Zero trust has been the most abused term in enterprise security marketing for the past four years. Every vendor slapped it on their product regardless of whether it applied. Every conference talk mentioned it. Every security framework document referenced it. And somewhere in the middle of all that noise, actual zero trust architecture went from being a conceptual model discussed in NIST publications to a concrete implementation requirement that organizations are now being mandated to pursue.
Why Did Zero Trust Become a Requirement?
The Biden administration’s executive order on cybersecurity in May 2021 (Executive Order 14028, Improving the Nation’s Cybersecurity), followed by the Office of Management and Budget’s zero trust strategy memo (M-22-09, January 2022), made this shift official for federal agencies and set a tone for the broader enterprise market. The federal mandate requires agencies to achieve specific zero trust security goals across identity, devices, networks, applications, and data. That is not an abstract directive. It is a structured framework with measurable outcomes and a deadline: the end of fiscal year 2024. Organizations in the defense contractor and critical infrastructure spaces are watching this closely because where federal mandates go, compliance requirements in adjacent sectors often follow.
What Does Zero Trust Mean in Practice?
For IT professionals, this shift means that zero trust is no longer something you can nod at in a meeting without being expected to have operational knowledge of what it means and how to implement it. Understanding the zero trust architecture model, the NIST SP 800-207 framework that defines it rigorously, and the specific technology controls that enable it has moved from nice-to-have background knowledge to something hiring managers and project sponsors are actively asking about.
The NIST SP 800-207 publication is free and available directly from NIST’s Computer Security Resource Center. Reading it before you engage in any zero trust conversation professionally is worth the time. It is specific enough to be useful and authoritative enough to anchor discussions that otherwise drift into vendor marketing territory.
Which Certifications Cover Zero Trust?
From a certification standpoint, zero trust concepts appear across several credentials rather than being concentrated in a single exam. The CISSP (Certified Information Systems Security Professional) covers security architecture principles that underpin zero trust design. The CompTIA Security+ and CySA+ both address identity and access management, network segmentation, and endpoint security in ways that map to zero trust implementation. The Microsoft certifications around Azure Active Directory and identity governance are directly applicable because identity is the control plane in most enterprise zero trust implementations.
CISSP Boot Camp
Instructor-led, with the exam voucher included.
Is There a Dedicated Zero Trust Certification?
A few smaller training providers offer dedicated zero trust credentials if you want something that specifically names the framework, but none yet has the market recognition of the established certifications from ISC2, ISACA, and CompTIA. That may change as the field matures. Right now the practical approach is to build the underlying skills through established certifications and demonstrate zero trust knowledge through the specific content those exams cover rather than chasing a new credential with limited hiring signal.
What is clear is that zero trust is not going back to being a buzzword. The regulatory direction, the threat landscape, and the technology ecosystem have all aligned around it in a way that makes it a durable priority. Professionals who understand it substantively, not just as a talking point, are going to have an easier time in security-adjacent roles for the foreseeable future.
Frequently Asked Questions
What is NIST SP 800-207?
NIST SP 800-207, Zero Trust Architecture, is the NIST publication that defines zero trust concepts and deployment models. NIST published the final version in August 2020, and it is free to download from the Computer Security Resource Center.
What did OMB memo M-22-09 require of federal agencies?
M-22-09, issued January 26, 2022, required federal agencies to meet specific zero trust goals by the end of fiscal year 2024. The goals are organized around five pillars: identity, devices, networks, applications and workloads, and data.
What is CISA’s Zero Trust Maturity Model?
It is CISA’s guide for measuring progress toward zero trust across five pillars and three cross-cutting capabilities. Version 2.0 aligns with OMB M-22-09 and describes four maturity stages: traditional, initial, advanced and optimal.
Is there a dedicated zero trust certification in 2026?
As of 2026, the best-known vendor-neutral option is the Cloud Security Alliance’s Certificate of Competence in Zero Trust (CCZT). It is an online, open-book exam with 60 multiple-choice questions, a 120-minute limit and an 80% passing score.
Does the CISSP exam cover zero trust?
Yes. The CISSP outline effective April 15, 2024 lists zero trust under secure design principles in Domain 3 and as a micro-segmentation option in Domain 4. ExamNav offers a CISSP boot camp that covers both domains.
Related reading
- Log4Shell Was a Wake-Up Call. Here's the Cert Path for Infrastructure Security.
- The CISM in 2025: Still the Gold Standard for Security Management Careers
- CISSP (Certified Information Systems Security Professional) boot camp
Brian Rhoades is a Senior VMware Instructor and IT veteran with more than 15 years of hands-on experience in virtualization, systems engineering, and cloud infrastructure. He has trained thousands of IT professionals to confidently work with VMware vSphere, vSAN, and NSX, and has authored multiple books and study guides for outlets across the industry. Brian has a habit of being somewhere new every few weeks, which if you've ever tried to pin down a good VMware instructor, explains a lot.
