Plan your path to DoD ZT Roadmap Target Level with less effort

The DoD Zero Trust Strategy is the US Department of Defense plan, released by the DoD CIO in November 2022, to move the department to a zero trust security model. It sets strategic goals and a target of reaching Target Level zero trust across the department by FY2027. It is paired with a Capability Execution Roadmap that turns those goals into 45 capabilities and 152 specific activities across seven pillars.

The Capability Execution Roadmap is the companion to the DoD Zero Trust Strategy that lists what must be built. It defines 45 capabilities and 152 activities, numbered by pillar from 1.1 User Inventory to 7.6 Automated Dynamic Policies. Each activity is tagged as Target Level or Advanced Level, so components can plan and report their progress in a consistent way.

The seven pillars are User; Device; Applications and Workloads; Data; Network and Environment; Automation and Orchestration; and Visibility and Analytics. Each pillar groups related capabilities. For example, the User pillar covers user inventory, conditional access, multi-factor authentication and privileged access management, while Visibility and Analytics covers logging, SIEM, behaviour analytics and threat intelligence integration.

Target Level is the minimum zero trust baseline the DoD requires, made up of 91 activities that components are expected to complete by FY2027. Advanced Level adds 61 further activities that deliver the most mature protection, such as greater automation and dynamic policy, and is planned for after Target Level. Together they make up the 152 activities in the roadmap.

Not directly. The strategy is addressed to DoD components and military services. Contractors are bound by their contract terms, such as DFARS clauses, NIST SP 800-171 and CMMC, rather than by the strategy itself. Even so, suppliers that host, build or connect to DoD systems are increasingly asked how they support zero trust outcomes, and the roadmap is the reference used to answer.

They are companion documents with different jobs. The strategy and roadmap set the goals, the capabilities, the activities and the FY2027 deadline. The DoD Zero Trust Reference Architecture describes the technical architecture, standards and interfaces used to build those capabilities. Organisations normally use the roadmap to plan and track progress and the reference architecture to guide design decisions.

DoD zero trust builds on NIST zero trust thinking, notably NIST SP 800-207, and many capabilities overlap with controls in NIST SP 800-53, NIST SP 800-171 and ISO 27001, such as access control, MFA, asset inventory and logging. Evidence you collect for those frameworks often supports roadmap activities too, although the roadmap expects specific architecture outcomes rather than a certifiable management system.

Yes, on request. The roadmap is mapped in OneClickComply's control library and can be enabled for your organisation; it is not yet a self-service framework in the platform. Once enabled, you can link capabilities to your existing controls and automated evidence. OneClickComply does not certify zero trust maturity, and DoD assessments remain the responsibility of the relevant component.