The short version
- Zero trust treats every request as untrusted until verified, regardless of origin.
- NIST SP 800-207 is the canonical reference and defines the policy engine / policy enforcement split.
- Identity is the foundation; without strong identity and device posture, the rest collapses.
The longer explanation
Where the model comes from
The term "zero trust" was coined by a Forrester analyst in 2010. The concept became a federal mandate in 2021 when the U.S. Executive Order on Cybersecurity directed agencies to adopt zero-trust architectures, and NIST SP 800-207 became the working reference. Most large private enterprises have since incorporated zero trust into their target-state security architecture.
The seven tenets from NIST 800-207
NIST defines zero trust with seven tenets. The practical read on each:
- All data sources and computing services are resources. Treat APIs, microservices, storage buckets, and data streams the same way you treat application servers.
- All communication is secured regardless of network location. TLS everywhere, including east-west traffic.
- Access is granted per-session. Authorization is not a once-at-login decision; it is evaluated for each request or short-lived session.
- Access is determined by a dynamic policy. Static ACLs are not enough. Policy consumes identity, device posture, time, location, and signal quality.
- Integrity and security posture of assets is monitored. You cannot grant access to a compromised device.
- All authentication and authorization is dynamic and strictly enforced before access is allowed. No bypass paths.
- As much information as possible is collected about assets, network infrastructure, and communications to improve security posture. Zero trust is an analytics program as much as an access program.
The logical architecture
Under the hood, NIST separates two components: a policy decision point (PDP), which evaluates policy and returns a decision, and a policy enforcement point (PEP), which sits in front of the resource and enforces that decision. Most vendor offerings map to one or both of these. When you evaluate tools, ask which role they play and what they require from the identity and device-posture layers underneath.
Enterprise use cases
- Remote access for a hybrid workforce. Move from VPN-to-network to identity-aware proxy on high-value applications.
- Third-party and contractor access. Scope access to specific applications and data, time-bound, with device posture enforced.
- Cloud and SaaS consolidation. A single policy plane across IaaS, PaaS, and SaaS instead of per-vendor access rules.
- OT/IT boundary hardening. Apply the model at the gateway between enterprise IT and operational technology in industrials and utilities.
How Thoughtwave approaches this
Our cybersecurity practice runs zero-trust programs in three stages: assessment against the NIST tenets, a sequenced roadmap that starts with identity and device posture, and application-by-application migration behind an access broker. We pair security engineers with a compliance lead because regulated environments layer HIPAA, PCI-DSS, SOC 2, or FedRAMP requirements on top of the core controls.
For deeper context, see our Cybersecurity Solutions service and our work with Banking & Finance and Government clients.