U.S. Federal Agencies Push Zero Trust Security Model

The U.S. Office of Management and Budget (OMB) memo M-22-09 requires federal agencies to adopt a Zero Trust security architecture by the end of fiscal year 2024. The model, defined in NIST Special Publication 800‑207, removes implicit trust and verifies every user, device, and connection. The Cybersecurity and Infrastructure Security Agency (CISA) provides a Zero Trust Maturity Model that organizes implementation into five pillars—Identity, Device, Network, Application/Workload, and Data—each with three maturity stages (Traditional, Advanced, Optimal). In its final series installment, CISA details the Data pillar, emphasizing inventory management, access determination, encryption, tagging, and automation to protect data at rest, in motion, and in use.

The guidance advises agencies to integrate best‑of‑breed solutions across layers, using metadata and classification to inform role‑based or attribute‑based access controls, thereby achieving higher maturity and stronger overall security.