By Franklyn C. Adams,
Timehri Networks
For many water and wastewater utilities, the idea of implementing Zero Trust can sound unrealistic.
Much of the equipment operating treatment plants, pump stations, wells, tanks, lift stations, and distribution systems was designed years before Zero Trust became a cybersecurity strategy. Programmable logic controllers may not support modern authentication. Remote terminal units may have limited logging. Human machine interfaces may depend on legacy operating systems. Engineering workstations may run software that cannot easily be upgraded without affecting vendor support or process availability.
Replacing all of this equipment is rarely practical.
Fortunately, that is not what Zero Trust requires.
On October 8, 2026, the National Security Agency released new guidance titled “Hardening Department of War Critical Operational Technology Environments with Zero Trust Principles.” Although the guidance was developed primarily for national security and defense environments, NSA states that its recommendations are also applicable to technical leaders, IT and OT managers, administrators, and operators responsible for critical systems. The guidance specifically identifies sectors including water as environments where disruption could have significant consequences for public health and safety.
The important message for water utilities is straightforward:
Zero Trust does not require replacing every legacy PLC. It requires reducing unnecessary trust around the systems that already exist.
What Zero Trust Means in an OT Environment
Zero Trust is often summarized as:
Never trust, always verify.
NSA describes Zero Trust as an approach that assumes adversarial compromise is possible or may already have occurred. Users, devices, communications, and workflows should therefore be continuously evaluated rather than automatically trusted because they are already inside the network.
That concept is easy to understand in an enterprise IT environment.
It becomes more complicated in OT.
A PLC controlling a pump may communicate with the same HMI every few seconds for years. An RTU at a remote tank may have only enough computing capability to perform its control and telemetry functions. A treatment plant may rely on equipment that cannot support multifactor authentication, endpoint detection software, or modern encryption.
The answer is not to force enterprise security controls onto equipment that cannot safely support them.
Instead, utilities can apply Zero Trust principles around the legacy equipment.
This means controlling which systems can reach the PLC, which users can reach the engineering workstation, which networks can communicate with the SCADA environment, and which remote sessions are permitted to cross into OT.
The PLC does not necessarily need to understand Zero Trust.
The architecture surrounding it does.
Start With Asset Visibility
A utility cannot make informed trust decisions if it does not know what equipment exists.
That makes asset visibility one of the most important foundations of Zero Trust.
Utilities should be able to identify their:
- PLCs
- RTUs
- HMIs
- SCADA servers
- engineering workstations
- historians
- industrial switches
- firewalls
- cellular gateways
- wireless infrastructure
- remote access systems
- vendor managed devices
- network connections between IT and OT
This inventory should include more than manufacturer and model number.
Utilities should understand where each asset is located, what process it supports, what systems communicate with it, and whether it has any external connectivity.
For example, discovering a cellular modem connected to a remote PLC changes the security discussion considerably.
So does discovering that a vendor maintains persistent remote access to an engineering workstation.
Zero Trust begins by replacing assumptions with visibility.
Segment the Network Around the Process
For many smaller utilities, network segmentation may provide the greatest immediate improvement in OT security.
A flat network creates implicit trust.
If a compromised workstation can communicate directly with SCADA servers, PLCs, HMIs, and engineering systems, then the attacker inherits much of that trust.
Segmentation creates boundaries.
Figure 1 — Defensible OT Segmentation Architecture for Water Utilities
The objective is not to create layers for their own sake, but to ensure that every communication path between enterprise IT, the industrial DMZ, SCADA systems, control networks, and field devices has a defined operational purpose.
Communications between these zones should be explicitly permitted based on operational requirements.
The objective is not simply to install another firewall.
The objective is to answer:
Which system needs to communicate with which other system, using what protocol, and for what operational reason?
Anything outside that requirement should be questioned.
If an enterprise workstation has no legitimate reason to communicate directly with a PLC, the firewall should not allow it.
