Zero trust is a security approach that does not trust a user, device, or application just because it sits inside your network. Every request to reach a resource is checked, every time. The National Institute of Standards and Technology calls it “an evolving set of cybersecurity paradigms,” which means it is a way of designing security, not a product you buy and install. The motto in federal guidance is “never trust, always verify.”
The reason it exists is simple. Older security models built a strong wall around the network and trusted everything inside. Once an attacker got in, often by stealing a password, they could move freely. Zero trust assumes attackers will get in and limits what any one login can reach. This guide explains the core ideas, NIST’s seven tenets, the CISA maturity model, and a practical starting path for small teams and individuals.
Why the Old Model Fails
The traditional approach is called perimeter security. A firewall guards the edge, and users and devices inside are trusted. That works only if the inside is the only place work happens. Today, staff use cloud services, personal phones, and home networks, and the perimeter is blurry.
Credentials make the problem worse. The Verizon 2026 Data Breach Investigations Report, summarized by Push Security, covered more than 22,000 confirmed breaches in 145 countries. Credential abuse was the initial access method in 13% of breaches and appeared in 39% of breaches overall. Exploiting vulnerabilities led initial access at 31%, and phishing at 16%. Third-party involvement rose to 48% from 30%.
If a stolen password gives access to everything, one mistake becomes a catastrophe. Zero trust is designed to shrink that damage.
What NIST Says Zero Trust Is
NIST Special Publication 800-207, published in August 2020, is the standard reference. It describes zero trust as moving defenses from network perimeters to focus on users, assets, and resources. Authentication and authorization of the user and device are discrete functions performed before a session to a resource is established.
The Seven Tenets
NIST lists seven tenets, paraphrased here.
- All data sources and computing services are considered resources. Printers, cloud apps, phones, and sensors all count.
- All communication is secured regardless of network location. Being on the office network earns no extra trust.
- Access to individual resources is granted on a per-session basis. Approval for one resource does not carry over to another.
- Access is determined by dynamic policy. Policy can consider the identity of the user, the state of the device, and other signals such as behavior.
- The enterprise monitors the integrity and security posture of all owned and associated assets. No device is assumed secure by default.
- All resource authentication and authorization is dynamic and strictly enforced before access is allowed.
- The enterprise collects as much information as possible about the current state of assets, network infrastructure, and communications, and uses it to improve its security posture.
The Three Core Components
NIST describes a logical architecture with three parts. The Policy Engine decides whether to grant access to a resource. The Policy Administrator carries out that decision by setting up or shutting down the connection. The Policy Enforcement Point is the gate that actually opens or closes the path between the user and the resource.
In plain terms, here is the flow. A user asks for access to an application. The request goes to the gate. The gate asks the decision-maker, which checks who the user is, whether the device looks healthy, and whether the request fits policy. If the answer is yes, a connection is opened for that session only. If anything changes, the access can be cut.
The CISA Zero Trust Maturity Model
The Cybersecurity and Infrastructure Security Agency released version 2.0 of its Zero Trust Maturity Model in April 2023. It breaks zero trust into five pillars: Identity, Devices, Networks, Applications and Workloads, and Data. Three cross-cutting capabilities run through them: Visibility and Analytics, Automation and Orchestration, and Governance.
Each pillar moves through four stages: Traditional, Initial, Advanced, and Optimal. CISA describes the journey as an incremental process that may take years. The model is useful because it lets an organization place itself on a scale and pick the next step instead of trying to change everything at once.
Recent Updates From NIST and the Department of Defense
NIST finalized SP 1800-35 on June 10, 2025. It presents 19 example zero trust implementations built with 24 industry collaborators, which gives practitioners worked examples using real products.
The Department of Defense released a zero trust primer in January 2026. It describes seven pillars: User, Device, Application and Workload, Data, Network and Environment, Visibility and Analytics, and Automation and Orchestration. Its target level includes 42 capabilities and 91 activities. The primer uses the phrases “never trust, always verify” and “assume breach.” The numbers are specific to defense systems, but they show how large a full program can be.
Core Principles in Everyday Language
Verify Explicitly
Check who is asking, from what device, and for what resource, each time.
Use Least Privilege
Give each person and system only the access needed for the job, and for only as long as needed. This is not a NIST tenet by name, but it follows from the per-session access in tenet three and the dynamic policy in tenet four.
Assume Breach
Plan as if an attacker is already inside. Segment networks, log activity, and make it hard to move from one system to another.
A Beginner’s Roadmap
Zero trust is a program, not a purchase. Small organizations and individuals can apply the ideas without a large budget.
Step 1: Know What You Protect
Make a list of your accounts, devices, data stores, and apps. Tenet one says everything counts as a resource, and you cannot protect what you have not listed.
Step 2: Strengthen Identity
Turn on multi-factor authentication for every account that offers it, starting with email, finance, and admin accounts. Use a password manager so each account has a unique password. Identity is the first pillar in the CISA model for a reason.
