Zero Trust Architecture in Federal and National Policy

Zero Trust Architecture (ZTA) represents a foundational shift in how federal agencies and regulated sectors approach network security — moving from perimeter-based defenses to continuous verification of every access request regardless of source location. This page covers the regulatory mandates, technical frameworks, operational scenarios, and decision boundaries governing ZTA adoption across federal civilian agencies, the Department of Defense, and critical infrastructure sectors. The policy landscape has been shaped by a sequence of executive directives, NIST standards, and agency-specific implementation guidance that together define enforceable obligations for federal contractors and operators.

Definition and scope

Zero Trust Architecture is defined by NIST Special Publication 800-207 as a set of cybersecurity principles under which no implicit trust is granted to assets or user accounts based solely on their physical or network location. The architecture assumes that threats exist both inside and outside traditional network boundaries, requiring continuous authentication, authorization, and validation before granting access to any resource.

The scope of ZTA in federal policy extends across three distinct tiers:

1. Federal Civilian Executive Branch (FCEB) agencies — governed by the Federal Information Security Modernization Act (FISMA) and Office of Management and Budget (OMB) memoranda, including OMB M-22-09, which establishes specific ZTA maturity targets for FCEB agencies by fiscal year 2024.
2. Department of Defense (DoD) components — subject to the DoD Zero Trust Strategy published in 2022, which outlines 91 capability activities organized into seven pillars.
3. Critical infrastructure operators — addressed through sector-specific guidance from the Cybersecurity and Infrastructure Security Agency (CISA) and cross-sector critical infrastructure protection standards.

ZTA is not a single product or platform but an architectural philosophy operationalized through policy, technology, and process controls.

How it works

ZTA implementation follows a structured progression through five functional pillars identified in the CISA Zero Trust Maturity Model (version 2.0, published April 2023):

1. Identity — Every user, device, and service principal must be authenticated using strong, phishing-resistant credentials. Federal policy under OMB M-22-09 mandates phishing-resistant multi-factor authentication (MFA) across FCEB agencies.
2. Devices — Endpoints must be inventoried, validated against compliance baselines, and continuously monitored. NIST SP 800-207 differentiates between agent-based and agentless device trust models.
3. Networks — Micro-segmentation replaces broad network zones; traffic flows are encrypted end-to-end regardless of whether they traverse internal or external infrastructure.
4. Applications and workloads — Access to individual applications is granted per-session based on dynamic policy evaluation, not standing network access. This is contrasted with legacy VPN models, where network access implicitly conferred application access.
5. Data — Data classification, access controls, and logging are implemented at the data layer, independent of the system hosting the data.

The CISA maturity model rates agency posture across four levels — Traditional, Initial, Advanced, and Optimal — enabling benchmarking against federal baseline requirements. Agencies self-assess and report posture to OMB under the annual FISMA reporting cycle. The NIST Cybersecurity Framework provides a complementary risk-management overlay that maps to ZTA controls.

Common scenarios

Federal agency network modernization — Under OMB M-22-09, FCEB agencies are required to reach specific ZTA milestones across all five pillars. A civilian agency migrating from a hub-and-spoke VPN model to a cloud-delivered Secure Access Service Edge (SASE) architecture represents a typical ZTA transition scenario. The agency must inventory all identities, enforce MFA, deploy endpoint detection tools, and establish application-level access controls before achieving CISA's "Advanced" tier.

DoD contractor compliance — Defense contractors accessing Controlled Unclassified Information (CUI) face ZTA-aligned requirements through the Cybersecurity Maturity Model Certification (CMMC) program, which incorporates access control and audit requirements drawn from NIST SP 800-171. The DoD Zero Trust Strategy's 91 activities include contractor-facing obligations for systems that interconnect with defense networks.

Cloud-hosted systems — The Federal Risk and Authorization Management Program (FedRAMP) authorization baseline for cloud service providers incorporates ZTA-relevant controls. Agencies migrating workloads to FedRAMP-authorized clouds must map cloud provider controls to their ZTA architecture documentation. See cloud security national standards for FedRAMP baseline alignment detail.

Operational Technology environments — ZTA implementation in industrial control systems and operational technology networks requires adaptation of the standard five-pillar model. CISA's guidance acknowledges that OT/ICS environments may not support agent-based device authentication, requiring compensating controls. This is addressed further in OT/ICS cybersecurity reference material.

Decision boundaries

The primary classification boundary in federal ZTA policy separates FCEB agencies, which carry mandatory implementation obligations under OMB M-22-09, from non-FCEB entities (state governments, private sector, critical infrastructure operators), for which ZTA adoption is strongly encouraged but not federally mandated as of the 2022 DoD strategy publication date.

A second boundary separates ZTA target architecture (the end-state design goal) from ZTA maturity level (current operational posture). Agencies may be required to produce a ZTA target architecture while still operating at the "Initial" maturity level — these are distinct compliance obligations.

A third boundary governs classified versus unclassified systems. OMB M-22-09 applies to unclassified federal systems. Classified national security systems (NSS) operate under separate authorities issued by the Committee on National Security Systems (CNSS) and the National Security Agency (NSA), and are not governed by the same OMB memorandum. The federal cybersecurity agencies reference covers the jurisdictional split between CISA (FCEB) and NSA (NSS) in detail.

The cybersecurity executive orders page traces the policy sequence from Executive Order 14028 (May 2021) through subsequent OMB and CISA implementation directives that formalized ZTA as a federal requirement.

References

• NIST SP 800-207: Zero Trust Architecture
• OMB Memorandum M-22-09: Moving the U.S. Government Toward Zero Trust Cybersecurity Principles
• CISA Zero Trust Maturity Model, Version 2.0
• DoD Zero Trust Strategy (2022)
• Federal Information Security Modernization Act (FISMA) – CISA Overview
• FedRAMP Program Overview – GSA
• NIST SP 800-171: Protecting CUI in Nonfederal Systems