Topic starter
12/07/2026 12:23 pm
TL;DR: CISA’s updated Zero Trust Maturity Model now places Identity first, linking least privilege, continuous visibility, and policy automation to practical maturity rather than a destination, according to SentinelOne. That shift makes identity governance the control plane for NHI, human access, and emerging autonomous behaviour, not a side effect of network segmentation.
Editorial analysis by NHI Mgmt Group, based on content published by SentinelOne: “New CISA Zero Trust Updates Confirm Identity’s Central Role”.
Key questions
Q: How should teams benchmark Zero Trust maturity when identity is the first pillar?
A: Benchmark maturity by whether identity signals drive real enforcement across people, devices, workloads, and data, not by whether Zero Trust is mentioned in policy.
Q: Why does least privilege break down when identity visibility is incomplete?
A: Least privilege depends on knowing which entitlements exist, where they are used, and when they drift from intended scope.
Q: What are the signs that identity controls are not supporting zero trust as intended?
A: Common signs include accounts not using MFA, service accounts being reused for user access, identity stores outside admin control, and assets being accessed through paths that bypass ZTNA or PAM policy.
Practitioner guidance
- Align identity controls to Zero Trust maturity stages Map current identity, device, workload, and data controls to Traditional, Advanced, or Optimal maturity so gaps are visible in business terms.
- Inventory entitlements across directories and cloud Build a consolidated view of permissions, overprovisioned entitlements, and orphaned credentials across Active Directory, Azure AD, cloud IAM, and endpoint stores.
- Automate policy decisions for drift-prone access Use observed triggers, entitlement changes, and risk signals to drive step-up, denial, or revocation without waiting for the next review cycle.
Bottom line: Identity-first Zero Trust makes maturity a governance problem, not a perimeter problem, because access decisions now depend on continuous identity visibility.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
12/07/2026 12:36 pm
Identity maturity now defines Zero Trust maturity: CISA’s decision to place Identity first is not a cosmetic reorder. It reflects a structural reality that access decisions, entitlement scope, and continuous verification are the core of Zero Trust, while network segmentation is only one enforcement layer. For IAM and NHI teams, that means maturity scoring must start with whether identity is observable and governable across the full access path.
A few things that frame the scale:
- 90% of IT leaders say properly managing NHIs is essential for a successful zero-trust implementation, according to the Ultimate Guide to NHIs.
- Systems with least-privileged AI access had a 17% incident rate vs 76% for over-privileged systems. Organisations failing to scope AI access properly are 4.5x more likely to experience a security incident, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: Should organisations prioritise identity governance before micro-segmentation in Zero Trust?
A: In most hybrid and cloud-first environments, yes. Identity governance addresses who gets access and whether that access still makes sense, while segmentation mainly constrains where traffic can go. If the underlying identity model is weak, segmentation often just contains bad access rather than preventing it.
👉 Read our full editorial: Identity-first zero trust is reshaping least privilege maturity