How to run a zero trust maturity assessment.
An eight-step method for assessing your organization against CISA ZTMM 2.0, producing a score you can defend to leadership and auditors.
A zero trust maturity assessment answers two questions: where do we stand on each ZTMM function today, and what should we do next to reach our target stage? The method below works whether you run it by hand or automate it.
Set scope and a target stage
Decide which systems, business units and pillars are in scope. Agree a target stage per pillar with leadership; Advanced is a common goal, with Optimal for the most critical functions.
Map your data sources
List the tools that hold evidence for each pillar: identity provider, endpoint and XDR, network and SASE, cloud security, SIEM, data protection.
Map evidence to functions and criteria
For each of the 40 functions, define which configuration export, log or record satisfies each stage. Break each stage into atomic, testable criteria.
Collect evidence, read-only
Pull evidence through least-privilege, read-only accounts. Hash every file so its integrity can be checked later.
Review with separation of duties
Someone other than the submitter accepts or rejects each item. Set a freshness window, such as 30 days, after which evidence stops counting.
Score
A stage counts only when every criterion for it is met by accepted, current evidence. Record a confidence level for each result.
Prioritize the gaps
Rank the gaps between today and your target stage by impact, and link each gap to the failing criteria and the evidence that would close it.
Act, verify and monitor
Run improvements through approval, a canary step and independent verification. Then watch every evidence source so silence or drift raises an alert.
Manual versus continuous assessment
| Aspect | Manual assessment | Continuous with ZTASphere |
|---|---|---|
| Evidence | Screenshots and spreadsheets gathered by hand | Collected read-only from 17 tool integrations |
| Freshness | Out of date soon after publication | Older than 30 days stops counting automatically |
| Consistency | Depends on who filled in the sheet | Versioned rules over 182 criteria |
| Integrity | Hard to prove nothing changed | SHA-256 evidence hashes and a hash-chained audit log |
| Drift | Found at the next audit | Alerts and tickets when a feed or level drops |
| Effort | About 9,062 staff hours a year (estimate) | About 1,525 hours, 83% less (estimate) |
Estimate Effort figures from the ZTASphere 2.0 business case, expected scenario.
Assessment checklist
- Scope, systems and target stage per pillar agreed
- Evidence sources listed for every pillar
- Criteria defined for each function and stage
- Read-only service accounts created
- Evidence hashed on collection
- Independent reviewer assigned
- Freshness window set (for example 30 days)
- Exceptions recorded with approver and expiry
- Gap-to-goal roadmap ranked by impact
- Report released through a draft and approval step
- Source health monitored with alerting
- Audit trail verified before release
Frequently asked questions
How long does a zero trust maturity assessment take?
A manual assessment of all five pillars commonly takes weeks of staff time across many tool owners. With automated evidence collection, the score updates as soon as integrations are connected and evidence arrives.
Who should be involved?
An assessor to run the process, pillar owners who hold the evidence, an independent reviewer to accept it, and a risk approver, often the authorizing official, to approve exceptions and release the report.
How often should we reassess?
Continuously if you can. Controls drift and evidence ages, so a yearly snapshot quickly stops reflecting reality. A practical rule is to stop counting evidence older than 30 days.
Can we assess one pillar first?
Yes. Identity and Devices are common starting points because identity providers and endpoint tools already hold most of the evidence.
See your zero trust maturity, scored on live evidence.
Bring one pillar or all five. In a working session we connect to the tools you already run and show what ZTASphere sees, using your own environment's language and priorities.