Key takeaways

  • NIST SP 800-207 describes zero trust as a shift from static, network-based perimeters to a focus on users, assets and resources. Network location alone never implies trust.
  • The standard lists seven tenets. Together they say: treat every data source as a resource, secure all communication, grant access per session with least privilege, decide by dynamic policy, monitor device posture, authenticate continuously, and collect data to improve.
  • CISA's maturity model uses five pillars (Identity, Devices, Networks, Applications and Workloads, Data) and three cross-cutting capabilities, with four stages: Traditional, Initial, Advanced and Optimal.
  • A mid-size firm gets most of the early value from identity (MFA, conditional access, least privilege) and device health. Micro-segmentation and data labeling come later.
  • Zero trust is a program of small steps. NIST says not all tenets may be fully implemented in their purest form.

What zero trust actually is

Zero trust gets sold as a product category. The standard says otherwise. NIST Special Publication 800-207, Zero Trust Architecture (August 2020), describes zero trust as an evolving set of cybersecurity paradigms that move defenses from static, network-based perimeters to a focus on users, assets and resources. A zero trust architecture uses those principles to plan enterprise infrastructure and workflows. It is a way of deciding who and what may reach each system, not a box you install.

The older model trusted anything inside the office network. A laptop on the corporate LAN, or a user on the VPN, was treated as friendly. Attackers learned to use that. Once one account or one machine is stolen, the whole inside is open. Zero trust removes the assumption. The question changes from "is this request coming from inside?" to "is this user, on this device, in this state, allowed to reach this one resource right now?"

For a firm with 50 to 500 people, this matters because the perimeter has already dissolved. Staff work from home, email lives in the cloud, the practice-management or ERP system may be hosted by a vendor, and personal phones read company mail. There is no single wall to defend. The practical goal is to make each access decision on its own merits.

The seven tenets, in plain language

NIST states its definition as a list of tenets, and is candid that they are the ideal goal: not all may be fully implemented in their purest form for a given strategy. In our words, they are the following.

  • All data sources and computing services are resources. That includes SaaS, small devices that send data to aggregators and, if they touch company resources, personally owned devices.
  • All communication is secured regardless of network location. Network location alone does not imply trust. A request from inside the office must meet the same requirements as one from anywhere else.
  • Access is granted per session. Trust in the requester is evaluated before access, with the least privilege needed, and access to one resource does not automatically grant access to another.
  • Access is decided by dynamic policy. The policy looks at the observable state of the user identity, the application and the requesting device, and may add behavioral and environmental signals such as time of day or unusual activity.
  • The enterprise monitors the integrity and security posture of all assets. No asset is inherently trusted. A device that is unpatched, subverted or unmanaged can be treated differently, including being denied.
  • Authentication and authorization are dynamic and strictly enforced before access. NIST describes a constant cycle of obtaining access, assessing threats, adapting and reevaluating trust, and expects identity, credential and access management and asset management to be in place, including multifactor authentication.
  • The enterprise collects as much information as possible about the state of assets, network infrastructure and communications, and uses it to improve its security posture.

Read together, the tenets point at four capabilities that a mid-size firm can build: a trustworthy identity system, a trustworthy device inventory with health checks, policies that combine the two, and logging good enough to see what happened.

How the pieces fit: decisions and enforcement

NIST's abstract architecture separates the decision from the enforcement. A policy engine and policy administrator decide whether a subject may reach a resource, and a policy enforcement point opens or closes the connection. In a small firm you rarely build these yourself. They show up as features of tools you already license: the conditional access engine of your identity provider, the compliance signal from your device-management tool, a secure web gateway or an access proxy in front of internal applications.

NIST also lists deployment variations, such as an approach built on enhanced identity governance, one built on micro-segmentation, and one built on software-defined perimeters. For most mid-size firms the first is where to begin, because the identity system already exists and the cost of adding policy to it is low.

The CISA Zero Trust Maturity Model: five pillars, four stages

CISA's Zero Trust Maturity Model, version 2.0 (April 2023), was written for federal civilian agencies, but its structure is useful anywhere. It organizes the work into five pillars: Identity, Devices, Networks, Applications and Workloads, and Data. Three cross-cutting capabilities run through every pillar: Visibility and Analytics, Automation and Orchestration, and Governance.

The model describes a journey from a Traditional starting point, through Initial and Advanced, to Optimal. CISA notes that each stage requires greater levels of protection, detail and complexity, and that the level of effort and the benefits both increase as maturity progresses. The model does not ask any organization to jump to Optimal. It asks you to know where each pillar stands today and to move the weakest ones first.

A simple self-assessment helps. For each pillar, write one sentence that describes today's state, then mark it Traditional, Initial, Advanced or Optimal. Most firms will find uneven results: strong identity because the cloud suite forced it, weak data classification because nobody owns it. That unevenness is the plan.

