NIST SP 800-207

United States

v2020

13 domains

51 controls

Zero Trust Architecture

Verified

NIST SP 800-207 is a compliance framework from United States with 13 domains and 51 controls that map to 5 other frameworks. The largest domains are Foundational Tenets (7 controls), NIST SP 800-207: Operations Security (6 controls), NIST SP 800-207: Access Control (5 controls). Every control below carries what it requires and what an assessor expects to see.

Maintained by Gerard BlokdykVerified against the published standard 31 May 2026Control text last updated 21 May 2026

Framework summaries on this platform are interpretations grounded in the published source, for educational and compliance planning purposes. They do not reproduce or replace the official standards. Refer to the authoritative source for the definitive text. Framework names and trademarks belong to their respective organisations.

Framework Domains (13)

Deployment Models

3 controls

Controls in the Deployment Models domain of NIST SP 800-207: 3 controls
Code	Title	Description
SP800-207-4.1	Enhanced Identity Governance Deployment	Where the primary driver is identity rather than network topology, deploy zero trust using an enhanced identity governan...
SP800-207-4.2	Micro Segmentation Deployment	Where workload to workload control is the primary concern, deploy micro segmentation that places each resource or small...
SP800-207-4.3	Software Defined Perimeter Deployment	Implement a Software Defined Perimeter that hides resources from unauthorized clients and only exposes them after authen...

Foundational Tenets

7 controls

Controls in the Foundational Tenets domain of NIST SP 800-207: 7 controls
Code	Title	Description
SP800-207-2.1	Tenet 1: All Data Sources and Computing Services as Resources	Classify every data source and computing service in the enterprise as a resource that requires access decisions, includi...
SP800-207-2.2	Tenet 2: All Communication Secured Regardless of Network	Apply encryption and authentication to all communications, regardless of whether the traffic originates inside or outsid...
SP800-207-2.3	Tenet 3: Per Session Resource Access	Grant access to enterprise resources on a per session basis. Trust is evaluated at each request and is not perpetuated b...
SP800-207-2.4	Tenet 4: Dynamic Policy Driven Access	Make access decisions using dynamic policy that incorporates user identity, device posture, application sensitivity, and...
SP800-207-2.5	Tenet 5: Monitor Integrity and Posture of Assets	Continuously measure and monitor the security posture of devices and workloads. Posture signals must feed back into the...
SP800-207-2.6	Tenet 6: Dynamic Authentication and Authorization	Authentication and authorization are strict, enforced before access, and re evaluated as risk signals change. Step up au...
SP800-207-2.7	Tenet 7: Telemetry to Improve Posture	Collect and analyze data about asset state, network activity, and access decisions, and use the results to improve the s...

Logical Components

3 controls

Controls in the Logical Components domain of NIST SP 800-207: 3 controls
Code	Title	Description
SP800-207-3.1	Policy Engine Capabilities	Stand up a Policy Engine that decides whether to grant or deny access by combining policy, trust algorithm, and signals...
SP800-207-3.2	Policy Administrator Role	Implement a Policy Administrator that executes the decisions made by the Policy Engine by establishing or shutting down...
SP800-207-3.3	Policy Enforcement Point Coverage	Deploy Policy Enforcement Points in front of every protected resource, whether at the application, gateway, micro servic...

NIST SP 800-207: Access Control

5 controls

Logical and physical access controls (NIST SP 800-207)

Controls in the NIST SP 800-207: Access Control domain of NIST SP 800-207: 5 controls
Code	Title	Description
SP800-207-DEP-PORTAL	Resource Portal-Based Deployment	Uses a single PEP gateway portal to broker access so that no agent is required on the requesting device, at the cost of...
SP800-207-DEP-SANDBOX	Device Application Sandboxing	Runs vetted applications or processes in sandboxed compartments on the asset, isolating them from the rest of the device...
SP800-207-NET-REQ	Network Requirements to Support ZTA	Enterprise network requirements enabling ZTA, including basic connectivity for assets, distinct logical access control,...
SP800-207-TA-CONTEXT	Singular vs Contextual Trust Algorithm	The trust algorithm evaluates each request in isolation, or takes subject history and request patterns into account for...
SP800-207-TA-CRITERIA	Criteria-Based vs Score-Based Trust Algorithm	The trust algorithm either requires a set of qualifying criteria to be met, or computes a single confidence score evalua...

NIST SP 800-207: Asset Management

5 controls

Information asset management (NIST SP 800-207)

Controls in the NIST SP 800-207: Asset Management domain of NIST SP 800-207: 5 controls
Code	Title	Description
SP800-207-DEP-AGENT	Device Agent/Gateway-Based Deployment	Splits the policy enforcement point between a device-installed agent and a resource-side gateway that connect only after...
SP800-207-DEP-ENCLAVE	Enclave-Based Deployment	Places a gateway PEP at the boundary of a resource enclave (a group of resources), suitable for legacy applications or o...
SP800-207-SUP-IDM	Identity Management System	Creates, stores, and manages enterprise user accounts and identity records, including the subject attributes used by the...
SP800-207-SUP-PKI	Enterprise Public Key Infrastructure (PKI)	Generates and logs certificates issued by the enterprise to resources, subjects, services, and applications.
SP800-207-SUP-SIEM	Security Information and Event Management (SIEM) System	Collects security-centric information for analysis to refine policies and warn of possible active attacks against enterp...

