What is Zero Trust?
Zero Trust is a cybersecurity model in which no user, device, application or connection is trusted automatically because of its place in the network, and in which every access request is explicitly verified per session and limited to what is strictly necessary. Its motto is “never trust, always verify”. The technical implementation is called Zero Trust Architecture (ZTA), with NIST SP 800-207 as the best-known reference model. Traditional security trusts everything inside the firewall. Zero Trust instead assumes that an attacker may already be inside and moves protection as close as possible to the systems and data you want to protect.
🕰️ Where does Zero Trust come from?
The idea is older than the term suggests:
| Year | Milestone |
|---|---|
| 1994 | Stephen Paul Marsh uses the term zero trust in his doctoral thesis at the University of Stirling |
| 2004 | The Jericho Forum advocates de-perimeterisation: the network boundary is no longer a reliable line of defence |
| 2010 | John Kindervag, an analyst at Forrester, publishes No More Chewy Centers and introduces the Zero Trust model |
| 2014 | Google describes BeyondCorp, its own Zero Trust approach following the 2009 Operation Aurora attacks |
| 2019 | Gartner publishes its first market guide for Zero Trust Network Access (ZTNA) |
| 2020 | NIST publishes SP 800-207 Zero Trust Architecture (August) |
| 2021–2022 | US Executive Order 14028 and memo M-22-09 require federal agencies to adopt Zero Trust |
| 2023 | CISA releases version 2.0 of its Zero Trust Maturity Model (April) |
| 2025 | NIST publishes SP 1800-35 with 19 example implementations (June) |
| 2026 | CISA and partner agencies publish a joint guide on Zero Trust for OT (April) |
Kindervag described the old model as “a hard, crunchy outside with a soft, chewy centre”: once inside, an attacker could move around freely. Zero Trust turns that centre into a series of small, separately guarded areas.
🎯 What is the aim of Zero Trust?
- Prevent lateral movement - an attacker who compromises one system does not automatically reach the rest
- Grant minimum access rights in line with Least Privilege, for no longer than needed
- Use identity, device posture and context as the basis for access, not the IP address or network segment
- Limit damage from insider threats, Ransomware and supply chain attacks
- Support Compliance - NIS2, ISO 27001 and BIO do not literally prescribe Zero Trust, but they do require the access control, strong authentication and logging that Zero Trust delivers
🔐 What are the core principles of Zero Trust?
Vendors and governments phrase the principles differently, but the core is the same everywhere:
| Principle | Explanation |
|---|---|
| Verify explicitly | Authenticate and authorise every access request based on identity, MFA, device posture and context |
| Least privilege access | Users and systems only get access to what is strictly necessary, just-in-time where possible |
| Assume breach | Assume attackers are already inside and limit their spread |
| Microsegmentation | Divide the network into small zones around individual systems or functions (Microsegmentation) |
| Continuous monitoring | Collect logs and telemetry and reassess trust continuously |
The first three are Microsoft’s well-known formulation. NIST SP 800-207 lists seven tenets, including: all data sources and services are resources, all communication is secured regardless of network location, access is granted per session, and policy is dynamic.
🛠️ How does a Zero Trust Architecture (ZTA) work according to NIST?
NIST SP 800-207 (August 2020, written by Scott Rose, Oliver Borchert, Stu Mitchell and Sean Connelly) describes Zero Trust Architecture as a vendor-neutral logical model: an architecture of cooperating components, not a product. At its heart are three components:
- Policy Engine (PE) - decides whether a subject is granted access to a resource. NIST calls the PE the “brain” of the architecture.
- Policy Administrator (PA) - turns the decision into action by establishing or terminating a session; together, PE and PA form the Policy Decision Point (PDP).
- Policy Enforcement Point (PEP) - sits between the subject and the resource and enforces the decision, for example a gateway, proxy or Firewall
The PE, PA and PEP talk to each other over a separate control plane, while the application data itself flows over the data plane. The two must be logically separated so that an attacker on the data network cannot reach the decision logic.
What information does the Policy Engine use?
The PE never decides on a password alone. NIST lists these data sources:
| Data source | What it contributes to the decision |
|---|---|
| CDM system (continuous diagnostics and mitigation) | Device state: patch level, approved software, known vulnerabilities |
| Industry compliance system | Policy rules that follow from laws and regulations |
| Threat Intelligence | New attacks, malware and vulnerabilities for which access should be denied |
| Network and activity logs | A (near) real-time picture of what is happening on the network |
| Data access policies | The baseline rights per role, account and application |
| PKI (certificate management) | Certificates for users, devices and services |
| ID management system | Accounts, roles and attributes, for example in an LDAP directory |
| SIEM | Security events used to refine policy and flag attacks |
The PE’s trust algorithm processes these signals. A criteria-based algorithm grants access only when every configured condition is met. A score-based algorithm calculates a confidence score and compares it with a threshold per resource. In addition, the algorithm can assess each request on its own (singular) or take the subject’s recent history into account (contextual). The contextual form is more likely to catch an attacker using stolen credentials who behaves differently from the real user, which ties in with anomaly detection.
