CISA Zero Trust Maturity Model

United States

v2.0

13 domains

46 controls

CISA Zero Trust Maturity Model for federal agencies

Verified

Framework summaries on this platform are AI-assisted interpretations for educational and compliance planning purposes. They do not reproduce or replace the official standards. Refer to the authoritative source for the definitive text. Framework names and trademarks belong to their respective organisations.

Framework Domains (13)

Applications and Workloads Pillar

4 controls

Controls in the Applications and Workloads Pillar domain of CISA Zero Trust Maturity Model — 4 controls
Code	Title	Description
ZTMM-APP-1	Application Access	Access to applications requires identity-aware, context-aware authorization regardless of network location.
ZTMM-APP-2	Application Threat Protection	Protect applications and workloads with runtime protection, WAF, and continuous threat monitoring.
ZTMM-APP-3	Secure Application Development and Deployment	Adopt secure development practices and continuous deployment with embedded security testing.
ZTMM-APP-4	Application Visibility and Analytics	Instrument applications for security visibility, with telemetry feeding analytics and detection.

CISA Zero Trust Maturity Model: Access Control & Identity

6 controls

Managing access to information systems (CISA Zero Trust Maturity Model)

Controls in the CISA Zero Trust Maturity Model: Access Control & Identity domain of CISA Zero Trust Maturity Model — 6 controls
Code	Title	Description
ZTMM-ID-AO	Identity Pillar: Automation and Orchestration	Automate identity lifecycle, provisioning, and policy enforcement across the identity pillar.
ZTMM-ID-VA	Identity Pillar: Visibility and Analytics	Collect and analyze identity-related data (authentication patterns, account activity) to inform access decisions and det...
ZTMM-STAGE-ADV	Maturity Stage: Advanced	Coordinated controls across pillars with centralized visibility and identity control, policy enforcement integrated acro...
ZTMM-STAGE-INIT	Maturity Stage: Initial	Starting automation of attribute assignment and policy configuration, initial cross-pillar solutions, and aggregated vis...
ZTMM-STAGE-OPT	Maturity Stage: Optimal	Fully automated, just-in-time lifecycles and attribute assignments, dynamic policies tailored to automated risk decision...
ZTMM-STAGE-TRAD	Maturity Stage: Traditional	Baseline stage with manually configured lifecycles and attributes, static security policies, siloed pillars, manual resp...

CISA Zero Trust Maturity Model: Audit & Accountability

0 controls

Audit logging and accountability measures (CISA Zero Trust Maturity Model)

CISA Zero Trust Maturity Model: Configuration Management

2 controls

Managing system configurations securely (CISA Zero Trust Maturity Model)

Controls in the CISA Zero Trust Maturity Model: Configuration Management domain of CISA Zero Trust Maturity Model — 2 controls
Code	Title	Description
ZTMM-DAT-AVAIL	Data Pillar: Data Availability	Ensure resilient and redundant access to data, including off-site or redundant stores, to support availability requireme...
ZTMM-DAT-CAT	Data Pillar: Data Categorization	Categorize and label data based on sensitivity to drive granular, risk-based access and protection decisions.

CISA Zero Trust Maturity Model: Incident Response

5 controls

Detecting and responding to security incidents (CISA Zero Trust Maturity Model)

Controls in the CISA Zero Trust Maturity Model: Incident Response domain of CISA Zero Trust Maturity Model — 5 controls
Code	Title	Description
ZTMM-APP-GOV	Applications Pillar: Governance	Define and enforce application security, access, and secure development governance.
ZTMM-APP-TEST	Applications Pillar: Application Security Testing	Integrate routine static, dynamic, and interactive application security testing throughout the development and deploymen...
ZTMM-DAT-AO	Data Pillar: Automation and Orchestration	Automate data categorization, labeling, and protection policy enforcement across the data pillar.
ZTMM-DAT-GOV	Data Pillar: Governance	Define and enforce data inventory, categorization, retention, and access governance.
ZTMM-DAT-VA	Data Pillar: Visibility and Analytics	Collect and analyze data access and usage to detect anomalous access and inform data protection decisions.

CISA Zero Trust Maturity Model: Risk Assessment & Management

5 controls

Identifying and managing cybersecurity risks (CISA Zero Trust Maturity Model)

Controls in the CISA Zero Trust Maturity Model: Risk Assessment & Management domain of CISA Zero Trust Maturity Model — 5 controls
Code	Title	Description
ZTMM-APP-AO	Applications Pillar: Automation and Orchestration	Automate application access policy, testing, and deployment workflows across the applications pillar.
ZTMM-APP-VA	Applications Pillar: Visibility and Analytics	Collect and analyze application access and behavior data to detect threats and inform access decisions.
ZTMM-NET-AO	Networks Pillar: Automation and Orchestration	Automate network configuration, segmentation, and traffic policy enforcement across the network pillar.
ZTMM-NET-ENC	Networks Pillar: Traffic Encryption	Encrypt network traffic, progressing from limited encryption of some traffic toward encryption of all applicable enterpr...
ZTMM-NET-GOV	Networks Pillar: Governance	Define and enforce network segmentation, encryption, and traffic management policies.

