Zero Trust

IT environments require robust defenses to reduce risk to the cyber and physical infrastructure Americans rely on every day. Driving zero trust (ZT) progress is an important part of CISA's mission of operational collaboration and information sharing.

Adopting ZT principles addresses many of the challenges of the dynamic threat landscape. Specifically, ZT improves visibility, enabling organizations to detect and understand threats more effectively. ZT also facilitates orchestration and automation, allowing for rapid and coordinated threat response.

What Zero Trust Means for Cybersecurity

ZT principles assume the entire network is compromised. That point of view provides a collection of concepts and ideas designed to minimize uncertainty by enforcing precise, least privilege per-request access decisions within information systems and services. The goal is to prevent unauthorized access to data and services and make access control enforcement as granular as possible. ZT presents a shift from a location-centric to a data-centric adaptive approach for fine-grained security controls between users, systems, data, and assets that change over time.

Building Zero Trust Capacity

Since the release of CISA's Zero Trust Maturity Model version 1.0 in September 2021, the agency has been working to accelerate adoption of ZT across the federal enterprise. CISA collaborates with government, commercial, and private sector partners—including global security leaders—to understand key ZT implementation roadblocks and to develop strategies and solutions to address these challenges.