The CISA Zero Trust Maturity Model: A Practical Guide for Smaller Organizations

Security teams keep asking whether CISA released a newer Zero Trust Maturity Model in 2024 or 2026. It did not.

What the CISA Zero Trust Maturity Model Is

The CISA Zero Trust Maturity Model (ZTMM) is a roadmap for moving from perimeter-based security to zero trust. The current release is version 2.0, published in April 2023, and it remains the latest version in 2026. (CISA, Zero Trust Maturity Model)

It rests on one principle: never trust, always verify. Three ideas put that principle into practice. Verify explicitly. Grant least privilege. Assume breach.

The model organizes capabilities across five pillars: Identity, Devices, Networks, Applications and Workloads, and Data. Three cross-cutting capabilities span all five: Visibility and Analytics, Automation and Orchestration, and Governance.

It defines four maturity stages for each pillar: Traditional, Initial, Advanced, and Optimal. Most smaller organizations start at Traditional and target Advanced.

Why Zero Trust Is a Strategy Not a Product

Zero trust describes an approach to security. It is not a product you buy or a feature you switch on. No single vendor delivers zero trust in a box, whatever the marketing says.

The core idea is simple: never trust, always verify. Every access request gets evaluated on identity, device posture, network context, and behavior. The model never assumes trust based on network location or a previous login.

This framing matters for budgeting. Organizations that treat zero trust as a one-time purchase tend to bolt on disconnected tools, then declare the work finished. The CISA model treats zero trust as an operating capability that matures over time, across all five pillars at once.

The Five Pillars of the CISA Maturity Model

CISA's model groups zero trust capabilities into five pillars. Each one is a domain where implicit trust has to go, replaced by explicit verification.

Identity

The identity pillar covers authentication, authorization, and lifecycle management for every user and machine. That includes employees, contractors, service accounts, and API keys. Mature identity means phishing-resistant authentication, least-privilege access, and validation that continues through the session, not just at login.

Devices

The device pillar tracks the security state of every endpoint that reaches your resources. You need an inventory of what exists and a live read on each device's health. A device that fails its checks should get restricted access, regardless of who is signed in.

Networks

The network pillar removes the assumption that internal location implies trust. Traditional networks trusted anyone who reached the internal segment. Zero trust verifies every connection through segmentation, encryption in transit, and access tied to identity and context.

Applications and Workloads

The application pillar covers how software runs and communicates across cloud, on-premises, and hybrid environments. Applications must authenticate to each other, not only to users. Modern apps run as distributed services that talk constantly, so each channel needs its own authentication and authorization.

Data

The data pillar addresses how you classify, protect, and control access to information. Protection has to travel with the data wherever it moves. That means categorization, encryption, access aligned to classification, and monitoring for loss.

Three cross-cutting capabilities run through all five pillars: Visibility and Analytics, Automation and Orchestration, and Governance. They are how you operate the pillars at scale, instead of by hand.

The Four Maturity Stages From Traditional to Optimal

CISA defines four maturity stages for each pillar. Version 2.0 added the Initial stage, sitting between Traditional and Advanced, because the jump straight to advanced zero trust was too large for most organizations to cross in one step. (CISA)

Traditional

Static credentials, perimeter defenses, and manual processes. Trust is often implicit, based on network location. Most organizations sit here before they begin.

Initial

Foundational controls like MFA are in place, and asset inventories are underway. Authentication improves, though it may still rely on passwords. This is the first concrete step toward zero trust.

Advanced

Phishing-resistant MFA, automated responses to common events, and signals correlated across pillars. Identity verification becomes continuous rather than point-in-time. Most organizations target this stage.

Optimal

Full automation, real-time risk assessment, and dynamic policy enforcement across every pillar. Trust decisions happen continuously, based on full context. Few organizations reach this everywhere at once.

‍

Why CISA Puts Identity First Among the Pillars

Identity appears first in the model for a reason. When perimeters dissolve and data lives everywhere, identity becomes the one consistent control point. Every access request, human or machine, carries an identity you can verify.

Attackers know this. They rarely break in through network flaws anymore. They log in. Verizon's 2025 Data Breach Investigations Report found stolen credentials behind 88% of attacks on basic web applications, with the human element present in 60% of all breaches. (Verizon 2025 DBIR)

Static authentication cannot keep up. It checks identity once at login, then grants access for the whole session. An attacker holding a stolen session token never authenticates at all. Zero trust treats identity as a signal to evaluate continuously, not a gate to pass through once.

In the model, identity does two jobs. It prevents unauthorized access through strong authentication and least privilege. It also drives detection through behavioral monitoring and risk scoring. Prevention without monitoring misses compromised legitimate accounts. Monitoring without prevention buries you in noise.

Least privilege carries equal weight. Standing access that nobody uses is pure attack surface. Tenable's 2026 Cloud and AI Security Risk Report found that 49% of identities holding critical, excessive permissions were dormant. (Tenable 2026 Cloud and AI Security Risk Report) Access that matches the job, and expires when the job is done, shrinks what any compromised account can reach.

What Each Stage Requires for a Smaller Organization

CISA built the model for federal agencies, but the stages map onto any organization. For a company with 20 to 200 staff and little or no dedicated security team, here is what each step realistically takes.

Reaching Initial

Initial is within reach for almost every smaller organization, and it is the right near-term target. It means MFA on every account, a real inventory of users and devices, and basic logging switched on. The work is mostly configuration and discipline, not heavy spend. Most of these controls already exist inside the cloud and identity tools you pay for. The gap is usually that nobody has turned them on or reviewed them.

Reaching Advanced

Advanced is the realistic destination for a smaller organization that takes security seriously. It means phishing-resistant MFA such as passkeys or hardware keys, regular access reviews, network segmentation, and automated responses to common events. This stage needs sustained attention, not a one-off project. Few 50-person companies can staff round-the-clock monitoring, so this is where many bring in a small business MSSP to run detection and response.

Reaching Optimal

Optimal means full automation, real-time risk scoring, and dynamic policy across every pillar at once. Be honest about this stage. Few organizations of any size reach Optimal everywhere, and a smaller company rarely needs to. The model expects you to pursue Optimal in your highest-risk areas, your most sensitive data and your privileged accounts, while holding Advanced elsewhere. Chasing Optimal across the board burns budget you could spend closing real gaps.

How to Use the CISA Model as a Practical Roadmap

The model works best as a planning tool, not a compliance checklist. Use it to see where you stand, decide where you want to be, and chart a path between the two.

Start with visibility before enforcement. Inventory your identity sources, map who can reach what, and find the privileged accounts before you tighten anything. Restrictive controls applied blind will break a business process you did not know existed.

Move on least privilege in steps. Sudden permission cuts break applications and frustrate people. Begin with access that is clearly unused. For privileged accounts, add just-in-time elevation before you remove standing rights, so people request access when they need it and it expires on its own.

Fit controls to how people actually work. Security that fights the business gets switched off or worked around. Involve the people who run critical processes, build a route for legitimate exceptions, and measure the experience alongside the security gain.

Then track progress against the stages over time. Moving a pillar from Traditional to Initial to Advanced is a concrete result you can show leadership. Zero trust is a program that runs for years, not a project with an end date.

‍