DoD Zero Trust Reference Architecture

United States

v3.0

7 domains

45 controls

The U.S. Department of Defense Zero Trust Reference Architecture and Zero Trust Capabilities/Activities. Defines the DoD zero-trust target state across 7 pillars (User; Device; Application & Workload; Data; Network & Environment; Automation & Orchestration; Visibility & Analytics), 45 capabilities and 152 Target-Level / Advanced-Level activities, supporting the DoD Zero Trust Strategy goal of a target-level zero-trust architecture. Aligned with NIST SP 800-207 zero-trust tenets and implemented over NIST SP 800-53 controls.

Verified

Framework summaries on this platform are AI-assisted interpretations for educational and compliance planning purposes. They do not reproduce or replace the official standards. Refer to the authoritative source for the definitive text. Framework names and trademarks belong to their respective organisations.

Framework Domains (7)

DoD ZT Pillar 1: User

9 controls

Controls in the DoD ZT Pillar 1: User domain of DoD Zero Trust Reference Architecture — 9 controls
Code	Title	Description
DODZT-1.1	User Inventory	Maintain an authoritative inventory of all privileged and non-privileged users and non-person entities, connected to ide...
DODZT-1.2	Conditional User Access	Enforce attribute-based, conditional user access to applications and data using vetted enterprise roles/attributes throu...
DODZT-1.3	Multi-Factor Authentication	Require phishing-resistant multi-factor authentication for users, integrated with the enterprise IdP and PKI.
DODZT-1.4	Privileged Access Management	Manage privileged access with Just-in-Time / Just-Enough-Administration through a PAM solution.
DODZT-1.5	Identity Federation and User Credentialing	Provide enterprise identity federation and standardized user credentialing across DoD components.
DODZT-1.6	Behavioral, Contextual ID, and Biometrics	Incorporate behavioral, contextual and biometric signals into authentication and access decisions.
DODZT-1.7	Least Privileged Access	Grant users the least privilege necessary, reviewed and enforced dynamically.
DODZT-1.8	Continuous Authentication	Continuously authenticate and authorize users throughout a session rather than only at logon.
DODZT-1.9	Integrated ICAM Platform	Operate an integrated Identity, Credential and Access Management platform as the enterprise authority for identity.

DoD ZT Pillar 2: Device

7 controls

Controls in the DoD ZT Pillar 2: Device domain of DoD Zero Trust Reference Architecture — 7 controls
Code	Title	Description
DODZT-2.1	Device Inventory	Maintain a complete inventory of all devices (managed and unmanaged) connecting to the network.
DODZT-2.2	Device Detection and Compliance	Detect devices and continuously assess their compliance posture before and during access.
DODZT-2.3	Device Authorization with Real-Time Inspection	Authorize devices using real-time inspection of device health and posture.
DODZT-2.4	Remote Access	Secure remote access for devices consistent with zero-trust principles.
DODZT-2.5	Partially and Fully Automated Asset, Vulnerability and Patch Management	Automate asset, vulnerability and patch management across devices.
DODZT-2.6	Unified Endpoint Management and Mobile Device Management	Manage endpoints and mobile devices through UEM/MDM.
DODZT-2.7	Endpoint and Extended Detection and Response	Deploy EDR and integrate into XDR for detection and response across the environment.

DoD ZT Pillar 3: Application and Workload

5 controls

Controls in the DoD ZT Pillar 3: Application and Workload domain of DoD Zero Trust Reference Architecture — 5 controls
Code	Title	Description
DODZT-3.1	Application Inventory	Maintain an inventory of applications and their components.
DODZT-3.2	Secure Software Development and Integration	Apply secure software development and integration practices (DevSecOps) for applications.
DODZT-3.3	Software Risk Management	Manage software supply-chain and component risk for applications.
DODZT-3.4	Resource Authorization and Integration	Authorize access to application resources dynamically and integrate authorization across the enterprise.
DODZT-3.5	Continuous Monitoring and Ongoing Authorizations	Continuously monitor applications and move to ongoing authorization (cATO).

DoD ZT Pillar 4: Data

7 controls

Controls in the DoD ZT Pillar 4: Data domain of DoD Zero Trust Reference Architecture — 7 controls
Code	Title	Description
DODZT-4.1	Data Catalog Risk Alignment	Catalog data and align protection to data risk.
DODZT-4.2	DoD Enterprise Data Governance	Establish enterprise data governance for zero trust.
DODZT-4.3	Data Labeling and Tagging	Label and tag data to enable attribute-based protection and access.
DODZT-4.4	Data Monitoring and Sensing	Monitor and sense data access and movement.
DODZT-4.5	Data Encryption and Rights Management	Encrypt data and apply digital rights management.
DODZT-4.6	Data Loss Prevention	Deploy data loss prevention controls.
DODZT-4.7	Data Access Control	Enforce fine-grained, per-session, attribute-based access to data.

DoD ZT Pillar 5: Network and Environment

4 controls

Controls in the DoD ZT Pillar 5: Network and Environment domain of DoD Zero Trust Reference Architecture — 4 controls
Code	Title	Description
DODZT-5.1	Data Flow Mapping	Map data flows across the network and environment.
DODZT-5.2	Software Defined Networking	Use software-defined networking to enable dynamic, policy-driven network control.
DODZT-5.3	Macro Segmentation	Implement macro-segmentation of the network.
DODZT-5.4	Micro Segmentation	Implement micro-segmentation down to the workload/host level.

