Zero Trust Architecture
Zero trust principles, micro-segmentation, NIST SP 800-207, ZTNA, continuous verification, BeyondCorp.
What is Zero Trust Architecture?
Zero Trust Architecture (ZTA) is a security model built on the principle that no user, device, or network segment should be inherently trusted. Every access request must be continuously verified, regardless of whether it originates inside or outside the traditional network perimeter. The mantra 'never trust, always verify' replaces the legacy castle-and-moat approach that assumed everything inside the firewall was safe.
NIST Special Publication 800-207 provides the definitive framework for Zero Trust Architecture, defining core tenets including least-privilege access, micro-segmentation, continuous authentication, and the assumption that the network is always hostile. Google's BeyondCorp initiative demonstrated that Zero Trust could work at massive scale, eliminating VPN dependencies and enabling secure access from any location without a traditional network perimeter.
Implementing Zero Trust is a journey, not a single product deployment. It requires integrating identity providers, device posture assessment, micro-segmentation, policy engines, and continuous monitoring into a coherent architecture. Zero Trust Network Access (ZTNA) replaces VPNs by providing application-level access based on identity and context. The Software-Defined Perimeter (SDP) model makes application infrastructure invisible to unauthorized users, dramatically reducing the attack surface.
Why it matters
The traditional perimeter is dead. Remote work, cloud adoption, and supply chain complexity mean organizations can no longer assume internal networks are safe. Zero Trust is the architectural response to this reality.
Zero Trust is the architectural philosophy that ties together network security, identity management, and endpoint security into a unified access model. It provides the strategic framework that modern security programs are built around.
Control Access & Trust
Decide who or what can do what, enforce it cryptographically, constrain AI behaviour.
Other domains in this layer
See how this layer connects to the rest of the domain map →Key topics
Standards and frameworks
Curated resources
Authoritative sources we ground Zero Trust Architecture questions in — frameworks, research, guides, and tools.
Forrester — Zero Trust Extended Ecosystem
Forrester originated the Zero Trust concept (John Kindervag, 2010). Their extended model includes workloads, data, networks, devices, people, visibility/analytics, automation/orchestration.
Google BeyondCorp Papers
The original enterprise ZTA implementation case study. Six published papers covering architecture, migration, and lessons learned. Vendor-specific but pioneered the practical approach to zero trust.
NSA/CISA Top 10 Cybersecurity Misconfigurations
Based on real red/blue team assessments. Includes default configurations, improper privilege separation, lack of network segmentation. Excellent for practical scenario questions.
NIST SP 800-207 — Zero Trust Architecture
Definitive guide to zero trust architecture. Defines ZTA concepts, deployment models, and implementation approaches for enterprise environments.
CISA Zero Trust Maturity Model
Framework for transitioning to zero trust architecture across five pillars: identity, devices, networks, applications, and data.
Certifications that signal this domain
Credentials whose blueprint meaningfully covers this domain. Core means centrally covered; also touched means present in the blueprint but not the primary focus.
Core coverage
Cisco Certified Implementation Expert - Security
Cisco Certified Implementation Expert - Security
Certified Information Systems Security Professional
Breadth across security engineering, architecture, operations, and governance at senior-IC / manager level. The default senior-generalist signal.
CISSP Information Systems Security Architecture Professional
Architecture concentration on top of CISSP — trust boundaries, identity / crypto / network composition, defense-in-depth design.
CREST Registered Technical Security Architect
CREST Registered Technical Security Architect
Certified Zero Trust (CCZT)
Vendor-neutral Zero Trust architecture and governance — NIST SP 800-207, ZTA pillars, and program implementation.
CyberArk Defender — PAM (CDE-PAM)
Day-to-day administration of CyberArk PAM — the dominant enterprise privileged-access platform.
CyberArk Guardian — PAM
Top-tier CyberArk practitioner — leads complex PAM programs and contributes back to the community.
CyberArk Sentry — PAM
Designs and deploys CyberArk PAM at enterprise scale — vault architecture, HA/DR, and complex onboarding.
Fortinet Certified Solution Specialist - Secure Access Service Edge
Fortinet Certified Solution Specialist - Secure Access Service Edge
Fortinet Certified Solution Specialist - Zero Trust Access
Fortinet Certified Solution Specialist - Zero Trust Access
GIAC Defensible Security Architecture
GIAC Defensible Security Architecture
Information Systems Security Architecture Professional
ISC2 specialization for security architecture. Requires an active CISSP. Focus on GRC, Security Architecture Modeling, Infrastructure Security, and IAM architecture. For senior security architects in enterprise environments.
Okta-specific identity deployment (SSO, MFA, lifecycle).
Microsoft Cybersecurity Architect
The Microsoft Certified: Cybersecurity Architect Expert (SC-100) is Microsoft's highest security certification and targets experienced professionals who design security architectures for hybrid and cloud-native environments based on the Microsoft platform. It requires at least one associate-level security certification (e.g., AZ-500, SC-200, or SC-300) and builds on that knowledge. The certification addresses zero-trust architectures, compliance requirements, identity governance, and infrastructure protection from a strategic perspective. For organizations heavily invested in Microsoft 365 and Azure, SC-100 is valuable proof of expertise; outside the Microsoft ecosystem, its relevance is more limited. The exam will be updated in April 2026.
Microsoft Certified: Identity and Access Administrator Associate
Entra ID deployment, conditional access, privileged access, identity governance.
Also touched
Certified Cloud Security Professional
Cloud security architecture: shared responsibility, identity, data protection, crypto, and cloud-native detection.
GIAC Security Essentials
Broad defender fundamentals. Often paired with SANS SEC401.
SailPoint Certified Identity Security Engineer
Designs and engineers SailPoint identity solutions across IdentityIQ and Identity Security Cloud (ISC).
Browse all certifications → — pick a cert on the interactive map to highlight every domain it covers.
Education and certifications
More in Cybersecurity
Test what you know about Zero Trust Architecture
38 questions available. Beginner to expert questions, scored against the global leaderboard.