The Department of Defense has issued a definitive mandate: Zero Trust for Operational Technology, codified in the ZT for OT Activities and Outcomes framework and DTM 25-003. BlastShield addresses 59 of 105 requirements — without touching a single PLC or disrupting operations.
of 105 requirements addressed
directly satisfied
enabled via BlastShield
ZT pillars covered
The Department of Defense's Zero Trust for Operational Technology guidance represents a fundamental shift from perimeter-centric security to a continuously authenticated, least-privilege architecture for every OT asset — from the Operational Layer (HMIs, engineering workstations, historians) down to the Process Control Layer (PLCs, RTUs, sensors, Safety Instrumented Systems).
The framework is built around seven pillars — User, Device, Application/Workload, Data, Network, Automation and Orchestration, and Visibility and Analytics — and defines 105 activities across Target Level (minimum mandatory compliance) and Advanced Level (adaptive, automated response) maturity tiers.
The core challenge for DoD Components is that standard IT-centric Zero Trust tools are unsuitable for OT environments. Active scanning can crash a PLC. Automated patching can violate safety certifications. Standard MFA can impede emergency operations. The framework explicitly acknowledges this — and BlastShield was built to solve exactly this problem.
The two protected layers: The DoD framework simplifies the Purdue Model into two zones. The Operational Layer (Levels 3-5: HMIs, SCADA, historians, engineering workstations) is the IT/OT boundary where human operators work. The Process Control Layer (Levels 0-2: PLCs, RTUs, sensors, Safety Instrumented Systems) controls physical processes. BlastShield acts as the unified policy enforcement engine across both layers — and renders both invisible to the enterprise IT network via Network Cloaking.
Target vs. Advanced: Target Level activities are the minimum required — inventories, MFA, microsegmentation, deny-by-default. Advanced Level adds adaptive automation: dynamic policy adjustment based on behavioral analytics, continuous authentication, and automated threat response. BlastShield directly satisfies 31 Target and 4 Advanced requirements, and enables 15 more Target and 6 more Advanced activities requiring integration with partner tools.
BlastShield alone satisfies these requirements.
Target: 31 · Advanced: 4
BlastShield provides significant coverage; partner tooling fills remaining gaps
BlastShield provides the enforcement layer; SIEM, IdP, or EDR activates the requirement
The DoD ZT for OT framework organizes requirements into seven pillars. BlastShield is strongest in the Network, User, and Device pillars — the three pillars that deal directly with OT access control and lateral movement prevention.
This is the core of the BlastShield value proposition. The Network pillar covers granular access rules, programmable infrastructure, OT plane segmentation, microsegmentation, and data-in-transit protection — all areas where BlastShield provides direct, comprehensive coverage.
BlastShield operates on a Zero Trust Default Drop model: no traffic is permitted unless identity-to-identity authorization exists. It enables cryptographic plane segmentation, host-level microsegmentation independent of VLANs, and AES-256 encryption for legacy plaintext protocols like Modbus, DNP3, and Telnet.
The User pillar requires migrating away from shared, static OT passwords to continuous, identity-based authentication. BlastShield delivers deny-by-default policy enforcement, FIDO2-compliant passwordless MFA (biometric + QR challenge-response + device keystore), session-based authentication, and integration with DoD-approved IdPs including Azure AD, Okta, and CAC/PIV systems.
For vendor and contractor access, BlastShield creates a "Segment of One" — a technician sees only the specific device they're authorized to service. They cannot ping adjacent controllers or scan the network.
The most intractable OT challenge: legacy PLCs and RTUs cannot run agents or accept certificates. BlastShield solves this through its Gateway architecture. The BlastShield Security Gateway holds certificates on behalf of legacy assets behind it — to the rest of the network, every device appears as a fully authenticated, encrypted node without any changes to the PLC firmware or configuration.
For BYOD/non-GFE assets used by third-party maintainers, BlastShield creates an encrypted, containerized session to the specific OT resource, preventing unmanaged devices from laterally exploring the network.
The BlastShield Orchestrator serves as the centralized policy repository — a single pane of glass for all access rules across the OT estate. Every function is accessible via REST API, enabling integration into DoD "Single Pane of Glass" dashboards and SOAR platforms. When a SIEM detects a threat, it can trigger a BlastShield policy change to isolate the compromised host in milliseconds.
BlastShield generates high-fidelity access logs — who connected, from where, to what, for how long, and what was denied. Every denied connection is a high-confidence indicator of compromise: in a Zero Trust network, a probe against a dark network is not noise, it is an attack. Logs export via Syslog to SIEM. For incident response, BlastShield provides a "Digital Kill Switch" — revoking a zone's certificates instantly, logically air-gapping the segment within milliseconds without physical site access.
The BlastShield Orchestrator serves as the centralized policy repository — a single pane of glass for all access rules across the OT estate. Every function is accessible via REST API, enabling integration into DoD "Single Pane of Glass" dashboards and SOAR platforms. When a SIEM detects a threat, it can trigger a BlastShield policy change to isolate the compromised host in milliseconds.
The table below covers the highest-priority Target Level activities where BlastShield has direct or enabling impact. The full 59-activity mapping is available in the white paper.
