NIST SP 800-207, published in August 2020, describes zero trust as a shift from static, network based perimeters to protecting users, assets and resources, with no implicit trust based on network location or ownership. It lists seven tenets. Here is each one in plain words, with a question to test your own environment.
1. Everything is a resource
All data sources and computing services count as resources, including SaaS, small devices that send data to aggregators and, if an organization chooses, personally owned devices that reach company data.
Ask: do we have a list of what we are protecting?
2. All communication is secured wherever it comes from
Being inside the office network does not earn trust. Requests from inside the old perimeter must meet the same requirements as any other. Traffic should protect confidentiality and integrity and provide source authentication.
Ask: do internal services talk to each other over encrypted, authenticated connections? Our posts on mutual TLS and a TLS baseline cover the transport side.
3. Access is granted per session, with least privilege
Trust in the requester is evaluated before access, and access to one resource does not automatically grant access to another.
Ask: does one login open everything, or only what the person needs right now?
4. Access follows dynamic policy
Decisions use the observable state of the client identity, the application and the requesting asset, and may include behavior and environment: software versions, network location, time, previously observed behavior.
Ask: can our rules take device state into account, or only a group membership?
5. The enterprise monitors the posture of its assets
No asset is inherently trusted. Assets that are subverted, have known vulnerabilities or are not managed may be treated differently, up to denying all connections.
Ask: do we know which devices are patched, and does that affect what they can reach?
6. Authentication and authorization are dynamic and strictly enforced
It is a constant cycle of obtaining access, assessing threats and reevaluating trust. NIST expects identity, credential and access management and asset management in place, including multifactor authentication for some or all resources.
Ask: when risk changes mid session, can we cut access?
7. Collect data to improve
The enterprise gathers as much information as possible about asset posture, network traffic and access requests, and uses it to improve policy.
Ask: do access logs feed back into policy changes?
How to use the list
NIST says these tenets are the ideal goal and that not all may be fully implemented in their purest form for a given strategy. Score yourself from zero to two on each, find the weakest two, and fix those first. Read NIST zero trust components for how the pieces fit, and zero trust myths for common misreadings.
NIST also notes the tenets apply to work within an organization or with partners, not to anonymous public or consumer facing processes.
Quick check
Is zero trust the same as having no firewall?
No. NIST observes that many definitions stress removing perimeter defenses, but it frames zero trust by tenets rather than by what is excluded.
Do all seven tenets have to be fully met before I can say I am doing zero trust?
NIST calls them the ideal goal and acknowledges not all may be fully implemented. Treat them as a direction, not a pass or fail test.
Sources
Last reviewed: 19 October 2026.
