CoChat
Sign Up
Cited by 1,174Access Control and TrustInformation and Cyber SecuritySecurity and Verification in Computing

The DOI matches its Crossref record; 21 of the 22 references it cites were found in a registry or an index; none of the 37 sources its claims cite is checked for support yet.

Zero Trust Architecture

Open access
Rose, Scott, Borchert, Oliver, Mitchell, Stu, Connelly, Sean·2020
DOI 10.6028/nist.sp.800-207

Published version of a preprint

Open this paper in CoChat — free account

Abstract

The Information Technology Laboratory (ITL) at the National Institute of Standards and Technology (NIST) promotes the U.S. economy and public welfare by providing technical leadership for the Nation's measurement and standards infrastructure. ITL develops tests, test methods, reference data, proof of concept implementations, and technical analyses to advance the development and productive use of information technology. ITL's responsibilities include the development of management, administrative, technical

Overview

Integrity signals

Registry

Crossref · 10.6028/nist.sp.800-207

Cites

21 of 21 references verified0 citation errors · 0 not checkable

Statistics

Nothing to recompute.

Verification

Claims the paper makes

0 of 37 cited sources checked · 0 supported · 0 flagged

Show all 36 claims

  • Probably not a substantial claim. 258
  • It may state two separate claims as one. 72
273 of 273

  • The authors state this as an assumption.

    Zero trust security models assume that an attacker is present in the environment.

    “Zero trust security models assume that an attacker is present in the environment and that an enterprise-owned environment is no different-or no more trustworthy-than any nonenterprise-owned environment.”

  • The authors state this as an assumption.

    An enterprise-owned environment is no different or no more trustworthy than any nonenterprise-owned environment.

    “Zero trust security models assume that an attacker is present in the environment and that an enterprise-owned environment is no different-or no more trustworthy-than any nonenterprise-owned environment.”

  • The authors state this as an assumption.

    The entire enterprise private network is not considered an implicit trust zone.

    “The entire enterprise private network is not considered an implicit trust zone.”

  • The authors state this as an assumption.

    Assets should always act as if an attacker is present on the enterprise network.

    “Assets should always act as if an attacker is present on the enterprise network, and communication should be done in the most secure manner available (see tenet 2 above).”

  • The authors state this as an assumption.

    Communication should be done in the most secure manner available.

    “Assets should always act as if an attacker is present on the enterprise network, and communication should be done in the most secure manner available (see tenet 2 above).”

  • The authors state this as an assumption.

    Devices on the network may not be owned or configurable by the enterprise.

    “Devices on the network may not be owned or configurable by the enterprise.”

  • The authors state this as an assumption.

    No resource is inherently trusted.

    “No resource is inherently trusted.”

  • The authors state this as an assumption.

    Every asset must have its security posture evaluated via a PEP before a request is granted to an enterprise-owned resource.

    “Every asset must have its security posture evaluated via a PEP before a request is granted to an enterprise-owned resource (similar to tenet 6 above for assets as well as subjects).”

  • The authors state this as an assumption.

    This evaluation should be continual for as long as the session lasts.

    “This evaluation should be continual for as long as the session lasts.”

  • The authors state this as an assumption.

    Enterprise-owned devices may have artifacts that enable authentication and provide a confidence level higher than the same request coming from nonenterprise-owned devices.

    “Enterprise-owned devices may have artifacts that enable authentication and provide a confidence level higher than the same request coming from nonenterpriseowned devices.”

  • The authors state this as an assumption.

    Subject credentials alone are insufficient for device authentication to an enterprise resource.

    “Subject credentials alone are insufficient for device authentication to an enterprise resource.”

  • The authors state this as an assumption.

    Not all enterprise resources are on enterprise-owned infrastructure.

    “Not all enterprise resources are on enterprise-owned infrastructure.”

  • The authors state this as an assumption.

    Remote enterprise subjects and assets cannot fully trust their local network connection.

    “Remote enterprise subjects and assets cannot fully trust their local network connection.”

  • The authors state this as an assumption.

    Remote subjects should assume that the local (i.e., nonenterprise-owned) network is hostile.

    “Remote subjects should assume that the local (i.e., nonenterprise-owned) network is hostile.”

  • The authors state this as an assumption.

    Assets should assume that all traffic is being monitored and potentially modified.

    “Assets should assume that all traffic is being monitored and potentially modified.”

  • The authors state this as an assumption.

    All connection requests should be authenticated and authorized.

    “All connection requests should be authenticated and authorized, and all communications should be done in the most secure manner possible (i.e., provide confidentiality, integrity protection, and source authentication).”

  • The authors state this as an assumption.

    All communications should be done in the most secure manner possible.

    “All connection requests should be authenticated and authorized, and all communications should be done in the most secure manner possible (i.e., provide confidentiality, integrity protection, and source authentication).”

  • The authors state this as an assumption.

    Assets and workflows moving between enterprise and nonenterprise infrastructure should have a consistent security policy and posture.

    “Assets and workflows moving between enterprise and nonenterprise infrastructure should have a consistent security policy and posture.”

  • The authors state this as an assumption.

    Assets and workloads should retain their security posture when moving to or from enterprise-owned infrastructure.

    “Assets and workloads should retain their security posture when moving to or from enterprise-owned infrastructure.”

  • The paper relies on this without support.

    Most organizations already have some elements of zero trust in their enterprise infrastructure or are on their way through implementation of information security and resiliency policies and best practices.