If a historian only needs data from a defined SCADA server, it should not automatically receive broad access to the entire control network.
If a vendor requires access to a single engineering workstation, that access should not provide unrestricted reachability to every device inside OT.
Segmentation converts the network from an environment of assumed trust into one of controlled communication.
Treat Remote Access as Privileged Access
Remote connectivity has become essential to many utilities.
Vendors troubleshoot equipment remotely. Integrators support PLC programs. Utility engineers connect after hours. Smaller organizations may depend heavily on external specialists because they do not maintain full time expertise for every control system.
Removing all remote access is therefore rarely realistic.
But permanently trusted remote access is difficult to reconcile with Zero Trust.
A better approach is controlled access.
Remote sessions should ideally be:
- individually authenticated
- protected with multifactor authentication where supported
- restricted to approved users
- limited to required systems
- enabled only when needed
- logged and monitored
- disabled when the work is complete
Consider a vendor that needs to troubleshoot a pump station.
The vendor may need access to an engineering workstation.
That does not automatically mean the vendor needs permanent VPN access to the entire SCADA network.
A stronger architecture may require the vendor to authenticate to a controlled remote access platform, connect through a jump host, and access only the workstation required for the maintenance activity.
That is Zero Trust applied practically.
The utility is not assuming the vendor is malicious.
It is simply limiting the consequences if the vendor’s credentials or computer are compromised.
Use Compensating Controls for Legacy Equipment
Legacy OT creates a recurring cybersecurity problem.
The device may still perform its operational function reliably, yet lack modern security capabilities.
Replacing the equipment might require capital funding, process downtime, engineering changes, testing, retraining, and sometimes redesign of an entire control system.
That may take years.
Utilities still need protection during that period.
This is where compensating controls become important.
EPA guidance for drinking water and wastewater systems describes compensating controls as alternative security measures used when a baseline control cannot be applied directly, provided they offer equivalent or comparable protection.
Imagine a legacy PLC that cannot support strong authentication.
The utility may compensate by:
- placing the PLC behind an industrial firewall
- permitting communications only from known SCADA systems
- blocking internet access
- restricting engineering access
- monitoring traffic to the controller
- maintaining known good program backups
- logging changes made from engineering workstations
- physically controlling access to network cabinets
Figure 2 – The PLC itself has not changed. Its exposure has.
This distinction is extremely important for smaller utilities because it allows cybersecurity improvements to occur incrementally rather than waiting for a multimillion dollar modernization project.
Protect the Engineering Workstation
If a legacy PLC cannot defend itself well, the systems capable of programming it become especially important.
Engineering workstations frequently have authority that ordinary computers do not.
They may download PLC logic, change controller configurations, modify HMI applications, alter device addresses, or perform firmware updates.
For that reason, engineering workstations should be treated as privileged OT assets.
They should not be ordinary office computers.
Utilities should consider controls such as:
- limiting internet access
- restricting email and general web browsing
- removing unnecessary software
- limiting administrator privileges
- controlling removable media
- monitoring authentication
- maintaining secure backups
- restricting who can connect remotely
- logging engineering changes where technically possible
The goal is to create a trusted pathway between the engineer and the controller rather than allowing any compromised computer to become an engineering station.
Figure 3 – Secure Engineering Access Path
Monitor Communications Without Disrupting Operations
Zero Trust also depends on verification.
In OT, that does not always mean installing software on every endpoint.
Passive network monitoring can provide valuable visibility without directly interrogating sensitive industrial devices.
By observing existing communications through network TAPs, SPAN ports, firewalls, or similar mechanisms, utilities can begin establishing what normal OT communication looks like.
That can help identify activity such as:
- a new device communicating with a PLC
- unusual connections between network zones
- unexpected engineering workstation activity
- communications occurring outside normal maintenance periods
- new protocols appearing in the control environment
- attempts to reach devices that normally communicate with only a small number of systems
NSA’s broader OT security guidance has previously recommended continuous OT monitoring to identify malicious behavior and lateral movement while maintaining awareness of communications within industrial environments.
