CISOs cannot ignore zero trust because it has become the common yardstick for access control. NIST defines it, CISA publishes a maturity model, and US federal policy pushed agencies toward it in 2022. Customers and auditors increasingly use the same vocabulary, so you need a clear position even if you buy no product.
What does zero trust actually mean?
NIST SP 800-207, published in August 2020, calls zero trust an evolving set of paradigms that move defenses from static, network-based perimeters to users, assets and resources. The core idea is that no implicit trust is granted to an account or device because of where it sits on the network or who owns it. Authentication and authorization of both the subject and the device are separate steps performed before a session to a resource starts.
NIST ties this to real trends: remote users, personal devices and cloud assets that sit outside any company-owned network. If your staff work from homes and your data lives in several clouds, the old perimeter was already gone.
Who is pushing it?
CISA's Zero Trust Maturity Model, in version 2.0, describes five pillars and three cross-cutting capabilities. Each pillar gives example states labelled traditional, initial, advanced and optimal. CISA says version 2.0 aligns with OMB memorandum M-22-09 from January 2022, and that it is one of several roadmaps agencies can use. CISA's description also says zero trust may require a change in an organization's philosophy and culture around cybersecurity, which is the part boards tend to underestimate.
You may not be a federal agency. Suppliers to agencies, and companies that follow federal guidance as a benchmark, still meet these terms in contracts and questionnaires.
What mistakes do CISOs make with it?
The first is treating zero trust as a product category. NIST describes an architecture and a set of principles, not an item to purchase. The second is announcing a program with no scope, so the label covers everything and nothing. The third is skipping the inventory. You cannot decide who may reach which resource if you do not know which resources, accounts and devices exist.
A constructed example: a mid-sized firm declares itself "zero trust" after replacing its VPN. Six months later an engineer's token still reaches production from an unmanaged laptop, because device checks were never part of the access decision. The tool changed. The trust model did not.
What should you do first?
Pick one high-value resource, such as the production deployment path or the finance database. Write down who needs access and from which devices. Require strong authentication and a device check for that path, log every decision, and measure how many exceptions remain. Then repeat for the next resource. Small, finished steps beat a multi-year plan with no owner.
Software teams have a version of this problem too. Build systems and automation accounts hold broad rights, and they deserve the same least-privilege questions as human users. Safeguard supports policies and gates on pull requests and agent identity controls, which covers part of that scope for code and automation, not the whole of zero trust.
How to check or apply this
- Read the abstract and core principles of NIST SP 800-207 so you use the term the way auditors do.
- Inventory users, devices, applications and data for one scope.
- Compare that scope with the CISA maturity model stages and note where you sit.
- Add device and identity checks to access decisions, not only network location.
- Log decisions and review exceptions monthly.
- Tell your board what the first scope is, what it costs in effort, and what will be measured.
- Answer customer questionnaires with the actual scope, not the label.
Quick check
Is zero trust a product I can buy?
No. NIST describes an architecture and principles. Products can support it, but the access decisions and the inventory behind them are your work.
Does zero trust apply to companies that are not federal agencies?
The mandate applies to agencies, but the vocabulary and maturity model are widely used as benchmarks, so suppliers and others meet them anyway.
Sources
- NIST SP 800-207, Zero Trust Architecture, fetched 18 October 2026.
- CISA, Zero Trust Maturity Model, fetched 18 October 2026. The page is marked as archived content.
Last reviewed: 18 October 2026.
