vahagn-madatyan Zero Trust Architecture Maturity Assessment
Architecture-level posture assessment that scores an organization's zero trust maturity across five pillars: Identity, Device, Network, Application, and Data. This is not a device-specific configuration audit — it evaluates how well the overall architecture implements zero trust principles from NIST SP 800-207.
Each pillar is scored from Level 1 (Traditional perimeter-centric) to Level 5 (Adaptive, fully automated). The overall maturity equals the lowest individual pillar score because zero trust is only as strong as its weakest pillar.
Consult references/maturity-model.md for full pillar definitions, scoring
criteria per level, and calculation methodology. Use references/cli-reference.md
for platform-specific validation commands organized by ZT control category.
When to Use
- Initial zero trust posture baseline — establishing where the organization stands before beginning a ZT transformation program
- Annual or semi-annual ZT maturity reassessment to measure progress against roadmap milestones
- Pre-migration assessment — evaluating ZT readiness before moving workloads to cloud, hybrid, or multi-cloud architectures
- Merger/acquisition due diligence — assessing acquired infrastructure against organizational ZT maturity targets
- Compliance mapping — demonstrating ZT posture for frameworks that reference zero trust (NIST CSF 2.0, DoD ZTRA, CISA ZT Maturity Model)
- Board or executive reporting — translating security posture into a scored maturity model with clear improvement trajectory
Prerequisites
- Read-only access to network infrastructure devices (firewalls, switches, routers, NAC appliances) via SSH, console, or management API
- Read-only access to identity infrastructure (IdP, RADIUS/TACACS+ servers, MFA platform, certificate authority) for configuration verification
- Network architecture diagrams showing segmentation boundaries, trust zones, and traffic flow paths
- Inventory of authentication methods deployed (password-only, MFA, certificate, SSO) and coverage percentage across user populations
- Understanding of data classification scheme (if any) and where sensitive data resides in the network
- Documented security policies covering access control, encryption requirements, and monitoring standards
Procedure
Follow this six-step maturity assessment flow. Each step scores one or more pillars against the maturity criteria in Threshold Tables below.
Step 1: Define Assessment Scope
Establish the boundaries of the assessment before scoring any pillar.
Identify the assessment perimeter:
- Enterprise campus, data center, cloud, remote access, or full organization
- Which sites, business units, or network segments are included
- Regulatory or compliance drivers that set minimum maturity targets
Document current architecture baseline:
- Number and type of network segments (VLANs, VRFs, security zones)
- Identity infrastructure components (IdP, directory, MFA, NAC)
- Data classification maturity (none, informal, formal with labeling)
- Monitoring and logging coverage (SIEM, flow analysis, endpoint telemetry)
Set target maturity level: Determine the organization's target maturity for each pillar based on risk appetite, regulatory requirements, and business objectives. Most organizations target Level 3 (Advanced) as an initial milestone with Level 4 (Optimal) as a two-to-three-year goal.
Step 2: Identity Pillar Assessment
Evaluate authentication and authorization maturity across all access points.
Authentication method inventory: Identify what authentication mechanisms are deployed and where. Check centralized identity provider integration, MFA deployment coverage, and certificate-based authentication availability.
Key evidence to collect:
- Percentage of users with MFA enabled (privileged vs. all users)
- Authentication method for network device management (local, RADIUS, TACACS+)
- Service account management — are machine identities inventoried with credential rotation policies?
- Conditional access policies — does authentication strength vary based on risk signals (location, device, behavior)?
Authorization model: Evaluate how access decisions are made. Check for role-based access control, just-in-time privilege elevation, and separation of duties enforcement.
Score the Identity pillar against the Threshold Tables maturity criteria. Record evidence for each level criterion that is or is not met.
Step 3: Device Pillar Assessment
Evaluate device trust and compliance verification maturity.
Asset inventory completeness: Determine whether all devices connecting to the network are inventoried, classified, and tracked. Check network access control enforcement — are unknown devices blocked or quarantined?
Key evidence to collect:
- 802.1X or NAC deployment coverage (percentage of access ports enforcing device authentication)
- Device posture checks enforced at connection time (patch level, encryption status, endpoint protection)
- IoT and unmanaged device handling — profiled, segmented, or unrestricted?