Step 3: Check Device Health
Keep operating systems and apps updated and turn on disk encryption and screen locks. Under tenet five, the state of the device is part of the access decision.
Step 4: Limit Access
Remove accounts that are no longer needed and trim permissions. Avoid shared admin accounts. Give contractors and vendors only what they need, since third-party involvement was in 48% of breaches in the DBIR.
Step 5: Segment and Monitor
Separate sensitive systems from general ones, and turn on logging and alerts. Tenet seven asks you to collect as much information as possible about current state, so you can notice unusual behavior.
Step 6: Review and Improve
Use the CISA maturity stages to judge where you are and pick the next improvement. Repeat the exercise on a schedule.
Common Misconceptions
“Zero Trust Is a Product”
NIST describes a set of paradigms. Vendors sell tools that support zero trust, but no single product delivers it.
“Zero Trust Means Trusting Nobody on Your Team”
It means verifying every request and limiting access, not assuming people are dishonest. Most failures come from stolen credentials and mistakes.
“It Replaces the Firewall”
Network controls remain part of the picture. Zero trust adds identity, device, and data checks so the network location is not the only thing that matters.
“You Can Finish It”
CISA says adoption may take years, and the model is meant to be improved over time.
A Day in a Zero Trust Workplace
An example shows how the ideas feel in practice. An employee signs in to a company’s file-sharing app. The system checks the password and a second factor. It also checks that the laptop is updated and that the sign-in looks normal for that person. If everything passes, the employee can open the files they need for the project, and nothing else. If the same login later appears from an unusual place or on a device with missing updates, the policy can ask for more proof or block access.
The tenets show up in that scene. Access is per session, policy is dynamic, the device is checked, and the system records what happens so the company can learn from it. Nothing about the experience requires the employee to understand the theory.
What It Costs and What It Saves
Zero trust takes effort, and the sources reviewed do not give cost figures for small businesses. The CISA model suggests an approach that spreads the work over time. A small organization can begin with identity and device hygiene, which are low-cost, and then move to segmentation and monitoring as budget allows.
The benefit is containment. The DBIR numbers show that stolen credentials and third-party access are common ways in. A system that limits what a single account can reach turns a break-in into a smaller incident. The reports reviewed do not quantify savings, so this article makes no claim about dollar amounts.
Questions to Ask a Vendor
Because many products use the term, a buyer should ask specific questions. Does the product check device health, or only identity? Can it make access decisions per session? Does it log activity so you can investigate later? How does it handle third-party and contractor access? Which of the CISA pillars does it cover, and which does it leave to other tools? A vendor that cannot answer these clearly is probably selling a label.
Zero Trust at Home
Households can borrow the same ideas. Give every account its own password, use two-step login, keep phones and computers updated, and avoid sharing logins. Separate guests from your main network if your router supports it. Remove old apps and accounts you no longer use. These habits reduce what an attacker can reach through any one weakness.
Where to Read More
For a first pass, CISA’s maturity model is the most approachable document, since it breaks the work into pillars and stages. NIST SP 800-207 is the foundation, and its seven tenets are short enough to read in one sitting. For examples of working designs, NIST SP 1800-35 presents 19 implementations built with industry partners. The Department of Defense primer shows how a large organization frames the same ideas. Reading them in that order moves from overview to detail to practice.
Frequently Asked Questions
What is zero trust in simple terms?
It is a security model that treats every access request as untrusted until it is verified, whether it comes from inside or outside the network.
Is zero trust a product I can buy?
No. NIST describes it as an evolving set of cybersecurity paradigms. Products can support it, but it is an approach to designing security.
What are the pillars of zero trust?
CISA’s model uses five: Identity, Devices, Networks, Applications and Workloads, and Data. The Department of Defense primer lists seven, which adds Visibility and Analytics and Automation and Orchestration as pillars.
How long does zero trust take to adopt?
CISA calls it an incremental process that may take years. You can start with multi-factor authentication and device updates now.
Can individuals use zero trust?
Yes, at a small scale. Unique passwords, multi-factor authentication, updated devices, and limited sharing apply the same ideas.
References and Sources
National Institute of Standards and Technology, “SP 800-207, Zero Trust Architecture”: https://csrc.nist.gov/pubs/sp/800/207/final
Cybersecurity and Infrastructure Security Agency, “Zero Trust Maturity Model Version 2.0”: https://www.cisa.gov/zero-trust-maturity-model
National Institute of Standards and Technology, “SP 1800-35, Implementing a Zero Trust Architecture”: https://csrc.nist.gov/pubs/sp/1800/35/final
U.S. Department of Defense, “Zero Trust Primer”: https://dodcio.defense.gov/Portals/0/Documents/Library/ZeroTrustPrimer.pdf
Push Security, “Verizon DBIR 2026: Key takeaways”: https://pushsecurity.com/blog/verizon-dbir-2026
About The Author
