NIST's New OT Guide Draws the Zero Trust Line at Level 3. Attackers Are Working Below It.
Zscaler, Monday, October 5th, 2026
Zscaler critiques NIST's draft SP 800-82r4, which applies zero trust to OT mainly at Purdue Level 3 and above.
NIST released the initial public draft of SP 800-82 Revision 4, its OT security guide, on September 21, 2026, with comments open through November 30.
The draft adds zero trust principles but recommends applying them to compatible systems, typically at Purdue Level 3 and above, which Zscaler says leaves controllers running physical processes protected only at the zone boundary - a defense the draft itself admits does not stop an attacker already inside.
Zscaler describes zero trust approaches that do not require device participation and outlines three actions to take before comments close.