PUBLISHED DATE: 21 January 2026
This guidance—co-authored by the NCSC and partner agencies—outlines eight principles for the desirable end-states that organisations should aim for when designing connectivity OT environments. They are intended as goals rather than minimum requirements.
System owners should use these principles as a practical framework to design, implement, and manage secure connectivity across both new and existing OT systems. These principles are particularly critical for operators of essential services, where connectivity failures or comprises can have significant impact.
Integrators and device manufacturers play a key role tin enabling these outcomes for organisations. They are encouraged to deliver products that are secure by design, easy to implement and maintain. They should also ensure they are providing documentation to allow organisations assess connectivity risks. It is especially important that this documentation is available for 'turnkey' solutions, allowing operators to understand the design and implement appropriate security controls throughout the system's lifecycle.
Secure connectivity principles for operational technology (OT) [PDF, 905 KB]
For questions related to this guidance, email info@ncsc.govt.nz.