What you’ll learn in this guide:
- The definition of zero trust rests on, straight from NIST's own framework
- The five areas a zero trust program has to cover, according to CISA's maturity model
- The four maturity stages, and where most organizations currently sit
- A rollout order that segments the network without breaking production systems
- The two entry points responsible for most breaches today
What Zero Trust Actually Means
NIST defines zero trust architecture in Special Publication 800-207. The framework removes automatic trust based on network location or device ownership. A user connecting from the corporate office receives the same scrutiny as one connecting from a coffee shop. The system authenticates every subject and device, then authorizes it, before granting access to a resource. It repeats that check for each new session.
The model protects individual resources, such as an application or a data set, instead of a network segment. This shift matters because an attacker who breaches one segment can no longer move freely once inside it.
Traditional Perimeter Security | Zero Trust |
Trusts users and devices once inside the network | Verifies every user and device on every request |
Grants broad access after one login | Grants access to one resource at a time |
Assumes internal traffic is safe | Treats internal and external traffic the same way |
Relies on firewalls at the network edge | Enforces policy close to each resource |
The Five Areas a Zero Trust Program Has to Cover
CISA's Zero Trust Maturity Model organizes a program into five pillars. Each pillar covers a distinct part of the environment. Three cross-cutting capabilities, visibility and analytics, automation and orchestration, and governance, tie all five pillars together. A program that covers only one or two pillars still leaves gaps for attackers to exploit.
Pillar | What It Covers |
Identity | Verifying who or what is requesting access |
Devices | Tracking and assessing the security posture of every device |
Networks | Segmenting traffic and encrypting connections |
Applications & Workloads | Securing access to individual applications and workloads |
Data | Classifying, encrypting, and controlling access to data |
The Four Maturity Stages, and Where Most Organizations Sit
CISA defines four maturity stages that apply across each pillar: traditional, initial, advanced, and optimal. A traditional stage relies on manual configuration and static policies. An optimal stage relies on automated policies that adjust to risk in real time. Most organizations sit closer to the traditional end of the scale, particularly in the network and device pillars. Those areas depend on legacy infrastructure that took years to deploy.
Stage | What It Looks Like |
Traditional | Manual configuration and static, perimeter-based policies |
Initial | Early automation, with some attributes assigned and enforced automatically |
Advanced | Centralized, automated policy enforcement across most pillars |
Optimal | Fully automated, dynamic policies that adjust to real-time risk |
A Rollout Order That Avoids Breaking Production Systems
Security teams get the best results when they sequence the five pillars instead of tackling all five at once. Identity and device visibility come first, since every other pillar depends on knowing who and what is on the network. Network segmentation follows once that inventory is in place. Application and data controls come next, since they depend on a segmented network to contain damage from a compromised device. Continuous monitoring and automation run throughout the rollout, not as a final phase.
Phase | Focus |
Foundation | Inventory every user and device, along with its current security posture |
Containment | Segment the network based on that inventory |
Access Control | Apply per-resource controls to applications and data |
Validation | Monitor continuously and automate policy enforcement |
The Two Entry Points Responsible for Most Breaches Today
Verizon's 2026 Data Breach Investigations Report found that 31% of breaches now start with an exploited software vulnerability. That number overtook stolen credentials as the top way attackers get in. IBM's 2026 Cost of a Data Breach Report put the global average cost of a breach at $4.99 million. That's a 12% increase over the prior year, and a new record. Zero trust addresses both entry points directly.
The device pillar catches vulnerable or misconfigured devices before an attacker can exploit them. The identity pillar removes the value of a stolen password, since a password alone no longer grants access to a resource.
Metric | Figure | Source |
Breaches starting with an exploited software vulnerability | 31% | Verizon 2026 DBIR |
Global average cost of a data breach | $4.99M | IBM 2026 Cost of a Data Breach Report |
Year-over-year increase in average breach cost | 12% | IBM 2026 Cost of a Data Breach Report |
Map your own environment against these five pillars to see where you stand, whether you're just getting started or checking progress toward optimal. See how the pillars come together on a real network.