The zero trust network security model removes implicit trust based on network location. Every request to a resource is authenticated and authorised, using the identity of the user and the state of the device, before access is granted. You start with one application and widen from there, not with a big replacement.
What does NIST say?
NIST SP 800-207 describes zero trust as an evolving set of cybersecurity paradigms that move defences from static, network-based perimeters to a focus on users, assets and resources. A zero trust architecture applies those principles to plan infrastructure and workflows.
Two statements carry the weight. First, zero trust assumes no implicit trust is granted to assets or user accounts based solely on physical or network location, or on whether the asset is enterprise or personally owned. Second, authentication and authorisation, of both subject and device, are discrete functions performed before a session to an enterprise resource is established.
It frames the focus as protecting resources such as assets, services, workflows and accounts, rather than network segments.
What are the core ideas in plain words?
Verify each request. Being on the office network proves nothing. Each access to an application is decided on its own.
Use least privilege. Grant the minimum access needed for the task, for the time needed.
Check the device as well as the person. A valid user on a device that is unpatched or unmanaged may get less access, or none.
Assume breach. Design as if some account or device is already compromised. Limit what it can reach and watch what it does.
Log and learn. Record access decisions so patterns can be reviewed and policy refined.
CISA's Zero Trust Maturity Model describes the goal as enforcing accurate, least privilege, per-request access decisions in the face of a network viewed as compromised. It organises progress into five pillars and three cross-cutting capabilities, with stages from traditional through initial and advanced to optimal.
How does a decision actually get made?
SP 800-207 describes a policy decision point that evaluates a request and a policy enforcement point that opens or closes the connection. A request arrives from a user on a device. The decision point checks identity, device state and context against policy, and instructs the enforcement point to allow, deny or limit the session. The decision can also be revisited during the session if something changes.
What does a constructed example look like?
A company's finance application is reachable by anyone on the office network or on the VPN. They move it behind an access proxy. Now a request must carry a verified sign-in with multifactor authentication and come from a managed, encrypted laptop. Members of the finance group get access to the application's front end only. A contractor on the VPN gets nothing. When a laptop falls out of patch compliance, it loses access until it is updated, and the event appears in a log.
What are the common traps?
Buying a product and calling it done. NIST treats zero trust as principles and an architecture, not a single item. Another trap is starting with the hardest application. Pick one with a defined user group. And removing the old controls too early: keep firewalls and segmentation while the new model matures.
How to check or apply this
- List your applications and who uses each.
- Pick one with a clear user group, and put it behind per-request, identity-based access.
- Require multifactor authentication and a device health check for it.
- Log every allow and deny, and review the denials weekly.
- Remove broad network-level allow rules that this application no longer needs.
- Use CISA's maturity model to choose the next pillar to improve.
Safeguard's policies and gates apply a similar check-before-allow idea to software changes, though they do not provide network access control.
Quick check
Does zero trust mean trusting no one?
It means no implicit trust from network location. Access is granted after authentication and authorisation, based on policy.
Can we adopt it all at once?
Rarely. NIST and CISA describe a gradual path. Start with one application and expand.
Sources
- NIST SP 800-207, Zero Trust Architecture
- CISA, Zero Trust Maturity Model
- NIST SP 800-215, Guide to a Secure Enterprise Network
Last reviewed: 18 October 2026.
