2.2.3Evaluate security posture

No resource is inherently trusted. Every asset must have its security posture evaluated via a PEP before a request is granted to an enterprise-owned resource (similar to tenet 6 above for assets as well as subjects). This evaluation should be continual for as long as the session lasts. Enterprise-owned devices may have artifacts that enable authentication and provide a confidence level higher than the same request coming from non-enterprise-owned devices. Subject credentials alone are insufficient for device authentication to an enterprise resource.