Activity ID
Requirement
How BlastShield Delivers
Coverage
1.2.2.OT
Role-Based Dynamic Access
Strict RBAC for all OT access; vendors access only the specific equipment they maintain — not the entire subnet
BlastShield creates a "Segment of One" via its SDP architecture. A vendor authenticated to service a Siemens turbine can see only that turbine — they cannot ping adjacent controllers or scan the network. Traditional VPNs fail this test; BlastShield passes it architecturally.
Direct
1.3.1.OT
MFA for OT Environments
Non-negotiable for Target Level; must accommodate OT-specific alternative credentialing where standard IT MFA disrupts operations
BlastShield Authenticator supports FIDO2 passwordless authentication via hardware tokens (YubiKeys) and biometrics — faster than password entry and suitable for HMI touchscreens in operational environments. MFA is enforced at network ingress: no packet reaches the OT asset until strong authentication completes.
Direct
1.7.1.OT
Deny by Default
All OT network access denied unless explicitly authorized; requires a "never trust, always verify" posture
BlastShield's Zero Trust Default Drop model is the foundational policy. Unlike firewall rules where "Allow Any" entries accumulate over time, BlastShield requires explicit identity-to-identity authorization for every connection. Anything not in policy is silently dropped.
Direct
5.4.1–5.4.2.OT
Microsegmentation
Critical Target Level activity; segment OT network to prevent lateral movement — the most common technique in OT malware and nation-state intrusions
BlastShield's core capability is attack surface reduction. Protected OT assets are invisible to unauthorized endpoints — they do not respond to pings, scans, or connection attempts from non-authenticated sources. There are no exposed management ports, no open services visible to the network. The attack surface is functionally zero for anyone outside the authenticated overlay.
Direct
5.4.3.OT
Data in Transit Protection
Encrypt OT communications that cross insecure boundaries; legacy protocols like Modbus, DNP3, and Telnet transmit in clear text
BlastShield encapsulates all traffic leaving the local OT network segment in AES-256 encrypted tunnels, effectively upgrading legacy clear-text protocols to military-grade encryption standards without requiring any changes to endpoint devices. Physical access to a network switch yields nothing to an attacker.
Direct
2.1.2–2.1.3.OT
NPE Certificate Management
Deploy X.509 certificates to all Non-Person Entities; challenge: legacy PLCs cannot host certificates or agents
The BlastShield Security Gateway holds certificates on behalf of legacy assets behind it. The legacy PLC remains untouched; to the Zero Trust enforcement layer, it presents as a fully authenticated, encrypted node. This achieves the NPE management outcome without "rip and replace" of legacy hardware.
Enables
7.2.1.OT
Incident Response Isolation
Ability to physically or logically disconnect OT infrastructure during an incident to prevent further spread
BlastShield provides a Digital Kill Switch. Security teams can instantly revoke certificates associated with a specific zone, site, or user group — logically air-gapping the compromised segment within milliseconds, without dispatching personnel to pull cables at remote sites. Essential for stopping ransomware propagation.
Direct
1.8.3.OT
Continuous Authentication
Advanced Level: Tie sessions to cryptographic user identity; terminate if risk profile changes
BlastShield ties sessions to cryptographic identity, not IP address. If a risk signal changes — unauthorized location, revoked credential, behavioral anomaly — the session can be terminated immediately from the Orchestrator. This positions agencies for the Advanced Level "transaction-based authentication" goal.
Direct (Advanced)
The DoD ZT for OT framework explicitly warns against applying IT-centric security tools to OT environments. BlastShield was designed for exactly these constraints.
The Challenge
Most DoD OT environments are brownfield — a mix of modern IIoT and 30-year-old controllers on unpatched firmware. Implementing segmentation with traditional firewalls requires changing IP addresses, re-cabling, and extended downtime that mission-critical systems cannot afford.
BlastShield Solution
BlastShield operates as a transparent overlay on the existing network segment — no IP changes to protected assets, no re-cabling, no downtime. Zero Trust segmentation goes live in hours, creating a secure enclave around legacy assets without disrupting process communications.
The Challenge
Safety Instrumented Systems (SIS) are the last line of defense against physical catastrophe. ZT implementation must not compromise safety performance — no active scanning, no agent installation, no latency introduction into safety loops.
BlastShield Solution
BlastShield creates dedicated Safety Zones with a Deny by Default policy (1.7.1.OT). No entity — including compromised administrator workstations — can communicate with the SIS unless explicitly authorized with high-assurance credentials. Data extraction for compliance reporting travels through strictly controlled, unidirectional-style tunnels.
The Challenge
Deployment at Base, Camp, Post, and Station environments means constrained satellite or radio links where bandwidth is scarce and latency is critical for real-time control loops. Hub-and-spoke VPN architectures add unacceptable latency.
BlastShield Solution
BlastShield uses a lightweight peer-to-peer mesh architecture. Authenticated users connect directly to OT resources — no hub-and-spoke backhaul. Protocol overhead is minimal, preserving "continuous and reliable operations" even on constrained links. BlastAccess has no visible latency even on low-bandwidth remote connections.
Our European compliance specialists help OT operators develop a defensible compensating control architecture that addresses both CRA and NIS2 — before enforcement deadlines arrive.
.svg)
Privacy Policy | Cookie Policy | © 2025 BlastWave, Inc. All Rights Reserved
This website uses cookies to ensure you get the best experience. More Info