Zero Trust Architecture
Open accessPreprint — published as 10.6028/nist.sp.800-207 · Paper page
Abstract
This publication has been developed by NIST in accordance with its statutory responsibilities under the Federal Information Security Modernization Act (FISMA) of 2014, 44 U.S.C. § 3551 et seq., Public Law (P.L.) 113-283.NIST is responsible for developing information security standards and guidelines, including minimum requirements for federal information systems, but such standards and guidelines shall not apply to national security systems without the express approval of appropriate federal officials exercising policy authority over such systems.This guideline is consistent with the requirements of the Office of Management and Budget (OMB) Circular A-130.Nothing in this publication should be taken to contradict the standards and guidelines made mandatory and binding on federal agencies by the Secretary of Commerce under statutory authority.Nor should these guidelines be interpreted as altering or superseding the existing authorities of
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
MASEC's anticipatory stance mirrors a well-documented shift in traditional cybersecurity: the evolution from post-hoc anti-malware toward default-deny, least-privilege, and zero-trust architectures.
“MASEC's anticipatory stance mirrors a well-documented shift in traditional cybersecurity: the evolution from post-hoc anti-malware toward default-deny, least-privilege, and zero-trust architectures (Saltzer & Schroeder, 1975;Rose et al., 2020).”
From Open Challenges in Multi-Agent Security: Towards Secure Systems of Interacting AI Agents (2025) · cites this paper as Rose et al., 2020
Section 1.1 describes an evolution from perimeter-based security toward zero trust, and Section 2 describes least-privilege access and authorization before access is allowed. The paper does not describe that evolution as a move away from post-hoc anti-malware; it identifies perimeter-based security as the earlier model. (LLM, conf=0.87)
Experimental — accuracy not yet measuredIn Zero Trust, all claims must be corroborated.
“All claims must be corroborated.”
From Zero-Trust Principles for Legacy Components: 12 Rules for Legacy Devices: An Antidote to Chaos (2021) · cites this paper as [2]
In Zero Trust, there should be no trust assumed due to the location of a node or entity.
“In particular, there should be no trust assumed due to the location of a node or entity.”
From Zero-Trust Principles for Legacy Components: 12 Rules for Legacy Devices: An Antidote to Chaos (2021) · cites this paper as [2]
A Zero Trust architecture addresses the perimeter security problem by focusing on protecting resources, not network perimeters.
“A ZT architecture addresses this problem by focusing on protecting resources, not network perimeters.”
From Zero-Trust Principles for Legacy Components: 12 Rules for Legacy Devices: An Antidote to Chaos (2021) · cites this paper as [2]
In Zero Trust, trustworthiness is no longer associated with location (inside a network perimeter or not).
“The trustworthiness is no longer associated with location (inside a network perimeter or not).”
From Zero-Trust Principles for Legacy Components: 12 Rules for Legacy Devices: An Antidote to Chaos (2021) · cites this paper as [2]
In Zero Trust, there should be no 'blind' or unspoken/assumed trust.
“That is, there should be no”
From Zero-Trust Principles for Legacy Components: 12 Rules for Legacy Devices: An Antidote to Chaos (2021) · cites this paper as [2]
The concept of Zero Trust is not about zero trust per se, but rather about unwarranted trust.
“The concept is not about zero trust per se, but rather about unwarranted trust.”
From Zero-Trust Principles for Legacy Components: 12 Rules for Legacy Devices: An Antidote to Chaos (2021) · cites this paper as [2]
The NIST-defined ZTA places a lot of significance on identifying work flows and data flows, including a focus on assets and threats to assets.
“The NIST defined ZTA places a lot of significance on identifying work flows and data flows.This includes a focus on assets and on threats to the assets.”
From Zero-Trust Principles for Legacy Components: 12 Rules for Legacy Devices: An Antidote to Chaos (2021) · cites this paper as [2]
The basics of NIST ZTA include entity identification, entity authentication, access control, separate and segment resources, and logging/log handling.
“-Entity identification -Entity authentication -Access control (authorization) -Separate and segment the resources -Logging and log handling (monitoring)”
From Zero-Trust Principles for Legacy Components: 12 Rules for Legacy Devices: An Antidote to Chaos (2021) · cites this paper as [2]
An important ZT concept is separation and segmentation.
“An important ZT concept is that of separation and segmentation.”
From Zero-Trust Principles for Legacy Components: 12 Rules for Legacy Devices: An Antidote to Chaos (2021) · cites this paper as [2]
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
The self-check needs the paper’s full text.
