Zero Trust in OT
Zero Trust is a security model in which no user, device, or connection is trusted by default because of where it sits on the network; every access is verified and limited to what is needed. Applied to OT it means brokered, least-privilege access to controllers rather than a flat trusted plant network.
The model is described in NIST SP 800-207. In IT it is implemented with identity-aware proxies and continuous verification. OT equipment often cannot participate directly, since a 15-year-old PLC has no concept of identity, so Zero Trust in OT is applied at the boundaries: remote access brokers, jump hosts, per-session approval, and logging of every privileged connection.
It complements rather than replaces segmentation. Zones and conduits define where traffic may flow; Zero Trust decides who may open a session through them.
Why it matters in cement, mining, and aggregates
The immediate application in cement and mining is vendor and contractor access. Instead of a standing VPN into the control network, each OEM session is requested, approved, time-limited, and recorded. Nothing changes on the controllers themselves.