Zero Trust Architecture
What is Zero Trust Architecture?
A security model that requires strict identity verification for every person and device trying to access resources, regardless of network location.
Terms that appear alongside zero trust architecture
Each of these is named in at least one of the same controls as zero trust architecture. The number is how many controls name both.
- zero trust 9 shared controls
- nist 4 shared controls
- authentication 4 shared controls
- remote access 3 shared controls
- patch management 3 shared controls
- cisa 3 shared controls
- access control 3 shared controls
- least privilege 3 shared controls
Frameworks that govern zero trust architecture
What the standards actually require on zero trust architecture
Requirements naming zero trust architecture across 6 standards, quoted from the control text.
As agencies continue to use cloud technology they do so in a coordinated, deliberate way that lets the Government prevent, detect, assess and remediate incidents, and the migration to cloud technology adopts Zero Trust Architecture as practicable.
us-executive-order-14028-improving-the-nations-cybersecurity::3(c) · Sec. 3(c) Adopt Zero Trust Architecture in cloud migration →Management may adopt zero trust principles in architecture decisions where perimeter-based security no longer fits a complex environment of internal networks, remote offices, mobile personnel and cloud services: all networks including internal ones are untrust...
ffiec-it-examination-handbook::AIO-VII.B · VII.B Zero Trust Architecture (Architecture, Infrastructure, and Operations) →Align product deployment guides with zero trust models such as NIST's zero trust architecture and the CISA Zero Trust Maturity Model, and encourage customers to apply those principles in their environments.
secure-by-design-a-guide-for-manufacturers-cisa::P1-PD8 · Align with zero trust architecture →ISMAP Identity and Access Management requires comprehensive IAM controls covering customer + CSP + administrative + service-to-service identities.
ISMAP-Identity-Access-MFA-Privileged-Federation-SSO-API-Tokens-CloudIAM-PIV-PASETO · ISMAP Identity and Access Management - Cloud IAM + Multi-Factor Authentication + Privileged Access + Federation/SSO + API Security + Access Tokens + My Number Card Integration + Government IAM →Apply Protect-P Identity Management Authentication and Access Control (PR.AC-P) including: identity proofing + lifecycle management + credentials issued + revoked + physical access managed + remote access managed + access permissions managed (least privilege +...
NISTPF-5 · Protect-P Access Control (PR.AC-P) →Catalog the subjects (human users and non-person entities) and their privileges as a precursor to developing a zero trust architecture.
SP800-207-MIG-ACTORS · Migration Step: Identify Actors on the Enterprise →Questions people ask about zero trust architecture
What is Zero Trust Architecture?
Why is Zero Trust Architecture important for compliance?
Which compliance frameworks address Zero Trust Architecture?
Where can I learn more about Zero Trust Architecture?
See how Zero Trust Architecture applies across compliance frameworks
Our platform maps 1,016 frameworks with 316K cross-framework control mappings. Explore how this concept is addressed across standards.