Most zero trust assessments produce a single score that hides where the programme is actually weak, and they rarely count service accounts, workloads or AI agents at all. This guide is about running the assessment itself: collecting evidence, scoring each pillar against more than one framework, and turning the gaps into a plan for the next stage. It uses CISA's Zero Trust Maturity Model (ZTMM) v2.0 as the main yardstick, cross-checks it against the DoD Zero Trust Strategy target and advanced levels, and anchors both in NIST SP 800-207, CSWP 20 and SP 1800-35. For the CISA stage and function definitions in depth, see the CISA Zero Trust Maturity Model Guide. It is written for security architects, identity leads and programme owners who must report progress and defend a budget.
Key takeaways
- Score functions, not the organisation. CISA ZTMM v2.0 states that each pillar can progress at its own pace, so report a profile across five pillars and three cross-cutting capabilities rather than one label.
- Use frameworks for what they are good at. CISA ZTMM gives four stages for scoring, the DoD strategy gives a countable activity list (91 target, 61 advanced), and NIST SP 800-207 gives the tenets that tell you whether a control is really zero trust.
- Inventory is the first evidence, not a later step. NIST CSWP 20 says a full inventory of resources, network identities and roles or privileges is necessary for zero trust, and it names service accounts explicitly.
- Non-human identities set the real score. CISA defines identity to include non-person entities; workloads on static keys usually sit at Traditional even where workforce MFA is Advanced.
- Plan one stage at a time, by risk. CISA tells agencies to prioritise by risk, mission, federal requirements and operating constraints: pick the functions that protect your most important workflows and fund a single stage move per cycle.
The five levels
CISA ZTMM v2.0 has four stages: Traditional, Initial, Advanced and Optimal. There is no fifth CISA stage. Many organisations also report against NHI Mgmt Group's five-level maturity frame, so the table below is NHI Mgmt Group's own crosswalk, an approximate mapping for reporting, not an official equivalence published by CISA or DoD.
| NHIMG level | Name | Description | Nearest CISA ZTMM stage | Nearest DoD ZT level |
|---|---|---|---|---|
| 1 | Ad hoc | Perimeter trust, static policies, manual provisioning; service accounts and keys unknown or unowned | Traditional | Below target |
| 2 | Developing | Enterprise SSO and MFA for most users; first automation of lifecycle and policy; partial asset and NHI inventory | Initial | Below target |
| 3 | Defined | Complete inventory with owners for users, devices, workloads and NHIs; documented policies per workflow; phishing-resistant MFA rolling out | Initial moving to Advanced | Working towards target |
| 4 | Managed | Automated, cross-pillar enforcement; risk and posture feed access decisions; short-lived workload credentials; centralised visibility | Advanced | Target level (91 activities) |
| 5 | Optimised | Just-in-time, just-enough access for every identity; continuous validation; dynamic policy and automated response enterprise-wide | Optimal | Advanced level (all 152 activities) |
When reporting to a US federal or defence customer, always quote the native CISA stage or DoD activity count; use the NHIMG level only as an internal summary.
Capability areas
Assess along the CISA pillars, then cross-check each with the DoD pillar that covers the same ground. The DoD Zero Trust Strategy (October 2022) uses seven pillars and its Execution Roadmap v1.1 (November 2024) lists 45 capabilities and 152 activities, which gives you an itemised evidence list that the CISA stage descriptions do not.
| CISA ZTMM pillar | DoD pillar | Evidence to collect | NHI and workload angle |
|---|---|---|---|
| Identity | User | IdP coverage, MFA type by population, standing privileged accounts, review automation | Count of service accounts, API keys and agent identities; share with owners and expiry |
| Devices | Device | Asset inventory completeness against discovery, EDR coverage, posture signals used in access | Servers, VMs and containers with certificates or attested identities |
| Networks | Network and Environment | Segmentation of critical workloads, encrypted internal traffic, flat-network exceptions | Service-to-service access authorised by identity, not IP allowlists |
| Applications and Workloads | Applications and Workloads | Apps behind a policy enforcement point, per-request authorisation, CI/CD controls | Pipeline and deployment credentials; federated tokens versus stored secrets |
| Data | Data | Data inventory and categorisation, access logging, key management | Applications and agents with standing read access to sensitive stores |
| Cross-cutting: Visibility and Analytics | Visibility and Analytics | Which logs reach a central platform; PE decision logs; detection coverage | Behaviour baselines for service principals and tokens |
| Cross-cutting: Automation and Orchestration | Automation and Orchestration | Automated provisioning, deprovisioning and response playbooks | Automated rotation and revocation of machine credentials |
| Cross-cutting: Governance | (spread across pillars) | Policies, ownership, exceptions register, metrics reported | Named owner for every NHI; exception expiry dates |
Use NIST SP 800-207 as the quality gate. A control only scores above Traditional if it moves the programme towards the tenets: per-session access, dynamic policy, strict authentication and authorisation before access, and monitoring of asset posture. NIST SP 1800-35 (June 2025) documents 19 example implementations built with 24 collaborators, which is useful for checking what an Advanced design looks like in practice. For cloud-native estates, SP 800-207A describes identity-tier policies for services using API gateways, sidecars and SPIFFE identities; see the SPIFFE and SPIRE Guide and the Workload Identity Federation Guide.
Assessment method
- Scope by workflow: CSWP 20 applies the NIST RMF to zero trust and starts in PREPARE with workflows, the resources each uses and their data flows. Pick five to ten business-critical workflows rather than the whole estate.
