CPCSC makes zero trust access a control evidence problem

At a glance

What this is: This is an analysis of how CPCSC reframes zero trust access as an evidence and control-mapping problem, with ZTNA positioned around identity, segmentation, logging, and revocation requirements.

Why it matters: It matters because IAM, PAM, and NHI programmes increasingly have to prove not just that access is restricted, but that access decisions are explicit, monitored, and defensible during assessment and incident response.

By the numbers:

• CPCSC is built on ITSP.10.171, which defines 97 controls across 17 families.

Context

CPCSC makes access governance a certification issue, not just a network design choice. The framework expects defence suppliers handling Specified Information to move beyond broad VPN-style access and prove that identity, device posture, segmentation, logging, and revocation are all controlled.

For identity programmes, that shifts the focus from connectivity to evidence. The practical question is no longer whether a user can reach a resource, but whether the organisation can demonstrate explicit authorization, continuous verification, and reliable session termination under assessment.

Key questions

Q: Where does CPCSC-style zero trust fail in practice?

A: It fails when organisations keep treating remote access as a network connection instead of a controllable, auditable identity decision. If the programme cannot show who connected, what they reached, and how access was revoked when conditions changed, it has not created assessable zero trust, only narrower perimeter access.

Q: Why do broad VPN access models create CPCSC evidence gaps?

A: Broad VPN access creates evidence gaps because it hides the real entitlement boundary. Assessors need to see explicit authorization, segmentation, and session termination, while a VPN often shows only that a user joined the network. The larger the implied trust zone, the harder it is to prove least privilege.

Q: What are the signs that a Zero Trust programme is not being enforced consistently?

A: A Zero Trust programme is likely failing when access still depends on trust by location, broad entitlements, or one-time authentication. Other warning signs are unmanaged exceptions, inconsistent policy enforcement across applications and networks, and access that is not clearly tied to identity and context. If teams cannot explain why a request was allowed, the control model is too loose.

Q: What should defence suppliers do first when CPCSC access evidence is weak?

A: Start by mapping each remote access path to a named resource, a specific identity source, and a revocation mechanism. Then verify that logging captures the decision, not just the connection. That sequence reveals whether the programme can actually prove control, which is what CPCSC assessment will test.

Technical breakdown

Identity-driven access control replaces broad network trust

ZTNA changes the access model from network membership to resource-level entitlements. Users, devices, and processes must be identified and authenticated before any connection is permitted, which maps directly to access control and identity and authentication requirements in CPCSC. The technical shift matters because the connection decision is no longer based on where the request originates, but on who or what is requesting access, what posture it presents, and what resource it is allowed to reach.

Practical implication: Map every remote access path to a named identity, an explicit entitlement, and a revocation path.

Segmentation and cloaking reduce the visible attack surface

ZTNA does not merely filter traffic, it hides protected resources from unauthenticated hosts and opens only point-to-point paths to approved destinations. That architecture reduces lateral movement opportunities and aligns with boundary protection and network segmentation controls. In CPCSC terms, the access layer becomes a policy enforcement point, not a shared network fabric, which makes exposure narrower and easier to audit.

Practical implication: Use policy-enforced micro-segmentation to ensure users never join a broad trust zone.

Audit trails turn access sessions into certification evidence

The strongest CPCSC fit is often not the connection itself but the record it leaves behind. ZTNA logs connection attempts, policy decisions, administrative changes, and session outcomes with identity, device, source, target, and timestamp context. That creates assessable evidence for auditability, monitoring, incident response, and configuration governance, provided the logs are protected, forwarded, and retained as authoritative records rather than treated as troubleshooting artefacts.

Practical implication: Treat ZTNA logs as compliance evidence and validate that they survive policy changes and failures.

Threat narrative

Attacker objective: The objective is to exploit overly broad remote access or to operate within it long enough that the organisation cannot clearly prove control, scope, or revocation.

1. Entry occurs through remote access paths that are too broad, too static, or too network-centric to prove who received access and why.
2. Escalation follows when a single connection reaches more resources than the task requires, creating a larger blast radius than the business case justifies.
3. Impact appears as weak auditability, excessive reachable surface, and difficulty proving that access was terminated when conditions changed.

