Build an enterprise zero-trust network architecture by protecting specific resources, making access decisions explicit for both the requester and the device, and enforcing least-privilege access wherever it is needed. Treat it as a staged architecture and operating-model change—not a product purchase or a reason to trust everything on the corporate network.
What zero trust means for an enterprise
NIST defines zero trust as an evolving set of cybersecurity paradigms that moves defenses from static, network-based perimeters toward users, assets, and resources. In NIST SP 800-207, published in August 2020, the core principle is that neither network location nor enterprise ownership alone creates implicit trust. The protection target is the resource, not simply the network segment around it.
As an Amazon Associate I earn from qualifying purchases.
That changes the question from “Is this user on the company network?” to “Should this person or service, using this device and under these conditions, access this particular resource?” NIST treats authentication and authorization for both the subject (such as a person or service) and the device as discrete functions that take place before a session to an enterprise resource is established.
Zero trust is not a single topology or technology. NIST SP 800-207 describes architecture principles, deployment models, and use cases; CISA’s Zero Trust Maturity Model Version 2 organizes enterprise capabilities into pillars and cross-cutting capabilities. Together, they are useful for designing and sequencing a migration without mistaking a tool deployment for the finished architecture.
How an access decision should work
A practical way to explain the policy flow is to follow a request from its source to its destination. This is an implementation-oriented synthesis of NIST’s principles, not a verbatim sequence prescribed by NIST.
- Identify the requester. Establish whether the subject is a person or a service and authenticate it using the enterprise’s identity controls.
- Evaluate the device and context. Consider the device’s identity and relevant security posture, along with the context the enterprise has chosen to use in its policy.
- Apply policy to the resource. Determine whether this subject-device combination may access the specific application, service, data, or other resource, and under what scope.
- Enforce the decision. Put enforcement at a point suited to the resource and its access path. A decision that is not enforced cannot constrain access.
- Record and review. Capture access decisions and activity so security teams can assess whether policy is working and adjust it as the environment changes.
The enterprise must decide which signals matter, what access each decision permits, and how enforcement fits its applications and infrastructure. NIST supplies the architecture principles; it does not prescribe one universal policy rule or enforcement design for every organization.
Use CISA’s pillars to organize the architecture
CISA’s Zero Trust Maturity Model Version 2 groups capabilities into five pillars. It also identifies visibility and analytics, automation and orchestration, and governance as capabilities that support work across the pillars. Use the model to expose gaps and dependencies, not as five independent product shopping lists.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Rank #2
- HARDWARE PLUS SECURITY SERVICES: FortiGate-60F Firewall Appliance bundled with 1 year of FortiCare Premium and FortiGuard Unified Threat Protection.
- UNIFIED THREAT PROTECTION (UTP): Secures against advanced online threats with comprehensive web filtering and anti-botnet technologies.
- OPTIMIZED FOR MEDIUM-SIZED BUSINESSES: Tailored for businesses needing robust security without the infrastructure of larger enterprises.
- RELIABLE CUSTOMER SUPPORT: FortiCare Premium ensures high-quality support and service continuity.
- EFFECTIVE PROTECTION: Employs advanced filtering technologies to safeguard against sophisticated threats.
| Capability | What the enterprise needs to address |
|---|---|
| Identity | Establish reliable identities for people and services, then make access decisions explicit. |
| Devices | Include device identity and security posture in decisions about access to resources. |
| Networks | Reduce reliance on network location as a trust signal; constrain paths to resources and monitor activity. |
| Applications and workloads | Apply policy to application and service access, including cloud workloads. |
| Data | Identify the information the architecture is meant to protect and apply protections appropriate to it. |
| Visibility and analytics | Make relevant security and access information available for analysis across the pillars. |
| Automation and orchestration | Coordinate and automate policy-related work across capabilities where the enterprise’s design supports it. |
| Governance | Provide the oversight and decision-making that keep access policy and implementation aligned with enterprise needs. |
The pillars are interdependent. For example, a resource-level access rule needs a trustworthy identity, useful device information, an enforcement point that can apply the rule, and enough visibility to review its effects. A weakness in one area can limit the value of work in another.
Build the architecture in stages
A migration should start with the resources and access paths the enterprise needs to protect, then expand through measured improvements. The sequence below turns NIST’s resource-centered approach and CISA’s maturity framework into a practical planning method; it is not a mandated rollout schedule.
1. Set scope, ownership, and constraints
Identify the business-critical resources in scope and assign owners who can explain their purpose and access needs. Map the user groups and services that need them, along with dependencies and operational constraints. Include applications, workloads, infrastructure, and data as relevant to the environment. A resource-centered design cannot be planned reliably if the enterprise does not know what its resources are or who is accountable for them.