A staged plan for a mid-size firm

Stage 1: identity first

Identity is where attackers start, and it is the pillar where a firm gets the most for the least. Enforce multifactor authentication for every user, with phishing-resistant methods for administrators and for anyone who handles money or regulated data. Block legacy authentication protocols that cannot do MFA. Reduce standing administrator rights, so that privileged roles are granted when needed and not held permanently. Remove accounts of people who have left. Our article on MFA and passkeys covers the methods in detail.

Then add conditional access: require a managed, healthy device for sensitive applications, ask for stronger proof when a sign-in looks unusual, and block sign-ins from places where you have no staff. This is tenet four and six in practice.

In the cloud, the identity layer has a product name too: AWS IAM Identity Center for workforce access to AWS accounts, Google Cloud Identity and Access Management (IAM) for who can do what on which resource, Microsoft Entra ID for Microsoft Azure and Microsoft 365, and Oracle Cloud Infrastructure Identity and Access Management (OCI IAM) with identity domains. Many firms connect one corporate identity provider to all of them, so a departing employee loses access everywhere at once.

Stage 2: devices

Tenet five asks you to know the posture of every asset. That needs an inventory and a management tool that can report whether a device is encrypted, patched and running endpoint protection. Make that report a condition of access. Unmanaged devices can still be allowed to reach some things, such as webmail in a browser with no download, while being kept away from file shares and admin consoles. Retire or isolate devices that can no longer be patched.

Stage 3: applications and the network

Replace broad VPN access with per-application access where it is practical. Put internal web applications behind an access proxy that checks identity and device before it lets a session through. For the network itself, separate the segments that carry different risk: guests, staff devices, servers, cameras and building systems, and any industrial or lab equipment. The goal is to limit how far a stolen account or an infected machine can travel. This is the "assume breach" part of zero trust.

Encrypt traffic inside the network as well as outside. Tenet two says location does not make traffic safe.

Stage 4: data

Decide which data matters most, whether that is client files, patient records, payment data or source code, and attach the tightest policies there. Label it, restrict sharing, log access, and back it up in a way an attacker cannot reach. Data work is the slowest pillar, so start with the two or three repositories where a breach would be most costly.

Across all stages: visibility and governance

Tenet seven is the quiet one. Send identity, device and network logs to one place, keep them long enough to investigate an incident, and alert on a short list of events that matter, such as a new administrator, a mailbox forwarding rule or a sign-in from a new country. Assign an owner for each pillar and review the plan twice a year. CISA's model treats governance as a capability of every pillar for a reason: without an owner the policies drift.

Each cloud has a native place for that evidence. AWS CloudTrail records user activity and API usage, and Amazon GuardDuty watches accounts and workloads for suspicious activity. Google Cloud writes Cloud Audit Logs (Admin Activity, Data Access, System Event and Policy Denied) and offers Security Command Center for risk and threat findings. Microsoft Azure records management operations in the Azure Monitor activity log, adds Microsoft Defender for Cloud for posture and workload protection, and Microsoft Sentinel as a SIEM. Oracle Cloud Infrastructure (OCI) has the OCI Audit service and Cloud Guard. Turn them on early, send them to one place, and decide who reads the alerts.

What NIST warns about

NIST's threat discussion is a useful reality check. A zero trust design concentrates decisions in a policy engine, so subverting that engine is a serious risk and the components must be protected and monitored. Denial of service against the decision components can lock people out, so plan for availability. Stolen credentials remain a threat, which is why continuous evaluation and MFA matter. Reliance on a single vendor's proprietary formats can limit your options later. And administration by non-person entities, such as automation accounts and service credentials, needs the same discipline as human accounts.

Common mistakes

  • Buying a platform labeled zero trust without doing the identity and device work underneath it.
  • Turning on strict policies for everyone at once. Pilot with IT and one friendly team, then widen.
  • Ignoring service accounts and shared mailboxes, which often bypass MFA.
  • Leaving legacy systems out of scope. If a system cannot be brought into the model, isolate it and document the exception.
  • No logging. Without data, tenet seven fails and incident response becomes guesswork.

Does zero trust change how you buy insurance or answer auditors?

It helps with both, because the same controls recur: MFA, device management, least privilege, logging, tested backups. The CISA Cross-Sector Cybersecurity Performance Goals, a voluntary baseline aimed at helping small and mid-size organizations prioritize a limited number of high-impact actions, cover much of the same ground and are a practical checklist to run alongside the maturity model.

How Clayton Cybernetics can help

Our team designs and operates identity, device-management and network controls for organizations that need them to work every day, not only on paper. We can run the five-pillar self-assessment with you, rank the gaps by cost and risk, and build the first two stages: identity policies and device health checks. We can also operate the result under Managed IT and test it through defensive penetration testing. Call (305) 404-9404 to start.

Sources

This article is general information, not legal or security advice for your environment. NIST SP 800-207 and the CISA model were written for U.S. federal use; a private firm should adapt them to its own risk. Confirm current versions at the sources listed. Last reviewed .

Keep reading

Need help with this?

We find out whether everything you run is safe from attackers, then we fix it.

Cybersecurity