Planning for a Zero Trust Architecture: A Planning Guide for Federal Administrators

Rose, Scott

doi:https://doi.org/10.6028/NIST.CSWP.20

July 19, 2023: URLs for CSRC publication details pages have changed. Legacy URLs should automatically redirect to the new URLs. However, links to the actual publications have NOT changed (e.g., DOIs and PDFs on nvlpubs.nist.gov). Please send inquiries to csrc-inquiry@nist.gov. [12:20 pm ET - If you received "Page Not Found" errors recently, please retry accessing those files. File synchronization should now be complete.]

NIST CSWP 20

Planning for a Zero Trust Architecture: A Planning Guide for Federal Administrators

Documentation Topics

Date Published: May 6, 2022

Author(s)

Scott Rose (NIST)

Abstract

NIST Special Publication 800-207 defines zero trust as a set of cybersecurity principles used when planning and implementing an enterprise architecture. These principles apply to endpoints, services, and data flows. Input and cooperation from various stakeholders in an enterprise is needed for a zero trust architecture to succeed in improving the enterprise security posture. Some of these stakeholders may not be familiar with risk analysis and management. This document provides an overview of the NIST Risk Management Framework (NIST RMF) and how the NIST RMF can be applied when developing and implementing a zero trust architecture.

Keywords

architecture; cybersecurity; enterprise; network security; risk management; Risk Management Framework; zero trust

Control Families

None selected

Documentation

Publication:
https://doi.org/10.6028/NIST.CSWP.20

Supplemental Material:
NIST CSWP 20 (pdf)

Related NIST Publications:
SP 800-207

Document History:
08/04/21: CSWP 20 (Draft)
05/06/22: CSWP 20 (Final)

Topics

Security and Privacy

planning, risk management, zero trust

Technologies

networks

Applications

enterprise