On October 8, 2026, the National Security Agency released a Cybersecurity Information Sheet titled Hardening Department of War (DoW) Critical Operational Technology (OT) Environments with Zero Trust (ZT) Principles. Of the 84 activities in the DoW’s Zero Trust for OT guidance, it highlights 26 high-impact activities across ten priority areas, written for the reality of operational technology: systems that often stay in service for more than 50 years, cannot take an agent, and cannot be patched or rebooted on an IT schedule.
The guidance does not ask operators to replace that equipment. It selects activities that wrap legacy assets in protective enclaves without intrusive hardware modifications, and nearly every one of those controls starts with the same prerequisite: knowing what is connected and how it communicates. That is a network visibility problem, and it can be addressed without touching a single controller.
What the Guidance Asks For
The ten priority areas are remote access, OT data, asset inventory, visibility, cyber threat intelligence, smart controller hardening, network segmentation and monitoring, engineering workstations and HMIs, Active Directory and domain controllers, and safe verification of controls.
Three themes run through them. First, inventory and visibility come before policy: least-privilege rules depend on an accurate picture of what each asset legitimately needs to communicate with, and in long-lived OT environments, observed traffic is how teams confirm that picture before enforcing it. Second, segmentation and tightly controlled remote access limit the paths an attacker can use to reach or move through critical systems. Third, verification has to be safe. The guidance favors passive methods such as configuration audits, log analysis, and SPAN or TAP monitoring, because an active scan against a fragile controller can disrupt the physical process it runs.
The urgency is not abstract. The guidance warns that adversaries are using advanced AI, which it calls super intelligence, to automate reconnaissance and accelerate exploit development. It cites Volt Typhoon, whose intrusions typically begin in IT networks before pivoting to OT, and it names remote access by vendors, OEMs, and system integrators as a common vector in confirmed OT intrusions. In September, the FBI and CISA published guidance on third-party ICS integrators after foreign actors breached a U.S. industrial automation provider serving power utilities and transportation organizations, staging roughly 800 files of customer SCADA information and schematics for exfiltration. Recent incidents bear that out. The agencies’ advice includes monitoring and recording integrator remote sessions. The connections around OT matter as much as the controllers inside it.
Why Passive Network Evidence Fits OT
Most OT devices will never host security software, which is why agent-based approaches stop at the edge of the plant. The network gear around those devices is a different story. Switches, routers, and firewalls already carry every conversation a controller, HMI, or engineering workstation has, and they can export flow records and answer SNMP queries without anything being installed on the OT assets themselves. We covered the general case in Agentless Security for OT/ICS Networks. The NSA guidance gives that approach a concrete framework to map against.
NetFlow Optimizer (NFO) collects that network evidence and makes it usable. It receives NetFlow, IPFIX, sFlow, and J-Flow from multi-vendor network devices, parses and normalizes it, enriches each record with user identity where a mapping exists, application, threat intelligence, and GeoIP/ASN context, and reduces volume by 80 to 90 percent, primarily through aggregation. Its SNMP auto-discovery builds an inventory of the network infrastructure itself. The result is delivered, CIM-compliant, to Splunk, where it sits alongside identity, firewall, and remote-access data.
Every NSA control for legacy OT starts with knowing what talks to what. The network already knows. The job is to collect that evidence without touching the systems it describes.
Mapping Network Evidence to the NSA’s Priorities
The table below maps NFO’s evidence to the priority areas where network telemetry contributes. The NSA guidance does not endorse any product, and this mapping is NetFlow Logic’s own. None of these rows is a compliance claim. Each describes evidence NFO supports collecting, which teams then analyze and act on in Splunk alongside their other controls. One condition applies throughout: NFO sees traffic where network devices in the path export flow. In OT, that coverage is typically strong at zone boundaries and weaker inside cells built on unmanaged switches.
| NSA priority area (activity) | Network evidence NFO supports collecting |
| Inventory NPEs in OT environment (2.1.1) | SNMP auto-discovery of the switches, routers, firewalls, and other SNMP-capable devices that make up the OT network, plus flow records showing which endpoints are active, their IP addresses, and the ports and services they use, attributes the activity lists |
| Implement connection policy (2.2.1) | Observed conversations between OT assets, workstations, and servers (source, destination, protocol, port, and volume), where switches and routers in the path export flow, so unauthorized protocols and unexpected communication paths can be identified against the defined policy |
| Log parsing in OT environments (7.1.2) | Flow from network devices at and around OT zones, parsed, normalized, and enriched so each record carries the attributes needed to analyze behavior, delivered to Splunk for correlation with identity, firewall, and remote-access logs |
| Implement micro segmentation (5.4.1) | Ongoing records of traffic between zones, so teams can confirm in Splunk that only approved conduits carry traffic after a segmentation change |
| Third-party and remote access (1.5.1) | Records of sessions crossing into OT, with user identity where a mapping exists, showing source, destination, timing, and data volume, in support of continuous monitoring of vendor and integrator access |
| OT cyber threat intelligence program (7.5.1) | Enriched network telemetry delivered into the SIEM, with threat intelligence and GeoIP/ASN context on each record, ready for CTI-driven alerting there |
| Verifying ZT controls safely | Passive flow collection from network devices, and SNMP auto-discovery that can traverse from seed devices instead of scanning full address ranges, keeping polling on network infrastructure rather than controllers |
Two boundaries are worth stating plainly. NFO inventories network devices, not the controllers behind them; identifying a PLC’s model and firmware takes an OT-aware tool. And NFO records traffic; deciding whether a given conversation violates policy happens downstream, in Splunk, against the allowed-flow model the operator defines.
Cisco Depth, NFO Breadth
Cisco’s analysis of the guidance pairs Cisco Cyber Vision with Splunk. Cyber Vision uses deep packet inspection of industrial protocols to identify OT assets and their attributes, map communications, monitor behavior, and support segmentation planning, with sensors embedded in supported Cisco switches and routers. Its Splunk integration brings that OT context into investigation workflows.
NFO complements that depth with breadth. It collects flow and SNMP from the multi-vendor network gear many plants and bases already run, including segments outside a Cisco OT footprint. It covers the IT side of the IT/OT boundary, where the Cisco analysis itself notes threat actors can move laterally toward OT. And it delivers that evidence enriched and normalized, so Splunk can correlate OT context, network conversations, identity, and remote-access activity in one place. The two are designed for different jobs, and both feed the same analysis layer.
Where the Analysis Happens
NFO does not baseline, detect, or alert. It collects, enriches, reduces, and delivers. Splunk is where teams compare observed traffic against approved process flows, investigate whether an OT event lines up with a vendor session or an unusual enterprise identity, and track progress against the NSA activities. That division matters in OT, where the guidance keeps people in control: its micro-segmentation activity (5.4.1) enables automated policy changes only following human approval. For zone-and-conduit planning, the same evidence also supports work under IEC 62443.
The Bottom Line
The NSA’s OT guidance accepts that legacy controllers cannot be replaced overnight and asks operators to protect them with visibility, segmentation, controlled remote access, and safe verification. Every one of those starts with knowing what communicates with what. NFO supports evidence collection for those priorities by turning the flow and SNMP data your network devices already produce into enriched, CIM-compliant telemetry in Splunk, passively and without touching the controllers.
Wrap legacy OT in controls. Build those controls on evidence the network already has.
Want passive, multi-vendor network visibility across your OT and IT environments? Start a free 60-day trial of NetFlow Optimizer or schedule a technical demo with a NetFlow Logic engineer.
Start Free Trial | Schedule a Demo | Government Solutions | NFO Documentation