Zero trust: what an enterprise has to decide

What NIST SP 800-207 defines as zero trust architecture

NIST SP 800-207, Zero Trust Architecture, was published in August 2020. It treats zero trust as a set of guiding principles for workflow, system design and operations. It does not prescribe a single architecture.^2,5

The standard reduces any zero trust design to three logical components.

• Policy engine (PE). Makes the decision to grant, deny or revoke a subject's access to a resource. It weighs enterprise policy against outside inputs such as threat intelligence, and logs each decision.⁶
• Policy administrator (PA). Opens or shuts the communication path between the subject and the resource by sending commands to the enforcement points. Some implementations run the PE and PA as one service.^7,8
• Policy enforcement point (PEP). Enables, monitors and ends the connection itself. It can be split into an agent on the laptop and a gateway in front of the resource, or run as a single portal.⁹

NIST describes three approaches: enhanced identity governance, logical micro-segmentation and network-based segmentation. A full solution includes elements of all three. An enterprise's use case and existing policies often point to one of them to lead with.¹⁰

NIST SP 800-215 (November 2022) describes the same roles in network terms. A client or browser is the point of entry. A controller acts as the policy decision point. A gateway acts as the enforcement point in front of protected resources.¹¹

Where to start: CISA Zero Trust Maturity Model pillars and stages

CISA's Zero Trust Maturity Model, version 2.0, dated April 2023, divides the work into five pillars: Identity, Devices, Networks, Applications and Workloads, and Data. Three capabilities cut across all five: Visibility and Analytics, Automation and Orchestration, and Governance. Each pillar can progress at its own pace until it needs to coordinate with the others.^3,12

CISA tells agencies to assess their current systems, infrastructure, staff and processes before investing in zero trust capabilities. NIST's NCCoE puts it as a first step: inventory the hardware, software, applications, data and services. A resource left out of the inventory is likely to be left unprotected.^12,13

For the first project, NIST suggests a low-risk business process, so that a disruption does not hit the whole organization. Processes that run on cloud resources or serve remote workers are often good candidates. Critical processes follow once the team has experience.¹⁴

OMB M-22-09: the federal zero trust strategy as a reference model

OMB memorandum M-22-09, dated January 26, 2022, set a federal zero trust strategy. It required agencies to meet specific goals by the end of fiscal year 2024, organized on CISA's five pillars. The memo calls itself a starting point, not a comprehensive guide to a fully mature architecture.^3,15,16

Users log into applications, not networks. Every application is treated as internet-accessible from a security point of view. Each agency had to pick at least one internal-facing FISMA Moderate application and make it fully usable over the public internet within a year.^20,21,22

The Department of Defense has its own plan to implement zero trust architecture by 2027. In a GAO assessment published September 28, 2026, 12 of 18 major DoD IT business programs reported implementing zero trust to varying extents. Of the 6 that had not, 3 reported no plans to.^23,24

ZTNA vs VPN: replacing remote access

A VPN extends the perimeter over a public network. NIST SP 800-215 lists its limits. Cloud traffic from remote users lands at the corporate edge and is routed back out, which adds latency and can cause bottlenecks. VPNs often need agents, which makes access hard for large numbers of contractors and partners.^25,26

OMB called access without a VPN or other network tunnel a major shift that takes significant effort. NCCoE describes a gradual path. An organization moving from a full-device VPN to per-app tunneling can first run a full tunnel, observe the traffic, then allow only what each user profile needs.^22,30

In NIST's agent/gateway model, software on the device works with a gateway in front of the resource. In the resource portal model, one gateway fronts the resource and nothing is installed on client devices. That suits BYOD and work with other organizations, and the portal can front a data center of legacy applications.^9,31,32

SSE and SASE: buying choices for zero trust

SASE delivers networking and security together as a service: SD-WAN, secure web gateway, cloud access security broker, next-generation firewall and ZTNA. It covers branch offices, remote workers and on-premises access.⁴

NIST SP 800-215 notes that Gartner coined the term in 2019. The services inside a SASE are not new. They come as one package delivered from points of presence, instead of as separate point products.³³

Security service edge (SSE) products carry the access and security services without the SD-WAN. Microsoft describes Entra Internet Access and Entra Private Access as its SSE. In NIST's lab builds, Lookout's SSE included private access, cloud access and internet access.^34,35

For NIST SP 1800-35, NCCoE worked with 24 technology providers and built 19 example zero trust architectures in its labs. Even its SASE build with Palo Alto Networks as policy engine used products from AWS, IBM, Mandiant, Okta, Radiant Logic, SailPoint and Tenable.^36,37

The guide tells buyers to choose an approach first, from enhanced identity governance, software-defined perimeter, microsegmentation or SASE, and then study the builds that match it.³⁸

NIST names lock-in as a risk. The data sources behind access decisions often lack a common open standard, which can tie an enterprise to a subset of providers. NIST advises weighing vendor security controls, switching costs and supply chain risk alongside performance and stability.^39,40

What zero trust costs to buy and run

CISA writes that letting pillars mature at different speeds spreads costs over time rather than up front. It also says effort and benefits rise significantly as maturity advances. Systems built on implicit trust will need investment to change.^12,41

M-22-09 asked each agency for an FY22-FY24 implementation plan and an FY24 budget estimate. For FY22 and FY23, agencies were told to fund priority goals internally or from sources such as working capital funds or the Technology Modernization Fund.⁴²

NCCoE's advice on cost is reuse. Most organizations already own firewalls, identity systems and endpoint tools. Keep or repurpose as much as security allows, and buy new components that integrate with what stays.^43,44

NIST requires the policy engine and administrator to be properly configured and monitored, with every configuration change logged and subject to audit. NCCoE also found that organizations lacked the skills and training their administrators, security staff and users would need.^45,46

Where zero trust programs go wrong

• Buying it as a product. NIST says the move cannot be made by wholesale replacement of technology. NCCoE adds that each architecture has to be designed around the organization's requirements, risk tolerance and existing technology.^2,47
• Identity sprawl. NCCoE lists poor definition, management and tracking of user roles among the missing foundations, because fine-grained access policy depends on them. NIST notes that in many legacy architectures, privileged accounts may have blanket access to every enterprise resource.^46,48
• Policy scattered across products. When several components act as policy engine, rules end up in endpoint, identity, network and data tools, with no single place to see them all. NCCoE says to track each rule and where it is configured.^49,50
• Legacy applications. CISA notes that legacy systems often rely on implicit trust, with access assessed infrequently on fixed attributes. That conflicts with zero trust's adaptive evaluation.⁴¹
• A single point of failure. If the policy engine or administrator becomes unreachable, an operational error could stop the whole enterprise. NIST suggests hosting enforcement in a secured cloud environment or replicating it across locations.^51,52
• Breaking the workflow. NIST tells planners to weigh tradeoffs in performance, user experience and workflow fragility for each business process they move.⁵³