approaches below the IT/OT boundary: baseline-based detection, which needs learning windows long enough to see every operational mode, and specification-based detection, which defines the range of valid behaviour, as a simple safety system would. It counts the relatively static nature of OT as an advantage, and warns that endpoint detection and response may be difficult below the HMI or the engineering workstation. A passive sensor on a mirror port of the cell switch carries most of tenets 5 and 7.

What each measure costs in change control

A plant under Good Manufacturing Practice (GMP) pays for every one of these in change control. EU GMP Annex 11, in its 2011 text, requires in clause 10 that “any changes to a computerised system including system configurations should only be made in a controlled manner in accordance with a defined procedure.” Clause 12.1 asks for physical or logical controls restricting access to authorised persons, and 12.3 for a record of every creation, change and cancellation of an access authorisation.

The cost is uneven, and that shapes the order. On the sites we assess, the pattern below is the usual one; the depth of testing is always set by the impact assessment of each change, as described in when a repair becomes a requalification.

The second and fourth rows surprise people. An allow-list is written once in a meeting room and tested for months on the line, because every interface the cell feeds is in scope. Moving HMI users to a separate directory looks like an IT task, yet the user name is what the audit trail and the electronic signatures attach to. Plan it as a computerised system change, with the quality unit in the room from the first meeting.

Annex 11 clause 11 helps. Periodic evaluation already looks at security and incidents; the conduit rules and the jump host logs belong in that review, so each allow-list is re-read at a fixed rhythm instead of growing until it permits everything.

Where to start

1. Write the conversation list of one cell. Every station that talks to its controllers, with protocol and function, on one page signed by the automation lead. It is done when the network team can turn each line into a rule without asking a question.
2. Put engineering access behind one door. Route every engineering and vendor session for that cell through the jump host, with MFA and recording, and open the conduit rule only for the window of an approved change. Test it at the next planned download.
3. Raise the conduit rule set through change control. Write the allow-list as a change to the cell, with its interface regression tests, and add the rule review to the periodic evaluation of the system.

Five common mistakes

1. Buying zero trust as a product. The guide itself says no single tool or silver-bullet technology resolves the operational challenges. A licence does not write an allow-list.
2. Putting a policy decision in the polling path. An inline component that must answer before every HMI read is a new single point of failure for the line.
3. Joining the OT directory to the office domain. It saves an afternoon of account management and gives an intruder in the office a way into the cell.
4. Letting the conduit rules change outside management of change. A rule that changes by itself, however clever, is an unapproved change to a qualified system.
5. Leaving the quality unit out until the end. Directory and controller changes touch audit trails and signatures; the requalification found at the end of the project costs more than the one planned at the start.

The controller will never ask who you are. The conduit, the jump host and the change record can, every time.

References

• CISA, DoW, DOE, FBI and DOS, Adapting Zero Trust Principles to Operational Technology, 29 April 2026: cisa.gov
• NIST SP 800-207, Zero Trust Architecture, August 2020, §2.1, §3.2.2 and §5.2: csrc.nist.gov
• NIST SP 1800-35, Implementing a Zero Trust Architecture, June 2025: csrc.nist.gov
• CISA, Zero Trust Maturity Model, version 2.0: cisa.gov
• IEC 62443-3-3:2013, System security requirements and security levels, SR 5.1 and SR 5.2: webstore.iec.ch
• EudraLex Volume 4, Annex 11: Computerised Systems (2011), clauses 10, 11 and 12: health.ec.europa.eu
• “Securing Critical Infrastructure with Zero Trust”, AUTOMATION 2023 Volume 2, automation.com, 5 May 2023: automation.com