Brussels — The European Union Agency for Cybersecurity (ENISA) published draft guidance this week that significantly raises the profile of cryptographic device attestation as a mandatory control in Zero Trust deployments for operators of critical services and essential infrastructure.

What ENISA's draft says

The draft, released on Oct. 15, 2026, frames device attestation — cryptographic proof that a device's identity and software state are trustworthy — as a primary technical control rather than an optional enhancement. ENISA recommends that national authorities require attestation mechanisms in procurement and incident-prevention programs for sectors such as energy, transport, healthcare and telecommunications.

Key recommendations include:

  • Mandating cryptographic device identity (rooted in hardware or secure element) for endpoints connecting to critical networks.
  • Integrating remote attestation checks into Zero Trust policy decision points (PDPs) to deny or restrict access when device state or provenance cannot be verified.
  • Requiring vendors to provide verifiable firmware and software supply‑chain attestations as part of product certification and procurement.
  • Encouraging use of standardized attestation formats and privacy-preserving techniques, with ENISA pointing to existing IETF and W3C work as possible baselines.

Why this matters for Zero Trust

Zero Trust architectures center on continuous verification of identity, device posture and least-privilege access. The new ENISA draft moves device attestation from a best practice into a near-core requirement for the most risk-sensitive environments, altering how organizations will architect trust decisions.

“Attestation lets the PDP know not just who is requesting access, but whether that endpoint is a known, untampered device running approved software,” said an EU cybersecurity official briefed on the document. “For critical services, that additional assurance materially reduces attack surface from supply‑chain and endpoint compromise.”

Reaction from vendors and operators

Vendors say the draft accelerates work already underway but raises practical questions about interoperability and legacy device support.

  • Large cloud and endpoint vendors welcomed the clarity on attestation but urged phased timelines. “We support strong attestation standards, and we’ll need multi‑year migration paths for industrial and brownfield devices,” a spokesperson for a major cloud provider said.
  • Telecommunications operators noted that 5G private networks and MEC (multi‑access edge compute) deployments will need attestation integration at scale. Several European carriers are said to be trialing hardware-based attestation in private network pilots this quarter.
  • Industrial operators warned procurement cycles and device lifetimes in OT (operational technology) environments require careful transition plans. “Many controllers were designed without attestation in mind; retrofit will be costly,” an OT security manager at a continental utilities firm said.

Standards, privacy and interoperability challenges

ENISA’s draft urges the use of standardized attestation formats and references ongoing IETF, W3C and Trusted Computing Group work but does not mandate a single technical standard. That approach seeks to balance rapid adoption with flexibility, but it leaves open several questions:

  1. Which attestation architectures (TPM-style, Secure Enclave, TEE-based, or network-provided identity) will dominate in different sectors?
  2. How will privacy-preserving attestations be implemented so that device provenance can be proven without exposing user-identifying data?
  3. Can legacy OT devices be effectively represented in attestation ecosystems via gateways or proxies without introducing new attack vectors?

ENISA’s draft suggests cryptographic “claims” and minimal disclosure proofs as options, and recommends national authorities assess privacy implications in their own contexts.

Operational impact and timelines

ENISA proposes a staged adoption approach. For newly procured systems and high-risk services, attestation should be required within 12–24 months of final guidance; for existing fleets, ENISA advises assessed migration plans and compensating controls during the transition.

Security architects in financial services and energy are already recalculating roadmaps. “We’re reassigning portions of our Zero Trust budget to device identity and attestation pilots,” said a CISO at a pan‑European bank. “The draft makes it inevitable that attestation becomes a gating factor for access policies.”

What to watch next

ENISA has opened a six‑week public comment period. Industry groups, national regulators and vendors are expected to submit feedback on technical feasibility, timelines and harmonization with existing certification regimes.

Key near‑term indicators to watch:

  • Responses from large cloud providers and silicon manufacturers on standard formats and APIs for attestation.
  • National authority statements in EU member states clarifying which critical sectors will be prioritized and whether procurement rules will be updated.
  • Vendor announcements of interoperable attestation tooling, or new attestation-as-a-service offerings aimed at brownfield OT and edge deployments.

Bottom line

ENISA’s draft guidance elevates device attestation from a recommended control to a linchpin of European Zero Trust strategy for critical infrastructure. If adopted in its current direction, organizations will need to accelerate device identity strategies, prioritize attestation in procurement, and invest in migration plans for legacy assets. The public comment phase will be decisive in shaping practical timelines and interoperability expectations — and in defining what “trusted” devices will look like across Europe’s most critical networks.