Zero Trust Architecture

aid: zero-trust-architecture
name: Zero Trust Architecture
description: Zero Trust Architecture (ZTA) is a security framework defined by NIST SP 800-207 that requires all users and
  devices to be authenticated, authorized, and continuously validated before being granted access to applications and data,
  regardless of whether they are inside or outside the network perimeter. The architecture is built on the principle of "never
  trust, always verify," replacing implicit trust with explicit verification for every access request. ZTA leverages APIs,
  identity providers, policy engines, and continuous monitoring to enforce least-privilege access across enterprise resources.
type: Index
url: https://www.nist.gov/publications/zero-trust-architecture
tags:
- Access Control
- Authentication
- Authorization
- Cybersecurity
- Identity Management
- Least Privilege
- Network Security
- NIST
- Security
- Zero Trust
created: '2025'
modified: '2026-05-03'
specificationVersion: '0.19'
apis:
- aid: zero-trust-architecture:nist-sp-800-207
  name: NIST SP 800-207 Zero Trust Architecture
  description: NIST Special Publication 800-207 defines zero trust architecture (ZTA) and provides a roadmap for organizations
    migrating to ZTA. It describes seven ZTA tenets, three logical components (Policy Decision Point, Policy Enforcement Point,
    Policy Administration Point), three approaches to ZTA deployment, and guidance on threat models and use cases. Published
    August 2020.
  humanURL: https://csrc.nist.gov/pubs/sp/800/207/final
  tags:
  - NIST
  - Security Framework
  - Zero Trust
  properties:
  - type: Documentation
    url: https://csrc.nist.gov/pubs/sp/800/207/final
  - type: Documentation
    url: https://nvlpubs.nist.gov/nistpubs/specialpublications/NIST.SP.800-207.pdf
- aid: zero-trust-architecture:nist-sp-800-207a
  name: NIST SP 800-207A ZTA for Cloud-Native Applications
  description: NIST SP 800-207A extends the original ZTA guidance to cover cloud-native applications in multi-cloud environments.
    It addresses service mesh architectures, workload identity, microsegmentation, and API-centric access control patterns
    for containerized workloads.
  humanURL: https://csrc.nist.gov/pubs/sp/800/207/a/final
  tags:
  - Cloud Security
  - Kubernetes
  - NIST
  - Zero Trust
  properties:
  - type: Documentation
    url: https://csrc.nist.gov/pubs/sp/800/207/a/final
  - type: Documentation
    url: https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-207A.pdf
- aid: zero-trust-architecture:spiffe
  name: SPIFFE - Secure Production Identity Framework for Everyone
  description: SPIFFE is a CNCF-graduated open standard for workload identity in dynamic environments. It provides a framework
    for workloads to authenticate to each other using short-lived cryptographic SVIDs (SPIFFE Verifiable Identity Documents)
    without static secrets, forming a foundational element of API-centric Zero Trust implementations.
  humanURL: https://spiffe.io/
  tags:
  - CNCF
  - Identity
  - Open Source
  - Standards
  - Workload Identity
  - Zero Trust
  properties:
  - type: Documentation
    url: https://spiffe.io/docs/latest/
  - type: GitHubOrganization
    url: https://github.com/spiffe
- aid: zero-trust-architecture:spire
  name: SPIRE - SPIFFE Runtime Environment
  description: SPIRE is the reference implementation of SPIFFE, a CNCF-graduated production-ready toolchain for establishing
    trust between workloads. It issues SVIDs to workloads and exposes the SPIFFE Workload API for identity attestation across
    Kubernetes, VMs, cloud instances, and bare metal environments.
  humanURL: https://spiffe.io/docs/latest/spire-about/spire-concepts/
  tags:
  - CNCF
  - Identity
  - Open Source
  - Runtime
  - Zero Trust
  properties:
  - type: Documentation
    url: https://spiffe.io/docs/latest/spire-about/
  - type: GitHubOrganization
    url: https://github.com/spiffe/spire
- aid: zero-trust-architecture:open-policy-agent
  name: Open Policy Agent (OPA)
  description: Open Policy Agent is a CNCF-graduated open source general-purpose policy engine that enables unified, context-aware
    policy enforcement across APIs, microservices, Kubernetes, and CI/CD pipelines. In Zero Trust implementations, OPA serves
    as the Policy Decision Point (PDP) evaluating access requests against defined policies written in the Rego language.
  humanURL: https://www.openpolicyagent.org/
  tags:
  - Authorization
  - CNCF
  - Open Source
  - Policy Engine
  - Zero Trust
  properties:
  - type: Documentation
    url: https://www.openpolicyagent.org/docs/latest/
  - type: GitHubOrganization
    url: https://github.com/open-policy-agent
common:
- type: Portal
  title: NIST Zero Trust Architecture
  url: https://www.nist.gov/publications/zero-trust-architecture
  description: Official NIST page for Zero Trust Architecture publications and resources.
- type: Documentation
  title: NIST SP 800-207 PDF
  url: https://nvlpubs.nist.gov/nistpubs/specialpublications/NIST.SP.800-207.pdf
  description: Downloadable PDF of NIST Special Publication 800-207 Zero Trust Architecture.
- type: Documentation
  title: NIST SP 800-207A PDF
  url: https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-207A.pdf
  description: NIST SP 800-207A covering ZTA for cloud-native applications in multi-cloud environments.
- type: Compliance
  title: CISA Zero Trust Maturity Model
  url: https://www.cisa.gov/zero-trust-maturity-model
  description: CISA's Zero Trust Maturity Model providing a roadmap across five pillars.
