Zero Trust Architecture for CISOs: What NIST SP 800-207 and CISA's Maturity Model Require

TL;DR: The National Institute of Standards and Technology (NIST) Special Publication (SP) 800-207, published in August 2020, says no user account or asset gets trust by default from its network location or ownership, and access is checked before each session. The Cybersecurity and Infrastructure Security Agency (CISA) maturity model measures progress across five pillars, three cross-cutting capabilities and four stages. Use outside government is voluntary. Federal agencies faced an M-22-09 deadline at the end of fiscal year 2024.

What is zero trust architecture according to NIST?

The National Institute of Standards and Technology (NIST) set out its definition of zero trust architecture (ZTA) in Special Publication (SP) 800-207, a 59-page document published in August 2020. The core idea is short. No user account or asset receives trust by default because of where it sits on the network or who owns it.

Access is checked before each session starts. The thing being protected is the resource, not the network segment around it.

In our reading, the per-request wording that many security leaders quote comes from the Cybersecurity and Infrastructure Security Agency (CISA). Its maturity model page describes zero trust as least privilege, per-request access decisions made in the face of a network viewed as compromised. In our reading, the two agencies approach the same idea from opposite ends. NIST removes trust based on location, and CISA describes the decision that replaces it.

Key facts before you read further

What this means in practice

Here is a simple test. If being inside the building still opens doors that being outside does not, the old perimeter model is still doing the work.

The last row of the table matters for planning. SP 800-207 gives an abstract model and sample deployments. It does not hand you a build sheet. We think this is why CISA's maturity model, covered later in this guide, became the document most programs measure themselves against.

For terms used across this guide, see the CISO security glossary.

What are the pillars and stages of CISA's Zero Trust Maturity Model?

CISA's Zero Trust Maturity Model (ZTMM) sorts the work into five pillars, three cross-cutting capabilities and four stages. The current text is version 2.0. CISA's resource page gives it a revision date of April 11, 2023.

Version 1.0 was the August 2021 initial release. It opened for public comment in September 2021, and CISA published a separate Response to Comments document that summarizes the changes made in reply.

Check the date before you cite the model in a policy or contract. The cover reads April 2023, but the document's own revision history lists version 2.0 as March 2022.

Pillars and stages

The model includes five pillars and three cross-cutting capabilities. Each pillar has its own table in the PDF. Within each pillar, CISA gives specific examples of traditional, initial, advanced, and optimal zero trust architectures. Traditional is where most estates begin. Optimal is the end state the examples describe.

The cross-cutting capabilities follow the five pillars as a separate section with a separate table. In our reading, that is where an assessment checks whether the pillars work as one system rather than five projects.

How CISA frames the model

CISA presents the ZTMM as one of many paths toward the transition plan that Executive Order (EO) 14028 requires agencies to write. It describes zero trust as a shift from a location-centric model to a more data-centric approach. It also warns that zero trust may require a change in an organization's philosophy and culture around security.

The document is marked TLP:CLEAR under the Traffic Light Protocol, so it may be distributed without restriction. You can hand it to suppliers or board members as published. CISA also posts a Spanish translation.

CISA kept building on the model after version 2.0. It released microsegmentation guidance on July 29, 2025 and a paper on adapting zero trust to operational technology on April 29, 2026. Terms used here are defined in the glossary.

How NIST SP 800-207, CISA's model and NIST SP 1800-35 fit together

The four documents do different jobs. One defines the architecture, one measures progress, one shows working builds and one set federal obligations. In our reading, mixing up their roles is the usual way programs get misframed, so the table below separates them.

How they reference each other

The documents appeared in this order.

1. SP 800-207 came first, dated August 2020.
2. Executive Order (EO) 14028 followed in May 2021. Its section (3)(b)(ii) requires that agencies develop a plan to implement a Zero Trust Architecture.
3. ZTMM version 1.0 was the initial release in August 2021.
4. M-22-09 came next. It cited the CISA model directly: agencies would be expected to stop routing application access through specific networks, consistent with CISA's zero trust maturity model.
5. ZTMM version 2.0 carries an April 2023 cover date. Its revision table logs version 2.0 as March 2022, a response to request-for-comment feedback.
6. SP 1800-35 builds back onto the foundation. Its readers should already be familiar with SP 800-207.

