SecProve
ProfessionalVendor-neutralCloud Security Alliance· issued from US

CSA CZT

Certified Zero Trust (CCZT)

Vendor-neutral Zero Trust architecture and governance — NIST SP 800-207, ZTA pillars, and program implementation.

Official page at Cloud Security Alliance↔ Compare with another cert
Exam fee
$675
Ongoing
$0/yr AMF
Study time
30–60 hrs
Delivery
Online proctored
Validity
3 yrs (renewal cycle)

› Quality score

19.5 / 40

Four-axis SecProve rubric, each 0–10. SecProve editorial assessment — each axis carries a written justification so you can push back on any single call without dismissing the whole score.

Blueprint rigor
How well-defined and rigorous the exam blueprint is.
Body-of-knowledge maps to NIST SP 800-207, the CISA ZT Maturity Model, and CSA's own ZT pillars guidance. Coherent and well-scoped.
7.0/10
Practical evidence
Hands-on labs / written reports vs pure MCQ.
Pure MCQ — no applied design exercise.
0.0/10
Currency & upkeep
How aggressively content is kept current with the field.
Launched 2023; CSA refreshes content annually as the ZT guidance ecosystem evolves.
7.5/10
Market recognition
How often this signal actually moves a hiring decision.
Newer credential; growing recognition on cloud-architect and ZT-program-lead roles, especially in US federal-adjacent work. [Holders: 2k, 2024-12]
5.0/10

› Market signals

public, citable inputs to the recognition score
Holders worldwide
2,000
as of 2024-12 · source

Conservative estimate — CSA publishes named-holder lists but no aggregate count.

› Built for these roles

Zero Trust ArchitectSecurity ArchitectIdentity / Network Architect

› Exam format

60 multiple-choice questions, 120 minutes, English. Online proctored. Covers ZTA principles, NIST SP 800-207, CISA ZT Maturity Model, ZT planning, and pillar implementation (identity, devices, networks, applications, data).

› Recertification

Recertification by passing the current exam every 3 years. No CPE requirement.

› NICE Framework work roles

The NIST NICE work-role IDs this cert maps to. NICCS lookup.

DD-WRL-004OG-WRL-007
Recognition
GlobalUSEU
Exam languages
en

› Core domains covered

The 2 domains this cert is centrally about. Passing the exam demonstrates working knowledge of each.

A3Zero Trust Architecture

Zero trust principles, micro-segmentation, NIST SP 800-207, ZTNA, continuous verification, BeyondCorp.

A6Identity & Access Management

AuthN/AuthZ, SSO, MFA, PAM, RBAC/ABAC, identity governance, FIDO2/passkeys, plus non-human identity: service accounts, workload identity, agent / plugin identities.

› Also touched

Present in the blueprint but not the primary focus — you’ll be introduced but shouldn’t expect depth.

A1Governance, Risk & Compliance

Risk frameworks (NIST RMF, ISO 31000, FAIR), policy development, audit, regulatory compliance, third-party risk.

A5Cloud Security

AWS/Azure/GCP security controls, IAM policies, CSPM, container security, shared responsibility model.

A2Network Security

Firewalls, IDS/IPS, network segmentation, DNS security, SD-WAN, VPN, traffic analysis, wireless security.

› Prerequisites

Experience

Mid-career security or architecture background. Familiarity with at least one of identity, network, or cloud-security domains.

Knowledge assumed
  • NIST SP 800-207 ZTA principles
  • Identity, device, network, application, and data pillars
  • CISA ZT Maturity Model

› Progression

requiredrecommended

Where this cert fits in the typical learning path. Required edges are vendor-gated; recommended edges reflect de facto industry progression.

Required prereqs (0)

No vendor-gated prereqs.

Recommended priors (2)
CSA CCSKCloud Security AllianceCISSPISC2
CSA CZT
Cloud Security Alliance
Required by (0)

No certs require this one.

Recommended next (0)

No follow-on certs reference this one yet.

See this cert’s domains highlighted on the interactive map, or compare it against the rest of the catalog.

Highlight on the domain mapBrowse all certifications