FFIEC IT Examination Handbook AIO-VII.B: VII.B Zero Trust Architecture (Architecture, Infrastructure, and Operations)

Management may adopt zero trust principles in architecture decisions where perimeter-based security no longer fits a complex environment of internal networks, remote offices, mobile personnel and cloud services: all networks including internal ones are untrusted, no implicit trust is granted by location, access is granted per session only when required after authentication of users and devices, all data sources and computing services are resources, all communication is secured regardless of location, and the further NIST SP 800-207 principles apply.