Federal and defense suppliers
Your agency or prime contractor is moving to Zero Trust under OMB M-22-09 or the DoD strategy and is asking how your systems will fit. You need a credible maturity baseline and a plan that speaks their language.
Risk & security programs
Zero Trust architecture assessment
Your leadership, a federal customer or your insurer is asking about Zero Trust, and every vendor you talk to says their product delivers it. A Zero Trust architecture assessment shows you, pillar by pillar, where your identity, device, network, application and data controls really stand, and gives you a target architecture and roadmap that use the tools you already own wherever they can do the job.
Formal outcome from
No one — no standards body certifies an organization as Zero Trust
Who asks for it
Federal and defense customers · Boards and CIOs
Our role
Readiness — we help you build it and prove it
Your organization — readiness viewEvery requirement, an owner and its evidence
Readiness- SCOPEScope and system boundaryReady
- RISKRisk assessment and registerReady
- ACCESSAccess reviews, with evidenceGap · owner set
- CHANGEChange managementClosing
- VENDORVendor managementGap · owner set
- TESTPenetration test evidenceReport in hand
Handed to the assessor you choose — the opinion is theirs
Gaps found before the audit
Who it’s for
Why Zero Trust lands on your desk.
Zero Trust is an architecture principle, not a product: no user, device or network location is trusted by default, and every request for a resource is authenticated, authorized and evaluated against policy using as much context as you can gather. NIST SP 800-207 defines the tenets and the core logical components (a policy engine and policy administrator that make access decisions, and policy enforcement points that carry them out) and describes deployment approaches built on enhanced identity governance, micro-segmentation and software-defined perimeters.
The CISA Zero Trust Maturity Model turns those ideas into something you can measure. It organizes the work into five pillars (identity, devices, networks, applications and workloads, and data) plus three cross-cutting capabilities: visibility and analytics, automation and orchestration, and governance. Each is described across four maturity stages, from Traditional through Initial and Advanced to Optimal. Federal agencies work to OMB M-22-09 and the Department of Defense to its own Zero Trust strategy, and those expectations flow down to contractors and their suppliers.
Organizations come to a Zero Trust assessment because the term became a requirement on paper before anyone defined what it means for them. Some have bought a ZTNA product and want to know what is still missing; others need to answer a federal customer, a board or an insurer with more than a slide. You get an honest current-state baseline, a target that fits your business and risk, and a roadmap ordered by dependency, not a shopping list.
Who asks for it
Federal and defense customersBoards and CIOsCyber insurersEnterprise security reviews
Security leaders with a mandate
Leadership said “Zero Trust” and handed you the job. You need to turn the slogan into a defined target state, clear priorities and a roadmap you can fund and defend.
Companies that outgrew the perimeter
Remote work, SaaS and multi-cloud workloads mean your VPN and flat internal network no longer describe how people reach your data. You need to know where implicit trust still exists and what should replace it.
Teams partway through a rollout
You already have an identity provider, strong MFA or a ZTNA product in place and want an independent read on what is working, what is missing and what should come next.
Who certifies
No certificate exists. The proof is yours to build.
Formal outcome from
No one — no standards body certifies an organization as Zero Trust
What they produce
A current-state maturity baseline against the CISA model and a target architecture and roadmap that are yours to carry out
Where readiness fits
Products can advertise Zero Trust features, but no authority certifies an organization’s architecture. Readiness gives you an independent, product-neutral picture of where you stand and what to do next.
NIST SP 800-207 — Zero Trust Architecture NIST SP 800-207A — Zero Trust Architecture Model for Access Control in Cloud-Native Applications in Multi-Location Environments CISA Zero Trust Maturity Model, Version 2.0 OMB Memorandum M-22-09 — Moving the U.S. Government Toward Zero Trust Cybersecurity Principles DoD Zero Trust Strategy and DoD Zero Trust Reference Architecture NIST SP 1800-35 — Implementing a Zero Trust Architecture (NCCoE) NIST SP 800-63 — Digital Identity Guidelines NIST Cybersecurity Framework (CSF) 2.0
What it covers
What Zero Trust readiness covers.
- Identity: phishing-resistant MFA, single sign-on coverage, identity governance, privileged access and the lifecycle of non-human and service accounts
- Devices: inventory, endpoint detection and response, and whether device health and compliance signals are used in access decisions
- Networks: segmentation and micro-segmentation, encryption of internal traffic, remaining flat networks and dependence on VPN
- Applications and workloads: how access to applications is brokered, application-level authorization, and workload-to-workload trust in cloud and containers
- Data: discovery, classification, labeling, encryption and data loss prevention tied to who may access what
- Visibility and analytics: centralized logging, user and entity behavior signals, and whether telemetry actually informs access decisions
- Automation and orchestration: automated policy enforcement and response, and how access is revoked when risk changes
- Governance: Zero Trust policy, ownership, exception handling and how progress is measured
- Policy decision and enforcement points mapped against the NIST SP 800-207 logical architecture
- An inventory of implicit trust: where network location, shared credentials or legacy protocols still grant access by default
- Legacy and operational technology that cannot support modern authentication, and compensating approaches for it
- Third-party, contractor and vendor support access paths
- Current-state maturity scoring across the CISA pillars and cross-cutting capabilities
- Target-state architecture and a prioritized roadmap tied to business risk and existing investments
What you receive
What you have in hand when readiness is done.
