Trust Maturity Model. Executive Order 14028. If you're trying to build a Zero Trust program, understanding which frameworks apply and how is essential. Let's break them down.
NIST SP 800-207: The Foundational Framework
The National Institute of Standards and Technology (NIST) defines Zero Trust as "a collection of concepts and ideas designed to minimize uncertainty in enforcing accurate, least-privilege per-request access decisions in information systems and services in the face of a network viewed as compromised."
The NIST framework introduces four key architectural roles:
• Policy Engine (PE): The "brain" that evaluates resource access requests and makes allow/deny decisions.
• Policy Administrator (PA): Executes Policy Engine decisions, establishing and terminating sessions between subjects and resources.
• Policy Enforcement Point (PEP): The gateway that all data plane connections must pass through to gain access to a resource.
• Policy Information Points (PIP): Feeds contextual data: identity attributes, device posture, historical patterns, into the Policy Engine.
NIST also defines key tenets: all authentication and authorization must be dynamic and enforced before access; all communication must be secured regardless of location; access is granted on a per-session basis; and the enterprise continuously collects monitoring data to improve its security posture.
CISA Zero Trust Maturity Model
The Cybersecurity and Infrastructure Security Agency (CISA) maps Zero Trust maturity across five pillars: Identity, Device, Network/Environment, Application/Workload, and Data, at three levels:
• Traditional: Manual configurations, static policies, limited cross-pillar communication.
• Advanced: Some automation, central visibility, and cross-pillar enforcement are beginning to emerge.
• Optimal: Fully automated, dynamic policies, real-time analytics, open standards across all pillars.
This maturity model is invaluable not just for assessing your own organization, but for evaluating how far along your vendors are on their Zero Trust journey: something we'll cover in depth in Blog 14.
The OSI-Inspired ZT/CTPR Model
For Third-Party Risk specifically, a practical framework maps Zero Trust activities across three resource types (Users, Applications, Infrastructure) and four activity columns (Identity, Device/Workload, Access, Transaction). This 3x4 matrix, which we call the ZT/CTPR OSI Model, gives teams a structured, approachable roadmap for implementation.
Key Takeaway: No single framework tells the whole story. Effective Zero Trust programs draw from NIST for architecture, CISA for maturity benchmarking, and purpose-built models for operationalizing third-party risk.
Tags: NIST | CISA | Zero Trust Framework | Maturity Model | Policy
From Third Party Threat Hunting™ (TPTH™)
Put it to work
Privileged access
The free VAULTS™ training: 31 minutes on privileged access review, with a worked review.
Get the free training →Have us run it
Managed third-party threat hunting: practitioners on your systemically critical vendors, automation on the rest.
See the managed tiers →