In short
A zero trust security framework gives you a structure for designing and measuring zero trust. UK organisations should design against the NCSC's zero trust principles, use NIST SP 800-207 for shared vocabulary and architecture, and borrow CISA's maturity model, with its five pillars and four stages, to score progress. None is a certification.
Get a quote for zero trust frameworks
Tell us roughly how many users or sites you have and we will come back to you with options and a quote.
The NCSC zero trust architecture design principles
The NCSC's zero trust architecture design principles (opens in a new tab) are the UK reference. The current version is 1.1, reviewed on 16 January 2026, written for cyber security professionals, large organisations and the public sector. The page introduces them as eight principles and its overview lists seven: know your architecture; know your user, service and device identities; assess user behaviour and device and service health; use policies to authorise requests; authenticate and authorise everywhere; focus monitoring on users, devices and services; and don't trust any network, including your own.
Alongside the principles, the NCSC Zero Trust collection (opens in a new tab) includes an introduction, Demystifying Zero Trust and, since May 2026, guidance on ZTNA. The NCSC says the principles help you design and review an architecture and select which combination of services best supports your journey. Our page on NCSC zero trust guidance takes each principle in turn.
NIST SP 800-207: Zero Trust Architecture
NIST SP 800-207 (opens in a new tab) was published in final form in August 2020 by the US National Institute of Standards and Technology. It is the most widely cited definition of zero trust and zero trust architecture, and its vocabulary turns up in almost every vendor document. It contains:
- Definitions of zero trust and zero trust architecture, and the idea of shrinking the implicit trust zone.
- Seven tenets (section 2.1), summarised on zero trust principles.
- Logical components: policy engine, policy administrator, policy enforcement point and data sources, covered on zero trust architecture.
- Deployment models: device agent and gateway, enclave, resource portal and application sandboxing.
- Use cases, threats and a migration path (section 7): identify actors, assets and key processes, write policies, choose candidate solutions, deploy and monitor, then expand.
When people search for "NIST zero trust architecture 800 207", this is the document. It is free to read on csrc.nist.gov (opens in a new tab).
The CISA Zero Trust Maturity Model and its pillars
The US Cybersecurity and Infrastructure Security Agency's Zero Trust Maturity Model (opens in a new tab) (ZTMM) version 2.0, dated April 2023, is the source of the "5 pillars of zero trust". CISA wrote it to help US federal agencies, calls it one of many roadmaps they can reference, and now lists the page under archived content. It is still widely used outside government as a way to measure progress.
| Part of the model | What CISA lists |
|---|---|
| Five pillars | Identity; Devices; Networks; Applications and Workloads; Data |
| Three cross-cutting capabilities | Visibility and Analytics; Automation and Orchestration; Governance |
| Four stages | Traditional; Initial; Advanced; Optimal |
The stages describe a journey: Traditional means manually configured lifecycles, static policies and least privilege set only at provisioning; Initial starts automating and integrating across pillars; Advanced brings automated controls, central visibility and least privilege that changes with risk; Optimal is fully automated, just-in-time access with continuous monitoring. CISA notes that each pillar can progress at its own pace. The full model, with functions per pillar, is in the ZTMM v2.0 PDF (opens in a new tab).
Not sure which option fits? Ask us
Tell us what you need and we will recommend the right option for your organisation, with a quote.
Zero trust frameworks side by side
The three zero trust frameworks answer different questions, which is why they work well together:
| NCSC design principles | NIST SP 800-207 | CISA ZTMM v2.0 | |
|---|---|---|---|
| Origin | UK National Cyber Security Centre | US National Institute of Standards and Technology | US Cybersecurity and Infrastructure Security Agency |
| Current version | 1.1, reviewed 16 January 2026 | Final, August 2020 | 2.0, April 2023 (page now archived) |
| Written for | Security professionals, large organisations, public sector | Enterprises, especially US federal agencies | US federal agencies |
| Structure | Design principles plus ZTNA guidance | Tenets, logical components, deployment models, migration steps | Five pillars, three cross-cutting capabilities, four maturity stages |
| Answers | What good design looks like | What the parts are called and how they fit | How far along are we, pillar by pillar? |
| Best use in a UK business | The design you review against | Shared language with vendors and auditors | A scorecard for a roadmap |
| Certification? | No | No | No |
There are other zero trust models too, including vendor frameworks. They are usually built on these three; check which one a vendor's material maps to before comparing products.
