Skip to content

ZTASphere

Home
Platform
Solutions
Integrations
Security
Pricing & ROI
Resources
About
Book a demo

Home
Resources
ZTMM self-check

Free tool

ZTMM 2.0 self-check.

Ten questions, about two minutes. Get an indicative maturity stage for each zero trust pillar and the gaps to look at first.

0 of 10 answered

01 · IdentityHow do people sign in to your systems?

APasswords, with MFA on a few systemsBMFA for most users and systemsCPhishing-resistant MFA for all users through a central identity providerDContinuous, risk-based verification throughout each session

02 · IdentityHow is access granted and reviewed?

AManually, with standing permissions and occasional reviewsBSome automated provisioning and periodic access reviewsCAutomated joiner-mover-leaver and time-bound privileged accessDJust-in-time, just-enough access that is removed automatically

03 · DevicesHow complete is your device inventory?

APartial, kept in spreadsheetsBTool-based for managed devicesCAutomated across managed, unmanaged and IoT devices, reconciled between sourcesDReal-time, including supply chain risk

04 · DevicesDoes device health affect access decisions?

ANoBChecked when a device enrollsCChecked at access time for most resourcesDContinuously, and access changes in real time

05 · NetworksHow is your network segmented?

AMostly flat behind a perimeterBCritical systems segmentedCMicro-segmentation around most applicationsDDynamic, just-in-time connectivity per workload

06 · NetworksHow much internal traffic is encrypted?

ALittle internal traffic is encryptedBExternal and some internal trafficCAll traffic, including DNS, with managed certificatesDEverywhere, with automated key management and crypto agility

07 · Applications & WorkloadsHow do users reach internal applications?

AThrough a VPN or by being on the networkBSingle sign-on for some applicationsCIdentity-aware access with context for most applicationsDContinuous authorization on every request

08 · Applications & WorkloadsHow are applications security-tested?

AAnnually or ad hocBScans before major releasesCAutomated testing in pipelines with release gatesDContinuous testing, including production, with automated fixes

09 · DataDo you know where sensitive data lives?

ANot reliablyBManual inventory of key repositoriesCAutomated discovery and labelingDContinuous, and labels drive protection automatically

10 · DataHow do you prove zero trust maturity today?

AWe don't measure itBAn annual spreadsheet exerciseCPeriodic reports from some toolsDContinuously, from tool telemetry

Answer all ten questions to see your result.

What you get

An indicative stage for each of the five pillars
Your overall position on the ZTMM scale
The pillars to prioritize first

Nothing you answer leaves your browser.

Your indicative result

You are at the Initial stage overall.

Turn this estimate into an evidence-based score.

Self-reported answers are a starting point. In a demo, ZTASphere scores all 40 functions from the tools you already run.

Book a demo with my result

This self-check is indicative only and is not a CISA ZTMM assessment.

ZTASphere

Continuous, evidence-based zero trust maturity against the CISA Zero Trust Maturity Model 2.0. Built by Cyrix Global LLC, delivering technology since 1998.

Product

Platform
Integrations
Security & compliance
Pricing & ROI

Solutions

Federal agencies
Enterprise
SOC & incident response
Auditors & AOs

Resources

CISA ZTMM 2.0 guide
Maturity assessment guide
OMB M-26-14 logging
Post-quantum readiness
OMB M-22-09 & EO 14028
Zero trust glossary
Free ZTMM self-check

Company

About
Book a demo
6900 Wisconsin Ave
Bethesda, MD 20815

© 1998–2026 Cyrix Global LLC. ZTASphere is a product of Cyrix Global LLC. CISA, NIST, FedRAMP and the vendor names on this site belong to their owners and do not imply endorsement.

Free self-check Book a demo