- Inventory first: pull subjects (users, service accounts, workloads, agents), devices and resources from authoritative sources and compare with discovery. Unknowns are a finding.
- Score each function: for every CISA function in scope, record the stage with evidence (a configuration export, a log query, a policy), not interview answers.
- Cross-check against DoD activities: mark each target-level activity as met, partial or not met for the same workflows. The count is a defensible progress figure.
- Score NHIs separately: give human and non-human identities their own row in the Identity pillar so a strong workforce score cannot mask static keys.
- Agree and baseline: review scores with pillar owners, record disputes, and freeze the baseline for comparison next cycle.
Self-assessment questions
- Inventory: can you produce one list of users, service accounts, workloads, devices and applications for each critical workflow, with owners?
- Identity: what share of workforce sign-ins use phishing-resistant MFA, and what share of workloads still authenticate with long-lived passwords, keys or tokens?
- Privilege: does any privileged access, human or machine, expire automatically, or is all of it standing?
- Policy: where is your policy decision point, and does it log every grant and denial with the attributes used?
- Devices: do access decisions use device or workload posture, and how many unmanaged devices reach internal applications?
- Networks: is east-west traffic between critical services encrypted and authorised per service, or trusted because it is internal?
- Remote access: do any applications still depend on VPN reachability for their security? OMB M-22-09 directs agencies to make applications usable without relying on a VPN.
- Data: are sensitive data stores categorised, and is access by applications and agents logged and time-limited?
- Response: can you revoke a compromised token or service principal across all systems within an hour?
- Third parties: CISA asks agencies to assess dependencies on external partners and providers. Which vendor connections bypass your enforcement points?
Moving up: roadmap
- Traditional to Initial: enterprise IdP for all workforce applications, MFA everywhere, a first NHI inventory with owners, centralised logging for identity events. Map to NIST SP 800-53 AC-2, IA-2 and CM-8.
- Initial to Advanced: phishing-resistant MFA, automated joiner, mover and leaver for humans and machines, short-lived workload credentials replacing static secrets (IA-9), segmentation of critical workloads (SC-7, AC-4), device posture in access policy. For US defence suppliers this is roughly the DoD target level.
- Advanced to Optimal: just-in-time privileged access (AC-6), continuous session evaluation, automated revocation driven by risk signals (SI-4, CA-7), dynamic policy across pillars. Close the remaining DoD advanced activities.
- Test every change: run new policies in report-only or audit mode against one workflow, then pilot rings, then enforcement. Keep the previous policy versioned so rollback is a single change.
- Reassess on a cycle: rescore the same workflows every six or twelve months against the frozen baseline.
Common failure patterns in assessments: scoring from interviews rather than evidence; excluding NHIs because the IdP does not hold them (the Microsoft Midnight Blizzard breach turned on a forgotten test tenant account and an over-privileged OAuth application); counting a VPN replacement as network maturity; and chasing Optimal in low-risk pillars while identity stays at Initial.
Metrics
- Function profile: number of in-scope CISA functions at each stage, tracked per cycle.
- DoD activity coverage: target-level activities met out of 91 for the scoped workflows.
- NHI coverage: percentage of service accounts and keys with owner, expiry and least-privilege review.
- Static secret ratio: share of workload authentications using long-lived secrets versus federated or short-lived credentials.
- Enforced access: share of critical applications reachable only through a policy enforcement point.
Framework mapping
| Assessment area | NIST CSF 2.0 | NIST SP 800-53 Rev. 5 |
|---|---|---|
| Inventory of assets and data flows | ID.AM-01, ID.AM-02, ID.AM-03 | CM-8 |
| Identities for users, services and hardware | PR.AA-01, PR.AA-03 | AC-2, IA-2, IA-9 |
| Least privilege and policy enforcement | PR.AA-05 | AC-3, AC-6 |
| Segmentation and encrypted traffic | PR.IR-01 | SC-7, SC-8, AC-4 |
| Continuous monitoring | DE.CM-01, DE.CM-03 | SI-4, CA-7 |
Practitioner checklist
- Scope the assessment to five to ten named business-critical workflows.
- Build the inventory of users, NHIs, devices and resources before scoring anything.
- Score every CISA ZTMM v2.0 function in scope with one of the four stages and attached evidence.
- Give non-human identities their own row in the Identity pillar.
- Cross-check against DoD target-level activities and record the count.
- Label any five-level summary as the NHIMG crosswalk, never as a CISA stage.
- Choose next-stage moves by workflow risk, one stage at a time.
- Pilot new policies in audit mode with a documented rollback.
- Rescore against the frozen baseline every six to twelve months.
Standards and references
- CISA: Zero Trust Maturity Model Version 2.0
- NIST: SP 800-207 Zero Trust Architecture
- NIST: CSWP 20 Planning for a Zero Trust Architecture
- NIST: SP 1800-35 Implementing a Zero Trust Architecture
- NIST: SP 800-207A Zero Trust Architecture Model for Access Control in Cloud-Native Applications
- DoD CIO: Zero Trust Strategy
- DoD CIO: Zero Trust Execution Roadmap v1.1
- OMB: M-22-09 Moving the U.S. Government Toward Zero Trust Cybersecurity Principles
Related NHI Mgmt Group resources: NIST SP 800-207 Zero Trust Architecture Guide · Zero Trust Identity Guide · NHI Governance Maturity Model · Zero Trust for AI Agents Guide · Public Sector Identity Security Guide