DoD Zero Trust Reference Architecture
What is DoD Zero Trust Reference Architecture?
The U.S. Department of Defense Zero Trust Reference Architecture and Zero Trust Capabilities/Activities. It comprises 45 controls organised across 7 domains, and applies in the United States.
How DoD Zero Trust Reference Architecture maps to other frameworks
All 45 controls, each one mapped to the equivalent requirement in other standards, with the evidence that carries across and the mappings that were judged and rejected shown alongside. No account needed to look.
See the control mappings →The 7 domains DoD Zero Trust Reference Architecture groups its controls into
Where DoD Zero Trust Reference Architecture overlaps with the standards you already hold
What DoD Zero Trust Reference Architecture means in your sector
What DoD Zero Trust Reference Architecture means for your job
Questions people ask about DoD Zero Trust Reference Architecture
What is DoD Zero Trust Reference Architecture?
How many controls does DoD Zero Trust Reference Architecture have?
Where does DoD Zero Trust Reference Architecture apply?
What frameworks does DoD Zero Trust Reference Architecture map to?
How do I get started with DoD Zero Trust Reference Architecture compliance?
Query DoD Zero Trust Reference Architecture programmatically
DoD Zero Trust Reference Architecture, its 45 controls and every mapping into other standards are available over a REST endpoint and an MCP server, so an agent can read them directly. The free tier is 10 calls a day and needs no signup.
DoD Zero Trust Reference Architecture API reference and MCP config →What DoD Zero Trust Reference Architecture requires, control by control
Each page carries the requirement text for one DoD Zero Trust Reference Architecture control and what an assessor expects to see as evidence.
- DODZT-1-1 User Inventory
- DODZT-1-3 Multi-Factor Authentication
- DODZT-1-4 Privileged Access Management
- DODZT-1-7 Least Privileged Access
- DODZT-1-8 Continuous Authentication
- DODZT-2-1 Device Inventory
- DODZT-2-5 Partially and Fully Automated Asset, Vulnerability and Patch Management
- DODZT-2-7 Endpoint and Extended Detection and Response
- DODZT-3-5 Continuous Monitoring and Ongoing Authorizations
- DODZT-4-7 Data Access Control
How ready are you for DoD Zero Trust Reference Architecture?
Answer 25 questions and get a professional readiness report with gap analysis, maturity scores, and prioritised action items. Results in 5 minutes.