Skip to main content
Cyber Risk Council
Category: Zero Trust & Network Security

CISA Zero Trust Maturity Model

Also known as: ZTMM, CISA ZTMM, Zero Trust Maturity Model
Simply put

The CISA Zero Trust Maturity Model is a roadmap published by the U.S. Cybersecurity and Infrastructure Security Agency to help organizations plan and carry out a move toward a zero trust security approach. It is one of several available references organizations can use, offering guidance and a sense of progression rather than a rigid, mandatory checklist.

Formal definition

The CISA Zero Trust Maturity Model (ZTMM) is a reference roadmap developed by CISA to assist agencies and other organizations in developing zero trust strategies and implementation plans as they transition toward a zero trust architecture. It is positioned as one of many available roadmaps and frames maturation across defined stages, illustrating ways in which capabilities can advance over time. A later revision is published as ZTMM V2. Because it is a guidance model rather than a certification standard, referencing or aligning to it supports readiness and structured planning but does not by itself guarantee any specific security outcome or compliance status; realized value depends on organizational maturity, scope, and execution.

Why it matters

Zero trust has become a central organizing principle for modern security programs, shifting away from perimeter-based assumptions toward continuous verification of users, devices, and access requests. The CISA Zero Trust Maturity Model matters because it gives organizations a structured, publicly available way to reason about where they are today and what a progression toward a zero trust architecture might look like, rather than treating zero trust as a single product or a binary state. For a security leader, this framing is valuable because it reinforces that zero trust is a multi-year strategic journey involving governance, planning, and execution, not a switch that gets flipped.

Because the ZTMM is explicitly positioned by CISA as one of many roadmaps agencies can reference, its importance lies in providing a common vocabulary and a sense of staged progression that stakeholders across an organization can align around. This helps translate an abstract goal into an implementation plan with identifiable milestones. It is worth stressing that aligning to or referencing the model supports readiness and structured planning; it does not by itself certify an organization, guarantee any specific security outcome, or confirm a compliance status. The realized value depends heavily on organizational maturity, defined scope, and how well the plan is actually executed.

For buyers of virtual and fractional security leadership, understanding this distinction prevents a common misunderstanding: adopting a maturity model is a planning aid, not a substitute for the operational, governance, and stakeholder work required to advance. A model can describe how capabilities may mature over time, but the accountability for security decisions and the execution of those plans remains with the client organization.

Who it's relevant to

Federal agencies and public-sector organizations
The model was originally framed by CISA as one of many roadmaps agencies can reference as they transition toward a zero trust architecture. It is directly relevant to agencies developing zero trust strategies and implementation plans, giving them a CISA-published reference point for staged progression.
Private-sector organizations pursuing zero trust
Beyond federal agencies, other organizations can reference the ZTMM as they implement a zero trust architecture. It offers a common vocabulary and a sense of progression that helps translate zero trust goals into concrete strategies and implementation plans, though it remains guidance rather than a certification standard.
Virtual and fractional CISOs advising on strategy
Security leaders providing strategy, governance, and program development can use the ZTMM as a planning and communication tool to help clients assess current posture and plan a roadmap. A vCISO would typically advise on and direct alignment to the model rather than perform hands-on implementation, and would clarify that referencing the model supports readiness without guaranteeing a specific outcome or compliance status. Accountability for the resulting decisions remains with the client organization.
Executives and program sponsors
Leaders funding or sponsoring a zero trust initiative benefit from the model's staged framing, which reinforces that zero trust is a multi-year strategic effort dependent on organizational maturity, scope, and execution rather than a one-time purchase. It helps set realistic expectations and align stakeholders around progression milestones.

Inside ZTMM

Five Pillars
The model organizes zero trust into five foundational pillars: Identity, Devices, Networks, Applications and Workloads, and Data. Each pillar represents a distinct domain in which an organization can advance its zero trust posture, and progress in one pillar does not automatically imply progress in others.
Cross-Cutting Capabilities
Three capabilities span all five pillars: Visibility and Analytics, Automation and Orchestration, and Governance. These are intended to be developed in parallel with pillar-specific work rather than treated as separate efforts, though the degree of integration typically varies by organization.
Maturity Stages
The model describes a progression across maturity stages, commonly rendered as Traditional, Initial, Advanced, and Optimal. These stages are meant to help an organization assess its current state and plan incremental improvements; they represent a self-assessment aid rather than a certification or a guaranteed sequence of outcomes.
Guidance Orientation (U.S. Federal Focus)
The model was published by CISA (the U.S. Cybersecurity and Infrastructure Security Agency) primarily to help federal civilian agencies advance toward zero trust. Non-federal organizations may find it a useful reference, but it is guidance rather than a binding standard for the private sector, and its applicability may vary by context.
Incremental, Non-Prescriptive Approach
The model frames zero trust as a journey achieved through incremental steps rather than a single product or one-time deployment. It describes desired end states and directional improvements but generally does not mandate specific tools, vendors, or implementation details.

Common questions

Answers to the questions practitioners most commonly ask about ZTMM.