- Device certificate issuance and lifecycle management
Continuous compliance monitoring: Assess whether device posture is checked only at connection time or monitored continuously. Check for automated quarantine of devices that fall out of compliance during an active session.
Score the Device pillar against the Threshold Tables maturity criteria.
Step 4: Network Pillar Assessment
Evaluate segmentation, encryption, and network-layer access control maturity.
Segmentation analysis: Assess the granularity of network segmentation beyond basic VLANs. Check for micro-segmentation technologies that enforce identity-aware or tag-based policies between workloads in the same zone.
Key evidence to collect:
- Segmentation technology in use (VLAN-only, ACL-based, group-based policy, zone-based, software-defined)
- East-west traffic inspection — is lateral movement between segments inspected and controlled?
- Encryption of internal traffic — MACsec for LAN, IPsec for WAN, TLS for application transport
- Dynamic segmentation — does the network segment change based on identity or posture signals?
Access control model: Evaluate firewall and ACL rule architecture. Check for default-deny posture, explicit allow rules with logging, and regular rule review cadence. Assess rule permissiveness — overly broad rules (any-any, /8 source ranges) indicate low maturity.
Score the Network pillar against the Threshold Tables maturity criteria.
Step 5: Application and Data Pillar Assessment
Evaluate application-layer controls and data protection maturity together because they are closely coupled in ZT architectures.
Application access controls: Assess whether applications enforce their own access controls independent of network location. Check for application-aware proxies, ZTNA brokers, or service mesh with mutual TLS.
Key evidence to collect:
- Application access method (direct network access, VPN, ZTNA/SDP, reverse proxy)
- API security — authentication and authorization enforcement at API gateway
- Workload segmentation in data center or cloud (container network policies, service mesh, security groups)
- Application vulnerability management integration with access decisions
Data protection controls: Assess data classification, encryption enforcement, and access governance.
Key evidence to collect:
- Data classification scheme (does one exist, is it enforced, is it automated?)
- Encryption by classification level — is sensitive data encrypted at rest and in transit regardless of network location?
- Data loss prevention coverage — egress inspection, email DLP, endpoint DLP
- Data access logging — are accesses to sensitive data stores logged and monitored?
Score both the Application and Data pillars against the Threshold Tables.
Step 6: Calculate Maturity Score and Report
Compile pillar scores into an overall maturity assessment.
Calculate overall maturity:
Use the lowest-pillar method (recommended) — overall maturity equals the
lowest individual pillar score. Optionally calculate the weighted average
for progress tracking (see references/maturity-model.md for default
weights).
Gap analysis: For each pillar, identify the specific criteria not met between the current level and the target level. Classify each gap as a quick win (0–30 days, configuration change), project (1–6 months, new tooling), or strategic initiative (6+ months, organizational change).
Generate remediation roadmap: Prioritize the lowest-scoring pillar first. Within each pillar, order remediation actions by impact — quick wins that raise the pillar score first, then projects that close remaining gaps. Set re-assessment dates to measure progress.
