Map your controls to the DoD ZT RA v2.0 capability taxonomy

The DoD Zero Trust Reference Architecture 2.0 is the Department of Defense's technical blueprint for zero trust, dated July 2022 and prepared by the DISA and NSA Zero Trust Engineering Team. It defines five zero trust tenets, seven pillars and a capability taxonomy, and describes how those capabilities work together so DoD components and their suppliers can design consistent zero trust environments.

The reference architecture is technical, while the strategy is strategic. The DoD Zero Trust Strategy, published in November 2022, sets the department's goals, target and advanced zero trust levels, and the activities components must deliver. The reference architecture describes the tenets, pillars and capabilities, and how they fit together architecturally. Organisations normally use both, with the capability roadmap tracking delivery.

The reference architecture is guidance for DoD components designing zero trust, rather than a law or certification that applies directly to private companies. In practice, defence contractors, integrators and vendors align with it when their products or environments support DoD missions, because customers expect zero trust capabilities that match the DoD model. Contract terms decide what is actually required in each case.

The seven pillars are User, Device, Application and Workload, Data, Network and Environment, Automation and Orchestration, and Visibility and Analytics. Each pillar groups related zero trust capabilities. For example, the User pillar covers continuous authentication and access monitoring, and the Data pillar covers encryption, data loss prevention, rights management and data tagging.

The reference architecture defines five tenets: assume a hostile environment, presume breach, never trust and always verify, scrutinise explicitly, and apply unified analytics. These principles shape every capability in the architecture. They mean no user, device or network location is trusted by default, and every access decision is made using context and continuously reassessed.

There is no direct statutory penalty, because the reference architecture is guidance rather than a regulation. The consequences are commercial and contractual: DoD programmes are expected to reach zero trust targets, and suppliers who cannot show aligned capabilities may struggle to win or keep work. Separate requirements such as DFARS clauses and CMMC carry their own enforcement.

The DoD ZT RA builds on the zero trust concepts in NIST SP 800-207 and applies them to the DoD environment. Many of its capabilities, such as MFA, privileged access management, encryption and continuous monitoring, overlap with NIST SP 800-171, NIST SP 800-53 and ISO 27001 controls, so evidence from an existing programme often supports zero trust alignment too.

Yes, on request. The DoD ZT RA v2.0 capability set is mapped in OneClickComply's control library and available on request rather than enabled by default. Once enabled, controls you already run for frameworks such as NIST SP 800-53 or ISO 27001 are linked to the relevant capabilities, and automated evidence and monitoring apply to them.