Resources
Terms, questions, and the primary sources this briefing draws from.
Terms You'll Hear
The vocabulary that shows up across any Zero Trust conversation, defined in plain language.
- Zero Trust Architecture (ZTA)
- A security design where no user, device, or connection is trusted by default, regardless of whether it's inside or outside the network. Formalized for U.S. agencies by NIST SP 800-207.
- Multi-Factor Authentication (MFA)
- Requiring two or more proofs of identity — something you know, something you have, or something you are — instead of a password alone.
- Least Privilege
- Granting a user or system only the access it needs for a specific task, and no more, usually for a limited window of time.
- Microsegmentation
- Dividing a network into small, isolated zones so that a breach in one segment can't move freely into the next.
- Lateral Movement
- The technique attackers use to spread from an initial foothold to other systems on the same network — the exact behavior microsegmentation is built to stop.
- Policy Decision / Enforcement Point (PDP / PEP)
- The two halves of a Zero Trust access check: the PDP decides whether a request should be allowed, and the PEP is the gate that actually lets it through or blocks it.
- Assume Breach
- Designing a system as though an attacker already has a foothold inside it, so the focus shifts to limiting damage rather than only guarding the entrance.
- Zero Trust Maturity Model (ZTMM)
- CISA's roadmap for advancing Zero Trust across five pillars and four maturity stages — see Part Two, The Architecture.
Common Questions
Is Zero Trust a product I can buy?+
No. Zero Trust is a strategy and a set of principles, not a single tool. Organizations typically combine several products — identity providers, endpoint management, network segmentation — under a Zero Trust policy framework.
Does Zero Trust mean employees aren't trusted?+
It means access isn't trusted automatically just because someone is already logged in or on the office network. Verification is continuous and based on evidence — identity, device health, context — rather than a one-time assumption.
Is Zero Trust only for federal agencies?+
The federal push came from Executive Order 14028 and OMB's M-22-09 memo, but the underlying model applies to any organization dealing with cloud apps, remote work, or sensitive data — which is most of them.
How long does Zero Trust adoption take?+
It's a gradual maturity climb, not a single project. CISA's model expects organizations to move through Traditional, Initial, Advanced, and Optimal stages over time, often years, pillar by pillar rather than all at once.
Does Zero Trust replace firewalls and VPNs entirely?+
Not necessarily overnight. Many organizations keep existing tools in place while layering identity- and context-based policy on top, gradually shifting reliance away from network location as the primary trust signal.
The Source Documents
This briefing draws on the primary government publications that define Zero Trust in the U.S.
The foundational document that defines Zero Trust and its core tenets for U.S. federal systems.
CISA · Zero Trust Maturity Model 2.0The maturity model this briefing's Architecture section is built around, including its four stages.
The White House · Executive Order 14028The order that made Zero Trust Architecture a requirement for federal agencies, not just a recommendation.
OMB · Memorandum M-22-09The follow-up guidance that set concrete Zero Trust milestones for federal agencies to hit.
Back to the Beginning
Revisit the briefing from the top, or jump straight to the principles.
Return Home