Skip to content

Zero Trust

What is Zero Trust?

A security model that assumes no user, device, or network should be trusted by default, even those inside the corporate perimeter. Requires continuous verification for every access request.

Information Security

Related terms

Least PrivilegeMFA (Multi-Factor Authentication)

Frameworks that govern zero trust

NIST Cybersecurity Framework 2.0View framework →NIST SP 800-53 Rev 5View framework →

What the standards actually require on zero trust

Requirements naming zero trust across 6 standards, quoted from the control text.

Japan FSA Cybersecurity Guidelines for Financial Institutions2 controls

Identity and Access Management (IAM) is a critical control area per FSA Cybersecurity Guidelines + intersects with FISC Security Guidelines + Japan Banking Customer Authentication Standards + APPI access control.

JP-FSA-CYB-Identity-Access-Management-Privileged-Access-MFA-Zero-Trust-Just-In-Time-Banking-Customer-Authentication · Japan FSA Cybersecurity Identity and Access Management + Privileged Access + MFA + Zero Trust + Just-In-Time + Banking Customer Authentication + Risk-Based Authentication + Out-of-Band + Biometric + FIDO2 + Internet Banking Security →
Kuwait National Cybersecurity Framework2 controls

Kuwait NCF Protect function (Access). Access Control and Identity Management aligned with NIST SP 800-53 AC family + ISO 27001 A.9 + Zero Trust principles.

KNCF-Protect-Access-Control-IAM-Privileged-MFA-Zero-Trust-Identity-Lifecycle-IAG-PAM · Kuwait NCF Protect + Access Control + IAM + Privileged + MFA + Zero Trust + Identity Lifecycle →
CISA Zero Trust Maturity Model1 control

Establish zero trust governance including strategy, roadmap, funding, and measurement against maturity stages.

ZTMM-CROSS-3 · Governance for Zero Trust →
FISMA1 control

FISMA coordination with CIRCIA + Zero Trust + Executive Orders + OMB Memoranda. CIRCIA (Cyber Incident Reporting for Critical Infrastructure Act of 2022): Final Rule effective 2026;

FISMA-CIRCIA-ZTA-EO14028 · CIRCIA, Zero Trust Architecture, EO 14028 + 14110 + OMB Memoranda →
US Executive Order 14028 - Improving the Nation's Cybersecurity1 control

Per EO 14028 + OMB M-22-09: Zero Trust Architecture Adoption + federal cybersecurity modernization + identity + device + network + application + data pillars.

USEO14028-2 · Zero Trust Architecture and Federal Cybersecurity →
ITU-T X.805 - Security Architecture for End-to-End Communications6 controls

Security Dimension 2 Authentication per X.805 Clause 6.2: Authentication ensures the validity of the claimed identities of the entities participating in communication (e.g.

X805-Dim2-Authentication-Identity-Verification-Claimed-Identities-Entities-Communication · ITU-T X.805 Security Dimension 2 - Authentication + Identity Verification + Claimed Identity + Entity Authentication + Data Origin Authentication + Mutual Authentication + Multi-Factor + Cryptographic Authentication →

Questions people ask about zero trust

What is Zero Trust?
A security model that assumes no user, device, or network should be trusted by default, even those inside the corporate perimeter. Requires continuous verification for every access request.
Why is Zero Trust important for compliance?
Zero Trust is a key concept in Information Security. Understanding zero trust helps organizations meet regulatory requirements, reduce risk, and demonstrate due diligence during audits. Our compliance platform maps 686 frameworks with 311K cross-framework control mappings.
What concepts are related to Zero Trust?
Key concepts related to Zero Trust include Least Privilege, MFA (Multi-Factor Authentication). Understanding these interconnected concepts provides a more comprehensive view of Information Security requirements and helps organizations build holistic compliance programs.
Which compliance frameworks address Zero Trust?
Zero Trust appears in the requirement text of Japan FSA Cybersecurity Guidelines for Financial Institutions, Kuwait National Cybersecurity Framework, CISA Zero Trust Maturity Model, FISMA, US Executive Order 14028 - Improving the Nation's Cybersecurity. Across these standards we have identified 13 controls that name it directly, each linked to the control text on the compliance platform.
Where can I learn more about Zero Trust?
Explore our compliance framework pages to see how zero trust applies across different standards and regulations. Our implementation guides provide step-by-step guidance, and the compliance platform offers AI-powered analysis of how this concept maps across 686 frameworks.

See how Zero Trust applies across compliance frameworks

Our platform maps 686 frameworks with 311K cross-framework control mappings. Explore how this concept is addressed across standards.

Explore on Platform
Written and maintained by Gerard Blokdyk, The Art of Service.