Zero Trust

aid: zero-trust
name: Zero Trust
description: Zero Trust is the umbrella cybersecurity strategy that eliminates implicit trust based on network location and
  requires continuous verification of every user, device, workload, and access request. This index aggregates the core specifications
  (NIST, CISA, DoD, NSA, NCSC), the leading vendor platforms that implement Zero Trust (Cloudflare, Zscaler, Netskope, Palo
  Alto Networks, Tailscale, Twingate, Microsoft, Google), and the CNCF-graduated open standards that the ecosystem depends
  on (SPIFFE, SPIRE, OPA). Three sister API Evangelist topics cover Zero Trust Architecture, Zero Trust Network Access (ZTNA),
  and the Zero Trust Security Model in greater depth.
type: Index
url: https://www.nist.gov/publications/zero-trust-architecture
tags:
- Access Control
- Cloud Security
- Cybersecurity
- Federal
- Identity and Access Management
- Network Security
- Security
- Zero Trust
created: '2025'
modified: '2026-05-03'
specificationVersion: '0.19'
apis:
- aid: zero-trust:nist-sp-800-207
  name: NIST SP 800-207 Zero Trust Architecture
  description: The foundational US specification of Zero Trust, defining the seven tenets, PDP/PEP/PA components, and three
    deployment variants (enhanced identity governance, microsegmentation, network infrastructure / SDP).
  humanURL: https://csrc.nist.gov/pubs/sp/800/207/final
  tags:
  - NIST
  - Specification
  properties:
  - type: Documentation
    url: https://csrc.nist.gov/pubs/sp/800/207/final
  - type: APIReference
    url: https://nvlpubs.nist.gov/nistpubs/specialpublications/NIST.SP.800-207.pdf
- aid: zero-trust:cisa-ztmm
  name: CISA Zero Trust Maturity Model v2
  description: The federal-civilian Zero Trust roadmap from CISA, with four maturity levels across the Identity, Devices,
    Networks, Applications & Workloads, and Data pillars plus cross-cutting capabilities for Visibility & Analytics, Automation
    & Orchestration, and Governance.
  humanURL: https://www.cisa.gov/zero-trust-maturity-model
  tags:
  - CISA
  - Federal
  - Maturity Model
  properties:
  - type: Documentation
    url: https://www.cisa.gov/zero-trust-maturity-model
  - type: APIReference
    url: https://www.cisa.gov/sites/default/files/2023-04/zero_trust_maturity_model_v2_508.pdf
- aid: zero-trust:dod-zt-ra
  name: DoD Zero Trust Reference Architecture
  description: The Department of Defense seven-pillar Zero Trust reference architecture and 152-capability target/advanced
    execution roadmap.
  humanURL: https://dodcio.defense.gov/library/
  tags:
  - DoD
  - Federal
  - Reference Architecture
  properties:
  - type: Documentation
    url: https://dodcio.defense.gov/Portals/0/Documents/Library/ZT-Reference-Architecture.pdf
- aid: zero-trust:cloudflare-zero-trust
  name: Cloudflare Zero Trust API
  description: Cloudflare's Zero Trust platform combining ZTNA, SWG, CASB, RBI, DLP and an REST API for managing all of it.
  humanURL: https://developers.cloudflare.com/cloudflare-one/
  tags:
  - Cloudflare
  - SASE
  - Vendor
  - ZTNA
  properties:
  - type: Documentation
    url: https://developers.cloudflare.com/cloudflare-one/
  - type: APIReference
    url: https://developers.cloudflare.com/api/
- aid: zero-trust:zscaler-zia-zpa
  name: Zscaler Zero Trust Exchange API
  description: Zscaler's combined ZIA (internet access) and ZPA (private access) Zero Trust platform with REST APIs for both.
  humanURL: https://help.zscaler.com/
  tags:
  - SASE
  - Vendor
  - Zscaler
  properties:
  - type: Documentation
    url: https://help.zscaler.com/
  - type: APIReference
    url: https://help.zscaler.com/zpa/api-reference
- aid: zero-trust:microsoft-entra
  name: Microsoft Entra Zero Trust APIs
  description: Microsoft Entra (formerly Azure AD), Conditional Access, Defender for Cloud Apps, and Microsoft Intune together
    implement Zero Trust on the Microsoft platform; Microsoft Graph exposes a unified REST surface.
  humanURL: https://learn.microsoft.com/en-us/security/zero-trust/
  tags:
  - Microsoft
  - Vendor
  - IdP
  properties:
  - type: Documentation
    url: https://learn.microsoft.com/en-us/security/zero-trust/
  - type: APIReference
    url: https://learn.microsoft.com/en-us/graph/api/overview
- aid: zero-trust:google-beyondcorp
  name: Google BeyondCorp Enterprise
  description: Google's productized Zero Trust platform building on the original BeyondCorp research; provides context-aware
    access through Identity-Aware Proxy and Chrome Enterprise.
  humanURL: https://cloud.google.com/beyondcorp-enterprise
  tags:
  - Google
  - Vendor
  properties:
  - type: Documentation
    url: https://cloud.google.com/beyondcorp-enterprise/docs
- aid: zero-trust:spiffe-spire
  name: SPIFFE / SPIRE
  description: CNCF-graduated workload identity standard (SPIFFE) and reference runtime (SPIRE) used as the workload-identity
    foundation in Zero Trust deployments.
