Using CISA's Zero Trust Maturity Model Without a Federal Budget

Use the model as a map, not a target. CISA's Zero Trust Maturity Model 2.0 describes five pillars and three cross-cutting capabilities, each with four stages: traditional, initial, advanced, and optimal (CISA). A mid-market organization gets most of the risk reduction by moving identity and devices to "advanced" and leaving the rest at "initial" until there is a reason to go further.

"Zero trust" has been stretched to cover nearly every security product, which makes it hard to plan against. CISA's model is useful precisely because it is vendor-neutral and staged. It was written for federal agencies, but the structure works for any organization that wants to see where it is and decide what to do next.

What the model is

CISA defines zero trust as concepts designed to minimize uncertainty in enforcing accurate, least-privilege, per-request access decisions, assuming the network is already compromised. The approach shifts security from where a user sits on the network to the data and the request itself (CISA). Version 2.0 was published in April 2023 and aligns to OMB memorandum M-22-09 (CISA ZTMM v2.0).

The five pillars are Identity, Devices, Networks, Applications and Workloads, and Data. The three cross-cutting capabilities are Visibility and Analytics, Automation and Orchestration, and Governance (CISA ZTMM v2.0).

Why mid-market teams should not aim for "optimal"

"Optimal" in most pillars implies continuous, automated, risk-adaptive policy across every resource. That takes engineering capacity most organizations with a five-person IT team will never have, and chasing it everywhere stalls the basics. The model explicitly allows uneven progress across pillars, and that is the point: spend where the attacks are.

Most incidents we respond to still begin with a stolen credential, an unmanaged device, or an exposed edge appliance. That points the first dollars at identity and devices.

A realistic sequence

1. Identity to advanced. Phishing-resistant MFA for administrators and remote access, conditional access based on device and risk signals, and removal of standing admin rights. This is also where Microsoft 365 and Entra ID hardening pays off quickly.
2. Devices to advanced. A complete inventory, EDR on every endpoint, and access policies that check device health before granting access. If a device is not enrolled, it should not reach sensitive data.
3. Networks to initial. Segment the flat network into a few zones, put management interfaces behind a dedicated path, and stop exposing remote-access appliances directly where you can. Our view on where firewalls still fit in zero trust covers the trade-offs.
4. Applications to initial. Put internal applications behind identity-aware access rather than VPN-plus-trust, starting with the most sensitive.
5. Data to initial. Know where regulated data lives. For defense contractors that means CUI; for healthcare, ePHI. You cannot protect data you have not located.

Underneath all five, Visibility and Analytics should move early, because every other pillar needs logs to prove it is working. A 24/7 SOC is often the fastest way to get there without hiring.

How to score yourself

For each pillar, read the four stage descriptions in the CISA document and pick the one that matches what you can show evidence for today, not what is planned. Write one sentence per pillar explaining why. That one-page self-assessment is more useful to a board than any vendor maturity score, and it maps cleanly to control frameworks like NIST SP 800-171 and the zero trust architecture work clients ask us to scope.

What to avoid

• Buying a "zero trust platform" before fixing identity. Most products assume a clean identity provider underneath.
• Treating ZTNA as the whole program. Replacing the VPN is one control in one pillar.
• Skipping governance. Policies that nobody reviews decay. Assign an owner to each pillar.

If you want an outside read on where you sit across the five pillars, we can run that review in a couple of working sessions.

Frequently asked questions

What are the five pillars of CISA's Zero Trust Maturity Model?

Identity, Devices, Networks, Applications and Workloads, and Data. The model also has three cross-cutting capabilities: Visibility and Analytics, Automation and Orchestration, and Governance.

What are the maturity stages in the CISA Zero Trust Maturity Model?

Version 2.0 uses four stages for each pillar: traditional, initial, advanced, and optimal.

Is the CISA Zero Trust Maturity Model only for federal agencies?

It was written for federal agencies, but its vendor-neutral, staged structure is useful for any organization planning zero trust work.

Where should a mid-market company start with zero trust?

Usually with identity and devices: phishing-resistant MFA, conditional access, removing standing admin rights, full device inventory, and EDR with device-health checks before access.

Does zero trust mean replacing the VPN?

Not by itself. Zero trust network access can replace VPN access, but that is one control within the Networks and Applications pillars, not the whole program.