Zero Trust Maturity Assessment: CISA Framework, Gap Analysis, and Roadmap
Retool's new app builder is where AI-generated code ships safely
Building apps with AI is easy. Getting them to production safely is another story.
The phrase 'zero trust' has become so overloaded that it is nearly meaningless without a specific maturity framework. A vendor claiming their product 'enables zero trust' and an organization claiming they 'have zero trust' are both using the term without architectural accountability. The CISA Zero Trust Maturity Model v2.0 provides a structured scoring methodology that replaces marketing claims with measurable control states. This guide walks through how to run the assessment and what to do with the results.
CISA ZTMM v2.0 Structure: Pillars and Stages
The model defines four maturity stages across five pillars. Traditional: siloed, manual, static controls with implicit trust. Initial: beginning automation and cross-pillar integration, some dynamic policies. Advanced: automated controls, integrated visibility, policy driven by real-time signals. Optimal: fully automated, dynamic policy enforcement with continuous validation and minimal static trust.
Each pillar assessment asks: what visibility do you have, what policies enforce, what automation exists, and how well controls integrate across pillars?
Identity pillar
Evaluates authentication strength, privileged access governance, [identity lifecycle management](/blog/guide-finding-best-identity-access-management-solutions), and identity as a policy enforcement point. Traditional: shared passwords, no MFA, manual provisioning. Optimal: phishing-resistant MFA everywhere, continuous authentication risk scoring, automated just-in-time access with full lifecycle governance.
Devices pillar
Evaluates endpoint compliance enforcement in access decisions, device inventory completeness, configuration management, and patch status validation before access. Traditional: no device posture in access decisions. Optimal: real-time device health feeding Conditional Access, automatic quarantine on deviation, full hardware asset inventory with firmware integrity validation.
Networks pillar
Evaluates [microsegmentation](/blog/network-segmentation-best-practices) depth, network traffic encryption, east-west traffic inspection, and elimination of implicit internal trust. Traditional: flat network, perimeter firewall only, implicit internal trust. Optimal: workload-level microsegmentation, all east-west traffic encrypted and inspected, no implicit trust anywhere in the network fabric.
Applications and Workloads pillar
Evaluates application access gatekeeping (ZTNA vs. VPN), workload identity, API security, and secure software delivery. Traditional: network perimeter protects application access, no workload identity. Optimal: all application access through identity-aware proxy with continuous session validation, workload-to-workload authentication via service mesh, SBOM for all workloads.
Data pillar
Evaluates data classification, encryption in transit and at rest, DLP enforcement, and access governance linked to data sensitivity. Traditional: unclassified data, no DLP, data access governed by network location. Optimal: automated data classification, attribute-based access control enforcing data sensitivity labels, DLP integrated with identity and device posture.
Running the Assessment: Data Collection
The assessment requires inputs from identity management, endpoint management, network architecture, application security, and data governance teams. Budget 3-4 weeks for a thorough evaluation of a mid-size enterprise.
Identity pillar data collection
Collect: MFA enrollment rate and MFA type (SMS, TOTP, FIDO2/passkeys), Conditional Access policy coverage percentage, privileged account count vs. PAM-managed account count, orphaned account discovery rate (accounts not reviewed in 90 days), and federated identity coverage. Interview the IAM team about provisioning automation and deprovisioning SLA.
Devices pillar data collection
Collect: MDM/EMM enrollment coverage as a percentage of total corporate devices, Conditional Access compliant/managed device enforcement rate, vulnerability scanner coverage gap (devices not scanned in 30 days), patch compliance rate for critical patches, and whether device health posture data feeds into access decisions. BYOD vs. corporate device split and whether BYOD is blocked from sensitive data access.
Networks pillar data collection
Collect: flat vs. segmented network zones, whether east-west traffic between zones is inspected, VPN vs. ZTNA usage split for remote access, TLS termination and inspection points, and NetFlow/NDR sensor coverage. Architecture diagrams showing trust boundaries and traffic flows are essential: if they do not exist, that is itself a finding.