  humanURL: https://spiffe.io/
  tags:
  - CNCF
  - Open Source
  - Workload Identity
  properties:
  - type: Documentation
    url: https://spiffe.io/docs/latest/
  - type: GitHubOrganization
    url: https://github.com/spiffe
- aid: zero-trust:open-policy-agent
  name: Open Policy Agent (OPA)
  description: CNCF-graduated general-purpose policy engine commonly deployed as the PDP in Zero Trust implementations.
  humanURL: https://www.openpolicyagent.org/
  tags:
  - CNCF
  - Open Source
  - Policy Engine
  properties:
  - type: Documentation
    url: https://www.openpolicyagent.org/docs/latest/
  - type: GitHubOrganization
    url: https://github.com/open-policy-agent
common:
- type: Documentation
  title: NIST Zero Trust Architecture
  url: https://www.nist.gov/publications/zero-trust-architecture
- type: Documentation
  title: NIST SP 800-207 PDF
  url: https://nvlpubs.nist.gov/nistpubs/specialpublications/NIST.SP.800-207.pdf
- type: Documentation
  title: NIST SP 800-207A PDF
  url: https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-207A.pdf
- type: Compliance
  title: CISA Zero Trust Maturity Model v2
  url: https://www.cisa.gov/zero-trust-maturity-model
- type: Compliance
  title: OMB M-22-09 Federal Zero Trust Strategy
  url: https://www.whitehouse.gov/wp-content/uploads/2022/01/M-22-09.pdf
- type: Compliance
  title: DoD Zero Trust Reference Architecture
  url: https://dodcio.defense.gov/Portals/0/Documents/Library/ZT-Reference-Architecture.pdf
- type: Documentation
  title: NSA Zero Trust Guidance
  url: https://www.nsa.gov/Press-Room/News-Highlights/Article/Article/2899282/nsa-releases-guidance-on-zero-trust-security-model/
- type: Documentation
  title: UK NCSC Zero Trust Architecture
  url: https://www.ncsc.gov.uk/collection/zero-trust-architecture
- type: Portal
  title: Cloudflare Zero Trust
  url: https://www.cloudflare.com/zero-trust/
- type: Portal
  title: Zscaler Zero Trust Exchange
  url: https://www.zscaler.com/products-and-solutions/zero-trust-exchange
- type: Portal
  title: Netskope SASE
  url: https://www.netskope.com/platform/sase
- type: Portal
  title: Palo Alto Networks Prisma Access
  url: https://www.paloaltonetworks.com/sase/access
- type: Portal
  title: Microsoft Zero Trust Guidance Center
  url: https://learn.microsoft.com/en-us/security/zero-trust/
- type: Portal
  title: Google BeyondCorp
  url: https://cloud.google.com/beyondcorp
- type: Portal
  title: Tailscale
  url: https://tailscale.com/
- type: Portal
  title: Twingate
  url: https://www.twingate.com/
- type: GitHubOrganization
  title: SPIFFE
  url: https://github.com/spiffe
- type: GitHubOrganization
  title: Open Policy Agent
  url: https://github.com/open-policy-agent
- type: Resources
  title: Sister Topic - Zero Trust Architecture
  url: https://github.com/api-evangelist/zero-trust-architecture
- type: Resources
  title: Sister Topic - Zero Trust Network Access
  url: https://github.com/api-evangelist/zero-trust-network-access
- type: Resources
  title: Sister Topic - Zero Trust Security Model
  url: https://github.com/api-evangelist/zero-trust-security-model
- type: JSONSchema
  title: Zero Trust Access Decision Schema
  url: json-schema/zero-trust-access-decision-schema.json
- type: JSONSchema
  title: Zero Trust Subject Schema
  url: json-schema/zero-trust-subject-schema.json
- type: JSONStructure
  title: Zero Trust Access Decision Structure
  url: json-structure/zero-trust-access-decision-structure.json
- type: JSONLD
  title: Zero Trust JSON-LD Context
  url: json-ld/zero-trust-context.jsonld
- type: CodeExamples
  title: Zero Trust Access Decision Example
  url: examples/zero-trust-access-decision-example.json
- type: Resources
  title: Zero Trust Vocabulary
  url: vocabulary/zero-trust-vocabulary.yaml
- type: Features
  data:
  - name: Identity Verification
    description: Authenticate every user and workload regardless of location.
  - name: Device Trust
    description: Continuously evaluate device posture before and during access.
  - name: Least Privilege
    description: Grant minimum required permissions per session.
  - name: Microsegmentation
    description: Limit lateral movement by segmenting workloads and networks.
  - name: Continuous Monitoring
    description: Continuously analyze signals and re-evaluate authorization.
  - name: Encryption Everywhere
    description: Use mTLS and end-to-end encryption between all components.
  - name: Policy as Code
    description: Author and version policy in machine-readable form (Rego, Cedar, JSON).
  - name: Assume Breach
    description: Design controls assuming attackers are already inside.
- type: UseCases
  data:
  - name: VPN Modernization
    description: Replace flat-network VPNs with brokered, identity-aware access.
  - name: Federal Compliance
    description: Meet OMB M-22-09 Zero Trust mandate and CISA ZTMM milestones.
  - name: DoD Mission Adoption
    description: Implement the seven DoD Zero Trust pillars and 152 capabilities.
  - name: Multi-Cloud Workload Security
    description: Apply consistent Zero Trust controls across AWS, Azure, GCP.
  - name: Critical Infrastructure
    description: Apply Zero Trust to OT/ICS environments under TSA, NERC, and ENISA guidance.
  - name: Healthcare and Financial Compliance
    description: Align Zero Trust with HIPAA, GLBA, PCI-DSS, and SOX requirements.
maintainers:
- FN: Kin Lane
  email: kin@apievangelist.com