View Resource
SP 800-207A - A Zero Trust Architecture Model for Access Control in Cloud-Native Applications in Multi-Cloud Environments
Release Date: 09/14/2023
Organization: NIST
Content Type: Architecture
Solution Provider Neutrality: Neutral
The objective of this publication is to provide guidance for realizing an architecture that can enforce granular application-level policies while meeting the runtime requirements of ZTA for multi-cloud and hybrid environments.
NIST Special Publication 800-207 lays out a comprehensive set of zero trust principles and referenced zero trust architectures (ZTA) for turning ZT concepts into reality. A key paradigm shift in ZTAs is the change in focus from security controls based on segmentation and isolation using network parameters (e.g., Internet Protocol (IP) addresses, subnets, perimeter) to identities. From an application security point of view, this requires authentication and authorization policies based on application and service identities in addition to the underlying network parameters and user identities.