Zero trust is a security model that grants no implicit trust to a user account or device based on its network location or on who owns it. NIST SP 800-207 describes it as a set of cybersecurity paradigms that move defenses from static, network-based perimeters to users, assets, and resources. Authentication and authorization happen before each session with an enterprise resource begins.
The seven tenets in NIST SP 800-207
NIST published SP 800-207, Zero Trust Architecture, in August 2020. It lists seven tenets that a zero trust architecture is designed to follow.
All data sources and computing services count as resources. All communication is secured regardless of network location. Access to each resource is granted per session, with the least privilege needed for the task. Access is decided by dynamic policy that includes the state of the client identity, the application, and the requesting device.
The enterprise monitors the integrity and security posture of every asset it owns or that is associated with it. Authentication and authorization are dynamic and strictly enforced before access is allowed. The enterprise collects data on its assets, network, and communications and uses it to improve its security posture.
NIST calls the tenets the ideal goal. It says not every tenet may be fully implemented in its purest form.
Policy engine, policy administrator, enforcement point
NIST splits the access decision across three logical components. The policy engine decides whether to grant, deny, or revoke a subject's access to a resource. The policy administrator opens or shuts down the communication path based on that decision. The policy enforcement point enables, monitors, and terminates the connection between the subject and the resource.
OMB M-22-09 and the federal deadline
The Office of Management and Budget issued memorandum M-22-09 on January 26, 2022. It set a federal zero trust strategy and required agencies to meet specific security goals by the end of fiscal year 2024.
The goals follow CISA's zero trust maturity model. That model has five pillars: Identity, Devices, Networks, Applications and Workloads, and Data. Three themes cut across them: Visibility and Analytics, Automation and Orchestration, and Governance.
Phishing-resistant multifactor authentication is required for agency staff, contractors, and partners. The memo's goals also include encrypting all DNS requests and HTTP traffic and treating all applications as internet-connected.
Why zero trust cannot be bought as one product
NIST describes zero trust as a set of guiding principles, not a single architecture. It says the transition cannot be accomplished by a wholesale replacement of technology. NIST expects most enterprises to run in a hybrid zero trust and perimeter-based mode for an indefinite period. It says a significant enterprise is unlikely to migrate in a single technology refresh cycle.
In 2020, NIST reported that no standards existed for buyers to identify compatibility between zero trust products. It says this makes a multiyear zero trust road map very difficult to create.
Sources
Checked November 5, 2026.