CISA Zero Trust Maturity Model vs OT: Why IT Playbooks Fail

8 min read

The 3:00 AM Ghost in the Water Treatment Loop

An operator we will call Miller sat in the dimly lit control room of a midsize municipal water district, watching a telemetry screen flicker. It was 3:14 AM when the chemical feed pumps for Level 2 filtration began cycling rapidly, defying the programmed logic loops. Nobody in the room had touched the physical dials, and no scheduled batch runs were active. What Miller was watching was not a mechanical failure, but a digital ghost operating the valves via unauthenticated Modbus TCP commands originating from an IP address that belonged to the corporate finance department.

This scene is no longer a hypothetical tabletop exercise. In July 2025, the Michigan State Police and the Great Lakes Water Authority launched an investigation into a breach of a monitoring and reporting system at a Detroit-area water treatment facility, underscoring how physical infrastructure has moved directly into the crosshairs of modern adversaries. The official response to these incidents is almost always a mandate to implement the CISA Zero Trust Maturity Model. Yet, when corporate IT departments attempt to overlay modern identity-centric security onto legacy operational technology (OT), they routinely find that standard IT playbooks do not just fail—they can physically disable the plant.

Under the Hood of the Dual-Homed Disaster

To understand why standard IT security playbooks break down in the plant, we have to dissect the architectural reality of the dual-homed engineering workstation. Consider a representative municipal utility where the engineering workstation acts as the bridge between the enterprise network and the physical pumps. In these environments, IT and OT are rarely air-gapped; instead, they are joined by legacy machines running outdated operating systems like Windows 7 or even Windows XP, because the proprietary software required to calibrate a multi-million-dollar turbine cannot run on Windows 11.

When an IT department mandates a standard enterprise security agent, they often deploy active scanners like Tanium or CrowdStrike to map the network. In an IT environment, a rapid ping sweep is standard operating procedure. In an OT environment, sending a burst of unexpected TCP packets to a legacy programmable logic controller (PLC), such as an older Siemens S7-300, can cause the device's network card to buffer-overflow and lock up entirely, halting physical operations. True OT security requires passive network monitoring tools like Claroty, Dragos, or Nozomi Networks, which sniff mirrored switch traffic (SPAN ports) rather than actively querying fragile endpoints.

The Anatomy of a $280,000 Microsegmentation Bypass

The root cause of these architectural failures is almost always an undocumented bypass created for administrative convenience. In our representative utility, the IT team had successfully implemented multi-factor authentication (MFA) across 98% of corporate endpoints. However, because the legacy human-machine interface (HMI) in the water filtration plant could not support modern SAML or OAuth protocols, the engineering team set up a dual-homed network interface card on a single workstation. This allowed them to pull operational logs directly into an Excel sheet on the corporate network without logging in every time.

"The ultimate irony of industrial zero trust is that the most secure firewall in the world is completely neutralized by a single $20 network card installed by an engineer who just wanted to do their job without typing in a 16-character password four times an hour."

When an attacker gained access to a corporate laptop via a standard phishing email, they did not need to crack the corporate Active Directory. They simply scanned the local subnet, found the dual-homed workstation, and pivoted directly into the Purdue Model's Level 2 control zone. From there, they issued raw, unauthenticated commands directly to the PLCs. The incident response, forensic cleanup, and emergency re-architecting of that single plant cost the utility over $280,000 in direct contractor fees, not including the reputational damage of a public investigation.

The Vulnerability Mapping of Legacy Control Systems

The core friction of industrial Zero Trust is that physical controllers lack the computational horsepower to perform cryptographic verification. A modern microsecond-level authentication handshake requires CPU cycles that a PLC manufactured in 2008 simply does not have. These devices operate on deterministic loops where safety and latency are measured in milliseconds. If a security gateway introduces even a 50-millisecond delay to verify a digital signature, it can trigger an emergency safety shutdown of a high-pressure steam line or a high-speed assembly conveyor.

This is why CISA’s updated Zero Trust Maturity Model implementation guide places such a heavy emphasis on visibility and secure interconnectivity. You cannot protect what you cannot see, and you cannot authenticate what cannot compute. The exposure window is not defined by patch cycles, because many of these systems can never be patched without voiding vendor warranties or risking physical damage. Instead, the exposure window is defined by how long an adversary can navigate your internal network before encountering a hard, protocol-aware boundary.

CISA vs. DoD: Choosing Your Zero Trust Hardness

Organizations attempting to secure critical infrastructure must choose between two primary federal playbooks: the CISA Zero Trust Maturity Model and the Department of Defense (DoD) Zero Trust Framework. While both aim to eliminate implicit trust, their operational realities differ significantly. CISA's model is designed for civilian agencies and focuses on gradual, pillar-based evolution. The DoD framework, by contrast, is a battle-hardened mandate requiring the achievement of 152 specific activities across 7 pillars to reach "Target Level" compliance.

For civilian infrastructure operators, trying to force-fit the DoD's tactical-grade requirements is a recipe for project failure. The CISA model provides a more realistic runway, allowing operators to mature their capabilities incrementally. The transition from traditional to advanced security in an OT environment must be handled with a phased approach that prioritizes network segmentation over endpoint-level authentication.