Which framework should a UK business follow?
For most UK organisations, a practical combination is:
- Design against the NCSC principles. They are written for UK organisations, use UK terms and include the newest ZTNA guidance. If you sell to the public sector, they are the reference buyers will expect.
- Use NIST SP 800-207 vocabulary for architecture diagrams and when comparing vendors, since most products describe themselves in its terms.
- Score progress with CISA's stages. Rate each pillar Traditional, Initial, Advanced or Optimal today, set next year's target, and repeat. Our zero trust assessment page shows how.
- Keep baseline controls in step. Many first steps, such as MFA, secure configuration and access control, also support Cyber Essentials (opens in a new tab), the UK government-backed baseline scheme.
Is zero trust frameworks the right fit for you?
We will check it against your systems and requirements and recommend the right option.
The pillars mapped to products we supply
Frameworks become useful when each pillar has a named control. This is how the CISA pillars map to products we supply; facts are from the vendors' own sites, read on 9 November 2026.
| CISA pillar | Typical control | Products we supply |
|---|---|---|
| Identity | MFA, phishing-resistant methods, single sign-on | Cisco Duo (opens in a new tab) |
| Devices | Device health checks before access | Duo Device Trust; device posture checks in ZTNA platforms |
| Networks | Per-application access, segmentation | ZTNA such as Cisco Secure Access and Check Point Private Access; Zero Networks microsegmentation |
| Applications and Workloads | Apps hidden behind connectors; no inbound ports | ZTNA connectors; see how ZTNA works |
| Data | Controls on what users can do with data in the session | Enterprise browser controls such as Island |
Contact us for free advice on applying these frameworks to your organisation, or a quote for the products that fit.
How Forever Systems helps with ZTNA
Forever Systems supplies and supports several zero trust network access platforms, so we can recommend what fits how your people work and the tools you already run.
- Assess first: we look at your current VPN, firewall, identity set-up and the applications people need to reach before suggesting anything new
- Vendor-aware advice across the ZTNA products we supply, including Cisco Secure Access (opens in a new tab) and Check Point Private Access
- Pilots and phased roll-out: we can help you start with one group of users or one application, then extend access policy by policy
- VPN replacement: planning the move away from remote access VPNs, including identity provider integration and device posture checks
- Ongoing support: policy changes, licence reviews and renewals, with the details confirmed at quote
We work with businesses, schools, charities and public sector organisations. Pricing depends on users, features and term, so ask us for a quote.
Frequently asked questions
What are the five pillars of zero trust?
In CISA's Zero Trust Maturity Model version 2.0 the five pillars are Identity, Devices, Networks, Applications and Workloads, and Data, with three cross-cutting capabilities: Visibility and Analytics, Automation and Orchestration, and Governance.
Is zero trust a framework?
Zero trust is an approach to security design. Frameworks such as the NCSC design principles, NIST SP 800-207 and the CISA Zero Trust Maturity Model describe how to apply and measure it. None of them is a product or a certification.
Which zero trust framework should a UK business use?
Design against the NCSC's zero trust architecture design principles, use NIST SP 800-207 for vocabulary and architecture, and use CISA's maturity stages to measure progress. That combination suits most UK organisations.
What are the stages of the CISA Zero Trust Maturity Model?
Traditional, Initial, Advanced and Optimal. Each pillar is assessed separately, and CISA notes that pillars can progress at different speeds.
Is there a zero trust certification for UK businesses?
None of these three frameworks offers certification. Cyber Essentials is the UK government-backed baseline certification, and its requirements, such as access control and secure configuration, overlap with early zero trust work.
Still have a question about zero trust frameworks?
Ask us and a member of our team will get back to you.