NIST SP 800-207: Communications Security

5 controls

Network and communications security (NIST SP 800-207)

Controls in the NIST SP 800-207: Communications Security domain of NIST SP 800-207: 5 controls
Code	Title	Description
SP800-207-MIG-ACTORS	Migration Step: Identify Actors on the Enterprise	Catalog the subjects (human users and non-person entities) and their privileges as a precursor to developing a zero trus...
SP800-207-MIG-ASSETS	Migration Step: Identify Assets Owned by the Enterprise	Inventory and monitor enterprise-owned and non-enterprise assets, including hardware, digital artifacts, and their curre...
SP800-207-MIG-POLICY	Migration Step: Formulate Policies for the ZTA Candidate	Define the criteria and subject/resource attributes the policy engine uses to grant or deny access for the candidate res...
SP800-207-MIG-PROCESS	Migration Step: Identify Key Processes and Evaluate Risks	Identify business processes and data flows, evaluate their risk, and prioritize which to migrate to ZTA, often starting...
SP800-207-THR-NPE	Threat: Use of Non-Person Entities (NPE) in ZTA Administration	The risk associated with automated agents (NPEs) configuring and enforcing policy, including false positives and false n...

NIST SP 800-207: Cryptography

5 controls

Cryptographic controls (NIST SP 800-207)

Controls in the NIST SP 800-207: Cryptography domain of NIST SP 800-207: 5 controls
Code	Title	Description
SP800-207-SC-CONTRACTED	Deployment Scenario: Contracted Services and Nonemployee Access	Applies ZTA to accommodate visitors and contracted service providers who require limited, controlled access to specific...
SP800-207-SC-CROSSENT	Deployment Scenario: Collaboration Across Enterprise Boundaries	Applies ZTA to enable secure resource sharing between two distinct organizations through policies governing cross-enterp...
SP800-207-SC-MULTICLOUD	Deployment Scenario: Multi-cloud / Cloud-to-Cloud Enterprise	Applies ZTA where applications and data sources are hosted across multiple cloud providers, securing direct cloud-to-clo...
SP800-207-SC-PUBLIC	Deployment Scenario: Public- or Customer-Facing Services	Applies ZTA to resources accessed by the general public or registered customers who are not enterprise-managed subjects.
SP800-207-SC-SATELLITE	Deployment Scenario: Enterprise with Satellite Facilities	Applies ZTA to an organization with a headquarters plus geographically dispersed locations and remote workers that have...

NIST SP 800-207: Information Security Policies

5 controls

Organizational information security policies (NIST SP 800-207)

Controls in the NIST SP 800-207: Information Security Policies domain of NIST SP 800-207: 5 controls
Code	Title	Description
SP800-207-SUP-CDM	Continuous Diagnostics and Mitigation (CDM) System	Gathers information about the current state of enterprise assets and applies updates to configuration and software, feed...
SP800-207-SUP-COMPLY	Industry Compliance System	Ensures the enterprise remains compliant with applicable regulatory regimes and supplies the policy rules the enterprise...
SP800-207-SUP-DAP	Data Access Policies	The attributes, rules, and policies about access to enterprise resources that serve as the starting point for authorizin...
SP800-207-SUP-LOGS	Network and System Activity Logs	Aggregates asset logs, network traffic, and resource access actions to provide near real-time feedback on the security p...
SP800-207-SUP-THREAT	Threat Intelligence Feeds	External sources providing information on newly discovered attacks and vulnerabilities to help the policy engine make an...

NIST SP 800-207: Operations Security

6 controls

Secure operations and monitoring (NIST SP 800-207)

Controls in the NIST SP 800-207: Operations Security domain of NIST SP 800-207: 6 controls
Code	Title	Description
SP800-207-THR-CREDS	Threat: Stolen Credentials and Insider Threat	The risk that attackers obtain valid credentials (for example via phishing or social engineering) or that insiders abuse...
SP800-207-THR-DOS	Threat: Denial-of-Service or Network Disruption	The risk that an attacker disrupts or denies access to the policy administrator or PEP, blocking legitimate access decis...
SP800-207-THR-PROPRIETARY	Threat: Reliance on Proprietary Data Formats or Solutions	The risk arising from dependence on proprietary or non-interoperable data formats and components across the ZTA.
SP800-207-THR-STORAGE	Threat: Storage of System and Network Information	The risk that stored monitoring data and network/system information become high-value targets for attackers seeking to m...
SP800-207-THR-SUBVERT	Threat: Subversion of ZTA Decision Process	The risk that the policy engine and policy administrator configuration are improperly accessed or manipulated, corruptin...
SP800-207-THR-VISIBILITY	Threat: Limited Visibility on the Network	The risk that encrypted or unanalyzable traffic limits the enterprise's ability to inspect, analyze, and act on network...

