The CISA and Federal Agency Zero Trust Briefing Most OT Leaders Haven't Read Yet

The CISA and Federal Agency Zero Trust Briefing Most OT Leaders Haven't Read Yet

by Craig Duckworth and Dino Buslaki

Applied Sciences & Engineering Computing & Cybersecurity UTComputer networking and communicationsUTNNetwork security
🎙 Craig Duckworth and Dino Buslaki 👥 192 📅 June 3, 2026 ⏱ 35 min 👁 71 📄 expert opinion 🧭 2026-08-16
Available in: English (current) Français

Keywords

zero trustOTCISAIT/OT convergencemicro-segmentation

Summary

In this episode of Industrial Cybersecurity Insider, hosts Craig Duckworth and Dino Buslaki discuss the joint CISA/FBI/DOE/State zero trust briefing for OT environments published on April 29. They highlight that most OT leaders are unaware of this guidance. The conversation covers the differences between IT and OT security priorities, emphasizing safety and availability in OT. They critique the lack of enforcement in US regulations compared to the European Cyber Resilience Act (CRA), which has ’teeth’ and is driving compliance even for US operations of European companies. The hosts share real-world examples of IT security tools like CrowdStrike causing disruptions on plant floors due to lack of coordination. They discuss the visibility gap where IT sees less than a third of OT assets, often due to network architectures like DLR rings. They also address OEM resistance to adding cybersecurity measures, which can be costly and delay projects. The episode explores practical approaches to layering zero trust onto legacy plants without rip-and-replace, emphasizing the need for collaboration between IT, OT, and system integrators. They note that very few integrators have real OT cybersecurity practices, and CISOs often lack the tenure to understand OT complexities. The hosts advise CISOs to engage with integrators and OEMs to gain visibility and improve security posture.

209 words

Critical Evaluation

Value of the Information & Strength of the Argument

The value of the information lies in the hosts’ practical experience and candid insights into the challenges of implementing zero trust in OT environments. They provide concrete examples, such as the CrowdStrike incident causing a $100K/hour packaging line to stop, and the difficulty of gaining visibility into DLR rings. The argumentation is coherent, emphasizing the need for IT and OT collaboration and the importance of understanding OT-specific constraints. However, the discussion is largely anecdotal and lacks empirical data or detailed references to the cited briefing. The hosts make strong claims about the lack of integrator capabilities and regulatory enforcement, but these are not substantiated with specific evidence. Overall, the value is high for practitioners seeking real-world perspectives, but the argumentation would benefit from more rigorous sourcing.

Scientific Rigor, Source Quality, Title Accuracy

The hosts reference the CISA/FBI zero trust briefing and the European Cyber Resilience Act, but they do not provide direct citations or URLs. The discussion is based on their professional experience, which adds credibility but limits verifiability. The title accurately reflects the content, focusing on the under-read briefing. The episode does not include a public advertising segment. The hosts’ claims about regulatory differences and integrator gaps are plausible but not backed by specific data. The overall scientific rigor is moderate, typical of an expert opinion podcast rather than a formal analysis.

232 words

Title / Content Match

The title accurately reflects the content, which focuses on the CISA and federal agency zero trust briefing for OT environments and why it is under-read.

Quality & Reliability

7/10

The hosts provide practical insights from their experience as OT cybersecurity practitioners, but the discussion is largely anecdotal and lacks rigorous citations or data. They reference a specific CISA/FBI briefing, but do not provide direct quotes or detailed analysis. The credibility is moderate, relying on the hosts' expertise rather than verifiable sources.

Key Moments

Markers derived by PSI from the transcript: the creator did not define chapters.

Cited Sources

  • Adapting Zero Trust Principles to Operational Technology (CISA/FBI/DOE/State joint briefing) — Referenced as the April 29 joint publication that the hosts discuss.

Concurring Sources

  • CISA's Zero Trust Maturity Model — Aligns with the discussion on zero trust adoption in federal agencies.

Dissenting Sources

  • NIST SP 800-207 Zero Trust Architecture — While the episode suggests that zero trust in OT requires adaptation, NIST's guidance is primarily IT-focused and may not fully address OT-specific constraints, but it is not necessarily discordant.

Contribution & Novelties

The episode provides a practitioner’s perspective on the challenges of implementing zero trust in OT environments, highlighting the gap between IT and OT teams and the lack of regulatory enforcement in the US. It offers practical advice for CISOs to engage with system integrators and OEMs to improve visibility and security. The hosts emphasize the need for collaboration and understanding OT-specific constraints, such as safety and availability, which are often overlooked in IT-centric approaches.

Pour aller plus loin :

139 words

Radar Profile

The radar profile shows moderate scores across all dimensions, with slightly higher scores in quantity of information and technical level, reflecting the hosts' practical knowledge. The lower scores in quality and reliability indicate the anecdotal nature of the discussion and lack of rigorous sourcing.

Reliability 6/10

💬 No comments were provided for analysis.