Cybersecurity Risk Frameworks for Mission Critical Process Automation: From IT/OT Convergence to Zero-Trust Architectures

Abstract

There is a gap in industrial cybersecurity. Above all, the frameworks that govern OT security, IEC 62443 for short, were built for a time when the air gap existed, and the threat model was physical. That era came to an end quietly, between the first remote vendor access agreement and the first cloud-connected historian. By 2024, more than 12,000 ICS-oriented cybersecurity incidents had occurred in one year, with dual IT/OT breaches averaging USD 4.56 million per event. Zero Trust Architecture, as specified in NIST SP 800-207, is the correct conceptual response: No longer should you trust your network location; verify everything at every step. The caveat is that NIST SP 800-207 is IT-oriented, and its accompanying implementation manual specifically excludes OT. No Zero Trust standard is specifically designed for OT. This paper examines the top-level cybersecurity governance platforms and their relevance to five dimensions of OT, presents a scenario of 2024-2026 industrially harmful environments, and introduces the Adaptive Zero Trust Framework for Industrial Control Systems (AZTF-ICS). AZTF-ICS is an innovative five-pillar model that uses Zero Trust principles to address the unique operational constraints of mission-critical process automation, with real-time requirements, high availability, and safety tasks that are not susceptible to interruption, irrespective of any security control policy.