Applications pillar data collection
Collect: number of applications with direct network access vs. ZTNA-gated access, application authentication methods (network trust, basic auth, SSO/SAML, MFA-required), API inventory completeness, and whether service accounts have workload identities or share user credentials. Prioritize customer-facing and revenue-critical applications for the initial assessment.
Data pillar data collection
Collect: data classification coverage percentage of structured data stores, DLP policy coverage and enforcement mode (audit vs. block), encryption at rest coverage for databases and file shares, access review cadence for sensitive data stores, and whether data access is tied to identity and device posture or just network location.
Briefings like this, every morning before 9am.
Threat intel, active CVEs, and campaign alerts, distilled for practitioners. 50,000+ subscribers. No noise.
Scoring and Gap Analysis
For each pillar, score each sub-capability as Traditional (0), Initial (1), Advanced (2), or Optimal (3). A pillar score is the average of its sub-capability scores. A total ZTMM score is the unweighted average across all five pillars. Most mid-size enterprises score between 0.5 and 1.5 overall.
Document the evidence for each score: the scoring exercise produces an evidence inventory that becomes the foundation of your remediation tracking.
Building the Prioritized Roadmap
The gap analysis shows where you are; the roadmap shows how to get to Advanced (score 2.0+) across all pillars. Sequence improvements by risk reduction per dollar and speed to implement.
Priority 1: Identity pillar improvements (highest ROI)
Phishing-resistant MFA (FIDO2/passkeys) for all users and especially privileged accounts. Conditional Access enforcement requiring compliant device + MFA for all cloud application access. These address the primary initial access vector (credential compromise) with existing Microsoft Entra ID / Okta capabilities: no new tooling purchase required.
Priority 2: Privileged Access Management
PAM for all privileged accounts: just-in-time elevation, session recording, credential vaulting. This advances the Identity pillar from Initial to Advanced for the most critical accounts and directly addresses post-compromise lateral movement and privilege escalation scenarios.
Priority 3: Network segmentation for crown jewels
Identify the 3-5 most critical data stores and services. Segment them into dedicated VLANs or security groups with explicit allow rules only (deny-all default). East-west traffic to crown jewels should require explicit firewall rules. This advances the Networks pillar for the highest-risk targets without requiring a full microsegmentation deployment.
Priority 4: ZTNA replacement of VPN for remote access
[ZTNA enforces application-level access](/blog/guide-zero-trust-network-architecture) with identity and device posture checks rather than granting network-level access. Replace VPN with a ZTNA solution for remote access to internal applications. This advances both the Networks pillar and the Applications pillar simultaneously and removes the over-privileged network access that VPN provides.
Priority 5: Data classification foundation
The Data pillar cannot advance without a classification foundation. Implement automated classification using Microsoft Purview or an equivalent on primary structured data stores. Even a 3-tier classification (Public, Internal, Confidential) applied automatically enables attribute-based access policies and DLP enforcement.
The bottom line
Most organizations score Traditional or Initial across all five CISA ZTMM pillars. The highest-value starting point is the Identity pillar: phishing-resistant MFA plus Conditional Access enforcement directly addresses the credential compromise vector responsible for over 80% of breaches, and it requires no new tooling purchases for organizations already running Entra ID or Okta. Run the full maturity assessment to quantify the gaps across all five pillars, then sequence investments by risk reduction per dollar starting with identity and working toward network microsegmentation and data classification as the longer-horizon investments.
Frequently asked questions
How long does a zero trust maturity assessment take?
A thorough CISA ZTMM assessment for a mid-size enterprise (2,000-10,000 employees) takes 3-5 weeks: 1-2 weeks of data collection (interviews, tool inventories, architecture review), 1 week of scoring and gap analysis, and 1 week to build the prioritized roadmap. Larger enterprises with complex architectures may take 8-12 weeks. Accelerated assessments can be done in one week by limiting scope to Tier 1 critical systems and sampling rather than full coverage across each pillar.
What is the difference between NIST SP 800-207 and the CISA ZTMM?
