The traditional 'castle-and-moat' model assumed that users and devices located inside the corporate network boundary were inherently trustworthy. With cloud infrastructure, remote workforces, and multi-tenant SaaS platforms, that boundary no longer exists. Modern enterprise security relies on continuous verification and least-privilege enforcement.
1. The Logical Architecture of NIST SP 800-207
NIST Special Publication 800-207 defines the core logical framework for Zero Trust Architecture (ZTA), separating access decisions from access enforcement:
Policy Decision Point (PDP)
The Evaluation Engine
Evaluates incoming access requests against defined organizational policies, contextual telemetry (device posture, user role, risk score), and threat intelligence feeds to decide whether access is granted or denied.
- Policy Engine: Evaluates resource access rules.
- Policy Administrator: Issues credentials and session tokens.
Policy Enforcement Point (PEP)
The Gateway
Intercepts, inspects, and enforces the decisions made by the PDP. PEPs terminate untrusted connections and broker communication to the underlying resource.
- Identity-aware proxies and API gateways
- Software-defined network perimeters (SDP)
- Host-level microsegmentation agents
NIST SP 800-207 establishes seven basic tenets that guide zero trust design:
- All data sources and computing services are considered resources.
- All communication is secured regardless of network location.
- Access to individual enterprise resources is granted on a per-session basis.
- Access to resources is determined by dynamic policy.
- The enterprise monitors and measures the integrity and security posture of all owned and associated assets.
- All resource authentication and authorization are dynamic and strictly enforced before access is allowed.
- The enterprise collects as much information as possible about the current state of assets, network infrastructure, and communications and uses it to improve its security posture.
2. The Five Pillars of the CISA Zero Trust Maturity Model
The Cybersecurity and Infrastructure Security Agency (CISA) Zero Trust Maturity Model (Version 2.0) defines five foundational pillars that structure an enterprise implementation:
Identity
Phishing-resistant multi-factor authentication (MFA), centralized identity governance, automated lifecycle management, and continuous session risk evaluation.
Devices
Comprehensive device inventory, automated compliance checks, Mobile Device Management (MDM) enrollment, and endpoint detection and response (EDR) validation before granting access.
Networks
Granular microsegmentation, network isolation between production and non-production environments, encrypted internal communications (mTLS), and deprecation of legacy wide-open corporate VPNs.
Applications and Workloads
Continuous application vulnerability scanning, short-lived API authorization tokens, secure container runtimes, and decoupling applications from direct public internet exposure.
Data
Structured data discovery, automated classification, pervasive encryption at rest and in transit, and active data loss prevention monitoring.
3. Regulatory Context and Realistic Scope
It is important to maintain accuracy when discussing compliance: neither NIS2, the BSIG, nor ISO/IEC 27001 mandates a Zero Trust architecture by name. Rather, they require effective access control, encryption, least-privilege principles, and continuous monitoring. Adopting Zero Trust principles provides a structured engineering methodology to implement these required controls effectively, but it should not be conflated with a statutory mandate.
4. Conclusion
Zero Trust is not an off-the-shelf product; it is an architectural approach. By focusing on identity as the primary perimeter, enforcing microsegmentation, and validating device posture continuously, engineering teams reduce attack surfaces and lateral movement risks without creating unnecessary operational friction.