Which deployment variants does NIST describe?
NIST names three approaches: based on enhanced identity governance, based on micro-segmentation, and based on network infrastructure and the Software Defined Perimeter. An SDP only makes applications visible after the user and device have been verified. The publication also describes four ways to position the PEP:
| Deployment model | How it works | Fit for OT |
|---|---|---|
| Device agent/gateway | Agent on the user’s device, gateway directly in front of each resource | Good for engineering laptops; often impossible in front of every PLC |
| Enclave-based | One gateway at the edge of a group of resources, such as a data centre | Suits a production cell or zone with legacy systems; protects the group, not each device individually |
| Resource portal | A single portal as the gatekeeper, with no agent on the client | Suitable for suppliers without a managed laptop; the portal must withstand DDoS attacks |
| Device application sandboxing | Approved applications run isolated in a VM or container | Useful for engineering software on a workstation whose remaining software you do not trust |
In OT, the enclave model is often the realistic choice, because many PLCs and HMIs support neither an agent nor a gateway of their own. NIST acknowledges that most organisations will operate in a hybrid mode for a long time, with Zero Trust components alongside a classic perimeter.
Which building blocks do you see in practice?
| Component | Description |
|---|---|
| Identity management | IAM, MFA, RBAC, identity services such as Microsoft Entra ID (formerly Azure AD) or Okta |
| Device management | EDR, MDM, Asset Management and device posture checks |
| Network segmentation | VLAN, SDN, zones and conduits model in line with IEC 62443 |
| Access control | ZTNA instead of or alongside a classic VPN, PAM and firewall policy at session level |
| Monitoring & detection | SIEM, UEBA, XDR, SOC |
📊 What is the CISA Zero Trust Maturity Model?
CISA’s Zero Trust Maturity Model (version 2.0, April 2023) helps organisations measure their progress. The model has five pillars: Identity, Devices, Networks, Applications & Workloads and Data. Three cross-cutting capabilities run through them: Visibility & Analytics, Automation & Orchestration and Governance.
For each pillar you move through four maturity stages: Traditional, Initial, Advanced and Optimal. The Initial stage was added in version 2.0 because the leap from traditional to advanced proved too large.
🔄 What is the difference between Zero Trust and perimeter security?
| Aspect | Perimeter security | Zero Trust |
|---|---|---|
| Trust | Inside = trusted, outside = untrusted | No one trusted by default, not even internally |
| Control point | A single boundary (firewall, VPN) | At every resource or segment (PEP) |
| Basis for access | Network location and IP address | Identity, device posture and context |
| After login | Broad network access | Access to one application or system per session |
| Lateral movement | Relatively easy | Limited by microsegmentation |
| Monitoring | Mainly at the edge | Everywhere, continuously |
Zero Trust does not fully replace the perimeter. It works best as part of Defense in Depth, where boundary protection is one layer among several.
🏭 How do you apply Zero Trust in OT and industrial networks?
In OT, Zero Trust is challenging but achievable with the right adaptations. The guide Adapting Zero Trust Principles to Operational Technology, published by CISA in late April 2026 with partners including the US Department of Energy and the FBI, states explicitly that IT-focused Zero Trust measures cannot be applied wholesale to OT. It puts the emphasis on zones and conduits, full asset visibility, stronger identity and access management, and supply chain risk. Availability and safety come first.
Where Zero Trust reaches its limits in OT:
- Legacy Systems - many PLCs do not support modern authentication, and protocols such as Modbus have no authentication or encryption; DNP3 does offer Secure Authentication, but it is rarely used in practice
- No agents - on many OT devices you cannot install endpoint software
- Real time and availability - a PEP must not introduce delay or disruption into a control loop; policy must be fail-safe
- Long lifecycles - installations run for twenty years or more and are rarely replaced
How do you translate IT measures to OT?
| IT (classic ZTA) | OT application |
|---|---|
| ZTNA or VPN with device posture checks | A hardened Jump Server or ZTNA with identity verification as the only entry route (Remote Access) |
| MFA for web applications | Authentication with MFA for remote access to SCADA and HMI |
| Microsegmentation in data centres | Segmentation per function or cell (SCADA, Historian, PLC), in line with the zones and conduits of IEC 62443-3-3 |
| User behaviour analytics (UEBA) | Passive monitoring and anomaly detection with knowledge of industrial protocols |
| Removing standing admin rights | Temporary, approved access for technicians and suppliers, with session recording via PAM |
You can also restrict specific protocol traffic: Modbus itself has no read-only mode, but an industrial firewall with protocol filtering can pass read functions only and block write commands. Combine this with IDS/IPS and an up-to-date Asset Inventory, and do not actively scan OT devices without coordination.