Programme Management

2 controls

Controls in the Programme Management domain of NIST SP 800-207: 2 controls
Code	Title	Description
SP800-207-7.1	Migration Strategy and Roadmap	Adopt zero trust as a staged programme rather than a single deployment. Define a roadmap that prioritizes high value res...
SP800-207-7.2	Interoperability with Existing Controls	Ensure that ZTA integrates with existing security investments including SIEM, EDR, MDM, and ticketing systems. Avoid bui...

Risk

1 controls

Controls in the Risk domain of NIST SP 800-207: 1 controls
Code	Title	Description
SP800-207-6.1	ZTA Threats and Mitigations	Identify and treat threats specific to zero trust deployments, including disruption of the Policy Engine, theft of admin...

Supporting Components

3 controls

Controls in the Supporting Components domain of NIST SP 800-207: 3 controls
Code	Title	Description
SP800-207-3.4	Continuous Diagnostics and Mitigation Inputs	Integrate Continuous Diagnostics and Mitigation data sources so that asset state, software inventory, and vulnerability...
SP800-207-3.5	Identity Management Integration	Treat the Identity Provider as a critical input to the Policy Engine. Maintain accurate user and service identity attrib...
SP800-207-MIG-DEPLOY	Migration Step: Identify Candidate Solutions, Deploy, and Expand	Select ZTA components that fit the workflow, perform initial deployment in monitoring/observation mode, then expand the...

Trust Algorithm

1 controls

Controls in the Trust Algorithm domain of NIST SP 800-207: 1 controls
Code	Title	Description
SP800-207-5.1	Trust Algorithm Documentation	Document the trust algorithm that combines inputs into a decision. Specify which inputs are mandatory, which are weighte...

Your Compliance Coverage

If you comply with NIST SP 800-207, you already cover:

NIST SP 800-53 Rev 5

63%

32 controls mapped

Compare →

NIST SP 800-171

55%

28 controls mapped

Compare →

DoD Zero Trust Reference Architecture

10%

5 controls mapped

Compare →

+ 2 more: ISO 27002:2022 (4%), SWIFT CSCF (2%)

See all 5 mapped frameworks ↓

Maps to 5 other frameworks

51 total controls

NIST SP 800-53 Rev 5

32 source controls mapped|29 target controls covered

63%

NIST SP 800-171

28 source controls mapped|9 target controls covered

55%

DoD Zero Trust Reference Architecture

5 source controls mapped|4 target controls covered

10%

ISO 27002:2022

2 source controls mapped|1 target controls covered

SWIFT CSCF

1 source controls mapped|1 target controls covered

Compare NIST SP 800-207 with NIST SP 800-53 Rev 5

Coverage is not the same as your position

This page shows what NIST SP 800-207 overlaps with in general. Where your organisation actually stands, against the standard you are going for and the certifications you already hold, is a different question. Same graph and the same recorded refutations, scoped to you rather than to a pair.

The Compliance Position Diagnostic, $5,000 fixed, ten business days

What is NIST SP 800-207 and who does it apply to?

NIST SP 800-207 is a compliance framework from United States with 13 domains and 51 controls. Zero Trust Architecture It is used by organisations to establish and maintain compliance with industry standards and regulatory requirements.

What does NIST SP 800-207 actually require?

NIST SP 800-207 has 51 controls organised across 13 domains. The largest domains are Foundational Tenets (7 controls), NIST SP 800-207: Operations Security (6 controls), NIST SP 800-207: Access Control (5 controls). Each control defines specific requirements that organisations must implement to achieve compliance.

If I already comply with another framework, how much of NIST SP 800-207 do I already cover?

NIST SP 800-207 maps to 5 other compliance frameworks. The top mapping partners are NIST SP 800-53 Rev 5 (63% coverage), NIST SP 800-171 (55% coverage), DoD Zero Trust Reference Architecture (10% coverage). Use our comparison tool to explore control-level mappings between frameworks.

How do I implement NIST SP 800-207?

Start your NIST SP 800-207 compliance journey by running a self-assessment on our platform to identify your current compliance posture. Our AI advisory can answer specific questions about NIST SP 800-207 requirements, and cross-framework mapping helps you leverage existing controls from other frameworks you may already comply with. Create a free account to access all 51 controls and track your progress.

Start Your Compliance Journey

Create a free account to run self-assessments, get AI advisory, and track your compliance progress across 1,120 frameworks.

Get Started Free →

Free forever, no credit card required