In short
Zero trust for the public sector means councils, agencies and their suppliers grant access per application after checking identity and device, not per network. UK strategy sets outcomes rather than products: government adopted the NCSC Cyber Assessment Framework (CAF) for assurance, and zero trust controls provide evidence for its identity and access outcomes.
Not sure where to start?
Tell us what you need to achieve and we will point you to the right option.
Who this page is for
This page is for IT and security leads in local authorities, arm's-length bodies, police and fire services, housing associations, and the suppliers that run services for them.
Public sector networks tend to share a history: many sites joined by private circuits and site VPNs, a remote access VPN added for home working, older line-of-business systems that are hard to move, and a large number of partners and suppliers who need some access. Zero trust replaces the idea that anything on the network can be trusted with a check on every request to every application. If you are new to the idea, start with what zero trust security is.
The role of zero trust in public sector cyber strategy
The Government Cyber Security Strategy 2022 to 2030 (opens in a new tab) set out two pillars: building organisational cyber resilience and "defending as one". Under the first pillar, government adopted the NCSC's Cyber Assessment Framework (opens in a new tab) (CAF) as its assurance framework. Since 6 January 2026 the strategy's GOV.UK page points readers to the Government Cyber Action Plan (opens in a new tab), published by the Department for Science, Innovation and Technology, for the latest detail. The plan works through five delivery strands (accountability, support, services, response and recovery, and skills), expects arm's-length bodies' cyber risk to be reported using CAF outcomes and profiles, and holds lead government departments accountable for their wider public sector, such as local government.
Neither document prescribes zero trust or any other technology, and the CAF itself is outcomes-based: it describes the outcomes to achieve rather than the products to buy. Zero trust is one way of delivering several of those outcomes. CAF Principle B2, Identity and Access Control (opens in a new tab), expects users, devices and systems to be appropriately verified, authenticated and authorised before access is granted, with access rights reviewed and removed when no longer needed. That is a close description of what per-app ZTNA does.
The CAF collection was at version 4.0 when we checked it on 9 November 2026, with a CAF Core Profile setting a minimum baseline. The NCSC is clear that the CAF is not a certification scheme.
How zero trust maps to CAF outcomes
| CAF area | What it asks for (summary) | Zero trust controls that help |
|---|---|---|
| A4 Supply chain | Understanding and managing the risk from suppliers | Named, time-limited, logged supplier access to specific systems instead of shared VPN accounts |
| B2 Identity and access control | Verified, authenticated and authorised users, devices and systems; access reviewed and removed | Single identity provider, MFA, per-app ZTNA, device posture checks, automatic removal of leavers |
| B4 System security | Protecting systems from compromise | Closing inbound VPN and remote desktop ports; brokering access through outbound-only connectors |
| B5 Resilient networks and systems | Networks designed to limit the impact of an attack | Segmentation and microsegmentation so one compromised device cannot reach the rest |
| C1 Security monitoring | Visibility of activity to detect events | Per-application access logs showing who reached what, allowed and denied |
Area names are from the NCSC CAF collection (opens in a new tab); the summaries are ours. How each outcome is assessed depends on your CAF profile and your sector's lead department.
Not sure which option fits? Ask us
Tell us what you need and we will help you choose the right option.
Zero trust for government networks: moving from site VPNs to per-app access
- Map users, devices and applications. The NCSC's guidance on what to do before building a ZTNA architecture (opens in a new tab) starts here: know who connects, from which devices, to which systems.
- Strengthen identity. One identity provider, MFA on every remote and privileged sign-in, and joiner, mover and leaver processes that remove access promptly.
- Move staff remote access to per-app ZTNA. Applications are published through a policy engine, so home and mobile staff reach each one after identity and device checks.
- Give partners and suppliers their own route. Agentless or browser-based access to the named systems they support, approved and logged; see agentless ZTNA.
- Segment legacy systems. Systems that cannot move quickly sit in their own segments, reachable only by the services that need them; see zero trust network.
- Retire site and remote access VPNs. Close each route once nothing depends on it. The NCSC lists leaving legacy routes open among its ZTNA anti-patterns (opens in a new tab).
Legacy technology is a real constraint: the Government Cyber Action Plan estimates that 28% of the government technology estate is legacy. That is why most public sector projects run per-app access alongside the old VPN for a period and move systems in stages. Our VPN replacement guide covers the migration in detail.