Breaches seen in the wild

• CitrixBleed 2 2025: CitrixBleed 2 leaked NetScaler session tokens from memory, letting attackers hijack VPN sessions and skip MFA at 100+ organisations.
• SonicWall SSL VPN account compromises 2025: Attackers used valid credentials to log in to more than 100 SonicWall SSL VPN accounts across 16 environments in October 2025.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Control evidence is now part of the access control itself: CPCSC turns zero trust access into a proof problem, not just a policy problem. If a defence supplier cannot demonstrate who was allowed in, what they could reach, and when the session ended, the control objective has not been met. Practitioners should treat evidence quality as a first-class part of access design, not a separate audit exercise.

Broad remote access is incompatible with assessable least privilege: The CPCSC model rewards explicit entitlements and narrow reachability, because those are the only conditions that can be shown to an assessor. A VPN that merely connects a user to the network leaves too much implicit, too much shared state, and too much room for undocumented trust. The practical implication is that remote access architecture and certification evidence have to be designed together.

Session control is the real boundary in zero trust programmes: Continuous verification only matters if access can be re-evaluated and revoked while the session still exists. That makes identity context, device posture, and policy enforcement operational controls, not paper controls. For security leaders, this means the session lifecycle is where identity governance becomes measurable.

Identity blast radius is the right named concept for CPCSC-era access design: The article’s underlying shift is that every access decision now needs to account for how far a single identity can move if trust is misplaced. Narrowing identity blast radius is more useful than talking about generic zero trust adoption, because it ties access scope, segmentation, and logging to one assessable outcome. Practitioners should measure how much damage one credentialed session can realistically do.

Continuous monitoring only works when revocation is operationally immediate: CPCSC expects ongoing monitoring and response, not retrospective discovery after exposure has already spread. That makes access revocation, log fidelity, and policy enforcement inseparable. The implication for programmes is that the access layer must be able to express and enforce change at the speed the risk changes.

From our research library:

• 90% of IT leaders say properly managing NHIs is essential for a successful zero-trust implementation, according to the Ultimate Guide to NHIs.
• Read next: Zero Trust Identity Guide

What this signals

Identity blast radius: CPCSC-style certification pushes teams to measure how far one authenticated session can move, not just whether access is technically restricted. The useful design question is how quickly a change in identity, posture, or role can shrink reachable surface before an assessor or attacker does.

For defence suppliers, the more important architectural decision is whether access control produces machine-readable evidence at the same time it grants access. ZTNA becomes useful when it creates an audit trail that survives review, incident response, and configuration drift, not when it merely replaces one remote connectivity layer with another.

For practitioners

• Map CPCSC control families to access evidence Build an access-to-evidence matrix that ties identity, segmentation, logging, and revocation controls to specific CPCSC assessment needs, especially AC, IA, SC, AU, IR, and SI.
• Replace broad VPN trust zones Reduce network reachability to named resources and explicit entitlements so the access layer can prove why each session exists.
• Validate session termination paths Test whether policy, posture, or role changes actually terminate active sessions instead of leaving access alive until logout or timeout.
• Preserve logs as assessment artefacts Forward policy decisions, connection attempts, and administrative actions into tamper-evident logging with retention that survives incident review.
• Prove device and identity context at connection time Require device posture and identity assertions before access is granted so the resulting evidence can stand up during certification review.

Key takeaways

• CPCSC makes access control a verifiable evidence problem, so identity and logging have to be designed together.
• The practical risk is not only exposure, but the inability to prove who could reach what, and when access stopped.
• Programmes that cannot show explicit entitlements, segmentation, and revocation will struggle to satisfy the certification model.

Key terms

• Control Evidence: Control evidence is the record that shows a control exists and is operating as intended. In identity governance, it includes review records, ownership data, entitlement history, and lifecycle actions, all of which must reflect the current environment or the evidence can create false confidence.
• Identity Blast Radius: The amount of damage a compromised identity can cause across systems, data, and infrastructure. In NHI environments, it is shaped by permissions, network reach, and administrative capability rather than by the credential alone. Reducing blast radius is a containment strategy that limits lateral movement and data exposure.
• Continuous Verification: A Zero Trust practice that re-evaluates trust during the session instead of relying on a single successful login. The control is stronger when context signals are available in real time and when the identity programme can act on those signals without creating excessive exceptions.
• Session revocation: The ability to invalidate active sessions so access ends immediately instead of waiting for tokens or browser state to expire. For identity governance, this is the control that determines whether authentication still matters after a compromise is detected.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.