This is an older essay or practical note. Its reference date is retained from the original entry; use current vendor guidance for product versions and security updates.
A device being on the office network is not enough reason to let it reach a sensitive resource. Zero trust makes the access decision explicit and ties it to the resource being requested.
Technical notes checked against the linked primary sources on 6 October 2026. The original reference date is retained above.
Begin with the resource, identity, and policy
NIST SP 800-207 removes implicit trust based solely on network location or device ownership. Authentication and authorisation occur before a resource session is established. A corporate laptop or a VPN connection is an input to the assessment, not a blanket access grant.
Know where the decision is enforced
NIST's logical model separates three roles: a policy engine decides whether access is allowed, a policy administrator implements that decision, and a policy enforcement point enables, monitors, or ends the resource connection. Implementations may combine components. SP 800-207, section 3.
Segmentation supports the policy
Micro-segmentation can restrict unnecessary paths, but a VLAN or firewall rule alone does not establish a complete zero trust architecture. NIST describes identity-driven, micro-segmentation, and network-based approaches. Its model also recognises risks such as compromise of the decision components. SP 800-207, sections 3.1 and 5.
A small design example
Consider a support application: a support role needs its customer records, while a reporting job needs a limited database view. Write separate access policies for those identities and resources, then test that each can complete its task and cannot take an unintended path. This is an illustrative design exercise, not a claim that segmentation guarantees containment.
Use a maturity model to plan the work
CISA's version 2 model organises progress around Identity, Devices, Networks, Applications and Workloads, and Data. It describes four stages: Traditional, Initial, Advanced, and Optimal. The model was prepared for federal agencies, and CISA also encourages other organisations to review it. CISA's model announcement.
A practical review can ask who owns each identity, what device state is available, which paths are needed, how application access is enforced, and what data each role requires. Track specific gaps and test cases instead of treating a product purchase as completion.
Measure a pilot before expanding
Start with one workflow. Record successful and denied access tests, exceptions, logs, and user impact. Test access revocation and a policy-service outage as well as ordinary logins. Those results make the next design decision concrete.