CISA Zero Trust Maturity Model: System & Communications Protection

6 controls

Protecting systems and communications (CISA Zero Trust Maturity Model)

Controls in the CISA Zero Trust Maturity Model: System & Communications Protection domain of CISA Zero Trust Maturity Model — 6 controls
Code	Title	Description
ZTMM-DEV-AO	Devices Pillar: Automation and Orchestration	Automate device enrollment, compliance enforcement, and remediation across the device pillar.
ZTMM-DEV-GOV	Devices Pillar: Governance	Define and enforce device policies, supply chain risk management, and configuration governance.
ZTMM-DEV-SCRM	Devices Pillar: Asset and Supply Chain Risk Management	Manage the inventory, supply chain provenance, and lifecycle risk of devices accessing enterprise resources.
ZTMM-DEV-VA	Devices Pillar: Visibility and Analytics	Collect and analyze device posture, compliance, and behavior data to inform access decisions and detect compromised devi...
ZTMM-ID-GOV	Identity Pillar: Governance	Define and enforce identity policies, entitlements, and access governance across the enterprise.
ZTMM-NET-VA	Networks Pillar: Visibility and Analytics	Collect and analyze network traffic and telemetry to detect threats and inform segmentation and access decisions.

Cross-Cutting Capability

3 controls

Controls in the Cross-Cutting Capability domain of CISA Zero Trust Maturity Model — 3 controls
Code	Title	Description
ZTMM-CROSS-1	Visibility and Analytics	Unify telemetry across pillars into analytics that drive detection, response, and policy decisions.
ZTMM-CROSS-2	Automation and Orchestration	Automate policy enforcement, response, and provisioning across pillars to reduce reaction time.
ZTMM-CROSS-3	Governance for Zero Trust	Establish zero trust governance including strategy, roadmap, funding, and measurement against maturity stages.

Data Pillar

4 controls

Controls in the Data Pillar domain of CISA Zero Trust Maturity Model — 4 controls
Code	Title	Description
ZTMM-DAT-1	Data Inventory and Classification	Discover and classify data across structured and unstructured stores, updating continuously.
ZTMM-DAT-2	Data Access Control	Apply attribute-based, dynamic access control to data based on classification and user context.
ZTMM-DAT-3	Data Encryption	Encrypt data at rest and in transit with managed keys and lifecycle rotation.
ZTMM-DAT-4	Data Loss Prevention	Detect and prevent unauthorized data movement across endpoint, network, and cloud channels.

Devices Pillar

3 controls

Controls in the Devices Pillar domain of CISA Zero Trust Maturity Model — 3 controls
Code	Title	Description
ZTMM-DEV-1	Device Inventory	Maintain a real-time inventory of all devices including managed, unmanaged, and IoT/OT.
ZTMM-DEV-2	Device Compliance and Posture	Verify device compliance and posture (patch level, encryption, EDR) before granting access; continuously re-evaluate.
ZTMM-DEV-3	Device Threat Protection	Deploy EDR or equivalent across all endpoints with integrated response actions.

Identity Pillar

4 controls

Controls in the Identity Pillar domain of CISA Zero Trust Maturity Model — 4 controls
Code	Title	Description
ZTMM-ID-1	Identity Authentication	Authentication evolves from passwords to phishing-resistant MFA across all users and accounts, with continuous validatio...
ZTMM-ID-2	Identity Stores	Move from siloed identity stores to a consolidated, governed identity fabric supporting human and machine identities.
ZTMM-ID-3	Risk Assessments for Identity	Use real-time risk signals (device, location, behavior) to drive authentication and authorization decisions.
ZTMM-ID-4	Access Management	Move from role-based to attribute-based or just-in-time access with continuous authorization.

Maturity

1 controls

Controls in the Maturity domain of CISA Zero Trust Maturity Model — 1 controls
Code	Title	Description
ZTMM-MAT-1	Maturity Stage Self-Assessment	Conduct regular self-assessment against Traditional, Initial, Advanced, and Optimal stages across all pillars.

Networks Pillar

3 controls

Controls in the Networks Pillar domain of CISA Zero Trust Maturity Model — 3 controls
Code	Title	Description
ZTMM-NET-1	Network Segmentation	Move from perimeter-based segmentation to micro-segmentation enforced by identity and policy.
ZTMM-NET-2	Network Traffic Management	Encrypt traffic by default, inspect where feasible, and apply policy-based routing for sensitive flows.
ZTMM-NET-3	Resilience and Availability	Design network for resilience, with adaptive routing and DDoS protection for critical services.

Maps to 1 other framework

46 total controls

NIST SP 800-53 Rev 5

24 source controls mapped|18 target controls covered

52%

Compare CISA Zero Trust Maturity Model with NIST SP 800-53 Rev 5

Frequently Asked Questions

What is CISA Zero Trust Maturity Model?

CISA Zero Trust Maturity Model is a compliance framework from United States with 13 domains and 46 controls. CISA Zero Trust Maturity Model for federal agencies It is used by organisations to establish and maintain compliance with industry standards and regulatory requirements.

How many controls does CISA Zero Trust Maturity Model have?

CISA Zero Trust Maturity Model has 46 controls organised across 13 domains. The largest domains are CISA Zero Trust Maturity Model: Access Control & Identity (6 controls), CISA Zero Trust Maturity Model: System & Communications Protection (6 controls), CISA Zero Trust Maturity Model: Incident Response (5 controls). Each control defines specific requirements that organisations must implement to achieve compliance.

What frameworks does CISA Zero Trust Maturity Model map to?

CISA Zero Trust Maturity Model maps to 1 other compliance frameworks. The top mapping partners are NIST SP 800-53 Rev 5 (52% coverage). Use our comparison tool to explore control-level mappings between frameworks.

How do I get started with CISA Zero Trust Maturity Model compliance?

Start your CISA Zero Trust Maturity Model compliance journey by running a self-assessment on our platform to identify your current compliance posture. Our AI advisory can answer specific questions about CISA Zero Trust Maturity Model requirements, and cross-framework mapping helps you leverage existing controls from other frameworks you may already comply with. Create a free account to access all 46 controls and track your progress.

Start Your Compliance Journey

Create a free account to run self-assessments, get AI advisory, and track your compliance progress across 700 frameworks.

Get Started Free →

Free forever — no credit card required