NIST SP 800-207: Zero Trust Architecture, explained

Zero Trust Architecture (ZTA) is the security model defined in NIST Special Publication 800-207, published in August 2020 by NIST's Scott Rose and Oliver Borchert together with Stu Mitchell and DHS's Sean Connelly. The document states that zero trust moves protective measures "from static, network-based perimeters to focus on users, assets, and resources," replacing the older assumption that anything inside a network perimeter can be trusted by default. Instead, ZTA requires that "authentication and authorization (both subject and device) are discrete functions performed before a session to an enterprise resource is established" — every request is evaluated on its own merits, regardless of where it originates.

The seven tenets

Section 2.1 of SP 800-207 lists seven tenets that define the zero trust approach:

#	Tenet
1	All data sources and computing services are considered resources.
2	All communication is secured regardless of network location.
3	Access to individual enterprise resources is granted on a per-session basis.
4	Access to resources is determined by dynamic policy — including the observable state of client identity, application/service, and the requesting asset.
5	The enterprise monitors and measures the integrity and security posture of all owned and associated assets.
6	All resource authentication and authorization are dynamic and strictly enforced before access is allowed.
7	The enterprise collects as much information as possible about the current state of assets, network infrastructure and communications.

These are deliberately framed as an "ideal," not a single product configuration: SP 800-207 presents them as the goal a ZTA implementation moves toward, acknowledging that most enterprises will operate a hybrid of zero trust and legacy perimeter-based access for some time.

Three logical components make the access decision

SP 800-207 describes a ZTA's control plane as three logical components:

Component	Role
Policy Engine (PE)	"Responsible for the ultimate decision to grant access to a resource for a given subject." Uses enterprise policy plus input from external sources (identity management, threat intelligence, SIEM data) to compute a trust score or confidence level.
Policy Administrator (PA)	"Responsible for establishing and/or shutting down the communication path between a subject and a resource" — it executes the PE's decision by generating any session-specific credential or token the client uses to access the resource.
Policy Enforcement Point (PEP)	"Responsible for enabling, monitoring, and eventually terminating connections between a subject and an enterprise resource." This is the single logical component that sits in the data path itself; it may be split into client-side and resource-side parts.

Four ways to deploy a ZTA

SP 800-207 does not mandate one architecture — it describes four general approaches an enterprise can combine:

1. Device agent/gateway-based deployment — an agent on the client device coordinates with a gateway that acts as the PEP in front of each resource.
2. Enclave-based deployment — a gateway PEP sits in front of a group of resources (an enclave) rather than each resource individually, useful for legacy systems that cannot support their own agent.
3. Resource portal-based deployment — a single portal acts as the PEP for a class of resources, avoiding the need for a client-side agent, at the cost of more limited visibility into client device state.
4. Device application sandboxing — resource access happens through an isolated application or sandbox on the client device, isolating it from other processes that have not been separately authorized.

CISA's Zero Trust Maturity Model: a related, separate document

NIST's SP 800-207 defines the architecture; it does not tell an organization how mature its own implementation is or prioritize what to build first. CISA's Zero Trust Maturity Model (version 2.0, published April 2023) fills that gap for US federal civilian agencies, and CISA's own resource page states it aligns to OMB memorandum M-22-09. It organizes the same underlying concept into five pillars plus three cross-cutting capabilities, each scored across four maturity stages:

Pillar / capability
Identity, Devices, Networks, Applications and Workloads, Data	the five pillars
Visibility and Analytics, Automation and Orchestration, Governance	the three cross-cutting capabilities

Stage	CISA's description
Traditional	Manually configured lifecycles and attributes; static security policies; siloed pillars; manual response.
Initial	Starting automation of attribute assignment, configuration and enforcement; initial cross-pillar integration.
Advanced	Automated lifecycle and configuration controls with cross-pillar coordination; centralized visibility and identity control.
Optimal	Fully automated, just-in-time lifecycles; dynamic least-privilege access; cross-pillar interoperability with continuous monitoring.

CISA's model is specific to the US federal civilian executive branch; it is not a legal requirement for device makers, OT asset owners or software vendors elsewhere, though both documents are widely cited as the reference vocabulary for "zero trust" regardless of sector.

Where this fits for device and firmware teams

ZTA was written with enterprise IT networks in mind, not embedded devices, but its tenets translate directly to device fleets and industrial networks: per-session (not per-perimeter) authentication for every device-to-service connection, continuous posture checks rather than a one-time boot-time trust decision, and dynamic policy that can react to a device's observed state — exactly the kind of evidence a firmware security assessment or passive OT network snapshot produces.

SoftWSP's device and firmware assessments produce the kind of per-asset posture evidence (firmware version, exposed services, known CVEs) a Policy Engine needs as an input, rather than a one-time compliance checkbox: see device firmware security.

This guide summarises public NIST and CISA publications; it does not constitute legal or compliance advice.