Project Zero Trust

Appendix BZero Trust Maturity Model

Because Zero Trust is a strategic initiative, it's important to benchmark your Zero Trust journey and measure your improvements over time. The Zero Trust Maturity Model documents improvements made to your individual Zero Trust environments. Designed using a standard Capability Maturity Model, the Zero Trust Maturity Model leverages the five-step methodology for implementing Zero Trust and should be used to measure the maturity of an individual protect surface containing a single DAAS element.

Step	Initial (1) The initiative is undocumented and performed on an ad hoc basis with processes undefined. Success is dependent on individual efforts.	Repeatable (2) The process is documented and is predictably repeatable, using lessons learned in the initial phase.	Defined (3) Processes for success have been defined and documented.	Managed (4) Processes are monitored and controlled; efficacy is measurable.	Optimized (5) The focus is on continuous optimization.
1. Define your protect surface. Determine which single DAAS element will be protected inside the defined protect surface.	The DAAS element is unknown or discovered manually; data classification is not done or is incomplete.	The use of automated tools to discover and classify DAAS elements has begun, but is not standardized.	Data classification training and processes have been introduced and are maturing; protect surface discovery is becoming automated.	New or updated DAAS elements ...