Put NIST 800-207 zero trust principles into practice

NIST SP 800-207 is the National Institute of Standards and Technology's Special Publication on zero trust architecture, published in August 2020. It defines zero trust as moving defences from static network perimeters to users, assets and resources, sets out seven tenets of zero trust, and describes the logical components, deployment models, threats and migration approaches for building a zero trust architecture.

The seven tenets are: all data sources and computing services are resources; all communication is secured regardless of network location; access is granted per session; access is decided by dynamic policy; the enterprise monitors the integrity and security posture of all assets; authentication and authorisation are dynamic and strictly enforced before access; and the enterprise collects as much information as possible to improve its security posture.

No. NIST SP 800-207 is guidance, not a law or certifiable standard. US federal agencies use it as the reference definition of zero trust in their zero trust programmes, but there is no legal obligation for private organisations to follow it and no penalties attached to it. Most companies outside government adopt it voluntarily as a design blueprint.

No. There is no official certification for NIST SP 800-207. It describes principles and architecture patterns rather than auditable control requirements. Organisations typically self-assess their architecture against the seven tenets, sometimes with an independent assessor, and pair that with a certifiable framework such as ISO 27001 or a SOC 2 report to give customers formal assurance.

NIST SP 800-207 describes three core logical components. The policy engine decides whether to grant access to a resource, the policy administrator establishes or shuts down the communication path based on that decision, and the policy enforcement point enables, monitors and terminates connections between a subject and the resource. These are fed by data sources such as identity, device posture, threat intelligence and activity logs.

NIST SP 800-207 describes an architecture approach, while ISO 27001 and SOC 2 define auditable security controls. They complement each other: zero trust practices such as strong authentication, least privilege access, device management and continuous monitoring also satisfy many ISO 27001 Annex A controls and SOC 2 criteria. With control mapping, the same evidence can support all three.

There is no fixed timeline. NIST SP 800-207 expects most organisations to migrate gradually, running a hybrid of zero trust and perimeter-based architecture for some time. It recommends identifying actors, assets and business processes, formulating policies, selecting candidate solutions, then deploying and monitoring incrementally. Duration depends on the size and complexity of your environment.

Yes, on request. NIST SP 800-207 is mapped in OneClickComply's control library and is available to customers who ask for it, rather than being a standard framework you can switch on today. It links the zero trust tenets to practical controls and uses automated evidence collection and continuous monitoring to show how your environment reflects each tenet.