メニュー
Implement the CISA Zero Trust Maturity Model v2.0 across the five pillars of identity, devices, networks, applications, and data to achieve progressive organizational zero trust maturity.
デフォルトでは、最初にソースを確認する Prompt が選択されています。直接コマンドに切り替えるか、ローカルコピーをダウンロードすることもできます。
インストールを決める前に、SKILL.md と SkillsMP に表示されている付属ファイルをお読みください。
Codex または Claude でインストール この Prompt をコピーして Codex、Claude、または他のアシスタントに貼り付けると、Skill ページを確認してインストールできます。
直接コマンドでは確認用 Prompt が省略されます。実行前にソースを確認してください。
npx skills add https://github.com/xalgord/xalgorix --skill implementing-cisa-zero-trust-maturity-modelコマンドは1行のまま表示されます。コピー前に横へスクロールして全体を確認してください。
ローカルで確認しますか？SkillsMP が現在取得できるファイルをダウンロードできます。
SOC 職業分類に基づく
SKILL.md を表示中
| name | implementing-cisa-zero-trust-maturity-model |
| description | Implement the CISA Zero Trust Maturity Model v2.0 across the five pillars of identity, devices, networks, applications, and data to achieve progressive organizational zero trust maturity. |
| domain | cybersecurity |
| subdomain | zero-trust-architecture |
| tags | ["zero-trust","cisa","maturity-model","federal-compliance","governance","nist-800-207","identity","devices","networks","applications","data-security"] |
| version | 1.0 |
| author | mahipal |
| license | Apache-2.0 |
| nist_ai_rmf | ["GOVERN-1.1","GOVERN-1.7","MAP-1.1","GOVERN-4.2","MAP-2.3"] |
| nist_csf | ["PR.AA-01","PR.AA-05","PR.IR-01","GV.PO-01"] |
The CISA Zero Trust Maturity Model (ZTMM) Version 2.0, released in April 2023, provides federal agencies and organizations with a structured roadmap for adopting zero trust architecture. The model defines five core pillars -- Identity, Devices, Networks, Applications & Workloads, and Data -- each progressing through four maturity stages: Traditional, Initial, Advanced, and Optimal. Three cross-cutting capabilities (Visibility and Analytics, Automation and Orchestration, and Governance) span all pillars. This skill covers assessment, gap analysis, and progressive implementation across all pillars and maturity levels.
ZTMM programs fail most often when maturity is self-attested on a spreadsheet rather than proven with telemetry. Watch for these:
How to confirm: for each "Advanced/Optimal" claim, pull the supporting log or query (% devices with real-time posture, CAE token-revocation events, segment policy-deny counts) and reconcile against OMB M-22-09 requirements. Treat any pillar without queryable telemetry as Traditional until proven otherwise.
Identity refers to attributes that uniquely describe an agency user or entity, including non-person entities (NPEs) such as service accounts and machine identities.
Traditional Stage:
Initial Stage:
Advanced Stage:
Optimal Stage:
Devices include any hardware, software, or firmware asset that connects to a network -- servers, laptops, mobile phones, IoT devices, and network equipment.
Traditional Stage:
Initial Stage:
Advanced Stage:
Optimal Stage:
Networks encompass all communications media including internal networks, wireless, and the internet.
Traditional Stage:
Initial Stage:
Advanced Stage:
Optimal Stage:
Applications and workloads include agency systems, programs, and services running on-premises, on mobile devices, and in cloud environments.
Traditional Stage:
Initial Stage:
Advanced Stage:
Optimal Stage:
Data encompasses all structured and unstructured information, at rest, in transit, and in use.
Traditional Stage:
Initial Stage:
Advanced Stage:
Optimal Stage:
Maturity Progression:
Traditional -> Manual log review, limited SIEM
Initial -> Centralized logging, basic SIEM correlation
Advanced -> UEBA, automated threat detection, data lake analytics
Optimal -> AI/ML-driven continuous monitoring, predictive analytics
Maturity Progression:
Traditional -> Manual incident response, ad-hoc scripts
Initial -> Basic SOAR playbooks, automated alerting
Advanced -> Integrated SOAR with multi-pillar orchestration
Optimal -> Fully autonomous response, self-healing infrastructure
Maturity Progression:
Traditional -> Ad-hoc policies, manual compliance checks
Initial -> Documented zero trust strategy, basic policy framework
Advanced -> Policy-as-code, continuous compliance monitoring
Optimal -> Dynamic policy engine, real-time governance decisions
# Example: CISA ZTMM Maturity Assessment Scoring
class ZTMMAssessment:
PILLARS = ['Identity', 'Devices', 'Networks', 'Applications', 'Data']
STAGES = ['Traditional', 'Initial', 'Advanced', 'Optimal']
CROSS_CUTTING = ['Visibility_Analytics', 'Automation_Orchestration', 'Governance']
def __init__(self):
self.scores = {}
def assess_pillar(self, pillar, capabilities):
"""
Assess a pillar against ZTMM criteria.
capabilities: dict of capability_name -> maturity_stage
"""
stage_values = {stage: i for i, stage in enumerate(self.STAGES)}
scores = [stage_values.get(stage, 0) for stage in capabilities.values()]
avg_score = sum(scores) / len(scores) if scores else 0
overall_stage = self.STAGES[int(avg_score)]
self.scores[pillar] = {
'capabilities': capabilities,
'average_score': avg_score,
'overall_stage': overall_stage
}
return self.scores[pillar]
def generate_roadmap(self):
"""Generate prioritized improvement roadmap."""
roadmap = []
for pillar, data in self.scores.items():
for capability, stage in data['capabilities'].items():
stage_idx = self.STAGES.index(stage)
if stage_idx < 3: # Not yet Optimal
next_stage = self.STAGES[stage_idx + 1]
roadmap.append({
'pillar': pillar,
'capability': capability,
'current': stage,
'target': next_stage,
'priority': 3 - stage_idx # Higher priority for lower maturity
})
return sorted(roadmap, key=lambda x: x['priority'], reverse=True)
| CISA ZTMM Pillar | OMB M-22-09 Requirement | NIST 800-207 Section |
|---|---|---|
| Identity | MFA for agency staff | 3.1.1 |
| Devices | EDR for federal endpoints | 3.1.2 |
| Networks | Encrypt DNS traffic | 3.1.3 |
| Applications | Application security testing | 3.1.4 |
| Data | Data categorization | 3.1.5 |