CISA Zero Trust Maturity Model (ZTMM) Explained

"How do we do zero trust?" is a strategy question, and CISA's Zero Trust Maturity Model (ZTMM) is one of the most useful maps for answering it. Rather than a product or a checklist, it describes zero trust across five pillars and four stages of maturity, so you can see where you are and plan where to go.

The five pillars

• Identity — authenticating and authorising users and services (the highest-leverage pillar).
• Devices — the security posture of the endpoints accessing resources.
• Networks — segmentation and control of network traffic.
• Applications & Workloads — securing apps and the workloads they run on.
• Data — classifying, protecting and governing data itself.

Three cross-cutting capabilities support all five: Visibility & Analytics, Automation & Orchestration, and Governance.

The four maturity stages

1. Traditional — manual, static, perimeter-based controls.
2. Initial — starting to automate and apply zero-trust principles in places.
3. Advanced — coordinated, largely automated controls with centralised visibility.
4. Optimal — fully automated, dynamic, policy-driven controls with continuous validation.

Each pillar can sit at a different stage — most organisations are uneven, which is exactly what the model is meant to reveal. If you also run a NIST programme, the same stage-by-stage thinking appears in the NIST CSF 2.0 maturity tiers.

CISA ZTMM version 2.0: what changed and where it fits

The current CISA Zero Trust Maturity Model is version 2.0, published in April 2023; its biggest change from the 2021 draft (version 1.0) was adding a fourth stage, Initial, between Traditional and Advanced, so organisations can show early progress rather than jumping straight from legacy controls to advanced ones.

• Version 1.0 (2021 draft): three stages - Traditional, Advanced, Optimal.
• Version 2.0 (April 2023): four stages with Initial added, updated functions within each pillar, and the three cross-cutting capabilities applied to every pillar.

The model sits alongside two other US federal references. NIST SP 800-207 defines zero trust architecture, and OMB Memorandum M-22-09 set the federal government's zero-trust strategy and goals. CISA's model is the practical bridge: a way to measure, pillar by pillar, how far an organisation has moved toward that target state.

A quick way to read any pillar is to compare its ends. In Identity, Traditional means passwords or basic MFA with static, manually managed access; Optimal means continuous validation of identity and risk on every access request, built on phishing-resistant MFA. Most organisations sit somewhere in between, at a different stage in each pillar.

How to use it

Assess each pillar's current stage, find the pillars that are both behind and high-risk, set a realistic target per pillar, and build an incremental roadmap. Identity is usually the place to start: strong, phishing-resistant identity — passkeys and FIDO2 security keys — underpins the other four pillars.

Assess your posture with the Zero Trust Maturity tool →, and start on the Identity pillar with the Identity Risk tool.

Frequently asked questions

What are the zero trust principles in cybersecurity? Zero trust rests on a few core principles: never trust, always verify; verify explicitly on every request; enforce least-privilege access; and assume breach — design as if an attacker is already inside. CISA's five pillars operationalise these principles across identity, devices, networks, applications and data.

What is the US Department of Defense Zero Trust Reference Architecture? The DoD Zero Trust Reference Architecture is the Department of Defense's own zero-trust blueprint, organised around seven pillars and a set of target and advanced activities. It is distinct from CISA's five-pillar maturity model, though both rest on the same underlying zero-trust principles.

The five pillars? Identity, Devices, Networks, Applications & Workloads, Data — plus cross-cutting Visibility, Automation and Governance.

The four stages? Traditional, Initial, Advanced, Optimal.

Is it a compliance requirement? Mostly a planning/self-assessment framework (federal agencies have zero-trust directives that reference it).

How to self-assess? Rate each pillar, target realistically, prioritise — start with Identity.