💡 Concept vs Execution
NIST SP 800-207
NSA OT ZT CSI
AI & OT Security
Zero Trust for OT in the Age of AI: Concept and Execution through NIST SP 800-207 and the NSA OT CSI
NIST SP 800-207 defines what zero trust is. NSA's new OT guidance says what legacy OT should do first. Read together, they show what OT defense should accelerate in the age of AI, and what it should keep under human control, especially on a ship that loses its link to shore.
On 8 October 2026, the NSA released a Cybersecurity Information Sheet (CSI) titled "Hardening Department of War (DoW) Critical Operational Technology (OT) Environments with Zero Trust (ZT) Principles." It frames the urgency around AI. Adversaries, it says, are using super intelligence (SI) to automate reconnaissance, speed up exploit development and run campaigns at unprecedented speed and scale.
NSA CSI, October 202626 of 84 OT activities0 from Automation & OrchestrationNIST SP 800-207, August 2020Fast judgment, approved actionPolicy decisions belong onboard
AI is speeding up attacks. So why leave out automation?
Something in the CSI stands out. DoW guidance for zero trust in OT lists 84 activities, and the CSI picks 26 of them for immediate impact. None of the 26 come from the Automation & Orchestration pillar. Attacks are moving toward machine speed, yet where the CSI does let automation change enforcement policy, it puts human approval first.
To make sense of that, the CSI has to be read alongside NIST SP 800-207, the zero trust architecture standard it cites for its definition of zero trust. 800-207 defines what zero trust is and how it is structured. The CSI turns that concept into what to do first in legacy OT. Read together, they show what OT defense should accelerate in the age of AI, and what it should keep a firm hand on. That matters most in OT that runs for decades and loses its connection, like a ship at sea.
The two documents at a glance
In one line: 800-207 is the design language, and the CSI is the execution checklist.
| Item |
NSA CSI (Oct 2026) |
NIST SP 800-207 (Aug 2020) |
| Type |
Implementation guidance (Cybersecurity Information Sheet) |
Architecture standard (Special Publication) |
| Core question |
What should legacy OT do first? |
What is zero trust and how is it structured? |
| Audience |
Primarily NSS, DoW and Defense Industrial Base system owners and operators |
Enterprise architects at federal agencies |
| Scope |
Legacy OT/ICS |
Primarily IT enterprise |
| Length |
25 pages, 26 priority activities |
59 pages, 7 tenets and a logical model |
| Parent framework |
DoW ZT Framework (7 pillars, 45 capabilities); DoW ZT for OT guidance (84 activities) |
Self-defined (PE, PA, PEP; 4 deployment models) |
| Threat picture |
2026 (SI, Volt Typhoon, AA26-097A) |
2020 (how AI agents authenticate is an open issue) |
The 26 CSI activities break down as User 8, Device 5, Application & Workload 2, Data 4, Network & Environment 4, and Visibility & Analytics 3. Automation & Orchestration gets zero.
Both documents share the same philosophy: assume breach, remove implicit trust, and verify continuously. Much of their practice overlaps too.
▸They complement existing security, not replace it. Both treat zero trust as an addition to existing security and cyber hygiene.
▸They migrate incrementally. 800-207 describes a long hybrid period of zero trust and perimeter defenses; the CSI sets priorities with 26 of 84 activities.
▸Inventory comes first. Users and accounts, devices (NPEs), applications and databases must be known before policy can be written.
▸They rely on attribute-based dynamic access. PBAC/ABAC, MFA, per-session authentication and least privilege are shared tools.
▸Micro-segmentation blocks lateral movement. The CSI's aim to "wrap legacy assets in protective enclaves" is close to 800-207's enclave-based deployment model.
▸Third-party access is a key risk. 800-207's example is outside providers who maintain smart heating and lighting systems; the CSI points to vendor, OEM, system integrator and maintenance remote access.
▸Observe first. 800-207's reporting-only mode and the CSI's passive-first verification reflect the same thinking.
▸Automated actors are an attack surface. 800-207 warns about AI and other software agents in ZTA administration; the CSI warns about the new risks that come with adopting SI.
