Skip to content

Zero Trust

What is Zero Trust?

A security model that assumes no user, device, or network should be trusted by default, even those inside the corporate perimeter. Requires continuous verification for every access request.

Information Security

Related terms

Least PrivilegeMFA (Multi-Factor Authentication)

Frameworks that govern zero trust

NIST Cybersecurity Framework 2.0View framework →NIST SP 800-53 Rev 5View framework →

What the standards actually require on zero trust

Requirements naming zero trust across 6 standards, quoted from the control text.

New Zealand Information Security Manual (NZISM)3 controls

Agencies planning to adopt public cloud technologies or services should build Zero Trust philosophies and concepts into that adoption.

new-zealand-information-security-manual-nzism::2.3.26.C.01 · 2.3.26.C.01 Apply Zero Trust principles to cloud adoption →
US Executive Order 14028 - Improving the Nation's Cybersecurity3 controls

Within 60 days, the head of each agency reports to the Director of OMB and the Assistant to the President for National Security Affairs on the plans required by 3(b)(i) and (ii).

us-executive-order-14028-improving-the-nations-cybersecurity::3(b)(iii) · Sec. 3(b)(iii) Report the cloud and zero trust plans to OMB and the APNSA →
Kuwait National Cybersecurity Framework2 controls

Kuwait NCF Protect function (Access). Access Control and Identity Management aligned with NIST SP 800-53 AC family + ISO 27001 A.9 + Zero Trust principles.

KNCF-Protect-Access-Control-IAM-Privileged-MFA-Zero-Trust-Identity-Lifecycle-IAG-PAM · Kuwait NCF Protect + Access Control + IAM + Privileged + MFA + Zero Trust + Identity Lifecycle →
CISA Zero Trust Maturity Model1 control

Establish zero trust governance including strategy, roadmap, funding, and measurement against maturity stages.

ZTMM-CROSS-3 · Governance for Zero Trust →
FFIEC IT Examination Handbook1 control

Management may adopt zero trust principles in architecture decisions where perimeter-based security no longer fits a complex environment of internal networks, remote offices, mobile personnel and cloud services: all networks including internal ones are untrust...

ffiec-it-examination-handbook::AIO-VII.B · VII.B Zero Trust Architecture (Architecture, Infrastructure, and Operations) →
ISO 27799:20251 control

Added HLT control: each network segment should hold the smallest practical group of information services, users and systems, and should reach another segment only once the two have authenticated each other.

iso-27799-2025::8.35 · 8.35 HLT: Zero trust principles →

Questions people ask about zero trust

What is Zero Trust?
A security model that assumes no user, device, or network should be trusted by default, even those inside the corporate perimeter. Requires continuous verification for every access request.
Why is Zero Trust important for compliance?
Zero Trust is a key concept in Information Security. Understanding zero trust helps organizations meet regulatory requirements, reduce risk, and demonstrate due diligence during audits. Our compliance platform maps 1,016 frameworks with 316K cross-framework control mappings.
What concepts are related to Zero Trust?
Key concepts related to Zero Trust include Least Privilege, MFA (Multi-Factor Authentication). Understanding these interconnected concepts provides a more comprehensive view of Information Security requirements and helps organizations build holistic compliance programs.
Which compliance frameworks address Zero Trust?
Zero Trust appears in the requirement text of New Zealand Information Security Manual (NZISM), US Executive Order 14028 - Improving the Nation's Cybersecurity, Kuwait National Cybersecurity Framework, CISA Zero Trust Maturity Model, FFIEC IT Examination Handbook. Across these standards we have identified 11 controls that name it directly, each linked to the control text on the compliance platform.
Where can I learn more about Zero Trust?
Explore our compliance framework pages to see how zero trust applies across different standards and regulations. Our implementation guides provide step-by-step guidance, and the compliance platform offers AI-powered analysis of how this concept maps across 1,016 frameworks.

See how Zero Trust applies across compliance frameworks

Our platform maps 1,016 frameworks with 316K cross-framework control mappings. Explore how this concept is addressed across standards.

Explore on Platform
Written and maintained by Gerard Blokdyk, The Art of Service.