Can you see your biggest security gaps—and show that they are being addressed?
Zero trust helps turn that question into an operating discipline. It does not mean distrusting every person or buying a single security product. In NIST Special Publication 800-207, zero trust shifts the focus from a static network perimeter to users, assets, and resources. Access is not implicitly trusted because a user or device is on an internal network or owned by the organization. Authentication and authorization are evaluated before a session to a protected resource is established.
That resource-centered approach becomes useful to governance, risk, and compliance teams when security signals are visible, connected to business services, and supported by current evidence. The goal is not simply to collect more alerts. It is to help leaders prioritize risk, assign owners, and verify whether controls are improving.
Zero trust spans five connected pillars
CISA’s Zero Trust Maturity Model Version 2.0 organizes implementation across five pillars:
- Identity: who or what is requesting access, and what level of assurance supports that identity?
- Devices: what is the device’s identity, configuration, health, and security posture?
- Networks: how is traffic segmented, protected, observed, and controlled?
- Applications and workloads: which services are being accessed, how are they protected, and what dependencies do they have?
- Data: what information is involved, how sensitive is it, and what protections follow it?
CISA also describes three capabilities that cut across those pillars: visibility and analytics, automation and orchestration, and governance. This matters because progress in one pillar cannot be evaluated in isolation. A strong identity decision may still leave risk unaddressed if device posture is unknown, application dependencies are not mapped, or sensitive data is not classified.
Visibility should support decisions, not just dashboards
Zero trust visibility is useful when it answers practical governance questions:
- Which critical business service is at risk?
- Who and what can access it?
- Which policies and controls govern that access?
- Where are the largest gaps across identity, devices, networks, applications and workloads, and data?
- Who owns each gap and the decision to accept, mitigate, transfer, or avoid the risk?
- What current evidence demonstrates that remediation is working?
A collection of disconnected tool outputs does not answer those questions on its own. Signals need context: the business service they affect, the control or policy they inform, the risk decision they support, and the evidence that can be reviewed later.
Start with one critical business service
A practical zero trust effort can begin without attempting an enterprise-wide redesign. Select one critical business service and follow its access paths end to end.
- Define the service and its outcome. Identify the mission or business process it supports, the systems and workloads involved, and the data that must be protected.
- Map access. Document human and machine identities, devices, network paths, applications, workloads, administrative interfaces, third parties, and data flows.
- Identify decision points and signals. Record where access is authenticated, authorized, constrained, monitored, and revoked. Note which signals are available and whether they are current enough to support a decision.
- Find and prioritize gaps. Look for excessive privilege, unmanaged devices, weak segmentation, unprotected service-to-service access, incomplete logging, stale accounts, unclassified data, and policies that are not consistently enforced.
- Assign accountable owners. Every material gap needs an owner, a target state, a planned action, and a date for review. Tool ownership is not necessarily risk ownership.
- Verify progress with evidence. Recheck the access path and retain current evidence that the intended control is operating. A completed task or configuration change is not, by itself, proof that risk was reduced.
Connect security signals to governance
Governance keeps zero trust from becoming a collection of isolated technical projects. Policies should define expected access behavior, decision rights, exceptions, review frequency, and evidence requirements across the five pillars. Risk processes should provide a consistent way to prioritize gaps and document treatment decisions. Compliance processes should connect relevant requirements and controls without treating framework alignment as proof that the architecture is effective.
CISA presents maturity as a gradient from traditional through initial and advanced to optimal practices. Organizations can make incremental improvements rather than waiting for every pillar to reach the same stage. The important discipline is to understand dependencies, avoid creating new weaknesses, and measure progress against a defined target state.
Use current evidence to verify improvement
Useful evidence is specific to the control and the service being evaluated. Depending on the gap, that may include access-policy configurations, identity and device inventories, privilege-review records, network-flow observations, application authorization logs, data-classification records, exception approvals, test results, and remediation tickets linked to their validation.
Evidence should show more than activity. It should help a reviewer determine:
- what changed;
- which resource, identity, device, workload, network path, or data set was affected;
- who approved and implemented the change;
- when the control was tested;
- what result was observed; and
- whether any residual risk remains.
That creates a repeatable cycle: map access, identify gaps, assign owners, implement changes, and verify the result with current evidence.
From signals to action
Zero trust becomes visible when technical signals can be traced to a business service, a risk decision, an accountable owner, and reviewable evidence. Starting with one critical service keeps the scope manageable while exposing dependencies across all five pillars.
The question is not whether an organization can display more security data. It is whether leaders can use that data to identify the most important gaps, act on them, and demonstrate that the resulting controls are working.