In short
A zero trust assessment reviews identity, devices, networks, applications and data against the NCSC zero trust principles and rates each one using CISA's Traditional, Initial, Advanced and Optimal stages. The output is an application inventory, an access matrix, a list of VPN dependencies and the quick wins to tackle first.
Want help with a zero trust assessment?
We can plan it with you or do it for you. Tell us where you are up to.
What a zero trust assessment is for
The NCSC's first design principle is to know your architecture (opens in a new tab), including users, devices, services and data, so you can find your key resources and main risks and avoid late surprises with legacy services. Its Demystifying Zero Trust (opens in a new tab) guidance adds that you should define the threats you want to address and assess existing capabilities before deciding how far to go. NIST SP 800-207's migration steps start the same way: identify your actors, your assets and your key processes, and their risks.
An assessment does exactly that. It measures your zero trust readiness and gives you a baseline, so any product you buy is chosen to close a known gap rather than because it carries the zero trust label. Repeating it each year shows your zero trust maturity improving.
Self-check: rate each pillar
Use this table to score your zero trust posture. For each pillar, read across and pick the column that best describes you today. The stages are CISA's (Zero Trust Maturity Model (opens in a new tab) v2.0); the descriptions are our plain-English summary for a business, and the last column links each pillar to the NCSC principle it supports.
| Pillar | Traditional | Initial | Advanced | Optimal | NCSC principle |
|---|---|---|---|---|---|
| Identity | Passwords only on some systems; shared or old accounts | MFA on email and remote access; one main identity provider | MFA on everything, phishing-resistant for admins; prompt leaver process | Risk-based sign-in that adapts to behaviour; admin rights just in time | Know your user, service and device identities |
| Devices | No full device list; personal devices used freely | Most company devices enrolled in management | Device health checked before access; personal devices limited | Access changes automatically when a device falls out of compliance | Assess user behaviour, device and service health |
| Networks | Flat network; VPN gives broad access | Guest Wi-Fi separated; some VLANs | Users reach apps through ZTNA; servers segmented | Microsegmentation; office users treated like remote ones | Don't trust any network, including your own |
| Applications and Workloads | No inventory; some apps exposed to the internet | Inventory exists; SaaS behind single sign-on | Private apps behind connectors, no inbound ports | Every app access decided per session by policy | Authenticate and authorise everywhere |
| Data | No idea where sensitive data sits | Main data stores known | Access to sensitive data limited by role and device | Data controls applied inside the session | Use policies to authorise requests |
| Visibility (cross-cutting) | Logs scattered or not kept | Some logs collected centrally | Identity, device and access logs reviewed together | Alerts drive automatic responses | Focus your monitoring on users, devices and services |
Most businesses find they sit at Traditional or Initial in most pillars, which is a normal starting point. CISA notes that each pillar can move at its own pace, so you do not need to bring every pillar up at once.
Not sure which option applies to you? Ask us
Tell us about your organisation and we will point you to the right option.
What the assessment should produce
A useful assessment ends with four concrete outputs, each of which feeds straight into a project:
| Output | What it contains | Why it matters |
|---|---|---|
| Application inventory | Every application, where it is hosted (SaaS, cloud, on site), how users sign in and how sensitive it is | Decides which access method each app needs and the order to move them |
| Access matrix | Which groups of users and third parties need which applications, from which devices | Becomes your first set of ZTNA and conditional access policies |
| VPN dependency list | Everything that still relies on the VPN or on network location: file shares, legacy apps, admin tools, IP allow-lists | Shows what must be replaced before the VPN can go; the NCSC warns against legacy routes that bypass the policy engine |
| Quick wins | Changes with high risk reduction and little disruption, such as MFA gaps, unused VPN accounts or internet-exposed admin pages | Early progress while the larger project is planned |
With those in hand, the ZTNA project phases follow naturally, and comparing ZTNA providers becomes a matter of fit rather than features.
Questions to answer before you buy
If you only have an hour, answer these. They cover most of what decides a zero trust design:
- Which identity provider do all staff use, and is MFA on for every account?
- How many devices do you have, and how many are managed? Do staff or contractors use personal devices?
- Which applications do people reach through the VPN today, and which are already SaaS?
- Are any internal applications or admin pages reachable from the internet?
- Who outside the company (contractors, suppliers, partners) needs access, to what and for how long?
- Can you see, in one place, who signed in to what and from which device?
- Which systems would cause most harm if an attacker reached them?
Answers that start with "we're not sure" are the gaps to close first.
Prefer a hand with this?
We can help you plan it and set it up, alongside your own team.
How we can help
We can run through this assessment with you, review your current VPN, identity, device and network set-up, and recommend the products that close the gaps, drawing on the several ZTNA, MFA and segmentation platforms we supply. The advice is free; scope for any deployment work is agreed at quote.
If your estate is built mainly on Microsoft 365, a Microsoft 365 security assessment (opens in a new tab) on our sister site covers the Microsoft-specific settings alongside this broader review.
Contact us to talk through where your business stands.
How Forever Systems helps with ZTNA
Forever Systems supplies and supports several zero trust network access platforms, so we can recommend what fits how your people work and the tools you already run.
- Assess first: we look at your current VPN, firewall, identity set-up and the applications people need to reach before suggesting anything new
- Vendor-aware advice across the ZTNA products we supply, including Cisco Secure Access (opens in a new tab) and Check Point Private Access
- Pilots and phased roll-out: we can help you start with one group of users or one application, then extend access policy by policy
- VPN replacement: planning the move away from remote access VPNs, including identity provider integration and device posture checks
- Ongoing support: policy changes, licence reviews and renewals, with the details confirmed at quote
We work with businesses, schools, charities and public sector organisations. Pricing depends on users, features and term, so ask us for a quote.
Frequently asked questions
What is a zero trust assessment?
It is a review of how your identity, devices, networks, applications and data measure up against zero trust principles. It produces a baseline, an application inventory, an access matrix and a prioritised list of gaps, so you know what to fix first before buying anything.
How do you measure zero trust maturity?
A common way is CISA's Zero Trust Maturity Model: rate each of its five pillars (Identity, Devices, Networks, Applications and Workloads, Data) as Traditional, Initial, Advanced or Optimal, then set a target and repeat the exercise each year.
What should we fix first?
Usually identity: MFA on every account, removing old and shared accounts and a reliable leaver process. Next come device management and moving the first applications from VPN to per-application access. The assessment confirms the order for your business.
Can we do a zero trust assessment ourselves?
Yes. The self-check table and questions on this page are a starting point. Many businesses then ask for a second opinion when choosing products, and we can give free advice on that.
Is a zero trust assessment the same as Cyber Essentials?
No. Cyber Essentials is a UK certification of baseline controls. A zero trust assessment is a planning exercise with no certificate. The two overlap, since MFA, secure configuration and access control appear in both; see Cyber Essentials (opens in a new tab).
Still have a question about a zero trust assessment?
Ask us and a member of our team will get back to you.