Step 4: Create Zero Trust Policy

The objective of this document is to provide guidance for executing the fourth step in the five step Zero Trust implementation process described in the NSTAC Report to the President on Zero Trust and Trusted Identity Management, originally formulated and socialized by John Kindervag. Separate CSA research documents are being developed to elaborate detailed guidance for each of the five steps. The fourth step, Create Zero Trust Policy, entails creating security policies for, within and between the organization's Protect Surface(s) consisting of business system(s) composed of Data, Applications, Assets, and Services (DAAS) elements. The technical policies should not be confused with the organizational policies (for public and private sector) which are set by an organisation’s management as guidance and direction for the applicable system(s). Technical policies are derived from Zero Trust architecture. The policies are not limited to network or identities, but cover the whole technical stack to bring security policy enforcement closer to resources being secured. These key considerations and concepts are explored, including the network layer, the application layer, device-to-device communication. The paper demonstrates the implementation of CISA Zero Trust Maturity Model V2 for iterative development of the policies such that they support the organization’s risk posture and business information systems. This guidance empowers organizations to adopt a repeatable process for navigating the complexities of Zero Trust implementation.

Key Takeaways

• The objective of this document is to provide guidance for executing the fourth step in the five step Zero Trust implementation process described in the NSTAC Report to the President on Zero Trust and Trusted Identity Management, originally formulated and socialized by John Kindervag. Separate CSA research documents are being developed to elaborate detailed guidance for each of the five steps.
• The fourth step, Create Zero Trust Policy, entails creating security policies for, within and between the organization's Protect Surface(s) consisting of business system(s) composed of Data, Applications, Assets, and Services (DAAS) elements. The technical policies should not be confused with the organizational policies (for public and private sector) which are set by an organization’s management as guidance and direction for the applicable system(s). Technical policies are derived from Zero Trust architecture. The policies are not limited to network or identities, but cover the whole technical stack to bring security policy enforcement closer to resources being secured. These key considerations and concepts are explored, including the network layer, the application layer, device-to-device communication. The paper demonstrates the implementation of CISA Zero Trust Maturity Model V2 for iterative development of the policies such that they support the organization’s risk posture and business information systems. This guidance empowers organizations to adopt a repeatable process for navigating the complexities of Zero Trust implementation.