Zero trust is a security approach built on one idea: never trust a request just because of where it comes from. Every user, device and application has to prove who it is and that it should have access, every time, and gets only the access it needs. This guide explains what zero trust means, why the old “castle and moat” model stopped working, the core principles, the main frameworks and how organizations start.
In one sentence: Zero trust means granting access only after verifying identity, device and context for each request, giving the least access needed and assuming an attacker may already be inside.
The problem with perimeter security
Traditional security worked like a castle with a moat. A firewall protected the edge of the corporate network, and anything inside was largely trusted. That made sense when people worked in the office on company computers and applications ran in the company data center.
That world is gone. People work from home and on phones, applications live in many clouds and SaaS services, and partners connect from outside. Worse, attackers who steal one password or infect one laptop can often move freely once they are “inside”. Many major breaches follow exactly that pattern: one compromised account, then quiet movement to the valuable systems.
What zero trust actually means
The term was popularized around 2010 by analyst John Kindervag at Forrester, and Google’s BeyondCorp program showed it could work at scale. The US National Institute of Standards and Technology (NIST) defined it formally in Special Publication 800-207, Zero Trust Architecture, published in August 2020. NIST describes zero trust as protecting resources on the basis that trust is never granted automatically and must be evaluated continuously.
In practice, three ideas matter most:
- Verify explicitly: decide each access request using identity, device health, location, behavior and the sensitivity of what is being accessed.
- Least privilege: give only the access needed, for only as long as it is needed.
- Assume breach: design as if an attacker is already inside, so that one compromised account or device cannot reach everything.
How a zero trust decision works
NIST describes a simple pattern. Every request to a resource passes through a policy enforcement point (for example an identity-aware proxy or gateway). It asks a policy decision point whether to allow the request. The decision point weighs the signals and policy, then says allow, deny or ask for more proof, such as a second factor.
| Signal | Example question |
|---|---|
| Identity | Is this really Priya, verified with phishing-resistant MFA? |
| Device | Is her laptop managed, encrypted and up to date? |
| Context | Is the location, time and behavior normal for her? |
| Resource | How sensitive is the payroll system she is asking for? |
| Policy | Does her role allow this action, right now? |
The CISA Zero Trust Maturity Model
To help organizations plan, the US Cybersecurity and Infrastructure Security Agency (CISA) published the Zero Trust Maturity Model, with version 2.0 released in April 2023. It organizes zero trust into five pillars:
- Identity: strong authentication, single sign-on and risk-based access.
- Devices: knowing and checking every device that connects.
- Networks: segmenting networks and encrypting traffic.
- Applications and workloads: securing access to apps and the workloads behind them.
- Data: classifying, protecting and monitoring data.
Three capabilities cut across all pillars: visibility and analytics, automation and orchestration, and governance. The model describes four maturity stages for each pillar: Traditional, Initial, Advanced and Optimal.
Zero trust is a journey, not a product
Many vendors sell “zero trust” products, but no single product delivers it. Zero trust is an architecture and a way of working that you build up step by step. Common first steps include:
- Strong, phishing-resistant MFA for everyone, starting with administrators.
- Single sign-on through one identity provider, so access can be controlled and revoked in one place.
- Device checks before access to sensitive applications.
- Replacing broad VPN access with per-application access (often called zero trust network access).
- Segmenting networks so critical systems are isolated.
- Privileged access management for admin accounts, with just-in-time access.
- Central logging and monitoring, so unusual behavior is spotted fast.
Zero trust for SAP and business systems
Business systems such as SAP hold the most valuable data, so they are prime candidates for zero trust. That means users reach SAP through single sign-on with strong authentication, SAP servers sit in protected network segments, administrator and emergency access are tightly controlled and logged, and SAP security logs feed the security monitoring platform. Roles and authorizations inside SAP are the final layer of least privilege.
Frequently asked questions
Does zero trust mean we don’t trust our employees?
No. It means the system does not assume a request is safe just because it comes from inside the network. It protects employees too, because a stolen password alone is no longer enough.
Do we still need firewalls?
Yes. Firewalls and segmentation remain useful layers; zero trust simply stops relying on the network edge as the main control.
How long does zero trust take?
It is a multi-year program for most organizations, but early steps such as MFA and single sign-on bring big risk reductions within months.
Is zero trust required by law?
US federal agencies are required to move toward zero trust, and many regulations and frameworks encourage its principles, but for most private organizations it is a best practice rather than a specific legal requirement.
The bottom line
Zero trust replaces “trusted inside, untrusted outside” with continuous verification, least privilege and an assume-breach mindset. NIST SP 800-207 defines it, and the CISA maturity model gives a roadmap across identity, devices, networks, applications and data. Start with identity and the most valuable systems, and build from there.