    “Most organizations already have some elements of zero trust in their enterprise infrastructure or are on their way through implementation of information security and resiliency policies and best practices.”

  • The paper relies on this without support.

    ZTA has its roots in organizations that are geographically distributed and/or have a highly mobile workforce.

    “ZTA has its roots in organizations that are geographically distributed and/or have a highly mobile workforce.”

  • The paper relies on this without support.

    The most common scenario involves an enterprise with a single headquarters and one or more geographically dispersed locations that are not joined by an enterprise-owned physical network connection.

    “The most common scenario involves an enterprise with a single headquarters and one or more geographically dispersed locations that are not joined by an enterprise-owned physical network connection (see Figure 8).”

  • The paper relies on this without support.

    One increasingly common use case for deploying a ZTA is an enterprise utilizing multiple cloud providers.

    “One increasingly common use case for deploying a ZTA is an enterprise utilizing multiple cloud providers (see Figure 9).”

  • The paper relies on this without support.

    Another common scenario is an enterprise that includes on-site visitors and/or contracted service providers that require limited access to enterprise resources to do their work.

    “Another common scenario is an enterprise that includes on-site visitors and/or contracted service providers that require limited access to enterprise resources to do their work (see Figure 10).”

  • The paper relies on this without support.

    A common feature in many enterprises is a public-facing service that may or may not include user registration.

    “A common feature in many enterprises is a public-facing service that may or may not include user registration (i.e., users must create or have been issued a set of login credentials).”

  • The paper relies on this without support.

    In some ZT product offerings currently available on the market, the PE and PA components are combined in a single service.

    “In some ZT product offerings currently available on the market, the PE and PA components are combined in a single service.”

  • The paper relies on this without support.

    Different cloud providers have unique ways of implementing similar functionality.

    “One challenge is that different cloud providers have unique ways of implementing similar functionality.”

  • The paper relies on this without support.

    Some deployment models are better suited to particular workflows and current enterprise ecosystems.

    “Some deployment models (see Section 3.1) are better suited to particular workflows and current enterprise ecosystems.”

  • The paper relies on this without support.

    Some vendor solutions are better suited to some use cases than others.

    “Likewise, some vendor solutions are better suited to some use cases than others.”

  • The paper relies on this without support.

    Few enterprise policy sets are complete in their first iterations.

    “Few enterprise policy sets are complete in their first iterations: important user accounts (e.g., administrator accounts) may be denied access to resources they need or may not need all the access privileges they have been assigned.”

  • The paper relies on this without support.

    Important user accounts may be denied access to resources they need or may not need all the access privileges they have been assigned.

    “Few enterprise policy sets are complete in their first iterations: important user accounts (e.g., administrator accounts) may be denied access to resources they need or may not need all the access privileges they have been assigned.”

  • The paper relies on this without support.

    Many of the concepts and ideas of zero trust have been circulating for a long time.

    “Zero trust should instead be viewed as an evolution of current cybersecurity strategies as many of the concepts and ideas have been circulating for a long time.”

  • The paper relies on this without support.

    Determined attackers will not sit idle but will instead change behavior in the face of ZTA.

    “However, determined attackers will not sit idle but will instead change behavior in the face of ZTA.”

  • The paper relies on this without support.

    Cloud services can become unreachable through either an attack or simple error.

    “Most products and services surveyed relied on a cloud presence to provide robustness, but even cloud services have been known to become unreachable through either an attack or simple error.”
34 of 34

Claims other papers make about this one

Each is checked against this paper’s own text: does it say what the citing paper says it does?

Self-check

Percentages, sums and reported differences re-computed from the paper’s own numbers.

Each contradiction between two passages listed here was confirmed by an independent check.

  • Device agent is placed on opposite sides of the connection

    Minor

    The deployment description places both PEP components at or in front of the resource, but its example places the device agent on the client asset and the gateway in front of the resource.

1 of 1

Citations

Cites

Flagged first, then by citations

Show all 22 references

1 of the 22 references couldn’t be matched to a known paper.

Cited by

Sorted by citations

Items 501–600 of 1,065

Related

See all

Metadata

Authors
Rose, S., Borchert, O., Mitchell, S., & Connelly, S.
ORCID
Publisher
National Institute of Standards and Technology
Published
2020-08-11
DOI
10.6028/nist.sp.800-207
OpenAlex
W2976189582
Cited by
1,174
References
22
Citations by year
2026: 404 · 2025: 270 · 2024: 168 · 2023: 152 · 2022: 104 · 2021: 63 · 2020: 13
Type
report
Language
en
Open access
Funders
National Institute of Standards and Technology
Topics
  • Physical Sciences › Computer Science › Computer Networks and Communications › Access Control and Trust
  • Physical Sciences › Computer Science › Information Systems › Information and Cyber Security
  • Physical Sciences › Computer Science › Hardware and Architecture › Security and Verification in Computing
Keywords
zero-trust architecture, information security, access control, network partitioning, federal information systems

About these checks

Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.

A language model drew the claims from the paper on 2026-10-11, under version 3 of the claim definition (model deepseek-v4.1-flash, prompt extract-v3).

A second model labelled each claim on 2026-10-11 (model jev-1.13-20260917, definition revision gold-guideline-v0.2).

Statistics and arithmetic are recomputed, not judged.

Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.

What counts as a claim ›How we measure confidence ›How we check this ›

Are you an author, or do you see a problem with this page? Request a review