The influence therefore runs both ways. In our reading, the model shaped the memo, and the memo then reshaped the model.

What this means in practice

In our reading, SP 1800-35 is the most direct bridge to an audit program. It maps each build's capabilities to the NIST Cybersecurity Framework (CSF) versions 1.1 and 2.0, NIST SP 800-53r5, and NIST critical software security measures.

Check its boundaries before relying on it. Industrial control systems, operational technology (OT) and Internet of Things (IoT) devices are explicitly out of scope. In our reading, a leader with plant or device estates will need separate guidance for those areas.

For definitions of terms used here, see the glossary.

Which federal deadlines shaped the zero trust market?

In our reading, four documents, issued over about eighteen months, turned zero trust from a design idea into a federal compliance program. In our reading, each one added pressure on agencies, and that pressure reached vendors' product lines.

From order to deadline to budget

In May of 2021, the President issued Executive Order (EO) 14028, and M-22-09 followed with the deadline discussed earlier. The memo places significant emphasis on stronger enterprise identity and access controls.

The plans came fast. Agencies sent detailed implementation plans to OMB in the spring of 2022.

Money followed. In July 2022, OMB and ONCD released OMB Memorandum M-22-16. ONCD is the Office of the National Cyber Director. The memo said Federal Civilian Executive Branch agencies would lead through prioritizing Zero Trust Implementation and IT Modernization in FY 2024 Budget submissions. It added that budget submissions are expected to prioritize ensuring this work is completed.

From budget to scorecard

M-23-03 gave agencies Fiscal Year (FY) 2023 reporting guidance under the Federal Information Security Modernization Act (FISMA). It said OMB would align FISMA performance management with benchmarks for the implementation of zero trust architecture. It also admitted that past FISMA metrics have not focused enough on defense measures beyond the perimeter.

At that point zero trust had a mandate, a budget line and a scorecard.

Why private-sector buyers felt it

In our reading, the sequence explains much of how products reached commercial buyers. In our reading, vendors selling to agencies needed to show which memo goal or maturity model pillar a product served. In our reading, many reused that mapping in commercial sales material, so private buyers often saw tools described in federal terms.

We think the identity and phishing emphasis also pushed vendors to lead with authentication products. In our reading, products were also bundled to cover several pillars in one purchase, because agencies were buying against a deadline.

For a sitting CISO, the practical step is simple. When a vendor cites M-22-09 or the maturity model, ask which specific goal the product meets and what evidence an auditor would accept. A product that maps to a federal goal still needs to fit your own risk priorities. Vendor profiles on /vendors can help you trace who sells what.

What NIST's lab builds show about implementation approaches

The National Cybersecurity Center of Excellence (NCCoE) did not build the four approaches side by side from day one. In our reading, it started with identity and added capabilities in stages, and that order is the most useful thing in the build record for a security leader planning a program.

Identity came first

The project team chose enhanced identity governance (EIG) for its first minimum viable builds because it treated identity-based controls as foundational to zero trust architecture (ZTA). It ran EIG in two phases: a crawl phase without cloud capabilities, then a run phase that added them.

The crawl phase is the narrower design. It relies mainly on identity, credential and access management (ICAM) and endpoint protection platform (EPP) components. It has no dedicated policy engine (PE) or policy administrator (PA), and it protects only on-premises resources. Three of the builds follow this design.

The run phase protects both on-premises and cloud resources and supports device discovery and tunnels between requesting endpoints and resources. Three more builds follow it.

The other three approaches were layered on

After EIG, the team gradually deployed further components and added microsegmentation, software-defined perimeter (SDP) and secure access service edge (SASE) approaches. One general reference architecture applies to all four, and its components can run on-premises or as cloud services.

Two practical lessons

Discovery came before policy. The team used discovery tools to formulate an initial zero trust policy and to check that observed network flows matched static policies. We think that is a sensible first task for any program: map real traffic before writing rules.

Endpoints count as part of the design. Any changes required to existing endpoints, such as installing agents, belong to the reference architecture. Budget and rollout plans should treat agent deployment as core work.

The guide is also clear that the builds are examples. In its words, there is no single approach that is best for all enterprises, and ZTA is a set of principles, not a specification to comply with. In our reading, the choice among these approaches depends on where a given organization's resources and users sit, not on which approach looks most complete.

How long does a zero trust program take?

