0 / 24

Model 46 of 74 · Cybersecurity

Zero Trust Security Maturity Assessment

Assess zero trust architecture adoption across identity, network, and data.

Pillars & areas

Identity & access

Verify

  1. 01Identity & Access Management
  2. 02Network Segmentation & Micro-Perimeters

Devices & data

Protect

  1. 03Device Trust & Endpoint Security
  2. 04Data Protection & Classification

Monitor & govern

Adapt

  1. 05Visibility, Monitoring & Analytics
  2. 06Governance, Policy & Automation

Levels

  1. 1Perimeter-DependentLocation-based trust
  2. 2Trust-VerifiedExplicit verification
  3. 3Continuously AdaptiveReal-time risk signals

01 Identity & Access Management

How does the organisation verify and manage identity as the primary security control plane?

0/4 answered

ID-1How does your organisation authenticate users before granting access to systems and data?

Think about whether authentication relies on passwords alone, or whether additional factors and context are considered.

ID-2How are user access rights scoped and maintained over time?

Consider whether people accumulate permissions as they move between roles, or whether access is tightly matched to current responsibilities.

ID-3How does your organisation manage non-human identities such as service accounts, API keys, and automation credentials?

Think about whether service accounts are tracked, rotated, and scoped the same way human accounts are.

ID-4How does your organisation handle identity federation and single sign-on across internal and external services?

Consider whether each application manages its own user directory, or whether a central identity provider governs access decisions.

02 Network Segmentation & Micro-Perimeters

How does the organisation limit lateral movement and enforce granular network boundaries?

0/4 answered

NW-1How is your internal network segmented to limit the blast radius of a compromise?

Think about whether a compromised workstation could reach servers in other departments or environments without restriction.

NW-2How does your organisation control access to applications — through network location or through identity-aware proxies?

Consider whether being on the office network or VPN is enough to reach an application, or whether each connection must be individually authorised.

NW-3How does your organisation manage east-west traffic between internal services and workloads?

Think about whether internal service-to-service communication is encrypted, authenticated, and monitored or whether it flows unexamined.

NW-4How does your organisation handle network access for third parties, contractors, and guests?

Consider whether external parties land on the same network as employees or whether they are isolated with scoped access.

03 Device Trust & Endpoint Security

How does the organisation establish and maintain trust in the devices that access its resources?

0/4 answered

DV-1How does your organisation determine whether a device is trusted before allowing it to access corporate resources?

Think about whether any device can connect, or whether devices must meet specific health and compliance requirements first.

DV-2How does your organisation manage and secure endpoints across different operating systems and form factors?

Consider whether laptops, phones, tablets, and specialised devices all receive the same level of security management.

DV-3How does your organisation handle bring-your-own-device scenarios?

Think about whether personal devices access the same data and applications as corporate devices, and under what conditions.

DV-4How does your organisation detect and respond to compromised or non-compliant endpoints?

Consider how quickly a device with disabled security software or a known vulnerability would be identified and isolated.

04 Data Protection & Classification

How does the organisation protect data based on sensitivity, regardless of where it resides or travels?

0/4 answered

DP-1How does your organisation classify data to determine what level of protection it requires?

Think about whether there is a consistent scheme that labels data by sensitivity, or whether protection decisions are made ad hoc.

DP-2How does your organisation control who can access specific data sets and under what conditions?

Consider whether data access is governed by broad file-share permissions or by fine-grained, attribute-based rules.

DP-3How does your organisation protect data as it moves between systems, environments, and external parties?

Think about whether data in transit is encrypted and whether there are controls preventing sensitive data from leaving approved channels.

DP-4How does your organisation ensure data remains protected in cloud storage and SaaS applications?

Consider whether data in cloud platforms receives the same classification, encryption, and access controls as data in on-premises systems.

05 Visibility, Monitoring & Analytics

How does the organisation detect threats, anomalies, and policy violations across the zero trust environment?

0/4 answered

VM-1How does your organisation collect and centralise security telemetry across identity, network, endpoint, and data systems?

Think about whether security events from different systems are correlated in one place, or whether they sit in separate silos.

