Zero trust defense means no user, device, or network location is trusted by default; every access request is checked against policy first. The DoD Zero Trust Strategy requires Components to reach Target Level outcomes by the end of fiscal year 2027.
The Department of Defense published its department-wide zero trust strategy in 2022, as the strategy document shows. This guide explains the NIST model behind it, the DoD pillars, and what the target dates mean. It is an independent explainer, not an official DoD resource. For the wider event context, see the AFITC conference guide. For the wider set of defense cyber rules and agencies, see the defense cybersecurity guide.
The NIST foundation: SP 800-207
The DoD defines zero trust in accordance with NIST Special Publication 800-207, Zero Trust Architecture, published in August 2020 by Scott Rose, Oliver Borchert, Stu Mitchell, and Sean Connelly. NIST describes zero trust as a set of cybersecurity paradigms that move defenses from static, network-based perimeters to users, assets, and resources, with no implicit trust granted based solely on physical or network location.
SP 800-207 lists seven tenets:
- All data sources and computing services are considered resources.
- All communication is secured regardless of network location.
- Access to individual enterprise resources is granted on a per-session basis.
- Access is determined by dynamic policy, which can include client identity, the requesting asset’s state, and behavioral and environmental attributes.
- The enterprise monitors and measures the integrity and security posture of all owned and associated assets.
- Resource authentication and authorization are dynamic and strictly enforced before access is allowed.
- The enterprise collects as much information as possible about assets, network infrastructure, and communications to improve its security posture.
Core components
NIST SP 800-207 names three logical components. The policy engine makes the decision to grant, deny, or revoke access. The policy administrator establishes or shuts down the communication path between a subject and a resource. The policy enforcement point enables, monitors, and terminates the connection. Inputs such as a continuous diagnostics and mitigation (CDM) system feed the policy engine with the state of the requesting asset.
The DoD Zero Trust Strategy
The DoD Zero Trust Strategy, dated 21 October 2022 and cleared for open publication on 7 November 2022, states that defending DoD networks with ever more sophisticated perimeter defenses “is no longer sufficient.” It describes itself as a strategy, not a solution architecture, and it notes that zero trust is not a product that can be bought.
The strategy sets four goals: Zero Trust Culture Adoption, DoD Information Systems Secured and Defended, Technology Acceleration, and Zero Trust Enablement. It applies to the DoD Information Enterprise and specifically the DoD Information Network (DODIN), including NIPRNet and SIPRNet. According to the same document, the DoD CIO established a Zero Trust Portfolio Management Office in January 2022 to orchestrate the effort.
The seven pillars
The strategy organizes capabilities under seven pillars. Its objectives name them as follows:
- User
- Device
- Applications & Workloads
- Data
- Network & Environment
- Automation & Orchestration
- Visibility & Analytics
The strategy says all pillar capabilities must work together to secure the Data pillar, which is central to the model. Execution enablers such as zero trust awareness and culture, governance, policy framework, and training cut across the pillars. The strategy also provides the foundation for refinements to the DoD Zero Trust Reference Architecture, version 2.0 (July 2022), which it uses to define basic and intermediate maturity.
Target level, advanced level, and dates
| Item | What the strategy says |
|---|---|
| Target Level | The minimum set of zero trust capability outcomes and activities needed to secure and protect data, applications, assets, and services against currently known threats. It covers basic and intermediate maturity as defined by the Reference Architecture. |
| Deadline | Components must achieve the intended Target Level outcomes of each DoD Zero Trust capability and execution enabler no later than the end of FY2027. |
| Execution plans | Component plans were due to DoD CIO and JFHQ-DODIN through the Zero Trust PfMO no later than 23 September 2023. |
| Advanced Level | The complete set of capability outcomes and activities that enable adaptive responses to risk and threats. A limited number of systems are required to reach it within the strategy’s timeframe; the Department will keep pursuing it. |
Source: the DoD Zero Trust Strategy, 21 October 2022.
The strategy adds that the Target Level should be reached as soon as possible, and that the PfMO may modify how the Target Level is defined as threats change.
Where NIST and DoD fit together
The two documents work at different levels. NIST SP 800-207 is technology agnostic: it says its tenets apply to work inside an organization or with partner organizations, and it expects an enterprise to have identity, credential, and access management and asset management systems in place, including multifactor authentication for access to some or all resources. NIST also states that not every tenet may be fully implemented in its purest form for a given strategy.
The DoD strategy turns that model into a program. It sets the pillars, the capability roadmap by fiscal year, the milestones, and the governance through the Zero Trust Portfolio Management Office. It also states that it covers resourcing and acquisition, measurement and metrics, and governance, with appendices on strategic and execution milestones.
The strategy adds a note on classified and national security systems: it does not change the authority of the Director of the National Security Agency as National Manager for National Security Systems, so the National Manager, not the DoD, sets zero trust guidance for those systems.
What this means in practice
For a defense network, zero trust replaces the idea of a trusted internal zone with continuous checks. The strategy lists capabilities such as continuous multi-factor authentication, micro-segmentation, advanced encryption, endpoint security, analytics, and robust auditing. The goal it states is to reduce the attack surface and ensure that adversary damage is quickly contained and remediated if a device, network, user, or credential is compromised.
The strategy also names the Defense Industrial Base as part of the stakeholder ecosystem that must embrace the change. Contractors handling defense information should read CMMC explained alongside this guide. Zero trust also supports the network-defense missions described in what is cyberpower, and security professionals can meet the people working on it at the events covered in the overview of government cybersecurity conferences.
The strategy also looks ahead. Its vision section pictures a department five years out in which zero trust principles are integrated into each of the five cybersecurity functions: Identify, Protect, Detect, Respond, and Recover. It states that operators at all levels should be confident that the data accessed, the assets deployed, the applications used, and the services provided are secured and resilient.
Culture is treated as a requirement, not an afterthought. The strategy’s foreword says every member of DoD must adopt a “never trust, always verify” mindset, and that Components must address zero trust within staffing, training, and professional development processes as well as technology.
Frequently asked questions
What is zero trust in the DoD?
A cybersecurity framework built on the NIST SP 800-207 definition: no implicit trust based on network location or asset ownership, with access decided by policy for each request.
When does the DoD need to reach zero trust Target Level?
By the end of FY2027, according to the DoD Zero Trust Strategy.
How many pillars does the DoD model have?
Seven: User, Device, Applications & Workloads, Data, Network & Environment, Automation & Orchestration, and Visibility & Analytics.
Can an organization buy zero trust?
No. The strategy states that zero trust may include certain products but is not a capability or device that may be bought.
Photo credits: Damir K / Pexels (Pexels License); Brett Sayles / Pexels (Pexels License).
