NIST SP 800-207

What is NIST SP 800-207?

NIST SP 800-207 is the Zero Trust Architecture publication of the US National Institute of Standards and Technology (NIST), which describes in a vendor-neutral way how an organisation can grant access to systems and data without implicit trust based on network location or device ownership. The guide was published in August 2020 and written by Scott Rose, Oliver Borchert, Stu Mitchell and Sean Connelly. It defines Zero Trust through seven basic tenets, a logical model of cooperating components, three approaches, four deployment models and a migration path. In IT the document has become the de facto reference; in OT it serves as a framework of thinking that you adapt to the demands of the physical process.

🧠 What does NIST SP 800-207 contain?

NIST SP 800-207 is not a standard with auditable requirements but a Special Publication: guidance that underpins zero trust for US federal agencies and is free and voluntary for every other organisation. The document has seven chapters and two appendices:

The abstract states that Zero Trust moves defences from static network perimeters to users, assets and resources. Authentication and authorisation of both the user and the device happen before a session with a resource is established. Notably for this knowledge base, NIST explicitly says that zero trust principles are used to plan “industrial and enterprise infrastructure”.

🎯 What are the seven tenets of NIST SP 800-207?

NIST does not define Zero Trust as a product but as seven tenets. The document acknowledges that not every tenet can be implemented in its purest form.

1. All data sources and computing services are resources - including small devices sending data to aggregators and systems sending instructions to actuators.
2. All communication is secured regardless of network location - a request from inside the enterprise network must meet the same requirements as one from outside.
3. Access is granted per session - with least privilege, and access to one resource does not automatically grant access to another.
4. Access follows from dynamic policy - based on identity, application, the state of the requesting device and possibly behavioural and environmental attributes.
5. The enterprise monitors the integrity and security posture of all assets - no device is inherently trusted.
6. Authentication and authorisation are dynamic and strictly enforced - with IAM, asset management and MFA, and re-evaluation during the session.
7. The enterprise collects as much information as possible about assets, network and communications, and uses it to improve policy - with logging and anomaly detection as the foundation.

🔧 Which components make up a Zero Trust Architecture?

At the heart of the model is a decision and enforcement chain. NIST logically separates a control plane (over which the components talk to each other) from a data plane (which carries application traffic).

The PDP draws on data sources: a Continuous Diagnostics and Mitigation (CDM) system, compliance information, threat intelligence, network and system activity logs, data access policies, a PKI, an identity management system and a SIEM.

The trust algorithm involves two choices. A criteria-based algorithm grants access only when all configured requirements are met; a score-based algorithm calculates a confidence score and compares it with a threshold per resource. In addition, a singular algorithm evaluates each request on its own, while a contextual algorithm weighs recent history and is therefore more likely to spot misuse of stolen credentials.

🔄 Which approaches and deployment models does NIST describe?

NIST describes three approaches, which in practice are often combined:

• Enhanced identity governance - the identity and attributes of users and devices are the core of the policy, as in ABAC.
• Microsegmentation - resources are placed in small segments behind a gateway or host firewall that acts as the PEP.
• Network infrastructure and software defined perimeters - the network itself (for example an overlay or SDN) is configured dynamically by the PA.

There are also four deployment models: device agent/gateway (agent on the device, gateway in front of the resource), enclave-based (a gateway in front of a group of resources, such as legacy systems), resource portal (a single access portal without an agent) and device application sandboxing (trusted applications run isolated on the device). For OT, the enclave model is the most relevant: PLCs and field devices cannot run an agent themselves, so a gateway in front of the cell takes over enforcement.

🏭 How do you apply NIST SP 800-207 in OT?

The tenets are universal, but the technology in SP 800-207 was written for IT. NIST SP 800-82 Rev. 3 (September 2023) states that Zero Trust is mainly feasible at the higher levels of the Purdue Model and in the OT DMZ. The guide Adapting Zero Trust Principles to Operational Technology, published by CISA at the end of April 2026 together with partners including the US Department of Energy and the FBI, stresses that IT controls such as active scanning or dynamic isolation can disrupt a control loop or a safety function.