Cites
Guide to Attribute Based Access Control (ABAC) Definition and Considerations
Hu, V. C., Ferraiolo, D., Kuhn, R., Schnitzer, A., Sandlin, K., Miller, R., & Scarfone, K. (2014) · doi:10.6028/nist.sp.800-162 · Cited by 917 · see citing works
Anderson, B., & McGrew, D. (2017) · Proceedings of the 23rd ACM SIGKDD International Conference on Knowledge Discovery and Data Mining · doi:10.1145/3097983.3098163 · Cited by 295 · see citing works
Standards for security categorization of federal information and information systems
National Institute of Standards and Technology (US) (2004) · doi:10.6028/nist.fips.199 · Cited by 284 · see citing works
Joint Task Force Transformation Initiative (2018) · doi:10.6028/nist.sp.800-37r2 · Cited by 237 · see citing works
Digital identity guidelines: revision 3
Grassi, P. A., Garcia, M. E., & Fenton, J. L. (2017) · doi:10.6028/nist.sp.800-63-3 · Cited by 230 · see citing works
Stanton, B. C., Theofanos, M. F., Prettyman, S. S., & Furman, S. (2016) · IT Professional · doi:10.1109/mitp.2016.84 · Cited by 129 · see citing works
An introduction to privacy engineering and risk management in federal systems
Brooks, S., Garcia, M. E., Lefkovitz, N. B., Lightman, S., & Nadeau, E. M. (2017) · doi:10.6028/nist.ir.8062 · Cited by 101 · see citing works
SDN: Software Defined Networks: An Authoritative Review of Network Programmability Technologies
Nadeau, T. D., & Gray, K. (2013) · Cited by 59 · see citing works
Digital identity guidelines: enrollment and identity proofing
Grassi, P. A., Fenton, J. L., Lefkovitz, N. B., et al. (2017) · doi:10.6028/nist.sp.800-63a · Cited by 51 · see citing works
An intent-based approach for network virtualization
Cohen, R., Barabash, K., Rochwerger, B., Schour, L., Crisan, D., Birke, R., Minkenberg, C., Gusat, M., Recio, R. J., & Jain, V. (2013) · IFIP/IEEE International Symposium on Integrated Network Management (IM) · Cited by 44 · see citing works
Policy Machine: Features, Architecture, and Specification
Ferraiolo, D. F., Gavrila, S. I., Jansen, W., & Stutzman, P. E. (2015) · doi:10.6028/nist.ir.7987r1 · Cited by 41 · see citing works
Zero Trust Networks: Building Secure Systems in Untrusted Networks
Barth, D., & Gilman, E. (2017) · Cited by 41 · see citing works
Weidman, J., & Großklags, J. (2017) · Annual Computer Security Applications Conference · doi:10.1145/3134600.3134629 · Cited by 27 · see citing works
PRODUCTIVITY AND USABILITY EFFECTS OF USING A TWO-FACTOR SECURITY SYSTEM
Strouble, D., Alan, M., & Alsop, S. (2009) · Journal of the Association for Information Systems · Cited by 22 · see citing works
Using Extensible Messaging and Presence Protocol (XMPP) for Security Information Exchange
Appala, S., Pope, S., & Saint-Andre, P. (2019) · doi:10.17487/rfc8600 · Cited by 4 · see citing works
Flagged first, then by citations
Research works printed but not linked: 1
- [22]22. Grassi PA, Garcia ME, Fenton JL (2017) Digital Identity Guidelines. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) 800-63-3, Includes updates as of December 1, 2017. https://doi.org/10.6028/NIST.SP.800-63-3 [SP800-160] · DOI
Cited by
Sorted by citations
Rose, S., Borchert, O., Mitchell, S., & Connelly, S. (2020) · doi:10.6028/nist.sp.800-207 · Cited by 1,174 · see citing works
Self-citationA Survey on Zero Trust Architecture: Challenges and Future Trends
He, Y., Huang, D., Chen, L., Ni, Y., & Ma, X. (2022) · Wireless Communications and Mobile Computing · doi:10.1155/2022/6476274 · Cited by 260 · see citing works
Zero-Trust Principles for Legacy Components: 12 Rules for Legacy Devices: An Antidote to Chaos
Køien, G. M. (2021) · Wireless Personal Communications · doi:10.1007/s11277-021-09055-1 · Cited by 24 · see citing works
Min, C.-H., Kim, D.-H., Yang, H., & Kwak, J. (2025) · Electronics · doi:10.3390/electronics14204109 · Cited by 5 · see citing works
Open Challenges in Multi-Agent Security: Towards Secure Systems of Interacting AI Agents
de Witt, C. S., Krawiecka, K., Krawczuk, I., Hagag, B., Anderson, W. L., Belcak, P., Bucknall, B., Cai, X., Chopra, A., Cohen, D., et al. (2025) · arXiv · doi:10.48550/arxiv.2505.02077 · Cited by 2 · see citing works
Entre Códigos y Corazones: Investigación e Inteligencia Artificial hacia una Tecnología más Humana
Garcia-Heredia, N. B., & Mujica-Sequera, R. M. (2025) · Revista Docentes 2.0 · doi:10.37843/rted.v18i2.724
- Authors
- Rose, S., Borchert, O., Mitchell, S., & Connelly, S.
- Published
- 2020-02-13
- OpenAlex
- W3005594826
- Cited by
- 239
- References
- 15
- Citations by year
- 2026: 110 · 2025: 46 · 2024: 27 · 2023: 29 · 2022: 14 · 2021: 7 · 2020: 6
- Type
- posted content
- Language
- en
- Open access
- green
- doi.org
- Funders
- Information Technology Laboratory
- Topics
- Social Sciences › Sociology and Political Science › Access Control and Trust
- Physical Sciences › Computer Science › Information Systems › Information and Cyber Security
- Physical Sciences › Computer Science › Artificial Intelligence › Security and Verification in Computing
- Keywords
- zero-trust architecture, information security, access control, network partitioning, federal information systems
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
