CISA Zero Trust Maturity Model 2.0, explained.
The five pillars, three cross-cutting capabilities, four maturity stages and all 40 functions of ZTMM 2.0, with the evidence that proves each one.
What the CISA Zero Trust Maturity Model is
The Cybersecurity and Infrastructure Security Agency (CISA) published the Zero Trust Maturity Model to help federal agencies plan and measure their move to zero trust under Executive Order 14028 and OMB Memorandum M-22-09. Version 2.0, released in April 2023, is now the common yardstick for agencies, auditors and many commercial security programs.
Zero trust starts from one assumption: no user, device or network location is trusted by default. Every request is verified with the best available information, access is limited to what is needed, and the environment is monitored continuously. The ZTMM turns that idea into concrete, measurable functions.
The four maturity stages
Each function is assessed on the same four-stage scale. Version 2.0 added the Initial stage so organizations can show early progress.
Manual and static
Policies set by hand, siloed tools, and maturity known only at audit time.
Starting to automate
Some cross-pillar visibility and the first automated attribute checks.
Centralized and coordinated
Automated controls, shared context across pillars, and response on risk.
Fully automated and dynamic
Just-in-time access, continuous monitoring and self-adjusting policy.
Five pillars and three cross-cutting capabilities
- Identity: who is asking. Authentication, identity stores, risk assessment and access management.
- Devices: what they are asking from. Compliance, asset and supply chain risk, resource access and threat protection.
- Networks: how the request travels. Segmentation, traffic management, encryption and resilience.
- Applications and Workloads: what they are asking for. Access, threat protection, accessibility, secure development and testing.
- Data: what is ultimately protected. Inventory, categorization, availability, access and encryption.
Three capabilities cut across every pillar: Visibility and Analytics, Automation and Orchestration, and Governance. They are assessed for each pillar and for the enterprise.
All 40 ZTMM 2.0 functions and the evidence that proves them
This is the catalog ZTASphere scores against. The evidence column lists what an assessor typically asks to see. A stage counts only when every criterion for it is backed by current evidence.
Identity 7 functions
| ID | Function | Typical evidence |
|---|---|---|
| ID-01 | Authentication | Identity-provider policy exports; authentication method inventory; sign-in logs; recovery procedures; exception lists; allow, deny, and revocation test records. |
| ID-02 | Identity Stores | Directory inventory; federation trust settings; synchronization records; joiner, mover and leaver samples; orphan-account reports; partner agreements. |
| ID-03 | Risk Assessments | Risk policies; identity incident records; detection output; policy-decision logs; risk-event test cases; tuning and exception history. |
| ID-04 | Access Management | Entitlement exports; access requests; approval records; expiration settings; privileged-session evidence; access reviews; emergency account tests. |
| ID-VA | Visibility and Analytics Capability | Log-source inventory; schema mappings; correlated events; detection tests; missing-log alerts; retained query results. |
| ID-AO | Automation and Orchestration Capability | Lifecycle workflows; HR or authoritative triggers; action logs; failure queues; end-to-end offboarding tests. |
| ID-GV | Governance Capability | Approved identity standards; policy-to-system mappings; access reviews; exception expiries; enforcement test records. |
Devices 7 functions
| ID | Function | Typical evidence |
|---|---|---|
| DV-01 | Policy Enforcement and Compliance Monitoring | Management and posture exports; baseline definitions; patch histories; vulnerability observations; compliance decisions; drift and remediation tests. |
| DV-02 | Asset and Supply Chain Risk Management | CMDB and CAASM records; procurement and cloud inventories; support dates; supplier assessments; provenance records; software dependencies where available. |
| DV-03 | Resource Access | Conditional-access configurations; device identity records; posture timestamps; gateway decisions; unmanaged-device and revocation tests. |
| DV-04 | Device Threat Protection | Protection health and policy exports; detection history; isolation records; alert routing; approved detection simulations; agentless control evidence. |
| DV-VA | Visibility and Analytics Capability | Inventory reconciliation output; source health; identity-device links; anomaly cases; creation and retirement events. |
| DV-AO | Automation and Orchestration Capability | Provisioning scripts; change approvals; quarantine and repair logs; rollback tests; decommissioning records. |
| DV-GV | Governance Capability | Lifecycle standards; purchase and retirement records; owner assignments; exception reviews; enforcement reports. |
Networks 7 functions
| ID | Function | Typical evidence |
|---|---|---|
| NW-01 | Network Segmentation | Flow metadata; diagrams; firewall and workload policies; service dependency maps; rule exceptions; controlled reachability tests. |
| NW-02 | Network Traffic Management | Application profiles; traffic rules; utilization and availability metrics; rule-change approvals; monitoring and adaptation records. |
| NW-03 | Traffic Encryption | TLS and tunnel configurations; certificate inventory; key metadata; protocol observations; renewal history; plaintext-path exceptions. |
| NW-04 | Network Resilience | Dependency and high-availability designs; failover settings; outage history; recovery tests; capacity metrics; approved degraded-mode procedures. |
| NW-VA | Visibility and Analytics Capability | Sensor map; flow and DNS metadata; detection records; cross-source correlation tests; visibility gap register. |
| NW-AO | Automation and Orchestration Capability | Configuration repositories; pipeline logs; policy tests; drift reports; approved changes; rollback records. |