Does adopting the CISA Zero Trust Maturity Model mean my organization needs to buy new zero trust products?
No. The CISA Zero Trust Maturity Model is a guidance framework that describes maturity stages across pillars such as identity, devices, networks, applications and workloads, and data, along with cross-cutting capabilities. It is not a product, a shopping list, or a certification. Advancing in maturity typically depends on architecture, policy, and process changes as much as tooling, and a virtual CISO engagement would generally use it to assess current state and prioritize a roadmap rather than to justify a specific purchase. Vendor claims of a product being zero trust compliant should be treated with caution, since the model describes organizational maturity, not conformance to a single tool.
Is the CISA Zero Trust Maturity Model a mandatory compliance standard we can be certified against?
It is generally intended as guidance rather than a certifiable standard. While federal civilian agencies operate under related federal directives, for most private organizations the model functions as a voluntary reference for planning and self-assessment. There is typically no formal certification issued against it in the way certification works for ISO 27001 or an attestation works for SOC 2. A virtual CISO can help an organization use the model to benchmark maturity and support readiness for other frameworks, but reaching a higher maturity stage is a self-directed assessment outcome, not a certified compliance result. Accountability for how the model is applied remains with the client organization.
How would a virtual CISO typically use the CISA Zero Trust Maturity Model in an engagement?
In many engagements a virtual CISO uses the model as an assessment and prioritization tool. This often involves mapping the organization's current capabilities against the model's pillars and maturity stages, identifying gaps, and building a phased roadmap aligned to business risk and resources. The vCISO generally advises and directs this work at a strategy and governance level; hands-on configuration of identity systems, network segmentation, or logging pipelines is usually performed by internal staff or other providers unless that operational work is explicitly contracted. The value of this exercise tends to depend heavily on stakeholder access and organizational maturity.
Where should an organization with limited maturity begin when applying the model?
Starting points vary by organization, but a common approach is to first establish a baseline by assessing each pillar honestly, since many organizations begin at the earlier maturity stages. Identity and data are frequently prioritized early because they underpin access decisions across the other pillars, though the right sequence depends on the organization's specific risk profile and existing controls. A virtual CISO can help sequence efforts so that foundational governance and visibility are addressed before more advanced automation-oriented capabilities. Attempting to advance every pillar simultaneously often stalls when resources and cross-cutting capabilities are not yet in place.
How does progress against the model relate to other frameworks we already use, such as NIST CSF or ISO 27001?
The model can complement rather than replace those frameworks. NIST CSF supports organizing and communicating overall cybersecurity risk activities, and ISO 27001 provides a certifiable information security management system structure, while the CISA Zero Trust Maturity Model focuses specifically on maturing toward a zero trust architecture across defined pillars. In practice a virtual CISO may map work so that improvements support multiple frameworks at once, but progressing in the maturity model does not by itself demonstrate NIST CSF alignment or achieve ISO 27001 certification. Each framework serves a distinct purpose and should be treated accordingly.
What common mistakes should we avoid when implementing the model?
A frequent mistake is treating zero trust maturity as a purely technical project rather than a governance and business risk effort, which tends to leave policy, ownership, and accountability undefined. Another is assuming a single product or a managed service delivers maturity across all pillars, when the model describes organizational capability across identity, devices, networks, applications and workloads, and data. Organizations also sometimes overstate their maturity during self-assessment, which undermines the roadmap. Because accountability for security decisions generally remains with the client's officers, a virtual CISO can advise on and direct the effort, but sustained progress depends on internal cooperation, defined scope, and realistic assessment of current state.

Common misconceptions

Reaching a given maturity stage in the CISA model certifies that an organization is compliant or 'zero trust certified.'
The model is a self-assessment and planning aid, not a certification scheme. Advancing through its stages supports readiness and structured improvement, but it does not confer any formal compliance status, and a virtual CISO engagement using this model supports progress rather than guaranteeing certification or compliance outcomes.
Zero trust, as described by the model, is a technology or product an organization can purchase and deploy.
The model treats zero trust as an architectural and governance approach spanning multiple pillars and cross-cutting capabilities. Tools may support it, but maturity depends on strategy, governance, and organizational cooperation. A vCISO typically advises on this strategy and program direction rather than administering the tools themselves unless explicitly contracted.
Progress must be uniform across all pillars, and advancing in one means the organization is advancing overall.
The model treats the five pillars as distinct domains that can mature at different rates. Strong maturity in one pillar does not offset gaps in others, and realistic assessment requires evaluating each pillar and cross-cutting capability separately.

Best practices

Assess each of the five pillars independently rather than assigning a single overall maturity rating, since progress often varies by domain.
Develop the cross-cutting capabilities of Visibility and Analytics, Automation and Orchestration, and Governance in parallel with pillar-specific work rather than deferring them.
Treat the maturity stages as a planning and self-assessment tool to prioritize incremental improvements, not as a compliance certification or guaranteed outcome.
When engaging a virtual or fractional CISO to guide zero trust efforts, define scope clearly so it is understood whether the engagement covers strategy and governance advisory versus hands-on tool administration.
Confirm that accountability for security decisions and their outcomes remains with the client organization's officers, with the vCISO advising and directing the maturity roadmap.
Validate that the model's federal-oriented guidance is adapted appropriately to your organization's context, maturity, and stakeholder access before applying it as a benchmark.