NIST SP 800-207 is an architectural reference that defines zero trust principles, logical components (PEP, PDP, PA), and deployment scenarios. It describes what zero trust IS. The CISA Zero Trust Maturity Model v2.0 is an assessment framework that tells you how mature your zero trust implementation IS. NIST 800-207 is the design reference; CISA ZTMM is the scorecard. In practice: use NIST 800-207 when designing your architecture and CISA ZTMM when assessing your current state and tracking progress.
Can a small security team realistically implement zero trust?
Yes, but the scope must be bounded. A small team should focus zero trust principles on the highest-risk access paths: privileged user access, remote access to critical systems, and API access to sensitive data. Phishing-resistant MFA for all users + Conditional Access for cloud applications + PAM for privileged accounts achieves meaningful zero trust progress without requiring enterprise-scale microsegmentation or ZTNA platforms. Zero trust is a philosophy applied incrementally, not a binary state requiring full implementation to deliver value.
Which zero trust pillar should we address first?
The Identity pillar delivers the highest risk reduction per dollar because credential compromise is the primary initial access vector in over 80% of breaches. Strengthening identity (phishing-resistant MFA, Conditional Access, PAM) directly addresses how attackers most commonly get in and how they most commonly escalate privilege. Start there before investing in network microsegmentation, which requires more architecture changes and delivers lower immediate risk reduction for organizations without advanced persistent threats already operating inside their network.
How do we measure zero trust progress after the initial assessment?
Define measurable metrics for each pillar: Identity (MFA enrollment rate, phishing-resistant MFA percentage, Conditional Access coverage), Devices (MDM enrollment rate, compliant device enforcement rate, average time to patch critical CVEs), Networks (percentage of east-west traffic that is inspected, crown jewel segmentation coverage), Applications (percentage of applications gated by ZTNA vs. VPN, SSO coverage), Data (classification coverage rate, DLP enforcement mode). Re-run the CISA ZTMM assessment annually and track ZTMM scores per pillar over time.
Is VPN dead in a zero trust architecture?
VPN is incompatible with zero trust principles: it grants network-level access based on authentication without device posture, application-level policy, or continuous session verification. However, VPN cannot be eliminated immediately. The practical path is to deprecate VPN for application access use cases by replacing it with ZTNA (application-level, identity-and-device-aware access), while keeping VPN only for the infrastructure access use cases that ZTNA cannot handle (server management, network device access). Track the percentage of remote access sessions using ZTNA vs. VPN as your migration metric.
What does a zero trust assessment deliverable look like?
The deliverable has four sections: (1) Executive summary with overall ZTMM score, top 3 findings, and 12-month roadmap investment summary; (2) Pillar-by-pillar scorecard with current stage, target stage, evidence, and score justification; (3) Gap register: every sub-capability scored below target, with root cause and remediation effort estimate; (4) Prioritized roadmap with specific projects, effort/cost estimates, ZTMM score improvement per project, and risk reduction rationale. The roadmap is the primary deliverable that drives budget conversations with leadership.
Sources & references
Free resources
Critical CVE Reference Card 2025–2026
25 actively exploited vulnerabilities with CVSS scores, exploit status, and patch availability. Print it, pin it, share it with your SOC team.
Ransomware Incident Response Playbook
Step-by-step 24-hour IR checklist covering detection, containment, eradication, and recovery. Built for SOC teams, IR leads, and CISOs.
Get threat intel before your inbox does.
50,000+ security professionals read Decryption Digest for early warnings on zero-days, ransomware, and nation-state campaigns. Free, daily, no spam.
Unsubscribe anytime. We never sell your data.
Founder & Cybersecurity Evangelist, Decryption Digest
Cybersecurity professional with expertise in threat intelligence, vulnerability research, and enterprise security. Covers zero-days, ransomware, and nation-state operations for 50,000+ security professionals every morning.
Win a $2,495 Black Hat pass.
Full-access to Black Hat USA 2026 in Las Vegas. Subscribe free to enter.