Towards Secure Legacy Manufacturing: A Policy-Driven Zero Trust Architecture Aligned with NIST CSF 2.0

As smart manufacturing environments continue to evolve, operational technology systems are increasingly integrated with external networks and cloud-based platforms. However, many manufacturing facilities still use legacy systems running on end-of-support/life operating systems with discontinued security updates. It is difficult to mitigate the cyber threats and risks for these systems using perimeter-based security models that isolate them from other networks. To address these constraints, a Zero Trust-based security architecture tailored for legacy manufacturing environments with practical field applicability is proposed. Our architecture builds upon the six core functions outlined in National Institute of Standards and Technology Cybersecurity Framework 2.0—identify, protect, detect, respond, recover, and govern—adapting them specifically to manufacturing environment security challenges. To achieve this, the architecture combines asset identification, policy-driven access control, secure SMB gateway transfers, automated anomaly detection and response, clean image recovery, and organizational governance procedures. This study validates the effectiveness and scalability of the proposed architecture through scenario-based simulations. When combining the EoSL defense hardening and gateway-based perimeter control, the architecture achieves approximately 99% overall threat suppression and a 98% reduction in critical-asset infection rates, demonstrating its strong resilience and scalability in large-scale legacy OT environments.