Compliance FrameworksAmericas
NIST SP 800-207
Zero Trust Architecture: component trust, supply chain least privilege, continuous verification.
Zero Trust Architecture: component trust, supply chain least privilege, continuous verification.
| Short name | Zero Trust |
| Region | Americas |
| Country or scope | United States |
| Sector | Government |
| In your workspace | On unless you switch it off in Compliance › Manage. |
How Safeguard covers Zero Trust
- Scan requirements: 4, all decided by a scan.
- Controls: the scan requirements below, plus 9 controls from Safeguard's control catalog for Zero Trust.
- Automated tests: none map to it directly. You can link any automated test to its controls yourself (how).
- Policy templates: 25: 3 written for Zero Trust and 22 from the standard set.
How each kind of coverage works, and what the readiness score counts: Compliance frameworks.
What a scan checks
Each scan of a product checks these 4 requirements against what the scan found, including the product's software inventory (SBOM).
| Requirement | What Safeguard checks | Decided by |
|---|---|---|
ZTA-3.1 Identity Verification Components | Zero Trust requires identity verification components | Scan |
ZTA-3.3 Micro-Segmentation Components | Zero Trust requires micro-segmentation | Scan |
ZTA-3.5 Continuous Validation Components | Zero Trust requires continuous validation | Scan |
ZTA-2.1 Asset Inventory for ZTA | Zero Trust requires complete asset inventory | Scan |
More controls in the catalog
The framework's Controls tab lists its scan requirements and these controls from Safeguard's control catalog. Evidence them with automated tests, uploaded evidence, policies or an attestation.
| Control | Name |
|---|---|
ZTA-1.1 | Treat all data sources and computing services as resources |
ZTA-1.2 | All communication secured regardless of network location |
ZTA-2.2 | Implement a Policy Enforcement Point |
ZTA-3.2 | Assess device health and posture before granting access |
ZTA-4.1 | Limit access using least-privilege and just-in-time access |
ZTA-4.2 | Apply micro-segmentation to limit lateral movement |
ZTA-5.1 | Collect and analyze telemetry to improve security posture |
ZTA-5.2 | Define and enforce dynamic access policies |
ZTA-6.1 | Protect data in transit using approved cryptography |
Policy templates
Written for Zero Trust:
- Zero Trust Architecture Implementation Policy
- Zero Trust Device Trust and Compliance Policy
- Network Microsegmentation and East-West Traffic Policy
And 22 from the standard set, adapted to Zero Trust.