Zero-Trust Security Model

aid: zero-trust-security-model
name: Zero-Trust Security Model
description: The Zero Trust security model is a strategic cybersecurity approach that eliminates implicit trust and requires
  continuous verification of every user, device, workload, and request attempting to access resources, regardless of network
  location. It is rooted in NIST SP 800-207, formalized for federal agencies by the CISA Zero Trust Maturity Model and the
  DoD Zero Trust Reference Architecture, and operationalized by NSA, NCSC, and industry guidance. This topic indexes the canonical
  specifications, guidance documents, advocacy organizations, and reference data schemas that describe the Zero Trust security
  model and its pillars (Identity, Devices, Networks, Applications & Workloads, Data, Visibility & Analytics, Automation &
  Orchestration).
type: Index
url: https://www.nist.gov/publications/zero-trust-architecture
tags:
- Access Control
- Cybersecurity
- Federal
- Identity Management
- Network Security
- NIST
- Security
- Security Framework
- Zero Trust
created: '2025'
modified: '2026-05-03'
specificationVersion: '0.19'
apis:
- aid: zero-trust-security-model:nist-sp-800-207
  name: NIST SP 800-207 Zero Trust Architecture
  description: The foundational specification of the Zero Trust security model. Defines the seven tenets, the PDP/PEP/PA logical
    components, and the deployment variants (enhanced identity governance, microsegmentation, and network infrastructure /
    SDP).
  humanURL: https://csrc.nist.gov/pubs/sp/800/207/final
  tags:
  - NIST
  - Specification
  - Zero Trust
  properties:
  - type: Documentation
    url: https://csrc.nist.gov/pubs/sp/800/207/final
  - type: APIReference
    url: https://nvlpubs.nist.gov/nistpubs/specialpublications/NIST.SP.800-207.pdf
- aid: zero-trust-security-model:cisa-zero-trust-maturity-model
  name: CISA Zero Trust Maturity Model
  description: CISA's Zero Trust Maturity Model defines four maturity levels (Traditional, Initial, Advanced, Optimal) across
    five pillars (Identity, Devices, Networks, Applications & Workloads, Data) and three cross-cutting capabilities (Visibility
    & Analytics, Automation & Orchestration, Governance). It is the federal-civilian roadmap for Zero Trust adoption.
  humanURL: https://www.cisa.gov/zero-trust-maturity-model
  tags:
  - CISA
  - Federal
  - Maturity Model
  properties:
  - type: Documentation
    url: https://www.cisa.gov/zero-trust-maturity-model
  - type: APIReference
    url: https://www.cisa.gov/sites/default/files/2023-04/zero_trust_maturity_model_v2_508.pdf
- aid: zero-trust-security-model:dod-zero-trust-reference-architecture
  name: DoD Zero Trust Reference Architecture
  description: The Department of Defense Zero Trust Reference Architecture defines the seven DoD Zero Trust pillars (User,
    Device, Application & Workload, Data, Network & Environment, Automation & Orchestration, Visibility & Analytics) and 152
    capabilities across target and advanced activities.
  humanURL: https://dodcio.defense.gov/library/
  tags:
  - DoD
  - Federal
  - Reference Architecture
  properties:
  - type: Documentation
    url: https://dodcio.defense.gov/Portals/0/Documents/Library/ZT-Reference-Architecture.pdf
- aid: zero-trust-security-model:nsa-zero-trust-guidance
  name: NSA Zero Trust Guidance
  description: A series of NSA Cybersecurity Information Sheets providing pillar-by- pillar guidance for implementing Zero
    Trust, including the Network and Environment, User, Device, Application & Workload, and Data pillars.
  humanURL: https://www.nsa.gov/Cybersecurity/
  tags:
  - Federal
  - Guidance
  - NSA
  properties:
  - type: Documentation
    url: https://www.nsa.gov/Press-Room/News-Highlights/Article/Article/2899282/nsa-releases-guidance-on-zero-trust-security-model/
- aid: zero-trust-security-model:ncsc-zero-trust-principles
  name: UK NCSC Zero Trust Architecture Design Principles
  description: The UK National Cyber Security Centre's eight Zero Trust design principles, providing the British government's
    view of Zero Trust architecture for both public-sector and private organizations.
  humanURL: https://www.ncsc.gov.uk/collection/zero-trust-architecture
  tags:
  - Guidance
  - NCSC
  - UK
  properties:
  - type: Documentation
    url: https://www.ncsc.gov.uk/collection/zero-trust-architecture
common:
- type: Documentation
  title: NIST Zero Trust Architecture
  url: https://www.nist.gov/publications/zero-trust-architecture
  description: NIST landing page for Zero Trust Architecture publications.