For devices that cannot verify anything themselves, you place the control in the network in front of them: the conduit becomes the enforcement point, exactly as in NIST’s enclave model. The Purdue Model remains useful as a structure, but trust between the levels is no longer assumed. In 2024 the ISA Global Cybersecurity Alliance published a white paper showing how IEC 62443 supports Zero Trust outcomes.
🧭 How do you implement Zero Trust step by step?
Kindervag describes a five-step approach that also works well in OT:
- Define the protect surface - which data, applications, assets and services are critical? In OT, for example, the SCADA server, the safety systems and the engineering station.
- Map the transaction flows - which systems communicate with each other, over which protocols and ports?
- Architect the environment - place segmentation and enforcement points as close to the protect surface as possible.
- Create Zero Trust policy - using the Kipling method: who, what, when, where, why and how.
- Monitor and maintain - use logging and monitoring to refine the policy.
Start small, for example with supplier remote access, and then expand one protect surface at a time. For Dutch organisations covered by the Cybersecurity Act (the Dutch implementation of NIS2), this aligns with the requirements for access control and (where appropriate) multi-factor authentication in Article 21 of NIS2.
✅ What are the benefits and challenges of Zero Trust?
Benefits:
- Limits the impact of attacks, even when an attacker is already inside
- Protects hybrid environments (cloud, on-premises, OT, remote working)
- Supports compliance and Audit traceability
- Improves visibility and control across all layers
Challenges:
- Legacy systems and OT devices without modern authentication or endpoint agents
- Cultural change: ‘trust’ is no longer the default
- Complexity of integrations and management; the PE and the portal become critical systems themselves
- Zero Trust is a strategy, not a product, and requires a phased approach with clear priorities
❓ Frequently asked questions
Who invented Zero Trust?
The Zero Trust model was introduced in 2010 by John Kindervag, then an analyst at Forrester Research. The term itself had already been used in 1994 by Stephen Paul Marsh in a doctoral thesis. Google, NIST and CISA subsequently developed Zero Trust further.
What is the difference between Zero Trust and Zero Trust Architecture (ZTA)?
Zero Trust is the security principle of “never trust, always verify”. Zero Trust Architecture (ZTA) is the design that puts that principle into practice, with components such as the Policy Engine, Policy Administrator and Policy Enforcement Point from NIST SP 800-207. Zero Trust is therefore not a product: vendors supply components, and the architecture ties them together.
What is the difference between ZTNA and a VPN?
A VPN usually grants access to an entire network segment after login. ZTNA (Zero Trust Network Access) grants access only to one specific application or system, per session, after checking identity and device. As a result, ZTNA limits lateral movement far better than a classic VPN.
Can Zero Trust work with old PLCs that lack authentication?
Zero Trust can work with old PLCs, but the control then does not sit on the device itself. You place enforcement points in the network in front of it, such as an industrial firewall with protocol filtering, a jump server with MFA and microsegmentation per cell. Passive monitoring complements this without loading the PLC.
Is Zero Trust mandatory under NIS2?
NIS2 does not literally mandate Zero Trust. Article 21 does require policies for access control and asset management and, where appropriate, multi-factor authentication, which are core elements of Zero Trust. A Zero Trust approach therefore helps organisations comply with NIS2 and the Dutch Cybersecurity Act.
Does Zero Trust replace the IEC 62443 zones and conduits model?
Zero Trust does not replace the zones and conduits model but builds on it. Zones and conduits from IEC 62443 provide the segmentation, and Zero Trust adds identity-based, per-session access and continuous verification. In OT, the two work best together.
📌 In summary
Zero Trust is a security model based on the principle of “never trust, always verify”: access is granted per session based on identity, device posture and context, not network location. With Zero Trust Architecture from NIST SP 800-207 as the blueprint, the CISA Zero Trust Maturity Model as the growth path and IEC 62443 zones and conduits as the foundation for OT, organisations can limit lateral movement, even where legacy systems cannot verify anything themselves.