Topic starter
02/08/2026 12:26 pm
TL;DR: Zero Trust has moved from a federal mandate to a broader governance expectation, with CISA’s Zero Trust Maturity Model framing identity, devices, networks, workloads, and data as measurable pillars for resilience according to Abstract Security. The practical challenge is no longer defining Zero Trust, but proving that identity, access, and control decisions can be operationalised continuously across hybrid environments.
Editorial analysis by NHI Mgmt Group, based on content published by Abstract Security: “C2 Corner: From Mandate to Maturity”.
Key questions
Q: What breaks when Zero Trust is treated only as a technical project?
A: Controls become harder to adopt, exceptions multiply, and application owners see the programme as an obstacle rather than a shared operating model.
Q: What is the relationship between IAM maturity and Zero Trust?
A: IAM maturity is the foundation of Zero Trust because the architecture depends on accurate identity data, current entitlements, and reliable verification signals.
Q: What are the signs that a zero trust rollout is failing in practice?
A: Common warning signs include overlapping tools that do not integrate well, inconsistent policy enforcement across environments, weak visibility into asset and transaction flows, and users bypassing controls because processes are too cumbersome.
Practitioner guidance
- Baseline Zero Trust against maturity stages Map current identity, device, network, workload, and data controls to a maturity model and document where enforcement still depends on trust by default.
- Start with the protect surface Limit the first phase to crown-jewel applications, privileged accounts, and sensitive data paths so that policy scope remains measurable and defensible.
- Enforce phishing-resistant identity decisions Move beyond basic MFA by tying access to verified identity, device posture, and session context before granting or sustaining access.
Bottom line: Zero Trust maturity is becoming a governance baseline because organisations are expected to show how identity, device, workload, and data controls work together in practice.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
02/08/2026 1:25 pm
Zero Trust maturity has become an IAM governance baseline, not a specialist architecture choice. The article shows that organisations are now being judged on whether identity decisions can be measured, enforced, and adapted continuously. That shifts the centre of gravity from authentication events to governance over runtime access conditions. For practitioners, Zero Trust maturity now needs to be treated as part of the identity operating model, not a side project.
A few things that frame the scale:
- 90% of IT leaders say properly managing NHIs is essential for a successful zero-trust implementation, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: Should organisations prioritise protect-surface design before expanding Zero Trust estate-wide?
A: Yes. Starting with the most valuable applications, identities, and data paths gives teams a manageable way to define policy, measure improvement, and prove that controls work under real operating conditions. Estate-wide programmes often stall because they try to solve every trust problem at once, which makes maturity impossible to evidence.
👉 Read our full editorial: Zero trust maturity is becoming an IAM governance baseline