OMB M-22-09 and EO 14028: zero trust requirements for agencies.
What the federal zero trust strategy asks of each pillar, how it connects to the CISA maturity model, and how to show measurable progress.
The policy chain
Executive Order 14028 (May 2021) directed federal agencies to modernize their cybersecurity and develop plans to implement zero trust architecture. OMB M-22-09 (January 2022) set the federal zero trust strategy and specific goals for each pillar. CISA's Zero Trust Maturity Model gives agencies a common way to describe where they are and where they are going, OMB M-26-14 (May 2026, replacing M-21-31) sets the logging and network visibility maturity that underpins it, and OMB M-26-15 (June 2026) starts the migration to post-quantum cryptography. See our guides to M-26-14 and post-quantum readiness.
What M-22-09 asks for, by pillar
| Pillar | Strategy goals (summary) | Where ZTASphere finds the evidence |
|---|---|---|
| Identity | Enterprise-managed identities for agency staff, with phishing-resistant MFA protecting them. | Identity provider policies and MFA registration (for example Microsoft Entra ID) |
| Devices | A complete inventory of the devices used for government work, with the ability to detect and respond to incidents on them. | Asset intelligence and EDR/XDR (Armis, Axonius, Forescout, Cortex XDR) |
| Networks | Encrypted DNS and HTTP traffic, and plans to break the network into isolated environments. | NGFW, SASE and the built-in encryption-in-transit probe |
| Applications | Treat applications as internet-connected, test them rigorously, and welcome external vulnerability reports. | Prisma Access, Prisma Cloud and application security testing evidence |
| Data | Protections based on thorough data categorization, monitoring of access to sensitive data, and enterprise-wide logging. | Data governance, encryption and SIEM (SAEGIS, OpenText Voltage, Elastic) |
Summary for orientation only. Read the memorandum for the authoritative requirements.
From compliance to measurable progress
Meeting a goal once is not the same as staying there. Configurations drift, devices are added and logs stop flowing. That is why agencies increasingly track zero trust as a continuous measurement rather than an annual data call.
ZTASphere maps each strategy goal to the ZTMM functions that evidence it, collects that evidence read-only from your tools, and produces executive, pillar, gap and CDM-aligned reports that can be released through an approval step. It can run in AWS GovCloud, Azure Government or an air-gapped enclave.
Frequently asked questions
What is OMB M-22-09?
OMB Memorandum M-22-09, Moving the U.S. Government Toward Zero Trust Cybersecurity Principles, was issued in January 2022. It sets a federal zero trust strategy with specific goals for identity, devices, networks, applications and workloads, and data, which agencies were directed to meet by the end of fiscal year 2024.
How does EO 14028 relate to zero trust?
Executive Order 14028, Improving the Nation's Cybersecurity, signed in May 2021, directed agencies to develop plans to adopt zero trust architecture. M-22-09 followed with the detailed federal strategy.
What is OMB M-26-14?
M-26-14, issued in May 2026, sets federal logging and network visibility requirements and replaces M-21-31. Its maturity model aligns with the Visibility and Analytics capability in the CISA ZTMM. See our M-26-14 guide.
What does OMB M-26-15 require?
M-26-15, issued in June 2026, directs agencies to plan and execute the migration to post-quantum cryptography, starting with an inventory and a plan within 120 days. See our post-quantum readiness guide.
How do agencies show progress?
Most agencies describe and track progress using the CISA Zero Trust Maturity Model's pillars and stages. ZTASphere maps each strategy goal to ZTMM functions and keeps the evidence current.
See your zero trust maturity, scored on live evidence.
Bring one pillar or all five. In a working session we connect to the tools you already run and show what ZTASphere sees, using your own environment's language and priorities.