Notifications
Clear all
Topic starter
11/07/2026 1:58 pm
TL;DR: The NSA’s Zero Trust Implementation Guidelines translate Zero Trust into 91 measurable activities across discovery, identity, segmentation, visibility, and automation, while the article says 88% of CISOs still struggle to implement it and 90% of security leaders see it as central to security posture, according to Zero Networks. The real issue is not Zero Trust intent, but the gap between policy language and enforceable operational controls.
NHIMG editorial — based on content published by Zero Networks: Implementing Zero Trust: How to Operationalize NSA Guidelines
By the numbers:
- 88% of CISOs have experienced significant challenges in their Zero Trust implementation attempts.
Questions worth separating out
Q: How should security teams operationalize Zero Trust beyond the login screen?
A: They should enforce access decisions at every meaningful connection point, not only during authentication.
Q: Why do IAM programmes struggle when Zero Trust is applied only at the perimeter?
A: Because the main risk often appears after initial access, not before it.
Q: What do security teams get wrong about segmentation in Zero Trust?
A: They often treat segmentation as a network design exercise instead of an identity and governance control.
Practitioner guidance
- Tie access decisions to live identity context Enforce privileged and sensitive-path authorisation at the point of use, not only at login.
- Remove implicit internal trust from east-west traffic Treat internal application and workload communication as explicitly governed access.
- Map segmentation boundaries to business-critical blast radius Identify which identities, workloads, and services must never share the same reachability zone.
What's in the full article
Zero Networks' full article covers the operational detail this post intentionally leaves for the source:
- Step-by-step mapping of NSA Zero Trust Implementation Guidelines activities to identity and network controls
- The article’s table of ZIG domains, including how the vendor maps enforcement, visibility, automation, and incident response
- Practical examples of how identity-aware microsegmentation and just-in-time MFA are positioned in real environments
- The vendor’s implementation framing for reducing standing access and managing east-west traffic at scale
👉 Read Zero Networks' breakdown of the NSA Zero Trust Implementation Guidelines →
NSA Zero Trust guidelines: what they mean for IAM teams?
Explore further
11/07/2026 2:08 pm
Zero Trust only becomes real when identity governs reachability. The article correctly shifts focus from policy declarations to enforcement points, which is where many programmes fail. If internal access still inherits trust from the network, the organisation has a documentation exercise, not a Zero Trust architecture. Practitioners should treat reachability as an identity decision, not a routing convenience.
A few things that frame the scale:
- 79% of organisations have experienced secrets leaks, with 77% of these incidents resulting in tangible damage, according to the Ultimate Guide to NHIs.
- 71% of NHIs are not rotated within recommended time frames, which keeps stale credentials in circulation longer than most governance teams realise.
A question worth separating out:
Q: Who is accountable when Zero Trust controls fail to stop lateral movement?
A: Accountability sits with the teams that own the control points where internal access is approved, enforced, and monitored. In practice that usually spans IAM, network security, and platform operations. If those groups are siloed, the failure is structural rather than purely technical.
👉 Read our full editorial: NSA Zero Trust guidelines expose the operational gap in ZT