| NW-GV | Governance Capability | Network standards; service-specific policies; approvals; rule reviews; partner agreements; enforcement tests. |
Applications & Workloads 8 functions
| ID | Function | Typical evidence |
|---|---|---|
| AW-01 | Application Access | Authorization policies; token configurations; API routes; service identities; access logs; object-level authorization and expiry tests. |
| AW-02 | Application Threat Protections | Threat models; application and API protection policies; runtime events; detection rules; controlled test results; bypass-path inventory. |
| AW-03 | Accessible Applications | Access architecture; broker and gateway policies; exposure inventory; remote-access tests; application-specific applicability decisions. |
| AW-04 | Secure Application Development and Deployment Workflow | Pipeline definitions; branch protections; build and deployment logs; artifact signatures; production access lists; release approvals; rollback records. |
| AW-05 | Application Security Testing | Test configurations and results; vulnerability backlog; release gates; retests; penetration-test scope; security exceptions. |
| AW-VA | Visibility and Analytics Capability | Application and API telemetry; trace IDs; security events; source health; service maps; test-event correlation. |
| AW-AO | Automation and Orchestration Capability | Deployment and configuration policies; change logs; scaling records; security triggers; rollback and resilience tests. |
| AW-GV | Governance Capability | Application standards; release gates; dependency records; ownership and exception registers; policy checks in pipelines. |
Data 8 functions
| ID | Function | Typical evidence |
|---|---|---|
| DT-01 | Data Inventory Management | Repository inventories; discovery metadata; data-flow maps; owners; external sharing records; DLP coverage and controlled tests. |
| DT-02 | Data Categorization | Classification policy; label schema; repository samples; automated classifier results; owner approvals; relabeling and exception records. |
| DT-03 | Data Availability | Availability designs; backup catalogs; restore logs; recovery objectives; historical-data access tests; key-recovery and retention policies. |
| DT-04 | Data Access | Database and repository permissions; sharing links; policy decisions; entitlement reviews; export logs; read/write/share denial tests. |
| DT-05 | Data Encryption | Storage and database settings; key inventory; key-use logs; secret scans; rotation and recovery tests; cryptographic exception register. |
| DT-VA | Visibility and Analytics Capability | Repository metadata; access and sharing logs; DLP events; classification changes; cross-source investigation records. |
| DT-AO | Automation and Orchestration Capability | Data lifecycle workflows; retention schedules; key and backup operations; deletion records; failed-action queues; restore tests. |
| DT-GV | Governance Capability | Data policy and stewardship register; handling rules; sharing agreements; exception approvals; enforcement and review records. |
Cross-cutting 3 functions
| ID | Function | Typical evidence |
|---|---|---|
| CC-VA | Visibility and Analytics | Enterprise source map; common identifiers; data-quality reports; correlated timelines; analyst investigations; detection validation. |
| CC-AO | Automation and Orchestration | Playbook inventory; integration contracts; action permissions; incident or test records; rollback logs; failure analysis. |
| CC-GV | Governance | Program charter; decision rights; architecture standards; risk and exception registers; funding decisions; policy enforcement reviews. |
How to measure ZTMM maturity
Most organizations start with a workshop and a spreadsheet: each pillar owner rates their functions and attaches screenshots. That gives a baseline, but it is slow to produce, depends on who answered, and is out of date within weeks.
A defensible measurement has three properties. It is evidence-based: every rating traces to a configuration export, log or record. It is current: evidence older than a set window, such as 30 days, stops counting. And it is independent: the person who submits evidence is not the one who accepts it. Our step-by-step assessment guide walks through the process, and ZTASphere automates it from the tools you already own.
Frequently asked questions
What is the CISA Zero Trust Maturity Model 2.0?
It is CISA's roadmap for moving an organization toward zero trust. Version 2.0, published in April 2023, organizes the work into five pillars (Identity, Devices, Networks, Applications and Workloads, Data) and three cross-cutting capabilities (Visibility and Analytics, Automation and Orchestration, Governance), each measured across four maturity stages.
What are the four ZTMM maturity stages?
Traditional, Initial, Advanced and Optimal. Version 2.0 added the Initial stage between Traditional and Advanced so agencies could recognize early progress.
How many functions does ZTMM 2.0 have?
ZTASphere's catalog of ZTMM 2.0 has 40 functions: the pillar functions plus the Visibility and Analytics, Automation and Orchestration, and Governance capability for each pillar and for the enterprise as a whole. ZTASphere breaks these into 182 testable criteria.
Is the ZTMM mandatory for federal agencies?
OMB M-22-09 sets the federal zero trust goals, and CISA's model is the reference most agencies and their inspectors general use to describe and report progress. Commercial organizations use it voluntarily as a practical yardstick.
How is ZTMM different from NIST SP 800-207?
NIST SP 800-207 defines zero trust architecture: its tenets, components and deployment models. The CISA ZTMM describes how mature an organization's implementation is, pillar by pillar, so it is the better tool for measuring progress.
Source: CISA, Zero Trust Maturity Model Version 2.0 (April 2023). Function evidence lists come from the ZTASphere catalog (rules version 2026.11.1). CISA does not endorse ZTASphere.
Score all 40 functions automatically.
ZTASphere collects the evidence in this table from your security tools and keeps every score current.