Threshold Tables
Maturity Level Scoring — Identity Pillar
| Level | Maturity | Criteria |
|---|---|---|
| 1 | Traditional | Password-only authentication; local accounts on devices; no centralized identity provider |
| 2 | Initial | MFA for privileged users; centralized IdP (RADIUS/TACACS+) for infrastructure; basic password policies enforced |
| 3 | Advanced | MFA for all users; certificate-based auth available; automated account lifecycle; conditional access policies active |
| 4 | Optimal | Risk-adaptive MFA; continuous session evaluation; just-in-time privilege elevation; passwordless options deployed |
| 5 | Adaptive | Zero standing privileges; behavioral biometrics; real-time identity risk scoring; fully automated access governance |
Maturity Level Scoring — Device Pillar
| Level | Maturity | Criteria |
|---|---|---|
| 1 | Traditional | No device inventory; no posture checks; any device connects freely |
| 2 | Initial | Basic asset inventory; 802.1X on some access ports; endpoint protection required but not enforced at network level |
| 3 | Advanced | NAC enforces posture checks at connection; device certificates issued; 802.1X on all wired access ports |
| 4 | Optimal | Continuous posture monitoring; non-compliant devices quarantined automatically; IoT profiled and segmented |
| 5 | Adaptive | Real-time device risk scoring; automated remediation; predictive compliance; hardware attestation |
Maturity Level Scoring — Network Pillar
| Level | Maturity | Criteria |
|---|---|---|
| 1 | Traditional | Flat network or VLAN-only segmentation; implicit trust for internal traffic; no east-west inspection |
| 2 | Initial | ACL-based segmentation between zones; VRF-lite for management isolation; perimeter IDS/IPS only |
| 3 | Advanced | Micro-segmentation (group-based policy or zone-based); identity-aware firewall rules; encrypted management plane |
| 4 | Optimal | Encrypted east-west traffic; software-defined perimeter; dynamic segmentation based on posture and identity |
| 5 | Adaptive | Fully automated micro-segmentation; real-time policy adaptation; per-flow encryption; closed-loop enforcement |
Maturity Level Scoring — Application Pillar
| Level | Maturity | Criteria |
|---|---|---|
| 1 | Traditional | No application-layer access control; network access implies application access; no API security |
| 2 | Initial | Basic WAF deployed; application-aware firewall rules for critical apps; initial API gateway |
| 3 | Advanced | All external apps behind ZTNA/application proxy; API auth enforced; workload segmentation in data center |
| 4 | Optimal | Service mesh with mTLS; runtime protection (RASP); automated vulnerability scanning in CI/CD pipeline |
| 5 | Adaptive | Real-time application behavior analytics; automated policy generation from traffic analysis; zero-trust service mesh |
Maturity Level Scoring — Data Pillar
| Level | Maturity | Criteria |
|---|---|---|
| 1 | Traditional | No data classification; encryption only on external links; no DLP; access based on network location |
| 2 | Initial | Basic classification (public/internal/confidential); encryption at rest for databases; email DLP |
| 3 | Advanced | Automated classification and labeling; DLP across egress points; access logging for sensitive data stores |
| 4 | Optimal | Data access governance with analytics; rights management enforced; encryption enforced by classification level |
| 5 | Adaptive | Real-time data access risk scoring; automated DLP; predictive data movement analysis; full lineage tracking |
Overall Maturity Posture
| Score | Posture | Guidance |
|---|---|---|
| Level 4–5 | Strong | Maintain continuous improvement; focus on automation and adaptive controls |
| Level 3 | Moderate | Solid foundation; prioritize pillar-specific gaps to reach Level 4 |
| Level 2 | Developing | ZT journey underway; accelerate foundational controls (identity, network) |
| Level 1 | Traditional | Significant transformation needed; begin with identity and network pillars |
Decision Trees
ZT Pillar Prioritization
Assess all five pillar scores
├── Identity Pillar is lowest?
│ ├── Yes → PRIORITY 1: Identity
│ │ ├── Is MFA deployed for any users?
│ │ │ ├── No → Quick win: deploy MFA for privileged accounts first
│ │ │ └── Yes but partial → Expand MFA to all users
│ │ └── Is there a centralized IdP?
│ │ ├── No → Project: deploy RADIUS/TACACS+ integration
│ │ └── Yes → Advance to conditional access policies
│ └── No → Check next pillar
│
├── Network Pillar is lowest?
│ ├── Yes → PRIORITY 1: Network
│ │ ├── Segmentation beyond VLANs?
│ │ │ ├── No → Project: deploy micro-segmentation technology
│ │ │ └── Yes but limited → Expand to cover critical workloads
│ │ └── East-west encryption?
│ │ ├── No → Project: evaluate MACsec/IPsec for internal traffic
│ │ └── Partial → Extend to remaining segments
│ └── No → Check next pillar
│
├── Device Pillar is lowest?
│ ├── Yes → PRIORITY 1: Device
│ │ ├── 802.1X/NAC deployed?
│ │ │ ├── No → Project: deploy NAC on access layer
│ │ │ └── Yes but partial → Extend to all wired access ports
│ │ └── Posture checks enforced?
│ │ ├── No → Quick win: enable posture policy on existing NAC
│ │ └── At connection only → Advance to continuous monitoring
│ └── No → Check next pillar
│
├── Application or Data Pillar is lowest?