For smaller utilities, passive visibility can be particularly valuable because cybersecurity staff may not be able to watch every remote site continuously.
The network can help reveal when something has changed.
Zero Trust Should Not Break the Process
One of the most important differences between enterprise IT and OT cybersecurity is operational consequence.
A security control that causes an email system to restart is inconvenient.
A security control that causes a chemical dosing controller or pump station to stop communicating may affect public health or service delivery.
Zero Trust in OT must therefore be implemented deliberately.
Before changing firewall rules, remote access, authentication requirements, or network architecture, utilities should understand the operational dependencies involved.
Changes should be tested.
Maintenance windows should be planned.
Rollback procedures should exist.
Operations personnel should participate in decisions.
Cybersecurity should strengthen the process, not destabilize it.
A Practical Starting Point for Smaller Utilities
A small or midsize water utility does not need to launch a massive Zero Trust transformation program on day one.
A manageable starting point is to ask four questions.
Figure 4 – A Practical Zero Trust Starting Point
This approach creates a realistic path toward Zero Trust without requiring immediate replacement of the utility’s control infrastructure.
The Goal Is Not a Zero Trust Product
Utilities should be cautious about treating Zero Trust as something that can be purchased.
There is no single appliance that makes an OT environment Zero Trust.
A firewall can support the strategy.
A remote access platform can support the strategy.
Multifactor authentication can support the strategy.
Passive OT monitoring can support the strategy.
But Zero Trust is ultimately an architecture and operating principle.
It asks utilities to continuously reduce unnecessary trust.
That means fewer unrestricted network paths.
Fewer permanently enabled remote accounts.
Better understanding of assets.
Stronger boundaries around legacy equipment.
Better monitoring of important communications.
Clearer control over who can reach operational systems.
Legacy Does Not Have to Mean Unprotected
Water utilities will continue operating legacy technology for many years.
That is an operational reality.
Cybersecurity strategy must account for that reality rather than assuming every device can simply be replaced.
NSA’s October 2026 guidance provides an important reminder that Zero Trust principles can strengthen legacy OT even when individual devices cannot support modern security capabilities themselves. The agency specifically describes Zero Trust adoption as important for improving the security of legacy operational technology and strengthening defense in depth across critical infrastructure.
For water utilities, the path forward does not begin with replacing every PLC.
It begins with understanding the environment.
Know what is connected.
Control who can reach it.
Limit what each connection can do.
Monitor what happens across those connections.
Place stronger protections around systems that cannot protect themselves.
That is how Zero Trust becomes practical for operational technology.
And for smaller utilities with limited budgets and legacy infrastructure, practical security improvements are often the ones that matter most.
Sources & Further Reading
- NSA — Zero Trust Guidance for Protecting Operational Technology Systems Read the NSA guidance overview
- NSA — Cybersecurity Advisories & Guidance Browse NSA Cybersecurity Guidance
- EPA — Guidance on Improving Cybersecurity at Drinking Water and Wastewater Systems
Read the EPA water-sector cybersecurity guidance - CISA — Cross-Sector Cybersecurity Performance Goals
Explore CISA Cybersecurity Performance Goals - NSA, CISA, FBI & DOE — APT Cyber Tools Targeting ICS/SCADA Devices
Read the joint ICS/SCADA advisory - NSA — Smart Controller Security Controls and Technical Requirements for OT Environments
Read the NSA smart-controller guidance
About Timehri Networks
Timehri Networks helps water and wastewater utilities and other critical infrastructure organizations strengthen OT and ICS cybersecurity through practical assessments, network segmentation reviews, secure remote access, firewall and VPN evaluations, passive OT monitoring, and cybersecurity strategies designed around operational realities.
Securing Operations. Strengthening Communities.