DoD ZT Pillar 6: Automation and Orchestration

7 controls

Controls in the DoD ZT Pillar 6: Automation and Orchestration domain of DoD Zero Trust Reference Architecture — 7 controls
Code	Title	Description
DODZT-6.1	Policy Decision Point and Policy Orchestration	Operate a policy decision point and orchestrate policy across the enterprise (the zero-trust policy engine).
DODZT-6.2	Critical Process Automation	Automate critical security processes.
DODZT-6.3	Machine Learning	Apply machine learning to support zero-trust decisions.
DODZT-6.4	Artificial Intelligence	Apply artificial intelligence to support zero-trust decisions and operations.
DODZT-6.5	Security Orchestration, Automation and Response	Deploy SOAR to automate detection and response workflows.
DODZT-6.6	API Standardization	Standardize APIs to enable interoperability and automation.
DODZT-6.7	Security Operations Center and Incident Response	Operate a SOC and integrated incident response.

DoD ZT Pillar 7: Visibility and Analytics

6 controls

Controls in the DoD ZT Pillar 7: Visibility and Analytics domain of DoD Zero Trust Reference Architecture — 6 controls
Code	Title	Description
DODZT-7.1	Log All Traffic	Log all network, data, application and user traffic.
DODZT-7.2	Security Information and Event Management	Aggregate and correlate logs in a SIEM.
DODZT-7.3	Common Security and Risk Analytics	Perform common security and risk analytics across pillars.
DODZT-7.4	User and Entity Behavior Analytics	Apply UEBA to detect anomalous user and entity behavior.
DODZT-7.5	Threat Intelligence Integration	Integrate threat intelligence into monitoring and decisions.
DODZT-7.6	Automated Dynamic Policies	Drive automated, dynamic policy updates from analytics and telemetry.

Your Compliance Coverage

If you comply with DoD Zero Trust Reference Architecture, you already cover:

NIST SP 800-53 Rev 5

33%

15 controls mapped

Compare →

NIST Cybersecurity Framework 2.0

11%

5 controls mapped

Compare →

NIST SP 800-207

4 controls mapped

Compare →

+ 3 more: ISO 19011 (2%), ISO 31000:2018 (2%)

See all 6 mapped frameworks ↓

Maps to 6 other frameworks

45 total controls

NIST SP 800-53 Rev 5

15 source controls mapped|11 target controls covered

33%

NIST Cybersecurity Framework 2.0

5 source controls mapped|5 target controls covered

11%

NIST SP 800-207

4 source controls mapped|5 target controls covered

ISO 19011

1 source controls mapped|1 target controls covered

ISO 31000:2018

1 source controls mapped|1 target controls covered

ISO 27018:2019

1 source controls mapped|1 target controls covered

Compare DoD Zero Trust Reference Architecture with NIST SP 800-53 Rev 5

Frequently Asked Questions

What is DoD Zero Trust Reference Architecture?

DoD Zero Trust Reference Architecture is a compliance framework from United States with 7 domains and 45 controls. The U.S. Department of Defense Zero Trust Reference Architecture and Zero Trust Capabilities/Activities. Defines the DoD zero-trust target state across 7 pillars (User; Device; Application & Workload; Data; Network & Environment; Automation & Orchestration; Visibility & Analytics), 45 capabilities and 152 Target-Level / Advanced-Level activities, supporting the DoD Zero Trust Strategy goal of a target-level zero-trust architecture. Aligned with NIST SP 800-207 zero-trust tenets and implemented over NIST SP 800-53 controls. It is used by organisations to establish and maintain compliance with industry standards and regulatory requirements.

How many controls does DoD Zero Trust Reference Architecture have?

DoD Zero Trust Reference Architecture has 45 controls organised across 7 domains. The largest domains are DoD ZT Pillar 1: User (9 controls), DoD ZT Pillar 2: Device (7 controls), DoD ZT Pillar 4: Data (7 controls). Each control defines specific requirements that organisations must implement to achieve compliance.

What frameworks does DoD Zero Trust Reference Architecture map to?

DoD Zero Trust Reference Architecture maps to 6 other compliance frameworks. The top mapping partners are NIST SP 800-53 Rev 5 (33% coverage), NIST Cybersecurity Framework 2.0 (11% coverage), NIST SP 800-207 (9% coverage). Use our comparison tool to explore control-level mappings between frameworks.

How do I get started with DoD Zero Trust Reference Architecture compliance?

Start your DoD Zero Trust Reference Architecture compliance journey by running a self-assessment on our platform to identify your current compliance posture. Our AI advisory can answer specific questions about DoD Zero Trust Reference Architecture requirements, and cross-framework mapping helps you leverage existing controls from other frameworks you may already comply with. Create a free account to access all 45 controls and track your progress.

Start Your Compliance Journey

Create a free account to run self-assessments, get AI advisory, and track your compliance progress across 718 frameworks.

Get Started Free →

Free forever — no credit card required