VM-2How does your organisation detect anomalous behaviour that may indicate a compromised identity or insider threat?

Consider whether unusual access patterns — such as a user accessing systems they never have before, or logging in from an unusual location — are detected and investigated.

VM-3How quickly can your organisation investigate and reconstruct the full scope of a security incident?

Think about whether an analyst can trace an attacker's path from initial access through lateral movement to data exfiltration in hours or weeks.

VM-4How does your organisation measure and report on the effectiveness of its zero trust controls?

Consider whether there are dashboards or metrics that show how well trust verification is working, or whether effectiveness is assumed.

06 Governance, Policy & Automation

How does the organisation define, enforce, and evolve zero trust policies at scale?

0/4 answered

GP-1How does your organisation define and document its zero trust security policies?

Think about whether there is a written policy framework that describes trust principles, or whether zero trust is an informal aspiration.

GP-2How are zero trust policies enforced across the environment — manually or through automated controls?

Consider whether policies are enforced by people following documented procedures, or by systems that automatically apply and verify compliance.

GP-3How does your organisation manage exceptions to zero trust policies?

Think about whether exceptions are tracked, time-limited, and regularly reviewed, or whether they accumulate permanently.

GP-4How does your organisation use automation to respond to trust violations and policy breaches?

Consider whether a detected policy violation requires a human to take action, or whether the system responds automatically.

Self-assessment report

Zero Trust Security

Answer the questions above and your report builds here: an overall score, a score and target for each area, and the three changes that matter most.

About this model

About the Zero Trust Security maturity model

Traditional perimeter-based security assumes that everything inside the network boundary can be trusted. Zero trust inverts this assumption entirely: no user, device, workload, or network segment is inherently trusted, regardless of location. Every access request is verified against the identity of the requester, the health of their device, the sensitivity of the resource, and the context of the moment.

This maturity model treats zero trust not as a product to purchase but as an architectural philosophy that organisations adopt incrementally. It recognises that most organisations start with a perimeter-dependent posture and must evolve through deliberate, measurable steps toward continuous, adaptive trust verification.

This assessment evaluates an organisation's zero trust maturity across six interdependent areas: identity, network, device, data, visibility, and governance. Together, these areas cover the full surface of trust decisions — from who is requesting access, to what device they are using, to what data they are touching, to how violations are detected and handled.

The model is designed to be practical rather than theoretical. Each question asks about observable behaviours and concrete capabilities, not aspirational goals. Organisations should expect uneven maturity across the six areas — this is normal and the assessment is designed to surface those gaps so investment can be prioritised where it matters most.

The assessment contains 24 questions (4 per area) scored across 3 maturity levels, producing area-level and overall maturity scores.

Who this assessment is for

  • CISOs and security leaders evaluating their organisation's progress toward a zero trust architecture and identifying priority investment areas.
  • Security architects benchmarking current capabilities against a structured model to build a phased implementation roadmap.
  • IT directors and infrastructure managers understanding how network, endpoint, and identity infrastructure must evolve to support zero trust principles.
  • Risk and compliance teams assessing whether trust verification controls are sufficient to meet regulatory expectations around access management and data protection.
  • Consultants and assessors conducting security maturity reviews for clients transitioning from perimeter-based to identity-centric security models.

The three maturity levels

  • Level 1 — Perimeter-Dependent: The organisation relies on network boundaries as the primary trust mechanism. Being inside the firewall, VPN, or office network is treated as sufficient proof of legitimacy. Access controls are coarse, credentials are static, device health is unchecked, and internal traffic flows freely. Security monitoring focuses on the perimeter, leaving internal threats and lateral movement largely invisible.
  • Level 2 — Trust-Verified: The organisation has moved beyond implicit trust for critical access paths. Multi-factor authentication is standard, networks are segmented into defined zones, endpoints must meet compliance baselines before connecting, and data protection policies are enforced through technical controls. Trust is granted per session with conditions, but verification is often point-in-time rather than continuous, and some legacy systems remain outside the zero trust model.
  • Level 3 — Continuously Adaptive: Trust is never static. Every access decision weighs identity, device, network and data signals, and trust is re-evaluated throughout a session rather than granted once at login. Policies are codified, enforced consistently and adjusted based on observed risk. Compromised sessions and devices are contained within minutes, exceptions are rare and temporary, and progress is measured against clear targets — the organisation treats security as an adaptive system that keeps tightening over time.

