CISA Zero Trust Maturity Model
|
FUNCTION |
TRADITIONAL |
ADVANCED |
OPTIMAL |
| Access Authorization | Agency’s access to applications is primarily based on local authorization and static attributes. | Agency’s access to applications relies on centralized authentication, authorization, monitoring, and attributes. | Agency continuously authorizes access to applications, considering real-time risk analytics. |
| Threat Protection | Agency threat protections have minimal integration with application workflows, applying general purpose protections for known threats. | Agency has basic integration of threat protections into application workflows, primarily applying protections for known threats with some application-specific protections. | Agency strongly integrates threat protections into application workflows, with analytics to provide protections that understand and account for application behavior. |
| Accessibility | Some critical cloud applications are directly accessible to users over the internet, with all others available through a virtual private network (VPN). | All cloud applications and some on-premises applications are directly accessible to users over the internet, with all others available through a VPN | All applications are directly accessible to users over the internet. |
| Application Security | Agency performs application security testing prior to deployment, primarily through static and manual testing methods. | Agency integrates application security testing into the application development and deployment process, including the use of dynamic testing methods. | Agency integrates application security testing throughout the development and deployment process, with regular automated testing of deployed applications. |
| Visibility and Analytics Capability |
Agency performs application health and security monitoring in isolation of external sensors and systems. | Agency performs application health and security monitoring in context with some external sensors and systems. | Agency performs continuous and dynamic application health and security monitoring with external sensors and systems. |
| Automation and Orchestration Capability | Agency establishes application hosting location and access at provisioning. | Applications can inform device and network components of changing state. | Applications adapt to ongoing environmental changes for security and performance optimization. |