Current-state maturity assessment
A pillar-by-pillar rating against the CISA Zero Trust Maturity Model, with the evidence behind each rating so the baseline can be revisited and compared later.
Implicit-trust map
The places where access is still granted because of network location, shared credentials or legacy protocols, ranked by the data and systems they expose.
Target-state architecture
A reference design for your environment showing identity sources, policy decision and enforcement points and telemetry flows, aligned to NIST SP 800-207.
Prioritized roadmap
Initiatives ordered by risk reduction and dependency, so identity and device foundations come before the network and application policies that rely on them.
Tooling fit analysis
Which products you already own can meet each capability, where configuration rather than purchase closes the gap, and where something genuinely new is needed.
Zero Trust policy and standards
Draft governance documents (an access control policy, a segmentation standard and an exception process) for your leadership to approve.
Executive briefing
A plain-language summary for the board, the CIO or a federal customer that explains where you are, where you are going and why.
Common gaps
What a Zero Trust readiness review tends to surface.
Better found now, by people on your side, than by your assessor.
Multi-factor authentication that is broad but not phishing-resistant, or that exempts administrators and service accounts
Flat internal networks where any authenticated device can reach critical systems
VPN access that grants network-level trust as soon as a user connects
Device health signals collected but never used to allow or deny access
Service accounts and API keys with standing, broad privileges and no named owner
No data classification, so access policy cannot tell sensitive data from everything else
Logs collected but not correlated, leaving no basis for continuous verification
A ZTNA product protecting some applications while legacy access paths stay open beside it
Where testing fits
The tests Zero Trust calls for, from the same team.
Internal network pentest
Shows how far an attacker can move laterally today, the clearest measure of how much implicit trust remains inside your network.
What the test coversNetwork segmentation test
Verifies that the segmentation and micro-segmentation in your target architecture actually block the traffic they are meant to block.
What the test coversCloud configuration review
Checks identity policies, network controls and workload trust in your cloud accounts against the least-privilege model Zero Trust depends on.
What the test coversRed team engagement
Tests the architecture as a whole against a goal-driven adversary, including identity attacks designed to slip past individual controls.
What the test coversSocial engineering
Puts phishing-resistant MFA, help-desk identity verification and user reporting to the test against the attacks they exist to stop.
What the test covers Questions
What buyers ask about Zero Trust.
Can we buy Zero Trust?
No. Products provide important capabilities, such as an identity provider, ZTNA, endpoint detection or micro-segmentation, but Zero Trust is the way those capabilities are combined and governed so that every access decision is explicit and based on context. Many organizations find they already own much of what they need and have not configured it to enforce policy. The assessment is product-neutral and judges each tool by the capability it actually delivers in your environment.
Which model should we measure against?
NIST SP 800-207 defines what a Zero Trust architecture is; the CISA Zero Trust Maturity Model provides the most widely used maturity scale and is the natural choice for most US organizations. Defense suppliers may also need to align to the DoD Zero Trust strategy and reference architecture, which organize the work into seven pillars. Your assessment can report against more than one model.
Is Zero Trust required for federal contractors?
OMB M-22-09 directs federal agencies rather than contractors, but agencies are applying the same principles to the systems and services they buy, and DoD expects its industrial base to support its Zero Trust goals. NIST SP 800-171 and CMMC do not require Zero Trust by name, yet many of their access control, identification and authentication, and system and communications protection requirements are Zero Trust building blocks.
Do we have to reach “Optimal” in every pillar?
No. The CISA model expects organizations to progress at different rates across pillars, and the right target depends on your risk, your data and your budget. Many organizations aim higher in identity and data, where the payoff is largest, and accept lower maturity elsewhere for now. The roadmap you receive records those choices and the reasons behind them.
Where should we start?
Almost always with identity: a complete inventory of human and non-human accounts, phishing-resistant MFA, and single sign-on in front of the applications that matter. Device visibility and data classification usually come next, because network and application policies depend on them. Your roadmap orders the work by dependency and risk rather than by product category.
How does this relate to a penetration test?
The assessment looks at architecture and maturity; a penetration test shows what an attacker can actually do. They work best together. Testing reveals where implicit trust exists in practice, the roadmap tells you how to remove it, and retesting after major roadmap milestones shows whether the changes did what you intended.
Is Zero Trust on your desk?
One conversation with someone who does this work. You leave knowing where you likely stand and what readiness would involve for you.