Zero Trust Architecture
Open accessPreprint — published as 10.6028/nist.sp.800-207 · Paper page
Abstract
This publication has been developed by NIST in accordance with its statutory responsibilities under the Federal Information Security Modernization Act (FISMA) of 2014, 44 U.S.C. § 3551 et seq., Public Law (P.L.) 113-283.NIST is responsible for developing information security standards and guidelines, including minimum requirements for federal information systems, but such standards and guidelines shall not apply to national security systems without the express approval of appropriate federal officials exercising policy authority over such systems.This guideline is consistent with the requirements of the Office of Management and Budget (OMB) Circular A-130.Nothing in this publication should be taken to contradict the standards and guidelines made mandatory and binding on federal agencies by the Secretary of Commerce under statutory authority.Nor should these guidelines be interpreted as altering or superseding the existing authorities of the Secretary of Commerce,
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
The Zero Trust security model is emerging as a paradigm shift for cybersecurity and is adopted by the most mature actors from companies to nations.
“the Zero Trust security model is emerging [4] as a paradigm shift for cybersecurity that is adopted by the most mature actors from companies to nations [5-7].”
From Flexible zero trust architecture for the cybersecurity of industrial IoT infrastructures (2024) · cites this paper as [5]
The Introduction (page not provided) calls Zero Trust Architecture a new paradigm for enterprise network security, and §1.1 says federal agencies have been moving toward zero-trust principles. The paper does not establish that the most mature actors, from companies to nations, have adopted the model; §7 instead describes implementation as an incremental journey. (LLM, conf=0.84)
Experimental — accuracy not yet measuredOur approach is based on a modified logical model of the ZTA defined by the National Institute of Standards and Technology (NIST).
“Given these design constraints, our approach is based on a modified logical model of the ZTA defined by the National Institute of Standards and Technology (NIST) [5].”
From Flexible zero trust architecture for the cybersecurity of industrial IoT infrastructures (2024) · cites this paper as [5]
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
The self-check needs the paper’s full text.
No citation lists for this paper
No citation lists for this paper yet — checked again daily.
References 11 · Cited by 132
Research works printed but not linked: 10
- Anderson B, McGrew D (2017) Machine Learning for Encrypted Malware Traffic Classification: Accounting for Noisy Labels and Non- Stationarity. Proceedings of the 23rd ACM SIGKDD International Conference on Knowledge Discovery and Data Mining (ACM, Halifax, Nova Scotia, Canada), pp 1723-1732. https://doi.org/10.1145/3097983.3098163 · DOI · Paper page
- Gilman E, Barth D (2017) Zero Trust Networks: Building Secure Systems in Untrusted Networks (O'Reilly Media, Inc., Sebastopol, CA), 1st Ed.
- Ferraiolo DF, Gavrila S, Jansen W (2015) Policy Machine: Features, Architecture, and Specification. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Interagency or Internal Report (IR) 7987, Rev. 1. https://doi.org/10.6028/NIST.IR.7987r1 · DOI
- Grassi PA, Garcia ME, Fenton JL (2017) Digital Identity Guidelines. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) 800-63-3, Includes updates as of December 1, 2017. https://doi.org/10.6028/NIST.SP.800-63-3 · DOI
- Grassi PA, Fenton JL, Lefkovitz NB, Danker JM, Choong Y-Y, Greene KK, Theofanos MF (2017) Digital Identity Guidelines: Enrollment and Identity Proofing. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) 800-63A, Includes updates as of December 1, 2017. https://doi.org/10.6028/NIST.SP.800- 63A [SP800-160] · DOI
- Hu VC, Ferraiolo DF, Kuhn R, Schnitzer A, Sandlin K, Miller R, Scarfone KA (2014) Guide to Attribute Based Access Control (ABAC) Definition and Considerations. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) 800-162, Includes updates as of February 25, 2019. https://doi.org/10.6028/NIST.SP.800-162 · DOI · Paper page
- Cam-Winget N (ed.), Appala S, Pope S, Saint-Andre P (2019) Using Extensible Messaging and Presence Protocol (XMPP) for Security Information Exchange. (Internet Engineering Task Force (IETF)), IETF Request for Comments (RFC) 8600. https://doi.org/10.17487/RFC8600 · DOI
- Stanton B, Theofanos MF, Spickard Prettyman S, Furman S (2016) Security Fatigue. IT Professional 18(5):26-32. https://doi.org/10.1109/MITP.2016.84 · DOI
- Strouble D, Shechtman GM, Alsop AS (2009) Productivity and Usability Effects of Using a Two-Factor Security System. SAIS 2009 Proceedings (AIS, Charleston, SC), p 37. Available at http://aisel.aisnet.org/sais2009/37
- Weidman J, Grossklags J (2017) I Like It but I Hate It: Employee Perceptions Towards an Institutional Transition to BYOD Second-Factor Authentication. Proceedings of the 33rd Annual Computer Security Applications Conference (ACSAC 2017) (ACM, Orlando, FL), pp 212-224. https://doi.org/10.1145/3134600.3134629 · DOI
- Authors
- Rose, S., Borchert, O., Mitchell, S., & Connelly, S.
- Affiliations
- Information Technology Laboratory (US)
- Published
- 2019-09-23
- OpenAlex
- W4252307542
- Cited by
- 132
- References
- 11
- Citations by year
- 2025: 6 · 2024: 35 · 2023: 35 · 2022: 31 · 2021: 20 · 2020: 4 · 2019: 1
- Type
- posted content
- Language
- en
- Open access
- green
- doi.org
- Funders
- Information Technology Laboratory
- Topics
- Social Sciences › Sociology and Political Science › Access Control and Trust
- Physical Sciences › Computer Science › Information Systems › Information and Cyber Security
- Physical Sciences › Computer Science › Artificial Intelligence › Security and Verification in Computing
- Keywords
- zero-trust architecture, network security, access control, identity and access management, information security standards, federal information systems, FISMA
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
