Glossary
Zero trust glossary.
Plain-language definitions of {len(TERMS)} zero trust, ZTMM and federal compliance terms.
- Zero trust
- A security model that removes implicit trust: every access request is verified explicitly, access is least-privilege, and breach is assumed.
- Zero trust architecture (ZTA)
- An enterprise design that applies zero trust principles, defined in NIST SP 800-207 through a policy engine, policy administrator and policy enforcement points.
- CISA Zero Trust Maturity Model (ZTMM)
- CISA's model for measuring zero trust progress across five pillars, three cross-cutting capabilities and four maturity stages. Version 2.0 was published in April 2023.
- Pillar
- One of the five ZTMM areas: Identity, Devices, Networks, Applications and Workloads, and Data.
- Cross-cutting capabilities
- Visibility and Analytics, Automation and Orchestration, and Governance: capabilities assessed for every pillar and the enterprise.
- Maturity stage
- A ZTMM level: Traditional, Initial, Advanced or Optimal.
- Function
- A specific capability within a pillar that is assessed for maturity, such as Authentication or Network Segmentation. ZTASphere scores 40.
- Criterion
- An atomic, testable condition that must be met for a function to reach a stage. ZTASphere uses 182.
- Policy decision point (PDP)
- The component that decides whether an access request is allowed, based on policy and signals.
- Policy enforcement point (PEP)
- The component that enables, monitors and ends connections according to the PDP's decision.
- Phishing-resistant MFA
- Multi-factor authentication that cannot be defeated by a fake login page, such as FIDO2 security keys or PIV/CAC smart cards.
- Least privilege
- Granting only the access needed for a task, for only as long as it is needed.
- Just-in-time (JIT) access
- Privileged access granted on request for a limited time and removed automatically afterwards.
- Micro-segmentation
- Dividing a network into small isolated zones so workloads can talk only to what they need.
- ZTNA
- Zero trust network access: brokered, identity-aware access to applications instead of broad network access through a VPN.
- SASE
- Secure access service edge: networking and security services, including ZTNA, delivered from the cloud.
- EDR / XDR
- Endpoint, and extended, detection and response: tools that detect and respond to threats on devices and across sources.
- CAASM
- Cyber asset attack surface management: consolidating asset data from many tools into one inventory.
- CSPM / CNAPP
- Cloud security posture management and cloud-native application protection platforms, which assess cloud configuration and workloads.
- DLP
- Data loss prevention: controls that detect and stop sensitive data leaving where it should stay.
- CDM
- Continuous Diagnostics and Mitigation: CISA's program providing agencies with tools and dashboards for continuous monitoring.
- Continuous monitoring (ConMon)
- Ongoing assessment of security controls and risk, described in NIST SP 800-137 and required for FedRAMP authorizations.
- Evidence freshness
- How recently a piece of evidence was observed. ZTASphere stops counting evidence older than 30 days.
- FedRAMP
- The U.S. government program that standardizes security assessment and authorization for cloud services.
- ATO
- Authorization to operate: an authorizing official's formal acceptance of a system's risk.
- 3PAO
- Third-party assessment organization: an accredited assessor for FedRAMP.
- SSP
- System security plan: the document that describes how a system implements its security controls.
- POA&M
- Plan of action and milestones: the tracked list of weaknesses and the plan to fix them.
- OMB M-26-14
- The May 2026 OMB memorandum on agency logging and network visibility. It replaces M-21-31 with outcome-based activities and a five-level maturity model.
- Logging Reference Architecture (LRA)
- CISA's reference for agency logging under M-26-14, aligned with the ZTMM Visibility and Analytics capability.
- CEM and THIRF
- The two priorities of M-26-14: continuous event monitoring, and threat hunting, investigation, response and forensics.
- OMB M-26-15
- The June 2026 OMB memorandum on executing the federal migration to post-quantum cryptography.
- Post-quantum cryptography (PQC)
- Algorithms designed to resist attack by large quantum computers, standardized by NIST in FIPS 203, 204 and 205.
- ML-KEM
- Module-Lattice-Based Key-Encapsulation Mechanism (FIPS 203), the NIST standard for post-quantum key establishment. In TLS it is often used in a hybrid with X25519.
- ML-DSA and SLH-DSA
- NIST post-quantum digital signature standards: ML-DSA (FIPS 204) and the hash-based SLH-DSA (FIPS 205).
- Harvest now, decrypt later
- Recording encrypted data today in order to decrypt it once a capable quantum computer exists. It is why long-lived secrets need protection now.
- Cryptographic inventory (CBOM)
- A list of the algorithms, keys, certificates and libraries a system uses, the starting point for post-quantum migration.
- Crypto agility
- Designing systems so algorithms and keys can be replaced without rebuilding them.
- SBOM
- Software bill of materials: a list of the components in a piece of software, in formats such as CycloneDX or SPDX.