Compliancemanzill.com
NIST SP 800-207 - Zero Trust Architechture

Compliance assessment

NIST SP 800-207 - Zero Trust Architechture

29 controls in 8 families. Read each control, mark it Met, Partially Met or Not Met, and keep evidence alongside. Your score is saved as you go, so you can pick up where you left off.

Start at 2.1.1

Tenets of Zero Trust7

2.1.1Secure collaborative computing devicesNot assessed2.1.2Secure network communicationNot assessed2.1.3Grant access with least priviledgeNot assessed2.1.4Determine access control policyNot assessed2.1.5Monitor and measure the integrity and security posture of assetNot assessed2.1.6Enforce authentication and authorizationNot assessed2.1.7Collect data about asset security postureNot assessed

Zero Trust View of a Network6

2.2.1Authenticating all connections and encrypting all trafficNot assessed2.2.2Allow enterprise subjects to use non-enterprise-owned deviceNot assessed2.2.3Evaluate security postureNot assessed2.2.4Utilize local connectivity and network servicesNot assessed2.2.5Establish secure communicationNot assessed2.2.6Implement a consistent security policy and postureNot assessed

Logical Components of Zero Trust Architecture1

3.1.1Enhance identity governanceNot assessed

Use Micro-segmentation1

3.1.2Place individual or groups of resources on a unique network segmentNot assessed

Use Network Infrastructure and Software Defined Perimeters1

3.1.3Use software defined perimeter approachNot assessed

Network/Environment Components1

3.4Establish network componentsNot assessed

Threats Associated with Zero Trust Architecture5

5.3Prevent stolen credentials/insider threatNot assessed5.4Inspect organizational networkNot assessed5.5Store system and network informationNot assessed5.6Reliance on proprietary data formats or solutionsNot assessed5.7Use of non-person entities (NPE) in ZTA administrationNot assessed

Migrating to a Zero Trust Architecture7

7.3.1Identify actors on the enterpriseNot assessed7.3.2Identify assets owned by the enterpriseNot assessed7.3.3Identify key processes and evaluate risks associated with executing processNot assessed7.3.4Formulate policies for the zero trust architecture candidateNot assessed7.3.5Identify candidate solutionsNot assessed7.3.6Implement deployment and monitoring policiesNot assessed7.3.7Reevaluate the zero trust architecture after a change to the systemNot assessed