- type: Compliance
  title: NSA Zero Trust Guidance
  url: https://www.nsa.gov/Press-Room/News-Highlights/Article/Article/2899282/nsa-releases-guidance-on-zero-trust-security-model/
  description: NSA guidance on Zero Trust Security Model for network and environment pillar.
- type: Compliance
  title: DoD Zero Trust Reference Architecture
  url: https://dodcio.defense.gov/Portals/0/Documents/Library/ZT-Reference-Architecture.pdf
  description: Department of Defense Zero Trust Reference Architecture document.
- type: Portal
  title: SPIFFE Project
  url: https://spiffe.io/
  description: Official site for SPIFFE workload identity standard and SPIRE runtime.
- type: Portal
  title: Open Policy Agent
  url: https://www.openpolicyagent.org/
  description: Official site for Open Policy Agent (OPA), the CNCF policy engine used as PDP in ZTA.
- type: GitHubOrganization
  title: SPIFFE GitHub
  url: https://github.com/spiffe
  description: SPIFFE and SPIRE open source repositories on GitHub.
- type: GitHubOrganization
  title: Open Policy Agent GitHub
  url: https://github.com/open-policy-agent
  description: Open Policy Agent (OPA) GitHub organization.
- type: JSONSchema
  title: Zero Trust Policy Schema
  url: json-schema/zero-trust-architecture-policy-schema.json
- type: JSONSchema
  title: Zero Trust Identity Schema
  url: json-schema/zero-trust-architecture-identity-schema.json
- type: JSONSchema
  title: Zero Trust Resource Schema
  url: json-schema/zero-trust-architecture-resource-schema.json
- type: JSONLD
  title: Zero Trust Architecture JSON-LD Context
  url: json-ld/zero-trust-architecture-context.jsonld
- type: JSONStructure
  title: Zero Trust Policy Structure
  url: json-structure/zero-trust-architecture-policy-structure.json
- type: JSONStructure
  title: Zero Trust Identity Structure
  url: json-structure/zero-trust-architecture-identity-structure.json
- type: Resources
  title: Zero Trust Architecture Vocabulary
  url: vocabulary/zero-trust-architecture-vocabulary.yaml
- type: CodeExamples
  title: Zero Trust Policy Example
  url: examples/zero-trust-architecture-policy-example.json
- type: CodeExamples
  title: Zero Trust Identity Example
  url: examples/zero-trust-architecture-identity-example.json
- type: Features
  data:
  - name: Identity Verification
    description: Every access request requires verification of user and device identity regardless of network location.
  - name: Least Privilege Access
    description: Access is granted with minimum required permissions on a per-session basis.
  - name: Microsegmentation
    description: Networks are divided into small zones to limit lateral movement after breach.
  - name: Continuous Monitoring
    description: All network traffic, user behavior, and device health are continuously monitored and analyzed.
  - name: Policy Decision Point
    description: Centralized policy engine evaluates access requests against defined policies.
  - name: Policy Enforcement Point
    description: Gateway or proxy that enforces access decisions made by the policy engine.
  - name: Workload Identity
    description: Cryptographic identity for workloads and services replacing static credentials.
  - name: Device Health Attestation
    description: Device posture and compliance are verified before granting access.
  - name: Implicit Trust Elimination
    description: No user, device, or network is trusted implicitly, even inside the corporate perimeter.
  - name: Multi-Factor Authentication
    description: Strong MFA is required as part of identity verification for all access.
- type: UseCases
  data:
  - name: Remote Workforce Security
    description: Providing secure access to enterprise resources for remote employees without VPN.
  - name: Cloud Application Access
    description: Controlling access to multi-cloud and SaaS applications with consistent policies.
  - name: API Security
    description: Enforcing zero trust principles at API gateways with per-request authentication and authorization.
  - name: Kubernetes Workload Identity
    description: Using SPIFFE/SPIRE to assign cryptographic identities to Kubernetes pods.
  - name: Supply Chain Security
    description: Verifying identity and integrity of software components and build pipelines.
  - name: Government Compliance
    description: Meeting CISA Zero Trust Maturity Model requirements for federal agencies.
  - name: Insider Threat Mitigation
    description: Limiting damage from insider threats through continuous monitoring and least privilege.
  - name: Multi-Cloud Security
    description: Applying consistent zero trust policies across AWS, Azure, GCP, and private clouds.
- type: Integrations
  data:
  - name: SPIFFE/SPIRE
    description: Workload identity standard providing SVIDs for mutual TLS authentication.
  - name: Open Policy Agent
    description: Policy engine serving as the Policy Decision Point in ZTA implementations.
  - name: Envoy Proxy
    description: Service mesh proxy enforcing mTLS and authorization policies as PEP.
  - name: Istio
    description: Kubernetes service mesh providing ZTA controls through SPIFFE and OPA integration.
  - name: HashiCorp Vault
    description: Secrets management platform providing dynamic credentials in ZTA pipelines.
  - name: Okta
    description: Identity provider for user and device authentication in ZTA implementations.
  - name: Microsoft Entra ID
    description: Cloud identity platform used as Identity Provider in enterprise ZTA deployments.
  - name: BeyondCorp Enterprise
    description: Google's ZTA implementation providing context-aware access for enterprise applications.
  - name: Cloudflare Zero Trust
    description: Zero Trust Network Access and secure web gateway platform.
  - name: Zscaler Private Access
    description: Cloud-native ZTNA solution providing ZTA-compliant access to private applications.
maintainers:
- FN: Kin Lane
  email: kin@apievangelist.com