ZTNA for local government, blue light services and housing associations
| Organisation | Typical access problem | Where zero trust helps first |
|---|---|---|
| Councils | Many services, many line-of-business systems and suppliers, home and mobile staff | Per-app access for staff and named supplier access to each system |
| Arm's-length bodies | Smaller IT teams reporting cyber risk to a sponsoring department | Identity and access controls with clear logs to support CAF reporting |
| Police and fire services | Shift workers, shared devices and stations across a wide area | Identity-based sign-in on shared devices and per-app access from any site |
| Housing associations | Field staff, repairs contractors and tenant-facing systems | Agentless access for contractors and per-app access for mobile staff |
| Suppliers to the public sector | Customers asking how access to their systems is controlled | Showing named, MFA-protected, logged access to each customer environment |
Need help choosing?
We will recommend what fits your organisation and explain why, in plain English.
Products we supply for public sector bodies
We supply ZTNA and zero trust access platforms including Cisco Secure Access (opens in a new tab), Check Point ZTNA, Island Private Access, TruGrid SecureRDP for remote desktops and Zero Networks for segmentation and remote access. They differ in where the policy engine runs, whether users need a client, and how they handle legacy and non-web systems; the ZTNA providers page compares them.
Licensing is usually per user for access platforms and per protected server, workstation or device for segmentation, and subscriptions can be billed monthly, terms confirmed at quote. On procurement routes and frameworks, ask us how we can quote for your organisation.
If you are also reviewing site connectivity and web security together, our SASE site covers public sector SASE (opens in a new tab), and leased lines for the public sector (opens in a new tab) covers the circuits.
How we help public sector organisations
We can review how staff, partners and suppliers reach your systems today, map that against the outcomes you report on, recommend an approach and products, run a pilot with one service or team, and help migrate in stages. Scope and timescales are confirmed at quote.
Contact us to talk through your organisation's plans.
Zero trust for healthcare and education
How Forever Systems helps with ZTNA
Forever Systems supplies and supports several zero trust network access platforms, so we can recommend what fits how your people work and the tools you already run.
- Assess first: we look at your current VPN, firewall, identity set-up and the applications people need to reach before suggesting anything new
- Vendor-aware advice across the ZTNA products we supply, including Cisco Secure Access (opens in a new tab) and Check Point Private Access
- Pilots and phased roll-out: we can help you start with one group of users or one application, then extend access policy by policy
- VPN replacement: planning the move away from remote access VPNs, including identity provider integration and device posture checks
- Ongoing support: policy changes, licence reviews and renewals, with the details confirmed at quote
We work with businesses, schools, charities and public sector organisations. Pricing depends on users, features and term, so ask us for a quote.
Frequently asked questions
What is the role of zero trust in public sector cyber strategy?
UK public sector strategy sets outcomes rather than technologies. The Government Cyber Security Strategy adopted the NCSC Cyber Assessment Framework for assurance, and the Government Cyber Action Plan builds on it. Zero trust is one way to deliver CAF outcomes, especially identity and access control, supplier access and network resilience.
Does the government require zero trust?
Neither the Government Cyber Security Strategy nor the Government Cyber Action Plan names zero trust as a requirement. Both focus on outcomes and accountability, with the CAF as the assurance framework. Zero trust controls are a common way to meet the identity and access outcomes it describes.
How does zero trust apply to government networks?
It replaces network-level trust with per-request checks. Instead of site VPNs and a remote access VPN that put users on the network, applications are published through a policy engine, users and devices are verified before each connection, legacy systems are segmented and old routes are closed.
Is ZTNA suitable for local government?
Yes. Councils have many line-of-business systems, home and mobile staff and a long list of suppliers, which is exactly where per-app access helps. Staff reach each system after MFA and a device check, and suppliers get named, logged access to the systems they support.
Is the CAF a certification?
No. The NCSC states that the CAF is not a certification scheme. It is an outcomes-based framework for assessing and improving cyber resilience, and organisations reporting results are asked to state the CAF version, profile and scope they used.
Should a public sector zero trust implementation be in-house or managed?
Either can work. Many councils and public bodies keep policy decisions and the access matrix in-house and bring in a supplier for design, deployment and day-to-day changes. What matters is that responsibilities are written down, which the NCSC also asks for when assessing ZTNA services and providers. We can support either model, with scope confirmed at quote.
Still have a question about zero trust for the public sector?
Ask us and a member of our team will get back to you.