The biggest difference is what each puts first. The CSI puts availability and safety first; 800-207 aims for a balance of security, availability, usability and cost. That one difference drives the rest.
| Dimension |
NSA CSI |
NIST SP 800-207 |
| Remote access |
Recommends VPN, phishing-resistant MFA and PAM |
Remote assets should not need to backhaul through a VPN (network requirement 8, Section 3.4.1) |
| Architecture components |
The PE/PA/PEP model and the trust algorithm are not used (only generic "enforcement points" are mentioned); centered on product categories such as AD, PAM, EDR |
PE, PA, PEP, trust algorithm and control/data plane separation are central |
| Threats to ZT infrastructure itself |
Not treated as a topic of its own |
Covers subversion of the decision process, DoS, stolen credentials and insiders, reliance on proprietary solutions, and NPEs in administration |
| Automation |
No Automation pillar activities; automated policy changes only after human approval (5.4.1) |
Assumes dynamic reconfiguration, for example via SDN and intent-based networking |
| Protecting data in transit |
Availability and reliability as well as confidentiality, integrity and authenticity; encryption alone is not enough |
All communication secured for confidentiality, integrity and source authentication |
| Patching |
Assumes patches may be impossible; compensating controls, risk-based remediation, documented exceptions |
Assumes assets are monitored and patched as needed, for example through CDM |
| Migration method |
Priority list only |
Step-by-step procedure, RMF mapping, tuning phase |
The split on VPNs reads less as a contradiction than as a nod to OT reality. A model built on reliable connectivity and, for remote sites, a cloud-hosted policy engine does not transfer cleanly to OT.
The CSI is actionable but structurally thin; 800-207 is structurally sound but does not know OT. Each fills the other's gaps.
NSA CSI: strengths
▸Activity numbers and outcomes are spelled out, so it converts directly into a checklist or roadmap.
▸It assumes OT realities: unpatchable assets, limited maintenance windows, care around Level 0/1 devices.
▸It treats vendor, OEM and integrator remote access as a major risk and calls for mediation through PAM or controlled gateways with session recording and real-time oversight.
▸Its guidance is concrete: remove default credentials, separate view and change levels on controllers, disable unused logic, keep engineering workstations for OT use only and in locked locations.
NSA CSI: limits
▸It does not discuss what happens when the policy decision infrastructure fails or is compromised, a critical gap in OT.
▸It is AD/DC-centric and hard to apply as-is to OT without Active Directory.
▸It mixes in military-specific items such as B/C/P/S (Base/Camp/Post/Station) segmentation.
▸Some activities are loosely mapped to the text. Logging guidance for engineering workstations and HMIs, for example, is tied to the DLP activity (4.4.1).
▸Cite it with care. Activity labels alternate between "OT ZT" and "ZT OT", reference [15] gives a different EO 14144 title from the body, and it cites SP 800-82r3, still the latest final revision, though NIST released a draft r4 on 21 September 2026.
NIST SP 800-207: strengths
▸PE, PA, PEP and the seven tenets are the industry's shared vocabulary, useful for design, procurement and proposals.
▸It explains four deployment models and the trust algorithm in a technology-neutral way.
▸It analyzes threats to zero trust infrastructure itself.
▸Appendix B candidly lists gaps in the ecosystem.
NIST SP 800-207: limits
▸It barely addresses availability-first, unpatchable, real-time control environments.
▸Its remote-site use cases lean on a cloud-hosted policy engine and reliable connectivity.
▸Written in 2020, it does not reflect today's AI or SI threats.
▸It offers no prioritized list of controls; its only sequencing advice is to start with a low-risk business process.
If AI attacks, should AI defend?
Read together, the two documents point to one answer: fast judgment, approved action. Use AI to accelerate detection and analysis, but keep humans in control of any action that touches a physical process.
AI on the attack side is already in the threat picture.
The CSI describes SI-enabled adversaries finding unknown vulnerabilities, automating exploit development, generating convincing social engineering, coordinating attacks on many targets at once and optimizing paths through cyber-physical environments. Long-dwell campaigns like Volt Typhoon, which start in IT and pivot to OT, are the kind of playbook that this speed would sharpen.
AI on the defense side is a new attack surface.
The CSI warns that bringing SI into OT can introduce new risks and attack surfaces alongside the efficiency gains. 800-207 flagged the same problem back in 2020. AI and software agents that interact with the policy engine may authenticate at a lower bar than humans, such as an API key instead of MFA. An attacker who tricks an agent into acting can get it to do things the attacker is not privileged to do. False positives and false negatives from automated enforcement can also degrade security posture.
So the CSI did not drop automation; it tethered it.
Automation does appear among the 26 activities: automated auditing (1.7.1), automated configuration management (2.6.2), and EDR automated responses decided only after system analysis (2.7.1). But the one activity that lets automation change segmentation policy, 5.4.1, reads "automated policy changes are enabled following human approval." In OT, a wrong automatic block can be as damaging as an attack. A pump stops, a valve closes, a ship loses propulsion. The message is to place human approval at the point where an AI decision crosses into the physical world.
