Category: Identity & Access Management

Zero Trust Architecture

Also known as: ZTA, Zero Trust security model, never trust, always verify architecture

Simply put

Zero Trust Architecture (ZTA) is a security approach built on the principle of 'never trust, always verify,' meaning no user or device is trusted automatically just because it is inside a network. Instead, every request to access resources must be authenticated and verified. It represents a way of designing infrastructure and workflows around zero trust principles rather than relying on a trusted internal perimeter.

Formal definition

According to NIST Special Publication 800-207, a Zero Trust Architecture (ZTA) applies zero trust principles to the planning and design of enterprise and industrial infrastructure and workflows. It structures network devices, services, and access decisions to enforce continuous authentication and verification of every access request, rather than granting implicit trust based on network location. Readers should verify the specific components, tenets, and deployment models against the current authoritative text of NIST SP 800-207, and note that ZTA describes an architectural model and does not by itself constitute a compliance authorization or an Authority to Operate.

Why it matters

Zero Trust Architecture matters because the traditional perimeter-based security model, where users and devices inside a network are implicitly trusted, has proven inadequate against modern threats such as credential theft, lateral movement, and insider misuse. By requiring that every access request be authenticated and verified regardless of its origin inside or outside the network, ZTA aims to reduce the implicit trust that attackers frequently exploit once they gain an initial foothold. NIST SP 800-207 provides the foundational description of how zero trust principles are applied to enterprise and industrial infrastructure and workflows.

For defense and public sector organizations, ZTA has become a central concept in strategic cybersecurity planning. It reframes security architecture around continuous verification rather than a fixed trusted boundary, which is particularly relevant for enterprises operating distributed systems, remote access, and hybrid infrastructure. Adopting zero trust principles can help organizations structure network devices, services, and access decisions to better contain the impact of a compromise.

A critical point for compliance professionals is that ZTA is an architectural model, not a certification or authorization. Implementing a zero trust approach does not by itself constitute a compliance outcome, an assessment result, or an Authority to Operate (ATO). Security architecture and compliance authorization remain distinct: an organization may design toward zero trust principles while still needing to satisfy the separate assessment, authorization, and continuous monitoring requirements applicable to its systems. Readers should verify the specific tenets, components, and deployment models against the current authoritative text of NIST SP 800-207.

Who it's relevant to

Information System Security Managers and Security Architects

Those responsible for designing and maintaining enterprise infrastructure use ZTA as a model for structuring network devices, services, and access decisions around continuous authentication and verification. They should treat NIST SP 800-207 as the anchoring reference and confirm specific tenets and deployment models against its current text.

Authorizing Officials and Compliance Officers

These stakeholders must understand that ZTA is an architectural model and does not by itself produce an Authority to Operate or satisfy authorization requirements. Adopting zero trust principles is distinct from the assessment, authorization, and continuous monitoring obligations that apply to a given system.

Government Contractors and System Integrators

Organizations building or operating systems for federal and defense customers may be asked to align designs with zero trust principles. They should verify the applicable requirements and any agency-specific interpretations against current official sources, since architectural alignment does not automatically equate to meeting contractual or compliance mandates.

Auditors and Assessors

When evaluating an environment described as adopting zero trust, assessors should distinguish between the architectural design intent and demonstrable compliance outcomes. Confirming how access decisions are actually enforced, rather than accepting a 'zero trust' label at face value, is essential, as is referencing the authoritative NIST SP 800-207 text.

Inside ZTA

Core Principle ('Never Trust, Always Verify')

Zero Trust Architecture is a security model that assumes no implicit trust is granted to assets or user accounts based solely on physical or network location, or on asset ownership. Access decisions are made on a per-request basis and continuously re-evaluated rather than granted once at a network perimeter.

Foundational Guidance (NIST SP 800-207)

NIST Special Publication 800-207, issued by NIST, is generally regarded as the primary foundational document defining Zero Trust Architecture concepts and logical components for federal use. Readers should verify the current revision and consult any agency-specific or DoD-specific supplements, as related guidance continues to evolve.

Policy Decision Point (PDP) and Policy Enforcement Point (PEP)

In the logical model described in NIST guidance, a Policy Decision Point evaluates access requests against policy, while a Policy Enforcement Point enables, monitors, and terminates connections between a subject and a resource. Together they operationalize per-request access control.

Identity and Access Management

ZTA relies heavily on strong authentication and authorization of subjects (users, services, and devices), typically emphasizing continuous verification of identity and privilege rather than a single point-of-entry authentication event.

Micro-segmentation and Resource Isolation

Rather than relying on a hardened network perimeter, ZTA generally emphasizes segmenting resources and controlling access to individual resources so that a compromise in one area does not automatically confer broad access.

Continuous Monitoring and Dynamic Policy

ZTA implementations generally incorporate ongoing collection of information about asset state, network activity, and access requests to inform and adjust access policies in near real time. This aligns conceptually with the continuous monitoring expectations already present in the RMF.

