Implement the CISA Zero Trust Maturity Model v2.0 across the five pillars of identity, devices, networks, applications, and data to achieve progressive organizational zero trust maturity.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
A direct command skips the review prompt. Inspect the source before running it.
Implement the CISA Zero Trust Maturity Model v2.0 across the five pillars of identity, devices, networks, applications, and data to achieve progressive organizational zero trust maturity.
The CISA Zero Trust Maturity Model (ZTMM) Version 2.0, released in April 2023, provides federal agencies and organizations with a structured roadmap for adopting zero trust architecture. The model defines five core pillars -- Identity, Devices, Networks, Applications & Workloads, and Data -- each progressing through four maturity stages: Traditional, Initial, Advanced, and Optimal. Three cross-cutting capabilities (Visibility and Analytics, Automation and Orchestration, and Governance) span all pillars. This skill covers assessment, gap analysis, and progressive implementation across all pillars and maturity levels.
When to Use
When deploying or configuring implementing cisa zero trust maturity model capabilities in your environment
When establishing security controls aligned to compliance requirements
When building or improving security architecture for this domain
When conducting security assessments that require this implementation
Common Misconfigurations & Verification
ZTMM programs fail most often when maturity is self-attested on a spreadsheet rather than proven with telemetry. Watch for these:
Self-reported stage with no evidence. A pillar marked "Advanced" must be backed by data (CrowdStrike ZTA scores for Devices, Conditional Access logs for Identity, microsegmentation policy-deny counts for Networks). If you cannot pull the metric, the stage is aspirational, not real.
Pillars advanced in isolation. Identity at Optimal while Networks stays Traditional (flat, implicitly trusted) leaves lateral movement wide open - score the weakest pillar, not the average.
Cross-cutting capabilities ignored. Visibility/Analytics and Automation are treated as afterthoughts; without centralized telemetry you cannot prove any pillar's maturity.
MFA counted as phishing-resistant when it is SMS/push. Initial-stage MFA is not the Advanced FIDO2/WebAuthn the Identity pillar requires.
How to confirm: for each "Advanced/Optimal" claim, pull the supporting log or query (% devices with real-time posture, CAE token-revocation events, segment policy-deny counts) and reconcile against OMB M-22-09 requirements. Treat any pillar without queryable telemetry as Traditional until proven otherwise.
Prerequisites
Familiarity with NIST SP 800-207 Zero Trust Architecture
Understanding of federal cybersecurity mandates (EO 14028, OMB M-22-09)
Access to organizational IT asset inventory and network architecture documentation
Knowledge of identity and access management (IAM) fundamentals
Understanding of network segmentation and microsegmentation concepts
CISA ZTMM Five Pillars
Pillar 1: Identity
Identity refers to attributes that uniquely describe an agency user or entity, including non-person entities (NPEs) such as service accounts and machine identities.
Traditional Stage:
Password-based authentication
Limited identity validation
Manual provisioning and deprovisioning
Initial Stage:
MFA deployed for privileged users
Identity governance initiated
Basic identity lifecycle management
Advanced Stage:
Phishing-resistant MFA for all users (FIDO2/WebAuthn)
Continuous identity validation
Automated provisioning tied to HR systems
Identity threat detection and response (ITDR)
Optimal Stage:
Continuous, real-time identity verification
Passwordless authentication across all systems
AI-driven anomaly detection for identity behaviors
Full integration of identity signals into access decisions
Pillar 2: Devices
Devices include any hardware, software, or firmware asset that connects to a network -- servers, laptops, mobile phones, IoT devices, and network equipment.
Traditional Stage:
Limited device inventory
Basic endpoint protection (antivirus)
No device compliance checks
Initial Stage:
Comprehensive device inventory
Endpoint Detection and Response (EDR) deployment
Basic device health checks before network access
Advanced Stage:
Real-time device posture assessment
Automated compliance enforcement
Device certificates for machine identity
Vulnerability scanning integrated into access decisions
Optimal Stage:
Continuous device trust scoring
Automated remediation of non-compliant devices
Full device lifecycle management integrated with zero trust policies
Firmware integrity verification
Pillar 3: Networks
Networks encompass all communications media including internal networks, wireless, and the internet.
Traditional Stage:
Perimeter-based security (firewalls, VPNs)
Flat internal networks
Minimal east-west traffic inspection
Initial Stage:
Initial network segmentation
Encrypted DNS and internal traffic
Basic network monitoring and logging
Advanced Stage:
Microsegmentation of critical assets
Software-defined networking (SDN) for dynamic policy enforcement
Full TLS encryption for all internal communications
Network Detection and Response (NDR)
Optimal Stage:
Fully software-defined, policy-driven network
Zero implicit trust zones
AI-driven network anomaly detection
Automated threat response integrated with network controls
Pillar 4: Applications and Workloads
Applications and workloads include agency systems, programs, and services running on-premises, on mobile devices, and in cloud environments.
Traditional Stage:
Perimeter-protected applications
Manual vulnerability patching
Limited application-level logging
Initial Stage:
Application-level access controls
Web Application Firewalls (WAF)
Regular vulnerability scanning
Application inventory established
Advanced Stage:
Continuous integration of security testing (SAST/DAST)
Application-aware microsegmentation
API security gateways
Immutable infrastructure patterns
Optimal Stage:
Runtime application self-protection (RASP)
Automated application security orchestration
Full DevSecOps pipeline integration
Zero-standing privileges for application access
Pillar 5: Data
Data encompasses all structured and unstructured information, at rest, in transit, and in use.
Traditional Stage:
Basic encryption for data at rest
Limited data classification
No data loss prevention
Initial Stage:
Data classification scheme implemented
DLP policies for sensitive data
Encryption for data in transit (TLS 1.2+)
Basic data inventory
Advanced Stage:
Automated data classification
Fine-grained data access controls
Data activity monitoring
Rights management for sensitive documents
Optimal Stage:
Real-time data flow analytics
AI-driven data classification and protection
Automated response to data exfiltration attempts
Full data lifecycle governance with zero trust principles
