Score every domain, never average maturity
Score the five pillars and three cross-cutting capabilities separately. Then prioritize the weakest risk paths instead of assigning one overall label.
- Set the scope: business units, cloud tenants, remote users, privileged accounts, and sensitive data.
- Score each domain as Traditional, Initial, Advanced, or Optimal using observed controls.
- Attach evidence, coverage rates, policy results, and approved exceptions to every score.
- Rank gaps by business impact, exposure, and the strength of the missing control.
- Fund a 30/60/90-day plan. Rescore only after evidence changes.
For organizations in Washington, D.C. that support federal agencies: OMB Memorandum M-22-09 applies directly to federal agencies. It does not automatically apply to private contractors. Contract clauses, agency system rules, and Federal Information Security Modernization Act (FISMA) obligations may create similar duties. Check the contract and system authorization boundary before copying federal targets.
CISA Zero Trust Model (ZTMM) Version 2.0 is a voluntary framework. It helps organizations describe current Zero Trust capabilities, find gaps, and plan improvements.
It covers five pillars and three cross-cutting capabilities. CISA released v2.0 in April 2023. It keeps the core structure from v1.0 and updates guidance for the federal Zero Trust strategy.
It is not a certification standard. It does not replace system-specific risk decisions.
Federal agencies use it alongside the outcomes and reporting direction in OMB M-22-09. Nonfederal organizations can use it as a planning baseline. Federal deadlines and targets do not automatically apply to them.
Build an evidence matrix for eight domains
An evidence matrix turns CISA guidance into an assessment teams can repeat. Auditors can also test the assessment.
A tool inventory is not enough. For every domain, record a policy artifact, coverage report, test result, exception record, and named owner.
A reasonable first sample includes 10 to 25 privileged accounts. It also includes 5 to 10 critical applications. Expand the sample where failures appear.
Evidence makes each maturity score defensible.
| Sheet column | Record | Evidence to attach |
|---|
| Domain and capability | Identity, Data, Governance, or another domain | Scope definition and system list |
| Current level | Traditional through Optimal | Control test and dated report |
| Coverage and owner | Percent in scope and accountable leader | EDR, MFA, SIEM, or data report |
| Gap and target date | Missing enforcement or telemetry | Exception approval and retest result |
| Level | Control condition | Evidence artifact | Expected result |
|---|
| Traditional | Manual or location-based access | Static policy and ticket sample | Limited context at access time |
| Initial | Modern control covers part of scope | MFA or EDR coverage report | Known exclusions remain |
| Advanced | Context-aware policy is broadly enforced | Policy logs and test samples | Access changes with risk signals |
| Optimal | Automated adaptation is measured | SOAR actions and outcome trends | Continuous verification improves policy |
A useful matrix needs different control tests for each domain. Do not apply one generic description to all eight.
For Identity, test MFA coverage and phishing-resistant authentication for privileged accounts. Also test lifecycle governance and conditional policy enforcement.
For Devices, validate the managed-device inventory, EDR coverage, patch status, and device-risk signals. For Networks, validate segmentation and encrypted traffic enforcement.
Applications and Workloads should show workload identity, secure delivery, and runtime monitoring. Data should show classification, access decisions, encryption, and data security controls.
For Visibility and Analytics, assess SIEM telemetry quality. For Automation and Orchestration, assess automated response outcomes. For Governance, assess owners, risk decisions, and exception review records.
Turn evidence gaps into a 30/60/90-day plan
A 30/60/90-day plan should fix paths that let attackers bypass several controls. It should not simply raise the lowest score.
From evidence to prioritized remediation
1. Scope→2. Score→3. Prove→4. Rank risk→5. Retest
Keep eight separate scores. Do not convert them into one maturity average.
In the first 30 days, confirm the asset and identity scope. Require MFA for priority accounts, name evidence owners, and document exceptions.
By day 60, tighten ICAM lifecycle rules. Expand EDR and SIEM telemetry. Test least privilege on critical roles.
By day 90, automate repeatable response through Security Orchestration, Automation, and Response (SOAR). Retest data controls and update scores only when results support them.
Fix the paths that create the widest attacker access first.
| Source | Primary purpose | Best use |
|---|
| CISA ZTMM v2.0 | Maturity assessment | Evidence and phased improvement |
| NIST SP 800-207 | Architecture concepts | Design decisions for ZTA |
| OMB M-22-09 | Federal direction | Agency requirements and reporting |
| Microsoft model | Product-oriented guidance | Microsoft ecosystem planning |
Errors that weaken the result
Do not use this model instead of risk analysis, a compliance audit, a penetration test, or architecture design. It also fits poorly when a startup or isolated environment lacks critical assets, remote users, material SaaS use, or segmentation needs.
A repeatable Zero Trust assessment can use an unofficial Excel or Google Sheets workbook. Base it on CISA ZTMM v2.0.
Create one row for each pillar or cross-cutting capability. Record current and target maturity levels, link evidence, assign an owner, and calculate a gap score.
You can use current levels 0 through 3 against a target level. Label this scale as an internal priority method, not an official CISA method.
For example, Identity at Initial may have incomplete MFA coverage for administrators. It may rank above Networks at Initial when privileged access reaches sensitive data.
In the first 30 days, close the administrator MFA gap. By day 60, validate policy enforcement and SIEM telemetry. By day 90, automate remediation and retest the evidence.
Questions & answers
What are the five CISA zero trust pillars?
The five pillars are Identity, Devices, Networks, Applications and Workloads, and Data. Score each pillar separately. A weak Data or Identity pillar can expose the organization despite strong controls elsewhere.
What are the four maturity levels?
The four levels are Traditional, Initial, Advanced, and Optimal. They describe observed control maturity. They do not require every domain to move at the same pace.
What are the three cross-cutting capabilities?
Visibility and Analytics, Automation and Orchestration, and Governance are the three cross-cutting capabilities in v2.0. Governance was added in April 2023. It assigns accountability for policy, risk, and evidence.
Is CISA ZTMM v2.0 required for private companies?
CISA ZTMM v2.0 is not generally mandatory for private companies in the United States. A contract, FISMA authorization boundary, industry rule, or customer requirement may make parts relevant.
How do I assess zero trust maturity?
Assess Zero Trust maturity by scoring eight domains separately. Attach verifiable evidence to each score. Review coverage, policy enforcement, telemetry, exceptions, and test results before setting a target date.
The essentials:- Keep eight separate scores because averages can hide material Identity and Data risk.
- Treat CISA v2.0 as a planning model, not a certification or automatic compliance finding.
- Require logs, coverage reports, test results, and approved exceptions before scoring maturity.
- Use a 30/60/90-day plan to fix high-impact access and data gaps before lower-risk work.
Related sources
These articles can help you explore the topic in more depth:
