What Zero Trust really means, the NIST SP 800-207 components, lessons from SP 1800-35 and the CISA maturity model, and a pragmatic way to get started.
Zero Trust is a security model in which no user, device or network location is trusted by default: every request to access a resource is authenticated, authorised and evaluated against policy, and trust is reassessed continuously. It is not a product that can be bought, but an architecture that combines identity, device health, network controls and data protection. NIST SP 800-207 remains the reference definition, and more recent guidance from NIST and CISA explains how to put it into practice.
The traditional approach treated the internal network as a trusted zone protected by a strong perimeter. Cloud services, remote work, partner access and mobile devices have eroded that boundary. At the same time, attackers who obtain valid credentials or compromise one internal host can often move freely inside a flat, trusted network. Zero Trust starts from the assumption that the network may already be hostile, and moves protection closer to users, devices, applications and data.
NIST SP 800-207, published in August 2020, describes a set of logical components that any Zero Trust architecture needs:
Around these components, data sources feed the decision: identity management, endpoint detection and compliance, security information and event management, activity logs and threat intelligence. The publication also describes several deployment approaches, based on enhanced identity governance, on microsegmentation, or on software-defined perimeters, which are often combined in practice.
In June 2025, NIST's National Cybersecurity Center of Excellence published the final version of SP 1800-35, Implementing a Zero Trust Architecture. This practice guide documents 19 example implementations built with 24 technology collaborators, across on-premises and multi-cloud environments, and maps them to the NIST Cybersecurity Framework and SP 800-53 controls. Its main value is showing how commercial products can be assembled into working architectures, and which difficulties teams encounter along the way.
CISA's Zero Trust Maturity Model, version 2.0 released in April 2023, offers a complementary planning tool. It organises capabilities into five pillars (Identity, Devices, Networks, Applications and Workloads, and Data) and three cross-cutting capabilities (Visibility and Analytics, Automation and Orchestration, and Governance). Each pillar is described across four stages: Traditional, Initial, Advanced and Optimal. Organisations can use it to assess where they stand and to set realistic targets pillar by pillar.
Most Zero Trust programmes rely on a common set of technical capabilities:
Zero Trust is a multi-year journey, and trying to transform everything at once rarely works. A pragmatic path looks like this:
Frameworks such as ISO/IEC 27001 support this effort, because a Zero Trust roadmap fits naturally into a risk-based information security management system.
Zero Trust touches architecture, identity and operations. Security architects can structure their approach with the Microsoft SC-100 Cybersecurity Architect certification preparation, which covers Zero Trust strategy in hybrid and cloud environments. Identity is the foundation of the model, and the Microsoft SC-300 Identity and Access Administrator certification preparation addresses conditional access and authentication in depth. For managers who need to connect the programme to broader governance, the ISC2 CISSP certification preparation provides a vendor-neutral view of security architecture.
Zero Trust replaces implicit trust based on network location with explicit, continuously evaluated decisions. NIST SP 800-207 defines the model, SP 1800-35 shows concrete implementations, and the CISA maturity model helps measure progress. Start with identity and your most critical resources, advance step by step, and treat Zero Trust as a governance programme as much as a technical project.