Where industrial control systems cannot authenticate themselves, enforcement moves to conduits, gateways and monitoring. This fits IEC 62443-3-3, whose requirements for identification, use control and restricted data flow largely coincide with the Zero Trust tenets.

🧭 How do you migrate to Zero Trust step by step?

NIST expects organisations to run a hybrid of perimeter security and Zero Trust for years. Section 7.3 describes seven steps, which NIST maps to the risk management process of NIST SP 800-37:

1. Identify the actors - employees, suppliers and also non-person entities such as service accounts and applications that talk to each other.
2. Identify the assets - hardware, software, certificates and also unmanaged or “shadow” equipment; in OT a complete asset inventory is often a project in itself.
3. Identify key processes and evaluate their risks - choose a first candidate with limited impact, such as remote access for maintenance.
4. Formulate policies for that candidate - which users, devices and upstream systems are needed, and under which conditions.
5. Identify candidate solutions - based on the deployment model that suits the environment.
6. Start an initial deployment in monitoring mode - observe and tune policy before enforcing it strictly.
7. Expand the architecture - process by process, with a regular cycle of re-inventory.

In a European production environment you typically start with supplier access, because it carries the greatest risk of lateral movement and is relatively independent of process control.

🔐 Which risks and related documents should you know?

Chapter 5 warns that Zero Trust also brings new risks. The PDP becomes a crown jewel: whoever subverts it controls all access. A failure of the PE or PA can block every connection, which in OT directly affects availability. Other risks include stolen credentials and insiders, encrypted traffic that is harder to inspect, reliance on proprietary formats and automated administration accounts.

For Dutch and other European organisations SP 800-207 is not mandatory. NIS2 and the Dutch Cybersecurity Act do require appropriate measures for, among other things, access control and multi-factor authentication; NIST SP 800-207 is a good way to substantiate how you meet them.

❓ Frequently asked questions

Is NIST SP 800-207 mandatory?

NIST SP 800-207 is not mandatory for Dutch or European organisations; it is voluntary, free guidance. US federal agencies do use the publication as the basis for their Zero Trust strategy. In Europe you can use SP 800-207 to substantiate measures under NIS2 and national laws such as the Dutch Cybersecurity Act.

What is the difference between Zero Trust and NIST SP 800-207?

Zero Trust is the security principle “never trust, always verify”. NIST SP 800-207 is the document that translates that principle into seven tenets and a logical architecture with a Policy Engine, Policy Administrator and Policy Enforcement Point. Zero Trust is the idea; NIST SP 800-207 is its best-known blueprint.

What is a Policy Decision Point in NIST SP 800-207?

In NIST SP 800-207 the Policy Decision Point (PDP) is the combination of the Policy Engine, which decides on access, and the Policy Administrator, which executes that decision. The Policy Enforcement Point enforces the decision at the connection itself. Together they form the core of every Zero Trust Architecture.

Can NIST SP 800-207 be used for PLCs and SCADA?

NIST SP 800-207 is useful as a framework for OT, but many PLCs and field devices cannot authenticate themselves or run an agent. In practice you therefore apply Zero Trust to access to SCADA, HMIs and engineering stations, and protect controllers with a gateway in front of the cell, the enclave model from SP 800-207. Availability and safety of the process always come first.

Is NIST SP 800-207 being revised?

NIST SP 800-207 from August 2020 is still the current version. Rather than rewriting it, NIST has supplemented it with SP 800-207A for cloud-native applications (2023) and the practice guide SP 1800-35 (2025). For a new project, always check whether a revision has appeared in the meantime.

How does NIST SP 800-207 relate to IEC 62443?

NIST SP 800-207 describes a general Zero Trust architecture, whereas IEC 62443 sets auditable security requirements for industrial automation. In OT, the zones and conduits of IEC 62443 form the practical basis for the microsegmentation and per-session access of SP 800-207. The two documents therefore complement each other.

📌 In summary

NIST SP 800-207 is the vendor-neutral blueprint for Zero Trust: seven tenets, a decision chain of Policy Engine, Policy Administrator and Policy Enforcement Point, and a step-by-step migration path. In OT you use it as a framework for access to SCADA, HMIs and engineering stations and for supplier access, complemented by the zones and conduits of IEC 62443, so that you remove implicit trust without putting the availability of the process at risk.