Zero trust is a cybersecurity approach that verifies access instead of assuming a request is safe because it comes from inside an agency network. For federal agencies, Office of Management and Budget (OMB) Memorandum M-22-09 turned that principle into goals across five areas: identity, devices, networks, applications and workloads, and data. It called for agencies to work toward those goals by the end of fiscal year 2024; the deadline itself does not prove that every agency completed them.
What zero trust means
In a zero-trust approach, network location alone does not confer trust. A request to use an application or reach data must be authenticated and authorized under the agency’s security rules. OMB’s federal strategy states that no network should be implicitly trusted and calls for traffic to be encrypted and authenticated as soon as practicable. OMB Memorandum M-22-09
As an Amazon Associate I earn from qualifying purchases.
That changes the emphasis from defending a perimeter and treating everything inside it as trusted to making access decisions closer to the user, device, application, and data involved. Zero trust is not a single appliance, software product, or cloud-only security plan; the federal strategy covers cloud, on-premises, and hybrid environments.
What are the five pillars of federal zero trust?
M-22-09 organizes its agency goals around five pillars from the Cybersecurity and Infrastructure Security Agency (CISA). Three capabilities—visibility and analytics, automation and orchestration, and governance—support work across all five rather than standing alone as additional pillars. OMB Memorandum M-22-09
#1 Best Overall
Identity
Agencies were directed to use enterprise-managed identities and enforce strong multifactor authentication (MFA) at the application layer. The strategy calls for phishing-resistant MFA for agency staff, contractors, and partners, and for offering phishing-resistant MFA to public users where MFA is supported. Agencies should also consider using at least one device-level signal, alongside identity, when deciding whether to authorize access.
Devices
Agencies should keep reliable, complete inventories of devices authorized for or used in official business and deploy endpoint detection and response capabilities consistent with federal guidance. Device context can contribute to an access decision, while fleet-wide coverage helps security teams understand which endpoints are in use.
Networks
The strategy calls for encrypting DNS requests wherever technically supported and enforcing authenticated HTTPS for production HTTP traffic, including internal traffic. Agencies are also to plan for isolating applications and environments instead of relying on a broad, trusted network perimeter.
Applications and workloads
Agencies should treat applications as internet-connected from a security perspective, test them rigorously, and welcome external vulnerability reports. Access should be planned at the application level rather than requiring users to enter a particular network first.
Rank #3
Data
Agencies should categorize data according to its protection needs, monitor access to sensitive information, and apply protections appropriate to those categories. The strategy also calls for enterprise logging and information sharing, which help support visibility across systems.
How federal agencies were directed to implement the strategy
Executive Order 14028 initiated a government-wide transition toward zero trust and required agencies to develop implementation plans. M-22-09 directed agencies to build on those plans, incorporate the memorandum’s requirements, and coordinate implementation across the organization. OMB Memorandum M-22-09
- Expand existing plans. Agencies were to incorporate M-22-09’s added requirements into their zero-trust work rather than treat the memorandum as a standalone product purchase.
- Submit plans and budget estimates. The memorandum gave agencies 60 days to submit implementation plans for fiscal years 2022–2024 to OMB and CISA for OMB concurrence, along with budget estimates.
- Assign responsibility and coordinate. Agencies were to designate implementation leads and bring together leadership and the IT, security, acquisition, finance, and privacy functions needed to plan and carry out the work.
- Use maturity and architecture references. CISA’s Zero Trust Maturity Model gives agencies a roadmap for assessing progress across the pillars and supporting capabilities. CISA describes that model as complementary to OMB’s strategy. CISA: Executive Order on Improving the Nation’s Cybersecurity
OMB characterized its memorandum as a starting point, not a complete specification for a fully mature architecture. For longer-term planning, it points agencies to CISA’s maturity model and Cloud Security Technical Reference Architecture, as well as NIST Special Publication 800-207 and other agency reference architectures. OMB Memorandum M-22-09, appendix and framing
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →What the federal deadline does—and does not—show
M-22-09 set the end of fiscal year 2024 as the target for the specific zero-trust security goals in the memorandum. That was a policy deadline, not an adoption statistic or evidence that every agency met every goal. The cited policy documents do not establish government-wide completion or whether a successor federal strategy has replaced M-22-09.
Best Value
How to assess a proposed zero-trust approach
The federal policy does not prescribe one universal product. An agency can assess an architecture or set of tools against the work its mission and existing systems require:
- Identity and access: Can it use enterprise-managed identities, enforce authentication at the application layer, support phishing-resistant MFA, and incorporate device context into authorization?
- Devices: Can the agency maintain a reliable inventory and provide endpoint detection and response coverage for the devices it authorizes or operates?
- Networks: Does the approach support encrypted DNS where technically feasible, authenticated HTTPS for production traffic, and plans to isolate applications and environments?
- Applications and data: Can applications be rigorously tested and external vulnerability reports handled? Can access to sensitive data be monitored, protected according to its classification, and logged?
- Shared capabilities and integration: Are visibility, analytics, automation, orchestration, and governance adequate across cloud, on-premises, and hybrid systems, and can they work with the agency’s existing environment?
These checks reflect the goals and planning dimensions in OMB’s strategy; they are not a vendor ranking or a claim that one implementation fits every agency. OMB Memorandum M-22-09
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
