Services · Architecture
Zero Trust you can enforce, not just diagram.
Implement Zero Trust against NIST SP 800-207 and the CISA maturity model — with the identity, segmentation, and certificate controls that make policy enforceable and quantum-ready.
The problem
Why this exists.
Most Zero Trust programs stop at single sign-on and multi-factor authentication. That is a useful start and not an architecture: devices are unverified, workloads still trust the network, and the VPN is still the front door. A program that cannot enforce policy at the workload cannot produce evidence for an auditor either — and it will not survive the certificate and identity changes that post-quantum migration forces.
What changes
- Explicit, logged, attributable decisions for every access request
- Human and workload identities verified with short-lived credentials
- Device posture checked before access, not after
- Segmentation enforced at the workload, not just at the perimeter
- Continuous authorization with evidence that satisfies an auditor
Delivery
How the engagement runs.
A sequence you can plan around, with a decision or a working artifact at the end of every phase.
- 01
Assess
Baseline against NIST SP 800-207 and the CISA maturity model; map access paths, identity types, network flows, and current controls.
- 02
Design
Target architecture: policy decision and enforcement points, identity and device trust, segmentation zones, and telemetry.
- 03
Implement
Pilot one application or business unit: workload identity, mTLS, device posture, just-in-time access, and segmentation.
- 04
Operate
Continuous verification, access reviews, maturity reporting, and an evidence trail that holds up in an audit.
Deliverables
What you keep.
- Zero Trust maturity assessment against the CISA model
- Target architecture with policy decision and enforcement points
- Identity and device-trust design
- Workload identity and mTLS implementation plan
- Microsegmentation design and a bounded pilot
- ZTNA and VPN-replacement evaluation
- Telemetry, continuous verification, and access evidence design
- Phased roadmap with maturity targets and owners
Fit
Who this is for.
- Organizations replacing VPN with ZTNA
- Federal agencies and contractors working to OMB M-22-09
- Programs that stalled after MFA and SSO
- M&A integration and network consolidation
- Regulated environments that must evidence access decisions
Typical duration
10–16 weeks
Scope and elapsed time depend on access, estate size, and change control. We confirm both in writing before work starts.
Not sure which engagement fits? Start with the ten-minute assessment, or ask us directly.
Next step
Find out what you are actually running.
Cipher Posture finds and fixes quantum-vulnerable cryptography. Threat Model Agent models the whole system. Start with the readiness assessment.