The Defense Department’s (DoD) Zero Trust Portfolio Management Office is eyeing a September timeframe to issue new zero trust security guidance for operational technology (OT) and internet of things (IOT) technology.
Randy Resnick, director of DoD’s Zero Trust Portfolio Management Office – which works within the agency’s chief information officer organization – laid out the expected timelines during a panel discussion on June 4 at GDIT’s Emerge: Edge Forward conference in Washington, D.C.
The DoD official also provided some details about the number of zero trust control “activities” that will be featured in the upcoming guidance for OT and IOT, while referencing the “fan chart” that his office uses to align zero trust activities – including target level and advanced level activities – with the five zero trust pillars.
“We have a term called the fan chart for zero trust for IT [information technology, in which the] target was defined as 91 activities,” he said.
“For OT, we have a different fan chart,” he said. “There’s a lot of overlap, but the number of activities to hit target level OT is different.”
“Our plan that we’re going to make the public announcement around September,” regarding OT zero trust guidance, he said, adding “in September as well, we’re going to be making a public announcement about ZT for IoT.”
“I’ll go to the punch with ZT IoT – that’s going to be target level ZT for IT, plus two more activities from advanced,” Resnick said. “So, there’s 93 activities to secure IoT, and we’ll make that announcement September as well.”
“So, in September, we’ll have the IT, OT, and IoT guidance,” he said.
In March, Resnick forecasted that DoD would release zero trust guidance for OT “likely around August.”