Zero Trust in Manufacturing: What CMMC Assessors Should Understand About OT

Manufacturing Cybersecurity Is Not Traditional IT

For defense manufacturers, cybersecurity extends beyond office computers, cloud services, and business applications. Operational technology (OT) can include industrial control systems, programmable logic controllers, production equipment, and systems that monitor or control physical processes. These environments often have safety, availability, reliability, and maintenance priorities different from conventional IT.

NIST SP 800-82 Revision 3, Guide to Operational Technology (OT) Security, addresses these distinctions. A security approach that seems straightforward in an office network may require careful operational consideration on a manufacturing floor.

What Zero Trust Means in an OT Conversation

NIST SP 800-207 describes Zero Trust as an approach that avoids granting implicit trust simply because an asset or user is inside a network. The emphasis is on protecting resources and making appropriate authentication and authorization decisions. Zero Trust is an architectural approach, not a particular appliance or product.

In manufacturing, those principles remain relevant. However, OT systems may use specialized protocols, legacy equipment, vendor-managed components, and tightly coordinated processes. It is unwise to assume that conventional enterprise security techniques can be introduced into production without considering operational consequences.

Why OT Changes the Security Discussion

Availability and reliability

An unexpected interruption to a production process can have consequences unlike downtime on an office workstation. Operational continuity influences how changes are planned and evaluated.

Safety and physical effects

Some OT systems affect physical equipment and processes. Cybersecurity decisions must consider possible effects on personnel, machinery, and operations, not only information.

Technology lifecycles and dependencies

Manufacturing equipment may remain in service for many years and depend on specialized vendors, communications, and maintenance windows. These conditions help explain why understanding the system matters before judging the suitability of a security approach.

These realities do not remove cybersecurity responsibilities. They provide context for how protections function.

Zero Trust Is Not a Separate CMMC Requirement

NIST SP 800-207 does not establish an additional CMMC certification requirement. A manufacturer should not receive an adverse CMMC determination merely because it has not adopted a particular product marketed as Zero Trust.

CMMC Level 2 conclusions must be grounded in the applicable program requirements, assessment objectives, and evidence. Zero Trust concepts may inform discussions about protections, but they are not a replacement for governing CMMC criteria.

OT Does Not Automatically Determine CMMC Scope

Manufacturing environments can include enterprise IT, engineering workstations, production systems, quality systems, and security technologies. Their relationships to controlled unclassified information (CUI) and the assessed environment may differ.

DoD CMMC scoping rules establish asset categories and assessment treatment. Calling a device OT does not automatically exclude it. Likewise, the presence of equipment on a production floor does not mean every asset must receive identical assessment treatment. Actual system functions and applicable scoping rules matter.

Assessors should distinguish between understanding an asset’s operational role and assuming its assessment treatment. The organization’s documented scope and supporting evidence must be evaluated against the applicable requirements.

Assessing Requirements Is Different From Prescribing Architecture

Manufacturers may describe network separation, access restrictions, or monitoring when explaining their security environment. Such descriptions can be useful, but naming a technology does not establish a security outcome on its own.

Similarly, a preferred architectural design should not become an assessment requirement without support in the governing criteria. Assessors evaluate requirements and evidence rather than inventing obligations based on a favored implementation model.

This is particularly important in OT, where seemingly routine security changes can interact with production systems in consequential ways.

What Manufacturing Leadership Should Understand

OT-related CMMC conversations often require participation beyond IT. Production, engineering, security, and organizational leadership may each understand different operational dependencies.

Leaders should understand that OT is not automatically exempt from CMMC, that Zero Trust is not itself a CMMC certification checklist, and that operational constraints do not eliminate applicable security requirements. These are governance and business considerations as much as technical ones.

Start With Published Guidance

The appropriate starting points are NIST SP 800-82 Rev. 3 for OT security, NIST SP 800-207 for Zero Trust architecture, and 32 CFR Part 170 for CMMC program requirements. These publications have different purposes and should not be conflated.

For additional context on evidence and assessment expectations, read CMMC Assessment Readiness: What Ready Actually Looks Like.

The Bottom Line

Zero Trust principles can inform manufacturing cybersecurity, but they do not eliminate OT’s operational realities. CMMC assessors must understand the environment, apply the correct requirements, and evaluate evidence without elevating a preferred architecture into an unsupported obligation.

Defense manufacturers benefit from understanding where OT, CUI, cybersecurity responsibilities, and assessment scope intersect.

Continue the Conversation

Matt In Cyber offers independent CMMC education, executive briefings, and team training. If your manufacturing leadership team would benefit from a clearer understanding of CMMC and OT assessment concepts, contact Matt In Cyber to discuss an educational session.

Matt In Cyber does not provide official CMMC certification assessments. Educational services do not constitute an assessment, compliance determination, or certification.