NIST SP 800-207 Zero Trust Architecture Explained

Seven Basic Tenets (Official §2.1)

1. All data sources and computing services are considered resources
2. All communication is secured regardless of network location
3. Access to individual enterprise resources is granted on a per-session basis
4. Access is determined by dynamic policy (identity, asset state, environment, behavior)
5. The enterprise monitors and measures integrity and security posture of owned and associated assets
6. All resource authentication and authorization are dynamic and strictly enforced before access
7. The enterprise collects information about assets, network infrastructure, and communications to improve posture

Logical Components: PE, PA, and PEP

• Policy Engine (PE) — ultimate decision to grant or deny access
• Policy Administrator (PA) — establishes or tears down paths; configures PEPs
• Policy Enforcement Point (PEP) — enables, monitors, and terminates subject-to-resource connections

Common approaches include enhanced identity governance, micro-segmentation, and network-based segmentation. A full ZTA typically blends elements of all three.

Why It Matters

Zero trust is architecture and policy — not a single SKU. SIEM, CDM, and threat intelligence feed continuous evaluation (tenets 5–7).

How CyberSilo Helps

• ThreatHawk SIEM and ThreatSearch TIP — inputs to continuous trust evaluation
• Compliance Standards Automation — policy and evidence linkage
• Agentic SOC AI — triage of access anomalies

Frequently Asked Questions

Is zero trust one product?

No. SP 800-207 describes architecture tenets and logical components. Products enable parts of a ZTA; they do not equal ZTA by themselves.

Does a VPN equal zero trust?

Not by itself. Network location alone must not imply trust (tenet 2); access remains per-session and policy-driven.

What is the difference between the Policy Engine and the PEP?

The Policy Engine decides; the Policy Enforcement Point enforces (configured via the Policy Administrator).

Related NIST Resources

NIST hub · What Is NIST CSF 2.0? · CSF Function Guides · 800-63 Digital Identity