Zero Trust SCADA Gateway Deployment Guide (NIST SP 800-207 + IEC 62443)

This guide bridges the conceptual rigor of NIST SP 800-207—centered on 'never trust, always verify'—with the operational pragmatism of IEC 62443-3-3 (system security requirements) and IEC 62443-4-2 (component security requirements). It defines how SCADA gateways must function not as passive protocol translators, but as active policy enforcement points that inspect, normalize, and mediate traffic using identity-aware, context-sensitive policies. Core implementation entails deploying gateways with embedded certificate-based device attestation (e.g., TPM-backed X.509), real-time behavioral anomaly detection (leveraging OT-specific telemetry such as Modbus transaction timing or DNP3 object query patterns), and granular attribute-based access control (ABAC) aligned with IEC 62443-2-4 roles (e.g., 'Operator', 'Engineer', 'Maintenance'). The guide further prescribes lifecycle governance: secure boot, signed firmware updates, runtime integrity measurement (e.g., via Intel TDX or ARM TrustZone), and immutable audit logging synchronized with SIEM/ICS-SOC platforms. Critically, it addresses OT constraints—including deterministic latency, legacy protocol support (e.g., IEC 60870-5-104, OPC UA PubSub), and air-gapped deployment modes—by defining compensating controls where traditional ZT mechanisms (e.g., continuous re-authentication) are adapted to stateful session binding and time-bound authorization tokens aligned with process cycle times.