Zero Trust Maturity Evaluator

Evaluate your Zero Trust security posture across 8 pillars aligned with CISA ZTMM v2.0 and NIST SP 800-207. $9 per run, or 20 credits; free for CISO Marketplace members.

Build a Stronger Security Posture

The threat landscape has fundamentally shifted. AI-powered attacks, identity-based intrusions, and software supply chain compromises have rendered perimeter security obsolete. Zero Trust — "never trust, always verify" — is now the baseline expectation for enterprise security programs.

This assessment covers all 8 pillars of a complete Zero Trust program: the 5 core pillars from the CISA Zero Trust Maturity Model v2.0 plus Automation & Orchestration, Visibility & Analytics, and Governance. Complete all pillars to get your full maturity picture and a prioritized roadmap.

NIST SP 800-207 & CISA ZTMM v2.0 aligned — industry-standard framework
30 questions across 8 pillars — ~10 minutes to complete
Actionable recommendations — tailored to your maturity level
Runs in your browser — signed-in results are saved to your account
0/30 questions0%

Identity

1 / 8

User, application, and service identity verification and lifecycle management — the cornerstone of Zero Trust.

How do you verify user identities across your environment?

Username and password only
MFA used in some systems
MFA required everywhere with phishing-resistant authenticators (FIDO2/passkeys or PKI smart cards such as PIV/CAC)

How do you manage privileged access?

Static privileges with manual review processes
Privileged access management (PAM) for critical systems
Just-in-time privileged access with continuous verification and session recording

How do you authenticate non-human identities (services, APIs, workloads)?

Shared service accounts and long-lived API keys
Unique service identities with a secrets management vault
Short-lived, auto-rotated credentials with mutual TLS and workload identity federation

How do you manage the identity lifecycle (joiners, movers, leavers)?

Manual provisioning and deprovisioning with no formal process — orphaned accounts accumulate
HR-integrated automated provisioning with periodic access reviews and certification campaigns
Fully automated JML lifecycle with real-time deprovisioning, continuous access certification, and zero orphaned accounts

About Zero Trust Architecture

Zero Trust is a security paradigm built on "never trust, always verify." It requires continuous verification of every user, device, application, and data request — regardless of whether the request originates inside or outside the network perimeter.

Today, AI-powered attacks, identity-based intrusions, and software supply chain compromises are the dominant threat vectors. Zero Trust is no longer a roadmap goal — it's the operational baseline. New frontiers include agentic AI systems that require their own identity and access governance, post-quantum cryptography migration before "harvest now, decrypt later" attacks mature, and ITDR to detect identity-based compromise before lateral movement occurs.

NIST SP 800-207 (§2.1) sets out seven tenets of Zero Trust:

  1. All data sources and computing services are considered resources.
  2. All communication is secured regardless of network location.
  3. Access to individual enterprise resources is granted on a per-session basis.
  4. Access to resources is determined by dynamic policy, including the observable state of client identity, application/service and the requesting asset, and may include other behavioral and environmental attributes.
  5. The enterprise monitors and measures the integrity and security posture of all owned and associated assets.
  6. All resource authentication and authorization are dynamic and strictly enforced before access is allowed.
  7. The enterprise collects as much information as possible about the current state of assets, network infrastructure and communications, and uses it to improve its security posture.

Many programs summarise these as three working principles, a framing popularised by Microsoft: verify explicitly, use least-privilege access, and assume breach.

How to Act on Your Results

  • Share results with your executive team and board to align on investment priorities — use the Governance pillar score as your starting point for the conversation
  • Build a phased roadmap: identity and visibility gaps deliver the highest risk reduction per dollar — start there
  • Address supply chain and email security early — still the two most common initial access vectors, now amplified by AI-generated phishing and agentic pivoting
  • Use the effort tags in your recommendations to build a 30/90/12-month roadmap your board can follow
  • Begin your cryptographic inventory now — PQC migration is a multi-year program and the window to protect long-lived data is closing
  • Re-assess quarterly to track progress and recalibrate against new threats; use saved assessment deltas (shown between assessments scored by the same model) to show improvement
  • Map your gaps to NIS2, CMMC 2.0, or FedRAMP requirements if applicable — ZT pillar scores translate directly to compliance posture

Essential Zero Trust Resources

Frameworks & Standards

Implementation Priorities

  • • Deploy ZTNA to replace legacy VPN; evaluate SASE for converged cloud-delivered security
  • • Adopt CNAPP (CSPM + CWPP + CIEM) to unify cloud, container, and identity security
  • • Implement ITDR to detect identity-based attacks — token theft, AiTM bypass, privilege escalation
  • • Begin a CTEM (Continuous Threat Exposure Management) program to continuously discover and prioritize exposures
  • • Govern AI agents as non-human identities: inventory MCP servers, scope tool permissions, monitor pipeline actions
  • • Start your PQC migration with a cryptographic inventory (CBOM) — long-lived data is at risk today

This tool is designed for CISOs, security architects, and risk leaders. Results reflect self-assessment and should be validated with technical teams. Industry-specific requirements (HIPAA, PCI-DSS, FedRAMP, CMMC 2.0, NIS2) may impose additional controls beyond this framework.

Zero Trust Maturity Evaluator, a CISO Marketplace micro tool. $9 per run, or 20 credits; free for CISO Marketplace members. Last reviewed: November 2026 · Sources: CISA ZTMM v2.0, NIST SP 800-207, NIST SP 1800-35 (see Resources above).