Federal Adoption Context

Federal civilian and DoD efforts have promoted movement toward Zero Trust approaches. The specific mandates, timelines, and maturity models applicable to a given organization differ by authority and should be confirmed against current official sources, as they are subject to change.

Common questions

Answers to the questions practitioners most commonly ask about ZTA.

Does adopting a Zero Trust Architecture mean we no longer need a network perimeter or firewalls?

No. Zero Trust reframes the assumption that anything inside a network boundary is inherently trustworthy, but it does not eliminate perimeter defenses. Firewalls, segmentation, and boundary protections generally remain part of a layered approach; ZTA adds continuous verification of users, devices, and sessions rather than replacing traditional controls outright. Treating ZTA as a rip-and-replace of the perimeter is a common misconception. Confirm your specific architecture against current authoritative guidance, such as the applicable NIST publication on Zero Trust and any agency-specific reference architecture.

Is Zero Trust Architecture a specific product or certification we can purchase to become compliant?

No. Zero Trust is an architectural approach and set of principles, not a single product, standard, or certification. No individual tool makes an organization 'Zero Trust,' and adopting ZTA is not itself equivalent to satisfying a compliance mandate such as FISMA, the RMF, or CMMC. Vendors may offer components that support Zero Trust objectives, but implementation involves policy, identity, device, network, data, and monitoring decisions across the environment. Verify how ZTA maps to your governing requirements using current official sources rather than relying on vendor claims.

Where should an organization begin when implementing a Zero Trust Architecture?

Implementations generally begin by identifying the protect surface, the critical data, assets, applications, and services, and understanding how users and devices access them. Establishing strong identity and access management, device inventory and posture assessment, and visibility into transaction flows is typically foundational. The specific sequencing and maturity milestones depend on the applicable reference architecture and agency guidance, so confirm your roadmap against current authoritative sources rather than a generic checklist.

How does Zero Trust Architecture relate to the Risk Management Framework (RMF) and an Authority to Operate (ATO)?

ZTA is an architectural approach that can inform how controls are implemented, while the RMF is the process through which systems are categorized, controls are selected and assessed, and an authorizing official grants a time-bound ATO. Adopting Zero Trust principles does not by itself produce or replace an ATO, and an ATO remains subject to continuous monitoring rather than being permanent. Organizations should map their ZTA implementation to the applicable control baseline and confirm authorization requirements with their authorizing official.

What role does continuous monitoring play in a Zero Trust Architecture?

Continuous monitoring is central to Zero Trust because access decisions are intended to be evaluated dynamically rather than granted once and assumed valid. In most implementations this involves ongoing assessment of user and device posture, session context, and telemetry to inform authorization decisions. This aligns conceptually with continuous monitoring expectations under the RMF, though the specific tooling, cadence, and evidence requirements depend on the system, its categorization, and applicable agency guidance.

Does implementing Zero Trust affect how we handle Controlled Unclassified Information (CUI)?

It can, because Zero Trust principles emphasize protecting data and enforcing least-privilege access, which are relevant to safeguarding CUI. However, ZTA does not by itself define or replace the obligations that apply to CUI, which derive from separate authorities and may differ across federal civilian, defense, and other system categories. Organizations should confirm how their Zero Trust implementation supports, rather than substitutes for, applicable CUI safeguarding requirements using current official sources.

Common misconceptions

Zero Trust Architecture is a product you can purchase and deploy.

ZTA is an architectural approach and set of principles, not a single product. It is generally implemented through a combination of policies, processes, and technologies, and no single tool delivers a complete Zero Trust outcome on its own.

Adopting Zero Trust replaces or eliminates the need for the Risk Management Framework and existing compliance obligations.

ZTA is complementary to, not a substitute for, established compliance authorities and processes such as the RMF, FISMA obligations, or applicable control baselines. Organizations still generally need to authorize systems, assess controls, and perform continuous monitoring. Compliance and security remain distinct, and implementing ZTA does not by itself confer an authorization to operate.

Zero Trust means no perimeter and no trust of anything, so once configured it is complete.

ZTA reduces reliance on implicit network-location trust but does not remove the need for enforcement points, identity verification, and ongoing evaluation. It is a continuous, re-evaluated model rather than a one-time state, and its requirements and applicability may differ across federal civilian, DoD, and other environments.

Best practices

Anchor your implementation to NIST SP 800-207 as foundational guidance while confirming the current revision and any agency-specific or DoD-specific supplements that apply to your systems.

Treat ZTA as an integration of policy, process, and technology rather than a single procurement, and map its components (such as policy decision and enforcement points) to your existing architecture.

Strengthen identity and access management with continuous verification of subjects and least-privilege authorization applied on a per-request basis.

Use micro-segmentation and resource-level access controls to limit the scope of any single compromise instead of relying on perimeter defenses alone.

Integrate ZTA continuous monitoring with your existing RMF continuous monitoring program so that access policies are informed by current asset and activity state.

Verify current federal or DoD Zero Trust mandates, timelines, and maturity expectations against official sources, and confirm how they intersect with your authorization and compliance obligations.