Brussels — A draft guidance circulated by the European Union Agency for Cybersecurity (ENISA) in late 2026 would put hardware-backed device attestation at the center of European zero‑trust strategies for critical sectors, marking a potential turning point in how organizations prove device integrity inside zero‑trust architectures.

What the draft proposes

The ENISA draft recommends that operators in critical sectors — including energy, telecommunications, finance and healthcare — adopt continuous, hardware‑based attestation as a mandatory control for network access and high‑risk transactions. The document separates requirements into three tracks:

  • Immediate incorporation of attestation checks into conditional access policies for new procurements.
  • Phased retrofit requirements for existing fleets, with staggered compliance deadlines through 2028.
  • A requirement that attestation evidence be usable for both device admission and ongoing session re‑validation (continuous validation).

ENISA frames the measure as a response to increasingly sophisticated supply‑chain and firmware attacks that evade software‑only controls. The draft emphasizes cryptographic proofs anchored in a hardware root of trust — examples include TPM 2.0, DICE, and vendor TEEs — combined with privacy‑preserving attestations so device telemetry can be checked without exposing unnecessary personal or enterprise data.

Why this matters for zero trust

Zero trust relies on continuous verification of identity, device posture and session context. Hardware attestation offers a higher‑assurance signal for device posture than user‑space agents or network telemetry alone. If the ENISA guidance becomes binding for member states or is reflected in national procurement rules, zero‑trust deployments across Europe will need to treat attestation as a first‑class telemetry source alongside identity and telemetry feeds.

Technical and operational implications

Adopting hardware attestation at scale changes several practical aspects of implementing zero trust:

  • Policy engines: Policy decision points (PDPs) must ingest attestation evidence (signed quotes, attestations, claims) and evaluate them against expected measurements. This will drive demand for modular policy engines that support attestation semantics and trust anchors.
  • Provisioning and lifecycle: Device onboarding workflows will need secure provisioning of keys and identity; supply‑chain attestation and secure manufacturing records become procurement considerations.
  • Privacy models: ENISA explicitly calls for privacy‑preserving schemes — group signatures, DAA‑style approaches and selective disclosure — to reduce telemetry leakage while retaining assurance.
  • Interoperability: The guidance leans on existing IETF RATS (Remote ATtestation procedures) work as a reference model, underscoring the need for interoperable attestation formats and profiles across vendors and clouds.

Cloud and vendor responses

Major cloud providers and security vendors are already positioning to support attestation workflows through attestation‑as‑a‑service offerings, secure evidence brokers, and integrations into device posture services. For enterprises, this means an ecosystem where on‑prem hardware attestation can be normalized into cloud policy decisions.

Smaller hardware vendors and legacy equipment manufacturers face tougher decisions. Retrofitting attestation can require hardware changes, firmware updates and renewed supply‑chain documentation. ENISA’s phased deadlines are intended to ease the transition, but procurement teams will need to reevaluate vendor risk and lifecycle plans when acquiring new equipment.

Challenges and open questions

Industry experts and privacy advocates pointed to several unresolved issues in the draft:

  1. Standards harmonization: There are multiple attestation providers, different quote formats and vendor‑specific TEEs. Implementers need clear profiles and translation layers to avoid vendor lock‑in.
  2. Operational cost: Continuous attestation is heavier than periodic scans; it increases telemetry volume, cryptographic verification overhead and key lifecycle management complexity.
  3. Legacy systems: Industrial control systems and medical devices often lack the hardware or firmware to produce modern attestation evidence, creating practical and safety concerns for immediate enforcement.
  4. Privacy and legal: Even with privacy‑preserving techniques, cross‑border flows of attestation evidence raise GDPR and data‑locality issues that national regulators will need to resolve.

What practitioners should do now

Zero‑trust teams in affected sectors should treat the draft as an early warning and begin preparatory work:

  • Inventory devices and classify which can provide hardware attestation natively.
  • Map existing conditional access policies to the attestation signals you will need and identify gaps.
  • Run pilot integrations with attestation brokers or cloud attestation services to assess policy engine compatibility and performance.
  • Engage procurement to insert attestation requirements into RFPs and vendor SLAs for new hardware.
  • Assess privacy impacts and consult legal teams about telemetry handling across borders.

Implications for vendors and the market

If the ENISA guidance moves from draft to formal guidance or is mirrored by national procurement rules, expect several market shifts: increased demand for TPM/DICE‑enabled hardware, growth in attestation brokers and policy engines with attestation parsers, and a sharp uptick in consulting projects to retrofit critical systems. Suppliers that can demonstrate interoperable, privacy‑conscious attestation workflows will enjoy a competitive edge.

ENISA’s draft does not mandate a single technical standard, but its emphasis on hardware roots of trust and continuous validation sends a clear policy signal: device identity and integrity must be verifiable cryptographically if zero trust is to be credible in critical infrastructure.

For zero‑trust practitioners, the draft reframes device attestation from an advanced option into a primary control to be designed and budgeted for now — or risk being out of compliance with the next wave of European security requirements.