“Zero Trust” appears in almost every security vendor’s marketing, which has made the term easy to misunderstand. It isn’t a product, a firewall feature, or a VPN replacement on its own. Zero Trust security architecture is a way of designing access so that no user, device, or workload is trusted simply because of where it sits on the network.
This guide explains Zero Trust architecture from first principles: the tenets behind it, the logical components defined by NIST, the pillars CISA uses to measure maturity, and how those pieces fit together in a real enterprise environment.
What Is Zero Trust Security Architecture?
Zero Trust architecture (ZTA) is an enterprise security design that treats every access request as untrusted until it’s verified, regardless of whether it originates inside or outside the corporate network. Access decisions are made per request, using identity, device health, and contextual signals, and access is granted with the least privilege needed for that specific resource.
The foundational reference is NIST Special Publication 800-207, which defines Zero Trust concepts, logical components, and deployment models. In practice, organizations combine it with the CISA Zero Trust Maturity Model to plan and measure progress.
Why Perimeter-Based Security No Longer Works
Traditional network security assumed a clear inside and outside, with a hardened perimeter protecting a trusted interior. That model struggles with:
- Remote and hybrid work, where users connect from home and public networks
- Cloud and SaaS, where critical applications and data sit outside the corporate network
- Third parties and contractors who need access to specific systems
- Attackers who gain an initial foothold through phishing and then move laterally inside a flat network
Once inside a perimeter-based network, an attacker often inherits broad implicit trust. Zero Trust removes that implicit trust.
The Core Tenets of Zero Trust
NIST SP 800-207 describes a set of tenets that underpin Zero Trust. In plain terms:
- All data sources and computing services are resources. Laptops, servers, SaaS apps, APIs, and IoT devices are all things to protect.
- All communication is secured regardless of network location. Being on the internal network doesn’t make traffic trusted.
- Access is granted per session. Trust is evaluated before each access and isn’t carried over automatically.
- Access is determined by dynamic policy. Policies consider identity, device state, behavior, and environmental factors.
- The enterprise monitors the integrity and security posture of all assets. Unhealthy devices can be denied or restricted.
- Authentication and authorization are dynamic and strictly enforced before access is allowed.
- The enterprise collects as much information as possible about assets, network traffic, and access requests to improve its security posture.
Logical Components of a Zero Trust Architecture
NIST describes Zero Trust access in terms of a control plane, which makes decisions, and a data plane, where access happens.
| Component | Role | Real-World Examples |
|---|---|---|
| Policy Engine (PE) | Decides whether to grant access, using policy and inputs from data sources | Conditional access engine in an identity provider; ZTNA policy service |
| Policy Administrator (PA) | Executes the decision by establishing or shutting down the connection and issuing credentials or tokens | Identity provider issuing tokens; ZTNA controller configuring connections |
| Policy Enforcement Point (PEP) | Enables, monitors, and terminates connections between the subject and resource | Identity-aware proxy, ZTNA gateway, microsegmentation agent, API gateway |
The Policy Engine relies on data sources such as:
- Identity management and identity governance systems
- Device posture and endpoint detection data
- Threat intelligence feeds
- Activity logs and SIEM analytics
- Data classification and access policies
- Compliance requirements
A simplified flow: a user requests access to an application; the PEP intercepts it; the Policy Engine evaluates who the user is, whether MFA succeeded, whether the device is managed and healthy, and whether the request fits normal behavior; the Policy Administrator tells the PEP to allow a session limited to that application; the session is continuously monitored and can be terminated if conditions change.
Zero Trust Deployment Approaches
NIST identifies several ways to implement ZTA, which organizations often combine:
- Enhanced identity governance: identity and attributes are the primary basis for access decisions. Common in cloud-first organizations.
- Microsegmentation: resources are placed in small segments protected by gateways or host-based controls, limiting lateral movement.
- Software-defined perimeters: an overlay network hides resources and creates connections only after verification, as in many ZTNA products.
For a network-focused view of this shift, see our article on architecting a Zero Trust network beyond the VPN.