The 6 areas assessed

1. Identity & Access Management

The foundation of zero trust. This area assesses how the organisation authenticates users, manages access rights over time, handles non-human identities, and federates identity across its application estate. At maturity, identity becomes the primary control plane — every access decision starts with verified identity, not network location.

2. Network Segmentation & Micro-Perimeters

Examines how the organisation limits lateral movement within its environment. This covers internal network segmentation, identity-aware application access, east-west traffic controls between services, and isolation of third-party access. Mature organisations enforce micro-perimeters at the workload level, making the network path invisible and irrelevant to access decisions.

3. Device Trust & Endpoint Security

Evaluates how the organisation establishes and maintains trust in the devices accessing its resources. This includes device compliance verification, cross-platform endpoint management, BYOD governance, and detection of compromised endpoints. At the highest maturity, device posture is assessed continuously and feeds directly into access policy decisions.

4. Data Protection & Classification

Assesses whether the organisation protects data based on its sensitivity rather than its location. This covers data classification schemes, fine-grained access controls, data-in-transit protection, and cloud data security. Mature organisations apply automated classification and attribute-based access controls that follow data wherever it moves.

5. Visibility, Monitoring & Analytics

Measures the organisation's ability to observe, detect, and investigate across the zero trust environment. This includes centralised telemetry collection, behavioural anomaly detection, incident investigation speed, and zero-trust-specific effectiveness metrics. At maturity, analytics feed directly back into policy engines, creating a closed loop between detection and access decisions.

6. Governance, Policy & Automation

Examines how zero trust policies are defined, enforced, and evolved at scale. This covers policy documentation, automated enforcement, exception management, and automated response to trust violations. Mature organisations treat policies as code — versioned, tested, deployed through pipelines, and enforced by machines rather than people.

How this model relates to other frameworks

  • NIST SP 800-207 — Zero Trust Architecture reference document defining core tenets and deployment models
  • CISA Zero Trust Maturity Model — US federal government maturity model across five pillars (identity, devices, networks, applications, data)
  • Forrester Zero Trust eXtended (ZTX) Ecosystem — analyst framework mapping zero trust capabilities to vendor categories
  • Gartner Continuous Adaptive Risk and Trust Assessment (CARTA) — strategic approach to adaptive, continuous security evaluation
  • UK NCSC Zero Trust Architecture Design Principles — guidance for designing zero trust architectures in government and enterprise contexts
  • Google BeyondCorp — enterprise implementation demonstrating identity-based access without VPN dependency

Frequently asked questions

What is the Zero Trust Security maturity model?

Assess zero trust architecture adoption across identity, network, and data. It is an original, simplified model with three maturity levels (Perimeter-Dependent, Trust-Verified and Continuously Adaptive), assessed through 24 questions across 6 areas: Identity & Access Management, Network Segmentation & Micro-Perimeters, Device Trust & Endpoint Security, Data Protection & Classification, Visibility, Monitoring & Analytics and Governance, Policy & Automation.

How long does the Zero Trust Security assessment take?

Most people finish in 10–14 minutes. Each of the 24 questions has three concrete answer options. Your progress is saved in the page URL, so you can bookmark it and come back later.

How is the score calculated?

Each answer scores 1 (Perimeter-Dependent), 2 (Trust-Verified) or 3 (Continuously Adaptive). An area's score is the average of its answered questions, and the overall score is the average of the area scores, so every area counts equally. Scores run from 1.0 to 3.0.

Is my data stored or shared?

No. Your answers are never sent to a server. They are stored only in the page URL, which you control. Copy the link to share results with colleagues, or export a PDF or CSV report.

How should I use the results?

Start with "Where to focus" in your report. It lists the questions with the biggest gap to the target you set for each area, and shows what the next level looks like in practice. For a fuller picture, ask several people from different teams to complete the assessment and compare their links. Differences in perception are often as revealing as the scores themselves.