• CISA ZTMM Network Pillar: Transitioning from flat networks to macro-segmentation using industrial firewalls like Fortinet FortiGate or Palo Alto Networks PA-Series, which understand industrial protocols like DNP3 and Modbus.
• DoD Environment Pillar: Moving toward hardware-enforced unidirectional security gateways (data diodes) from vendors like Owl Cyber Defense to physically restrict data flow to one direction.
• NIST SP 800-207 Alignment: Implementing Policy Decision Points (PDP) and Policy Enforcement Points (PEP) at the boundary between Purdue Level 3 (Operations Systems) and Level 4 (Enterprise Systems).

The Phased Playbook for an OT Zero Trust Rollout

To implement Zero Trust in an operational technology environment without causing physical downtime, operators must follow a strict, non-negotiable sequence of phases. This is the exact playbook we use to secure municipal utilities and manufacturing facilities.

• Phase 1: Passive Asset Discovery: Deploy passive network monitoring to map every connected MAC address, IP address, and industrial protocol. Do not run active vulnerability scans on subnet ranges containing PLCs.
• Phase 2: Purdue Level 3.5 DMZ Enforcement: Terminate all direct connections between the corporate network and the plant floor. Force all traffic through a highly restricted Industrial DMZ (IDMZ) using jump hosts with session recording.
• Phase 3: Protocol-Aware Microsegmentation: Implement firewall rules that do not just restrict traffic by IP, but inspect the payload. If an engineering workstation only needs to read data, block write commands at the firewall level.
• Phase 4: Identity Translation Gateways: Use identity-aware proxies to translate modern corporate MFA into local, role-based access control at the boundary, keeping legacy endpoints isolated from direct identity requests.

Where IT-Style Zero Trust Actually Holds Up

While active scanning and direct endpoint authentication are dangerous on the plant floor, the identity-centric elements of the CISA model are highly effective when applied strictly to the enterprise IT layer. Securing the corporate Active Directory, enforcing phishing-resistant FIDO2 MFA for all remote access, and deploying modern Endpoint Detection and Response (EDR) on corporate laptops are essential first lines of defense. If an attacker cannot breach the corporate network, they cannot reach the IDMZ to exploit the legacy OT gaps.

The mistake is not the technology itself, but the failure of IT security teams to recognize where their authority must end and where specialized OT engineering must begin. A successful deployment requires a hybrid team where IT security analysts provide the policy framework, but OT engineers retain veto power over any active scanning or automated blocking actions on the plant floor.

Frequently Asked Questions

What happens to our compliance audit trail when a utility provider's Green Button API goes dark for three straight months?

When external APIs or utility data streams fail, your local collection gateway must fall back to cached, cryptographically signed local buffers. The Zero Trust architecture must treat the missing API as an untrusted state, logging the outage in your SIEM while ensuring that local operational controls do not automatically trust unsigned, manually entered backup data sheets without secondary engineering approval.

How do we enforce multi-factor authentication on a legacy PLC that only supports cleartext Telnet?

You do not enforce MFA on the PLC itself. Instead, you wrap the legacy device in a micro-segmented network bubble. All access to that segment must pass through an identity-aware proxy or a secure jump box (such as CyberArk or a hardened Bastion host) that requires phishing-resistant MFA before establishing a proxy session to the PLC's management port.

Can we use standard IT vulnerability scanners like Nessus on our plant floor subnets during scheduled maintenance windows?

No. Even during maintenance windows, active scanning can crash PLC network stacks, requiring physical power cycles or firmware re-flashing that can delay startup. Vulnerability management in OT must rely on passive traffic analysis and software bill of materials (SBOM) matching against known CVE databases rather than active probing.

What is the failure state of an OT security gateway if the central identity provider goes offline?

The security gateway must be configured to "fail open" for local safety-critical controls while logging the authentication bypass locally. In physical environments, life safety and operational continuity always override security policies; a locked-out operator during an over-pressure event is a far greater hazard than an unauthenticated network connection.

The Final Verdict: Securing critical infrastructure under the CISA Zero Trust Maturity Model is not a software deployment project, but an exercise in architectural isolation. Trying to force modern identity agents onto legacy PLCs will inevitably break your operations. Build a hardened Industrial DMZ first, secure your boundaries with protocol-aware firewalls, and keep your IT security scanners off the plant floor.

When you look at your current network topology, can you confidently point to a single network segment where a compromised corporate laptop is physically blocked from sending a direct Modbus write command to a system that controls physical valves?

Related from this blog

• Cloud Security Posture Management to Reach $15.62B by 2035
• Does the Zero Trust Maturity Model CISA Path Cost Too Much?
• SASE architecture enterprise rollout stalls on a 3-year contract
• How SASE Architecture Enterprise Rollouts Split in 2026
• ZTNA vs VPN Battles Heat Up with 14 New Data Centers

Sources

• Bridging the cyber gap: How agencies can secure operational technology in a zero trust world - Federal News Network — Federal News Network
• Cybersecurity Face-Off: CISA and DoD’s Zero Trust Frameworks Explained and Compared - Cisco Blogs — Cisco Blogs