The Five Pillars of Zero Trust
The CISA Zero Trust Maturity Model organizes capabilities into five pillars, supported by three cross-cutting capabilities.
| Pillar | Focus | Key Capabilities |
|---|---|---|
| Identity | Users and service identities | Phishing-resistant MFA, centralized identity, risk-based access, privileged access controls |
| Devices | Endpoints, servers, mobile, IoT | Asset inventory, device health checks, EDR, compliance enforcement |
| Networks | Traffic and connectivity | Microsegmentation, encrypted traffic, ZTNA, reduced implicit trust zones |
| Applications and Workloads | Apps, APIs, cloud workloads | Per-application access, secure development, workload identity, application-layer authorization |
| Data | Information assets | Classification, encryption, data loss prevention, access monitoring |
The cross-cutting capabilities are visibility and analytics, automation and orchestration, and governance. CISA’s model describes maturity stages from Traditional through Initial and Advanced to Optimal for each pillar.
What Zero Trust Architecture Looks Like in Practice
Consider an employee accessing a finance application:
- The employee signs in through the central identity provider using a passkey, a phishing-resistant method described in our guide to passwordless authentication.
- Conditional access checks that the laptop is managed, encrypted, patched, and running endpoint protection.
- The request is routed through an identity-aware proxy to the finance application only, not to the wider network.
- Authorization within the application limits the user to the data their role requires.
- Activity is logged and analyzed; unusual behavior, such as a large data export at an odd hour, triggers step-up authentication or session termination.
Administrators follow a stricter path with just-in-time elevation, covered in our privileged access management best practices.
Benefits of Zero Trust Architecture
- Reduced lateral movement: a compromised device or account can reach far less.
- Better protection for remote and cloud access without relying on network location.
- Stronger defense against credential theft through strong authentication and continuous evaluation.
- Improved visibility into who accesses what, from where, and how.
- Compliance support for access control, logging, and least privilege requirements in most frameworks.
Common Misconceptions
- “Zero Trust means trusting no one.” It means trust is never assumed and must be continuously earned and verified.
- “We bought a ZTNA product, so we’re Zero Trust.” ZTNA addresses part of the network pillar. Identity, devices, applications, and data still need attention.
- “Zero Trust replaces all network security.” Segmentation, firewalls, and monitoring remain important as part of defense in depth.
- “It’s only for large enterprises.” Smaller organizations can adopt core principles, such as strong identity and per-application access, relatively quickly.
Designing Your Zero Trust Architecture
- Identify your protect surface: the critical data, applications, assets, and services that matter most.
- Map transaction flows to understand how users and services access those resources.
- Choose enforcement points appropriate to each flow: identity provider, proxy, segmentation, or API gateway.
- Define access policies using identity, device, and context.
- Integrate telemetry and analytics to inform and refine decisions.
- Assess maturity against the CISA pillars and plan improvements in phases.
Securis360 helps organizations design and validate these architectures through network architecture reviews and security engineering services. For cloud-specific guidance, see Zero Trust for cloud environments.
Frequently Asked Questions
What are the main components of Zero Trust architecture?
NIST SP 800-207 defines a Policy Engine that makes access decisions, a Policy Administrator that executes them, and Policy Enforcement Points that control connections, all informed by identity, device, threat, and activity data sources.
What are the five pillars of Zero Trust?
In the CISA Zero Trust Maturity Model, the pillars are identity, devices, networks, applications and workloads, and data, supported by visibility and analytics, automation and orchestration, and governance.
Is Zero Trust the same as ZTNA?
No. ZTNA is a technology that provides identity-based, per-application access. Zero Trust is the broader architecture and strategy that ZTNA can be part of.
Does Zero Trust eliminate the need for a VPN?
Often it reduces or replaces VPN use for application access, but some organizations keep VPNs for specific use cases during transition. The goal is to stop granting broad network access by default.
How do we measure Zero Trust maturity?
Use the CISA Zero Trust Maturity Model to assess each pillar from Traditional to Optimal, and track metrics such as phishing-resistant MFA coverage, device compliance, and the share of applications accessed through identity-aware enforcement points.
Key Takeaways
- Zero Trust architecture removes implicit trust based on network location.
- NIST defines the core components: Policy Engine, Policy Administrator, and Policy Enforcement Points.
- CISA’s five pillars provide a practical way to plan and measure maturity.
- Zero Trust is an architecture and strategy, not a single product.