Topic starter
22/01/2026 2:52 pm
TL;DR: NIST SP 1800-35 shows that Zero Trust can be implemented in practice, but its example architectures still depend on periodic checks, provisioned access, and fragmented policy decisions, according to SGNL’s analysis of the guide. The real governance gap is not proving ZTA works, but making identity decisions continuous, contextual, and ephemeral enough for NHI and agentic environments.
Editorial analysis by NHI Mgmt Group, based on content published by SGNL: “Exceed NIST 1800-35âs Zero Trust demonstrations with continuous, context-aware identity”.
By the numbers:
- NIST SP 1800-35 includes 19 distinct Zero Trust Architecture implementation examples.
- The guide was built with 24 technology collaborators.
Key questions
Q: What breaks when Zero Trust still depends on periodic identity checks?
A: Periodic checks create a delay between context change and enforcement, so access can remain valid after the risk signal has changed.
Q: Why can JIT provisioning create governance gaps?
A: JIT can create governance gaps because it only provisions access at the moment of login and does not manage later updates or removal.
Q: What are the signs that fragmented policy data is weakening access decisions?
A: Common signs include different systems approving or denying the same user based on different context, delayed revocation after a posture change, and audit trails that cannot explain why a session was allowed to continue.
Practitioner guidance
- Replace polling with event-driven access revocation Wire risk signals from device, identity, and business systems into enforcement so a context change can end the session before the next scheduled check.
- Distinguish JIT provisioning from zero standing privilege Review whether your current JIT model still leaves a persistent entitlement or account behind, then reclassify it as temporary access rather than true zero standing privilege.
- Unify policy inputs before tuning access rules Map every policy decision point that contributes to authorisation, then remove duplicated or conflicting context sources that make the decision inconsistent across systems.
Bottom line: Zero Trust can be demonstrated with current architectures, but periodic checks and fragmented policy points still leave gaps in enforcement.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 6 days ago by NHI Mgmt Group
06/10/2026 9:05 pm
Continuous identity is the real control boundary for Zero Trust. The tested architectures in NIST SP 1800-35 show that Zero Trust can be demonstrated with today’s tools, but demonstration is not the same as durable governance. When policy decisions are periodic, access remains valid longer than the risk signal that justified it. The implication is that identity governance has to move from scheduled review logic to session-bound control logic.
A few things that frame the scale:
- 90% of IT leaders say properly managing NHIs is essential for a successful zero-trust implementation, according to the Ultimate Guide to NHIs.
A question worth separating out:
A: They should start with identity as the control plane, then layer in access provisioning, deprovisioning, recertification, role mining, segregation of duties, MFA, and passwordless authentication. The goal is to make access decisions continuously, based on risk and business need, while keeping workflows simple enough for users and admins to follow consistently.
👉 Read our full editorial: NIST zero trust gaps show why continuous identity controls matter