Zero Trust engineering
We add Zero Trust controls to the systems you already run. Access then depends on who the user is, the state of their device and the data they want.
We track progress with CISA’s Zero Trust Maturity Model. The DoW must bring its own systems to its Zero Trust target level by the end of FY2027.
CISA’s five pillars
| Pillar | Covers | We build |
|---|---|---|
| Identity | Users and service accounts, and how strongly they prove who they are. | Phishing-resistant MFA, Conditional Access in Microsoft Entra ID or Context-Aware Access in Google Workspace, and admin rights granted for a set time when someone needs them. |
| Devices | Whether the device making the request is known and healthy. | Device inventory and compliance in Intune or Google endpoint management, with access refused to devices that fail it. |
| Networks | How traffic moves and what it can reach. | Segmentation, encrypted internal traffic, and per-application access in place of a flat VPN. |
| Applications and Workloads | The applications people use and the services behind them. | Access through an identity-aware proxy, and workload identity federation in place of long-lived shared keys. |
| Data | The data itself, labeled by sensitivity. | A data inventory, sensitivity labels, data loss prevention rules and encryption under keys you control. |
CISA also names three capabilities that run across the pillars: Visibility and Analytics, Automation and Orchestration, and Governance. Source: CISA Zero Trust Maturity Model, version 2.0 (opens in a new tab).
Place your pillars on CISA’s scale
Pick the stage that sounds like you for each pillar and read how CISA describes it. It is a quick version of the first step of our engagements.
Identity · Authentication
Traditional
Agency authenticates identity using either passwords or multi-factor authentication (MFA) with static access for entity identity.
What CISA means by Traditional Manually configured lifecycles (i.e., from establishment to decommissioning) and assignments of attributes (security and logging); static security policies and solutions that address one pillar at a time with discrete dependencies on external systems; least privilege established only at provisioning; siloed pillars of policy enforcement; manual response and mitigation deployment; and limited correlation of dependencies, logs, and telemetry.
All five pillars at Traditional.
Quoted from CISA’s Zero Trust Maturity Model, Version 2.0 (opens in a new tab) (April 2023).
Moving each pillar up a stage
Maturity assessment
We rate each pillar at one of CISA’s four stages (Traditional, Initial, Advanced, Optimal) from the settings we find, and show the evidence for each rating.
- Scorecard
- Each pillar’s stage, and the changes that would move it up one.
Target architecture
We agree with you where the policy decision and enforcement points go, in NIST SP 800-207’s terms, and which of your existing products can fill each role.
- Target design
- Diagrams, and the order of the changes.
Implementation
We usually start with identity, including phishing-resistant MFA, one of the goals OMB set agencies in M-22-09. We build the policies in Microsoft 365, Google Workspace and your cloud accounts, run them in report-only mode where the product allows it, then enforce them.
Microsoft 365 engineering