The federal answer came with a date. M-22-09, issued by the Office of Management and Budget (OMB) on January 26, 2022, required agencies to meet specific cybersecurity standards and objectives by the end of fiscal year (FY) 2024. That deadline has passed. The same memo said the transition "will not be a quick or easy task" for an enterprise as complex as the federal government.

The deadline covered a defined set of objectives. It did not mark the end of zero trust work. The Cybersecurity and Infrastructure Security Agency (CISA) revised its Zero Trust Maturity Model to align with M-22-09, and the model says it will be updated as needed to reflect modern practices and technologies. A target that keeps moving is a program, not a project.

What the phased build says about pace

The National Institute of Standards and Technology (NIST) lab work makes the same point from the engineering side. Its phased approach was designed to mirror how most enterprises will evolve: start with the environment you already run, then gradually add or adapt capabilities. The stated objective is continuous improvement of access control processes and policies.

Even discovery runs without an end date. The team deployed it to observe the environment continuously and to audit the documented baseline map on an ongoing basis. The project documentation itself is to be updated as the architecture evolves.

Why the program needs owners beyond the CISO

In our reading, a zero trust program runs for several years and can outlast a single security leader's time in the seat. Our CISA tenure guide and time-in-seat report give context on how long leaders stay. In our reading, a program that lives in one person's head tends to stall at a handover.

M-22-09 spread ownership on purpose. It said chief financial officers, chief acquisition officers, senior privacy officials and others should work with IT and security leadership to deploy and sustain zero trust capabilities, and that the whole C-suite should be aligned and committed. It also told agencies further along to share information, playbooks and even staff with those just beginning.

We think a private-sector program can borrow that structure:

• A named owner per pillar, outside the security team where possible, so identity, device and application work survives a change at the top.
• A standing budget line held by finance, not a one-time project fund.
• Procurement language that carries zero trust requirements into every renewal.
• Written policy decisions and discovery baselines a successor can read on day one.

The board can also hold the program to account across leadership changes. Our page on board cybersecurity oversight covers how directors track work of this length.

How is zero trust measured and reported to the board?

The CISA model gives a security leader a ready-made scorecard. Each pillar gets one row and each stage gets one column. A mark shows where the pillar sits today and where the plan says it will sit next. The model was written for federal agencies, but CISA's text says all organizations should review and consider adoption of its approaches. In our reading, that makes the per-pillar grid a sensible default format for private-sector programs too.

The grid also follows how CISA frames a plan. The model says a typical plan will assess an agency’s current cybersecurity state and plan for a fully implemented ZTA. A scorecard is that plan on one page, with current state on the left, target on the right, and the gap in between.

How federal agencies were asked to report

The Office of Management and Budget (OMB) folded zero trust into Federal Information Security Modernization Act (FISMA) reporting through M-23-03, its fiscal year 2023 reporting guidance. The memo set out several mechanics:

• Agencies had already submitted detailed zero trust implementation plans to OMB in the spring of 2022.
• OMB said it would align performance management under FISMA with benchmarks for zero trust and the NIST Cybersecurity Framework.
• The chief information officer (CIO) metrics for that year would fully automate certain reporting, and CISA had to send performance and incident data to OMB in machine-readable form.
• A new CISO Council FISMA Metrics Subcommittee would advise OMB, with Continuous Diagnostics and Mitigation (CDM) data among its review areas.

The stated aim was metrics that would provide clarity on agency maturity in high-impact capability areas and inform investment decisions. OMB also said it wanted agencies to collect only data that provides critical insight. That is a useful test for any board pack.

Presenting stage movement to a board committee

Do not average the pillars into one maturity score. A program can move identity forward while data stays where it was. A blended number hides that.

We think the honest unit of progress is a stage claim backed by evidence a director could ask to see. A pillar that moved should come with what changed in production, not what was purchased.

Keep the grid stable from quarter to quarter so movement is visible. For how committees structure this oversight, see our board committee oversight report and the glossary entry on board cybersecurity oversight.

What this guide does not cover

This guide does not offer a build sheet for any single deployment approach. It does not cover zero trust for operational technology, industrial control systems or Internet of Things devices in depth. For the rules and the record behind it, see AI Governance for CISOs: NIST's Framework, the 12 GenAI Risks and the New Agentic AI Rules.