Rank #3
- Ubiquiti Networks networks networks Unifi security Gateway Pro 4-Port (USG-PRO-4)
- 4 Gigabit RJ45 ports plus 2 Gigabit SFP ports for fiber connectivity If needed
- Standard rack mount 1U size
- Provide cost-effective, reliable routing and advanced security for your network
- Max. Power Consumption:7W
2. Establish a current state and target outcomes
Use CISA’s maturity model to examine current capabilities across identity, devices, networks, applications and workloads, and data. Assess visibility and analytics, automation and orchestration, and governance across those workstreams as well. Record the gaps that block the intended access decisions, and define outcomes in terms of what the architecture should enable or constrain—not simply which systems will be installed.
3. Prioritize high-risk access paths
Choose initial work based on the resources and access paths that matter most to the enterprise, its known weaknesses, and the feasibility of making a change without disrupting required operations. CISA recommends modernizing network architecture with secure cloud capabilities such as identity and access management, endpoint detection and response, and policy enforcement; upgrading applications and infrastructure for modern identity and network access; centralizing cybersecurity data for analytics; and investing in technology and personnel. These are broad recommendations, not a prescribed vendor stack or a universal order of implementation.
4. Define policy and enforcement for selected resources
For each selected resource, specify the identities allowed to request access, the device and contextual signals the decision depends on, the access scope the policy permits, and where the decision will be enforced. Decide how the enterprise will respond if required signals are missing or a device’s posture changes. Design these choices around the actual application and infrastructure constraints; the exact policy and enforcement arrangement is enterprise-specific.
Rank #4
- Single appliance with integrated firewalling, SD-WAN and Wi-Fi controller reduces complexity of WLAN management. Its zero-touch deployment helps optimize your onboarding experience.
- Built on a patented secure processor, this compact network firewall delivers the highest level of security and performance in its class – 800 Mbps IPS | 500 Mbps threat protection.
- User-friendly management console gives you centralized visibility and simplifies policy enforcement across your network. Its zero-touch deployment helps you optimize your onboarding experience.
- Compact and fanless design equipped with 4 GE RJ45 ports (1 WAN port and 3 internal ports) provide essential connectivity and flexibility for various network configurations in a small-scale environment.
5. Reduce unnecessary paths between systems
Review whether systems and workloads can reach resources they do not need. Where it is useful and supportable, constrain those paths as part of the broader resource-protection design. CISA’s 2025 microsegmentation alert describes guidance covering key concepts, challenges, potential benefits, and recommended actions to modernize network security and advance zero trust. That description supports treating microsegmentation as one possible part of a wider effort; it does not establish a single required implementation for every enterprise.
6. Instrument the design and improve it
Make access decisions and relevant activity visible enough for security teams to evaluate policy and identify risks. CISA recommends centralizing and streamlining access to cybersecurity data for analytics, while its maturity model treats visibility and analytics, automation and orchestration, and governance as cross-cutting capabilities. Use what the enterprise can observe to identify gaps, inform policy changes, and plan the next stage of the migration.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallHow to compare architecture approaches
There is no universally correct zero-trust product or network topology in NIST SP 800-207 or CISA’s maturity model. Compare proposed approaches against the same practical questions so the decision stays tied to resource protection and operational fit.
| Comparison question | What to establish |
|---|---|
| Which resources and access paths are covered? | Whether the design protects the resources in scope and addresses the routes by which people, services, and devices reach them. |
| Which identity and device signals drive policy? | Whether the signals needed for the intended decisions are available and usable for the relevant subjects and devices. |
| Where is policy enforced? | Whether an enforcement point can apply the decision to the resource and access path in question. |
| How does the approach fit the environment? | Its integration with existing applications, cloud services, and infrastructure, including relevant operational constraints. |
| Can the enterprise review what happens? | Whether logging, visibility, and analytics support review of decisions and activity. |
| What does it require to operate? | The operational effort and governance needed to maintain policy and coordinate the capabilities involved. |
These are evaluation axes, not a vendor ranking. A proposal that addresses only network access, for example, should be assessed for how it handles identity, device posture, applications, workloads, and data—not assumed to cover those areas automatically.
Quick Recap
What to avoid when planning the migration
- Equating network access with resource authorization. Being connected to an enterprise network does not, by itself, establish that a subject and device should access a particular resource.
- Buying a single tool and calling the architecture complete. NIST presents zero trust as architecture principles and deployment models, while CISA spans multiple capability areas.
- Treating the pillars as isolated projects. Access decisions depend on information and controls that cross pillar boundaries.
- Leaving ownership and governance undefined. Without accountable resource owners and cross-enterprise oversight, policy decisions can become difficult to maintain.
- Expanding without visibility. If decision and activity data cannot be reviewed, it is harder to tell whether policy is effective or where the next improvement is needed.
References
- NIST, SP 800-207: Zero Trust Architecture, published August 2020.
- CISA, Zero Trust Maturity Model Version 2.
- CISA recommendations on modernizing network architecture, application and infrastructure access, cybersecurity data analytics, and investment in technology and personnel.
- CISA’s 2025 alert describing microsegmentation guidance for modernizing network security and advancing zero trust.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
