The U.S. Cybersecurity and Infrastructure Security Agency has released an updated version of its Zero Trust Maturity Model, which bolsters the agency’s zero trust standards with input from a public comment period.
While designed for federal agencies, any organization can review the guidance and apply the protections to their infrastructure to help keep malicious actors out of their networks and devices by implementing the principle of least privilege and authenticating identities and users.
The updated guidance essentially considers the reality that not every organization begins their zero-trust journey from the same starting point. The new version of the Zero Trust Maturity Model includes a new stage called “Initial” that can be used as a guide to identify maturity for each pillar, the agency says.
The agency also added several new functions and updated existing functions in all four stages of maturity (Traditional, Initial, Advanced and Optimal) to consider when organizations plan and make decisions for zero trust implementation.
Read Next: Your Guide to Implementing a Zero Trust Network Architecture
The updates to CISA’s zero trust guidance come as a result of the 2021 public comment period, and the agency also published its response to those comments and summarizes the comments and modifications made from that input.
According to CISA, the updated model provides a gradient of implementation across five pillars (identity, devices, networks, applications & workloads, and data) to facilitate implementation and help organizations make minor advancements over time.
“CISA has been acutely focused on guiding agencies, who are at various points in their journey, as they implement zero trust architecture,” says Chris Butera, CISA’s technical director for cybersecurity, in a statement. “As one of many roadmaps, the updated model will lead agencies through a methodical process and transition towards greater zero trust maturity.”
Butera reiterates that the Zero Trust Maturity Model is intended for federal civilian agencies, but all organizations can review the document to guide them on their zero-trust journey.
