Zero trust has spent years as a marketing phrase attached to products ranging from identity software to network gateways. Its durable meaning is more demanding. It is an operating model in which access to a resource is based on explicit, current evidence about the user, device, workload, and context—not on the assumption that anything inside a corporate network is safe. That shifts security from a one-time perimeter decision to a continuing management process.
NIST’s foundational 2020 architecture states that “trust is never granted implicitly but must be continually evaluated.” It assumes no automatic trust based solely on physical location, network location, or ownership of a device. Authentication and authorization happen before a session to a resource is established, and access is narrowed to what is required (NIST). Zero trust does not mean distrusting every employee; it means reducing the technical privileges that follow from an unverified assumption.
The model fits how organizations now work. Staff connect from homes and partner sites, applications span several clouds, software services communicate with one another, and contractors may use managed or personal devices. A firewall around an office cannot express all of those relationships. An attacker who obtains one credential or compromises one endpoint can exploit broad internal access. Resource-level decisions and segmentation are intended to limit that lateral movement.
CISA’s Zero Trust Maturity Model turns the concept into five pillars: identity, devices, networks, applications and workloads, and data. It adds three capabilities across them—visibility and analytics, automation and orchestration, and governance—and describes progress from traditional to optimal practice (CISA). The structure makes clear why buying a single zero-trust product cannot complete the transition. An identity decision is only as good as device signals, application policy, data classification, and the logs used to review it.
Implementation usually begins with identity because it is a common control point. Organizations can require phishing-resistant multifactor authentication, consolidate identity stores, shorten standing privileges, and separate administrator accounts. Device posture can then inform access: Is the endpoint managed, encrypted, patched, and free of known compromise? Applications need consistent authorization, service identities, and secrets management. Networks still matter, but segmentation and encrypted flows support resource policy rather than defining trust by location.
Data is often the hardest pillar. Teams cannot enforce granular access or detect unusual movement if they do not know where sensitive information resides, who owns it, and which workflows require it. Classification projects that attempt to label everything before protecting anything can stall. A practical program starts with a few high-consequence resources, maps their users and dependencies, then expands. Policies should include emergency access and degraded operation so stronger controls do not become a new source of operational fragility.
The federal government has supplied a useful test of ambition and execution. OMB’s 2022 strategy directed civilian agencies toward specific zero-trust goals by the end of fiscal 2024, and CISA continues to frame its model as a roadmap rather than a compliance checklist (CISA). At the Defense Department, a June 2025 GAO review found that 20 of 24 major business programs reported implementing zero trust in their security frameworks, while four lacked plans for the department’s 2027 deadline (GAO). The gap illustrates that mandates do not erase legacy systems, fragmented ownership, or planning constraints.
Technical guidance is becoming more concrete. In 2025, NIST published a practice guide built from 19 example zero-trust implementations using commercial technologies, mapping their capabilities to other NIST frameworks (NIST). The variety is a strength: organizations can combine policy engines, identity systems, endpoint signals, microsegmentation, and software-defined perimeters in different ways. It also means buyers need an architecture and test cases before evaluating vendor claims.
Measurement should focus on security outcomes and operational quality. Useful indicators include the share of high-value resources behind explicit policy, privileged accounts using phishing-resistant authentication, unmanaged devices blocked or restricted, time to revoke access, lateral paths removed, and policy exceptions aging past review dates. Login prompts alone are a poor proxy; excessive friction encourages workarounds, while invisible continuous signals can improve both security and user experience.
Zero trust is finally becoming ordinary work: inventorying resources, improving identity, segmenting dependencies, collecting reliable telemetry, and governing exceptions. It will never be a finished state because users, devices, applications, and risks keep changing. That is precisely why it works better as an operating model than a slogan.