- type: Documentation
  title: NIST SP 800-207 PDF
  url: https://nvlpubs.nist.gov/nistpubs/specialpublications/NIST.SP.800-207.pdf
- type: Documentation
  title: NIST SP 800-207A PDF
  url: https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-207A.pdf
- type: Compliance
  title: CISA Zero Trust Maturity Model
  url: https://www.cisa.gov/zero-trust-maturity-model
- type: Compliance
  title: OMB M-22-09 Federal Zero Trust Strategy
  url: https://www.whitehouse.gov/wp-content/uploads/2022/01/M-22-09.pdf
  description: White House OMB memorandum mandating Zero Trust adoption across federal civilian agencies.
- type: Compliance
  title: DoD Zero Trust Reference Architecture
  url: https://dodcio.defense.gov/Portals/0/Documents/Library/ZT-Reference-Architecture.pdf
- type: Documentation
  title: NSA Zero Trust Guidance
  url: https://www.nsa.gov/Press-Room/News-Highlights/Article/Article/2899282/nsa-releases-guidance-on-zero-trust-security-model/
- type: Documentation
  title: UK NCSC Zero Trust
  url: https://www.ncsc.gov.uk/collection/zero-trust-architecture
- type: Portal
  title: Cloudflare Learning - What Is Zero Trust
  url: https://www.cloudflare.com/learning/security/glossary/what-is-zero-trust/
- type: Portal
  title: Microsoft Zero Trust Guidance Center
  url: https://learn.microsoft.com/en-us/security/zero-trust/
- type: Portal
  title: Google BeyondCorp
  url: https://cloud.google.com/beyondcorp
- type: GitHubOrganization
  title: SPIFFE
  url: https://github.com/spiffe
- type: GitHubOrganization
  title: Open Policy Agent
  url: https://github.com/open-policy-agent
- type: JSONSchema
  title: Zero Trust Pillar Schema
  url: json-schema/zero-trust-security-model-pillar-schema.json
- type: JSONSchema
  title: Zero Trust Maturity Assessment Schema
  url: json-schema/zero-trust-security-model-maturity-schema.json
- type: JSONStructure
  title: Zero Trust Pillar Structure
  url: json-structure/zero-trust-security-model-pillar-structure.json
- type: JSONLD
  title: Zero Trust Security Model JSON-LD Context
  url: json-ld/zero-trust-security-model-context.jsonld
- type: CodeExamples
  title: Zero Trust Maturity Assessment Example
  url: examples/zero-trust-security-model-maturity-example.json
- type: Resources
  title: Zero Trust Security Model Vocabulary
  url: vocabulary/zero-trust-security-model-vocabulary.yaml
- type: Features
  data:
  - name: Never Trust Always Verify
    description: No user, device, or network is trusted by default; every access is verified.
  - name: Explicit Verification
    description: Authentication and authorization happen for every request using all available signals.
  - name: Least Privilege Access
    description: Users and workloads receive only the minimum permissions required for the task.
  - name: Assume Breach
    description: The model is designed assuming attackers are already present in the environment.
  - name: Continuous Monitoring
    description: All sessions and signals are continuously analyzed and policies re-evaluated.
  - name: Microsegmentation
    description: Networks and workloads are segmented to limit blast radius after compromise.
  - name: Data-Centric Protection
    description: Security controls follow the data, not the perimeter.
  - name: Identity as the Perimeter
    description: User and workload identity replaces network location as the primary trust boundary.
- type: UseCases
  data:
  - name: Federal Civilian Compliance
    description: Meeting OMB M-22-09 and CISA Zero Trust Maturity Model requirements.
  - name: DoD Mission Systems
    description: Implementing the seven DoD Zero Trust pillars and 152 capabilities.
  - name: Critical Infrastructure
    description: Applying Zero Trust to OT and ICS environments in energy, water, and transportation.
  - name: Healthcare Data Protection
    description: Protecting PHI under HIPAA using Zero Trust controls and continuous verification.
  - name: Financial Services Compliance
    description: Aligning Zero Trust with SOX, GLBA, and PCI-DSS requirements.
  - name: Higher Education Research
    description: Securing distributed research networks and BYOD environments.
maintainers:
- FN: Kin Lane
  email: kin@apievangelist.com