Zero trust in the age of AI means treating AI as just another subject.
800-207 calls the entities that request access subjects, whether people or non-person entities. An AI agent needs an identity, least privilege per session, and actions that are logged and verified. That is why the CSI stresses continuous verification across both human and non-human identities.
The faster AI makes decisions, the more it matters where those decisions are executed and who approves them. A ship exposes that question more sharply than almost any other environment. Fittingly, the CSI explains micro-segmentation with the image of bulkheads in a ship.
Policy decisions must be made onboard.
For enterprises with remote branches, 800-207 describes hosting the policy engine and administrator as a cloud service. But satellite links drop. If losing the link locks the crew out of propulsion or navigation systems, that is not security; it is an outage. The policy decision function belongs onboard, and its behavior when the shore link is lost must be defined at the design stage. For safety-related systems, fail-safe criteria must be set alongside it.
Fit the reality of no AD.
Much shipboard OT runs without Active Directory. The CSI's AD/DC hardening should be applied as local account life-cycle management, removal of shared accounts and minimization of privileged accounts.
Translate military terms into maritime ones.
The CSI's B/C/P/S segmentation can be reread as tiered segmentation across fleet, vessel and shore.
The CSI approach to remote access is the realistic one.
That means VPN plus PAM, phishing-resistant MFA, session recording and time-bound approval. The gap with 800-207's no-backhaul principle can be explained as a choice that reflects OT reality.
Keep automatic blocking behind human approval.
An automatic block during a voyage is itself a safety risk. The CSI's choice to allow automated policy changes only after human approval carries even more weight at sea.
The most effective approach is to use three layers: 800-207 for the design language, the CSI for the order of execution, and IACS UR E26/E27 for the mandatory baseline.
▸Split the roles. Write architecture and proposals in 800-207 terms; build detailed items and priorities from the 26 CSI activities. Zero trust is not an E26/E27 requirement, so position it accurately as a beyond-compliance maturity roadmap.
▸Map to E26/E27. Start with the CSI activities where the fit is clear: asset inventory (2.1.1, 3.1.1), zones and segmentation (5.3.1, 5.4.1), remote access (1.2.2, 1.3.1, 1.4.1, 1.5.1), and network and endpoint monitoring (2.7.1, 7.1.2).
▸Link to test stages. The CSI's rule of passive verification first and active testing only in approved maintenance windows lines up with the shipbuilding test stages used in industry practice (FAT, HAT, SAT). Confine active testing of Level 0/1 devices to the shipyard stage.
▸Follow 800-207 for the migration procedure. Move through actors, assets, processes, policies, solution selection, reporting-only deployment and expansion, and fill each stage's scope with the 26 CSI activities.
▸Start with whoever provides remote maintenance. The CSI names vendor, OEM and integrator remote access as a common vector in confirmed OT intrusions. A provider that first puts PAM, session recording, time-bound approval and phishing-resistant MFA in place becomes a verified third party in the shipowner's eyes.
▸Don't overstate applicability. The CSI is written primarily for U.S. NSS, DoW and the Defense Industrial Base. For commercial shipping, cite it as current U.S. government OT practice guidance. For shipyards in the defense supply chain, such as U.S. Navy MRO, it can serve as a direct reference.
NIST published SP 800-207, Zero Trust Architecture, six years ago. The 2026 CSI answers where legacy OT should begin while AI accelerates attacks, and it ties automated policy changes to human approval.
The remaining question sits where the CSI is silent and 800-207 leaves only an open research question. Whether a decision comes from AI or from a person, who makes the policy call, and where, on a ship that has lost its link to shore?
Any discussion of zero trust for maritime cybersecurity in the age of AI has to start there.
This article is a personal reading of two public documents. Mappings and maritime applications are the author's interpretation, not an official position of any regulator or classification society.
·IACS, UR E26 Cyber resilience of ships, Rev.1, November 2023; UR E27 Cyber resilience of on-board systems and equipment, Rev.1, September 2023
#ZeroTrust#OTSecurity#NIST800207#AISecurity#ShipCyberSecurity#MaritimeCyber#IACSURE26
Julius Shin
Maritime Technical Consultant · Shipboard Cybersecurity & Compliance
Owner-side maritime cybersecurity advisor covering IACS UR E26/E27 compliance, zone and conduit design, and OT/IT security architecture for commercial vessels — working across LR, ClassNK, DNV, ABS, and BV newbuilding projects.
🌐 More Articles ↗
Comments
Post a Comment