Zero Trust, beyond the slogan: what NIST and CISA actually say

The sentence it all starts from

Strip away the commercial noise and Zero Trust reduces to one sentence: no implicit trust granted based on network location. For decades corporate networks worked the opposite way, like a castle with a moat: outside the walls you are an enemy, inside you are a friend. Whoever got inside the perimeter — with a VPN, with a cable in the office — inherited a level of trust that was then rarely questioned again. Zero Trust demolishes that assumption. It does not matter where you are; it matters who you are, with which device, and to access what, verified every time.

The reference document is NIST's SP 800-207, published in 2020. The first thing it makes clear is what Zero Trust is not: not a product, not a technology to install. It is a set of guiding principles for designing a network's architecture.

NIST's principles

SP 800-207 lists the conceptual pillars. You need not memorise them, but it helps to see the logic.

1. 01
   Every resource is protected

   data and services treated as resources to defend individually
2. 02
   Per-session access

   granted case by case, never "once inside, always inside"
3. 03
   Dynamic policy

   the decision weighs identity, device, behaviour, context

The principle that holds the others together is that every access to a resource is authenticated and authorised before it is granted, per session, on the basis of a dynamic policy. "Dynamic" means the decision looks not only at the password but at the state of the device, the user's attributes, behaviour, context. And that the organisation continuously measures and monitors the integrity and security posture of all its assets: trust is never a blank cheque, it is an assessment that keeps updating.

On the architecture side, NIST describes three logical components: a policy engine that decides, a policy administrator that enacts the decision, and an enforcement point that applies it at the boundary with the resource. It is the scheme that, under different commercial names, sits inside most implementations.

CISA's five pillars

If NIST gives the theory, CISA offers the map to move by, with its Zero Trust Maturity Model (version 2.0). It organises the journey into five pillars and three cross-cutting capabilities.

The five pillars — Identity, Devices, Networks, Applications and Workloads, Data — are the areas you work on; the three cross-cutting capabilities (visibility and analytics, automation and orchestration, governance) run through all the pillars. And crucially CISA recognises that Zero Trust does not switch on with a toggle: it defines four maturity stages, from Traditional to Optimal, because it is a gradual journey, not a target to hit in a quarter.

Where you actually start

The most useful practical consequence is that nobody "buys" Zero Trust. You start from the pillars that return most for the least effort, and almost always that is identity: strong, phishing-resistant authentication, the principle of least privilege — giving each person only what they need — and access reviews. Then the posture of devices, the segmentation of the network so that a compromise does not spread, and the visibility that lets you notice what is happening. These are steps that have value in themselves, even before you call them Zero Trust.

It is worth remembering what Zero Trust does not promise: it is not a defence that makes the others pointless, it does not eliminate risk, it does not replace backups, patching and training. It is a way to reduce what an attacker gets when — not "if" — a link gives way: if every access is verified and limited, a stolen account opens one door, not the whole building. This is an explainer, not the attack of the day; but it is the model that the official sources at the top of the page — NIST's SP 800-207 and CISA's maturity model — give a concrete, verifiable shape.