│ └── Yes → Address after Identity/Device/Network foundation is Level 3+
│ ├── Application: start with ZTNA/app proxy for external access
│ └── Data: start with classification scheme and encryption policy
│
└── All pillars at same level?
└── Advance Identity and Network first (foundational pillars)
Quick Win vs Strategic Investment
Identified gap between current and target maturity
├── Can it be closed with a configuration change?
│ ├── Yes → Quick win (0–30 days)
│ │ ├── MFA enablement on existing IdP
│ │ ├── ACL tightening on existing firewalls
│ │ ├── Enable logging/monitoring already licensed
│ │ └── 802.1X on ports with existing NAC infrastructure
│ └── No → Requires new tooling or infrastructure?
│ ├── Yes → Project (1–6 months)
│ │ ├── NAC platform deployment
│ │ ├── Micro-segmentation technology rollout
│ │ ├── ZTNA/SDP implementation
│ │ └── Data classification tooling
│ └── Requires organizational change?
│ └── Strategic initiative (6+ months)
│ ├── Zero standing privileges program
│ ├── Full data governance framework
│ └── Automated closed-loop policy engine
Report Template
ZERO TRUST MATURITY ASSESSMENT
======================================
Organization: [name]
Assessment Scope: [campus / data center / full enterprise]
Assessment Date: [timestamp]
Assessed By: [operator/team]
Framework Reference: NIST SP 800-207
PILLAR MATURITY SCORES:
Identity: Level [1-5] — [Traditional/Initial/Advanced/Optimal/Adaptive]
Device: Level [1-5] — [Traditional/Initial/Advanced/Optimal/Adaptive]
Network: Level [1-5] — [Traditional/Initial/Advanced/Optimal/Adaptive]
Application: Level [1-5] — [Traditional/Initial/Advanced/Optimal/Adaptive]
Data: Level [1-5] — [Traditional/Initial/Advanced/Optimal/Adaptive]
OVERALL MATURITY:
Lowest-Pillar Score: Level [n] — [label]
Weighted Average: [n.n]
Target Maturity: Level [n] — [label]
PILLAR DETAIL — [Pillar Name]:
Current Level: [n]
Target Level: [n]
Evidence Summary:
- [criteria met]
- [criteria met]
Gaps to Target:
- [criteria not met] — Classification: [quick win / project / strategic]
(Repeat for each pillar)
GAP ANALYSIS SUMMARY:
Quick Wins (0–30 days):
- [action] — [pillar] — [expected level improvement]
Projects (1–6 months):
- [action] — [pillar] — [expected level improvement]
Strategic Initiatives (6+ months):
- [action] — [pillar] — [expected level improvement]
REMEDIATION ROADMAP:
Phase 1 (0–90 days): [lowest-scoring pillar quick wins]
Phase 2 (3–6 months): [foundational pillar projects]
Phase 3 (6–12 months): [advanced maturity initiatives]
NEXT ASSESSMENT: [date — typically 6 months for active transformation, 12 months for maintenance]
Troubleshooting
Pillar Scoring Disagreements
When evidence supports arguments for two adjacent maturity levels, score at the lower level. A pillar earns a level only when all criteria for that level are fully met. Partial implementation does not count — document the specific gaps preventing the higher score.
Scope Boundary Ambiguity
If the assessment scope is unclear (e.g., which cloud environments are included, whether partner network connections count), resolve scope questions before beginning pillar assessments. Unclear scope leads to inconsistent scoring and non-comparable results across assessment cycles.
Missing Evidence
When technical evidence cannot be collected for a pillar (e.g., no read-only access to the identity provider, cloud environment not in scope), document the gap and score based on available evidence only. Flag the pillar as "partial assessment" in the report and schedule follow-up evidence collection.
Legacy Infrastructure
Legacy devices that cannot support modern ZT controls (e.g., switches without 802.1X, devices without SNMPv3) should be scored at their actual capability level, not excluded. Their presence lowers the pillar score, which correctly reflects the risk. Document compensating controls if legacy devices are isolated into restricted segments.
Multi-Site Consistency
When assessing organizations with multiple sites, score each site independently first, then roll up to an overall score. A headquarters at Level 3 with branch offices at Level 1 results in an overall Level 1 — the weakest site determines organizational posture. This prevents overestimating maturity based on flagship site capabilities alone.