The zero-trust concepts do not universally apply to cyber-physical systems (CPSs) that perform specific tasks in unique safety spaces, Gartner argues. The analysis firm expects 75% of organizations that have adopted a formal zero-trust strategy will explicitly exclude their CPSs in mission-critical or production environments.

CPSs refer to systems that orchestrate sensing, computation, control, networking, and analytics to interact with the physical environment, according to Gartner. Examples include autonomous automobile systems, robotics systems, and industrial control systems and many CPSs can be found in critical infrastructure and clinical healthcare environments.

Gartner VP analyst Katell Thielemann argues organizations should understand what translates from IT-centric zero-trust strategy to CPSs and what not to avoid extra costs and dubious improvements.

“Zero trust is a security mindset that replaces perimeter-based defenses with a contextual balance of risk and trust,” Thielemann wrote in the report. “The name itself is a misnomer, as the overall goal is to replace implicit trust with explicitly defined and continuously assessed trust, which is very challenging in complex operational and production environments.”

Using robots and other hyper-automated CPSs as an example, the communications set up in those systems are naturally unpredictable to optimize operations, so zero-trust policy settings may be extremely complex or incompatible in those environments, Thielemann added.

On the other hand, Thielemann argues some zero-trust concepts can be used for CPSs, but organizations should stick to the basics for example using macro network segmentation to protect assets in the network that lack security hygiene and extend zero-trust mindset to physical processes when it comes to users, identities, and behaviors.

She warns some zero-trust vendors to position themselves as specialists for CPSs in operational or mission-critical environments, but they might only have one or few features aligned with zero-trust concepts while disregarding others.

Thielemann recommends organizations understand their own IT zero-trust strategies, brainstorm with CPS operators and engineers about how to adapt and ask zero-trust vendors to demonstrate which risks are mitigated for their environment.

“Inquire about existing controls, how they minimize impact to operations, and if they will provide solid production customer references within your vertical who are willing to provide feedback on the product,” she wrote.