aid: zero-trust-architecture name: Zero Trust Architecture description: >- Zero Trust Architecture (ZTA) is a security framework defined by NIST SP 800-207 that requires all users and devices to be authenticated, authorized, and continuously validated before being granted access to applications and data, regardless of whether they are inside or outside the network perimeter. The architecture is built on the principle of "never trust, always verify," replacing implicit trust with explicit verification for every access request. ZTA leverages APIs, identity providers, policy engines, and continuous monitoring to enforce least-privilege access across enterprise resources. type: Index url: https://www.nist.gov/publications/zero-trust-architecture tags: - Access Control - Authentication - Authorization - Cybersecurity - Identity Management - Least Privilege - Network Security - NIST - Security - Zero Trust created: '2025' modified: '2026-05-03' specificationVersion: '0.19' apis: - aid: zero-trust-architecture:nist-sp-800-207 name: NIST SP 800-207 Zero Trust Architecture description: >- NIST Special Publication 800-207 defines zero trust architecture (ZTA) and provides a roadmap for organizations migrating to ZTA. It describes seven ZTA tenets, three logical components (Policy Decision Point, Policy Enforcement Point, Policy Administration Point), three approaches to ZTA deployment, and guidance on threat models and use cases. Published August 2020. humanURL: https://csrc.nist.gov/pubs/sp/800/207/final tags: - NIST - Security Framework - Zero Trust properties: - type: Documentation url: https://csrc.nist.gov/pubs/sp/800/207/final - type: Documentation url: https://nvlpubs.nist.gov/nistpubs/specialpublications/NIST.SP.800-207.pdf - aid: zero-trust-architecture:nist-sp-800-207a name: NIST SP 800-207A ZTA for Cloud-Native Applications description: >- NIST SP 800-207A extends the original ZTA guidance to cover cloud-native applications in multi-cloud environments. It addresses service mesh architectures, workload identity, microsegmentation, and API-centric access control patterns for containerized workloads. humanURL: https://csrc.nist.gov/pubs/sp/800/207/a/final tags: - Cloud Security - Kubernetes - NIST - Zero Trust properties: - type: Documentation url: https://csrc.nist.gov/pubs/sp/800/207/a/final - type: Documentation url: https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-207A.pdf - aid: zero-trust-architecture:spiffe name: SPIFFE - Secure Production Identity Framework for Everyone description: >- SPIFFE is a CNCF-graduated open standard for workload identity in dynamic environments. It provides a framework for workloads to authenticate to each other using short-lived cryptographic SVIDs (SPIFFE Verifiable Identity Documents) without static secrets, forming a foundational element of API-centric Zero Trust implementations. humanURL: https://spiffe.io/ tags: - CNCF - Identity - Open Source - Standards - Workload Identity - Zero Trust properties: - type: Documentation url: https://spiffe.io/docs/latest/ - type: GitHubOrganization url: https://github.com/spiffe - aid: zero-trust-architecture:spire name: SPIRE - SPIFFE Runtime Environment description: >- SPIRE is the reference implementation of SPIFFE, a CNCF-graduated production-ready toolchain for establishing trust between workloads. It issues SVIDs to workloads and exposes the SPIFFE Workload API for identity attestation across Kubernetes, VMs, cloud instances, and bare metal environments. humanURL: https://spiffe.io/docs/latest/spire-about/spire-concepts/ tags: - CNCF - Identity - Open Source - Runtime - Zero Trust properties: - type: Documentation url: https://spiffe.io/docs/latest/spire-about/ - type: GitHubOrganization url: https://github.com/spiffe/spire - aid: zero-trust-architecture:open-policy-agent name: Open Policy Agent (OPA) description: >- Open Policy Agent is a CNCF-graduated open source general-purpose policy engine that enables unified, context-aware policy enforcement across APIs, microservices, Kubernetes, and CI/CD pipelines. In Zero Trust implementations, OPA serves as the Policy Decision Point (PDP) evaluating access requests against defined policies written in the Rego language. humanURL: https://www.openpolicyagent.org/ tags: - Authorization - CNCF - Open Source - Policy Engine - Zero Trust properties: - type: Documentation url: https://www.openpolicyagent.org/docs/latest/ - type: GitHubOrganization url: https://github.com/open-policy-agent common: - type: Portal title: NIST Zero Trust Architecture url: https://www.nist.gov/publications/zero-trust-architecture description: Official NIST page for Zero Trust Architecture publications and resources. - type: Documentation title: NIST SP 800-207 PDF url: https://nvlpubs.nist.gov/nistpubs/specialpublications/NIST.SP.800-207.pdf description: Downloadable PDF of NIST Special Publication 800-207 Zero Trust Architecture. - type: Documentation title: NIST SP 800-207A PDF url: https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-207A.pdf description: NIST SP 800-207A covering ZTA for cloud-native applications in multi-cloud environments. - type: Compliance title: CISA Zero Trust Maturity Model url: https://www.cisa.gov/zero-trust-maturity-model description: CISA's Zero Trust Maturity Model providing a roadmap across five pillars. - type: Compliance title: NSA Zero Trust Guidance url: https://www.nsa.gov/Press-Room/News-Highlights/Article/Article/2899282/nsa-releases-guidance-on-zero-trust-security-model/ description: NSA guidance on Zero Trust Security Model for network and environment pillar. - type: Compliance title: DoD Zero Trust Reference Architecture url: https://dodcio.defense.gov/Portals/0/Documents/Library/ZT-Reference-Architecture.pdf description: Department of Defense Zero Trust Reference Architecture document. - type: Portal title: SPIFFE Project url: https://spiffe.io/ description: Official site for SPIFFE workload identity standard and SPIRE runtime. - type: Portal title: Open Policy Agent url: https://www.openpolicyagent.org/ description: Official site for Open Policy Agent (OPA), the CNCF policy engine used as PDP in ZTA. - type: GitHubOrganization title: SPIFFE GitHub url: https://github.com/spiffe description: SPIFFE and SPIRE open source repositories on GitHub. - type: GitHubOrganization title: Open Policy Agent GitHub url: https://github.com/open-policy-agent description: Open Policy Agent (OPA) GitHub organization. - type: JSONSchema title: Zero Trust Policy Schema url: json-schema/zero-trust-architecture-policy-schema.json - type: JSONSchema title: Zero Trust Identity Schema url: json-schema/zero-trust-architecture-identity-schema.json - type: JSONSchema title: Zero Trust Resource Schema url: json-schema/zero-trust-architecture-resource-schema.json - type: JSONLD title: Zero Trust Architecture JSON-LD Context url: json-ld/zero-trust-architecture-context.jsonld - type: JSONStructure title: Zero Trust Policy Structure url: json-structure/zero-trust-architecture-policy-structure.json - type: JSONStructure title: Zero Trust Identity Structure url: json-structure/zero-trust-architecture-identity-structure.json - type: Resources title: Zero Trust Architecture Vocabulary url: vocabulary/zero-trust-architecture-vocabulary.yaml - type: CodeExamples title: Zero Trust Policy Example url: examples/zero-trust-architecture-policy-example.json - type: CodeExamples title: Zero Trust Identity Example url: examples/zero-trust-architecture-identity-example.json - type: Features data: - name: Identity Verification description: Every access request requires verification of user and device identity regardless of network location. - name: Least Privilege Access description: Access is granted with minimum required permissions on a per-session basis. - name: Microsegmentation description: Networks are divided into small zones to limit lateral movement after breach. - name: Continuous Monitoring description: All network traffic, user behavior, and device health are continuously monitored and analyzed. - name: Policy Decision Point description: Centralized policy engine evaluates access requests against defined policies. - name: Policy Enforcement Point description: Gateway or proxy that enforces access decisions made by the policy engine. - name: Workload Identity description: Cryptographic identity for workloads and services replacing static credentials. - name: Device Health Attestation description: Device posture and compliance are verified before granting access. - name: Implicit Trust Elimination description: No user, device, or network is trusted implicitly, even inside the corporate perimeter. - name: Multi-Factor Authentication description: Strong MFA is required as part of identity verification for all access. - type: UseCases data: - name: Remote Workforce Security description: Providing secure access to enterprise resources for remote employees without VPN. - name: Cloud Application Access description: Controlling access to multi-cloud and SaaS applications with consistent policies. - name: API Security description: Enforcing zero trust principles at API gateways with per-request authentication and authorization. - name: Kubernetes Workload Identity description: Using SPIFFE/SPIRE to assign cryptographic identities to Kubernetes pods. - name: Supply Chain Security description: Verifying identity and integrity of software components and build pipelines. - name: Government Compliance description: Meeting CISA Zero Trust Maturity Model requirements for federal agencies. - name: Insider Threat Mitigation description: Limiting damage from insider threats through continuous monitoring and least privilege. - name: Multi-Cloud Security description: Applying consistent zero trust policies across AWS, Azure, GCP, and private clouds. - type: Integrations data: - name: SPIFFE/SPIRE description: Workload identity standard providing SVIDs for mutual TLS authentication. - name: Open Policy Agent description: Policy engine serving as the Policy Decision Point in ZTA implementations. - name: Envoy Proxy description: Service mesh proxy enforcing mTLS and authorization policies as PEP. - name: Istio description: Kubernetes service mesh providing ZTA controls through SPIFFE and OPA integration. - name: HashiCorp Vault description: Secrets management platform providing dynamic credentials in ZTA pipelines. - name: Okta description: Identity provider for user and device authentication in ZTA implementations. - name: Microsoft Entra ID description: Cloud identity platform used as Identity Provider in enterprise ZTA deployments. - name: BeyondCorp Enterprise description: Google's ZTA implementation providing context-aware access for enterprise applications. - name: Cloudflare Zero Trust description: Zero Trust Network Access and secure web gateway platform. - name: Zscaler Private Access description: Cloud-native ZTNA solution providing ZTA-compliant access to private applications. maintainers: - FN: Kin Lane email: kin@apievangelist.com