CISA's Zero Trust Maturity Model v2, the reference framework most current guidance points back to, defines five pillars: identity, devices, networks, applications and workloads, and data. Each has its own maturity stages, from traditional through initial, advanced, and optimal. A Zero Trust programme is the coordinated work of advancing maturity across all five, not a single deployment.

Identity. Phishing-resistant multi-factor authentication, identity unified across cloud and on-premises systems, and privileged access managed through just-in-time elevation rather than accounts holding standing administrative rights indefinitely.

Devices. Device posture, patch level, EDR status, configuration compliance, checked as a precondition for access, with that signal feeding directly into the access decision rather than sitting in a separate console nobody consults in real time.

Networks. Zero Trust Network Access (ZTNA) or SASE replacing flat VPN, where being on the network no longer implies broad trust, combined with micro-segmentation so a compromised device cannot reach everything else on the same segment.

Applications & Workloads. Internal applications accessed through identity-aware proxies rather than direct network reachability, with application security testing (SAST, DAST, SCA) embedded in the development lifecycle instead of a pre-release afterthought.

Data. Sensitive data classified and tagged, ideally automatically, with access to it continuously evaluated against context (who, what device, what location, what behaviour pattern) rather than granted once at onboarding and left standing indefinitely.

Identity comes first in almost every real programme, because every other pillar's access decisions depend on knowing who or what is asking. An organisation that redesigns its network around ZTNA before strengthening identity has moved the same trust assumption onto a newer protocol rather than actually removed it.

Device posture is the next practical step for most organisations: making access conditional on a device meeting a defined bar is a comparatively fast win once identity is solid, and it is a precondition that makes the network and application pillars more effective once they arrive.

Data classification is often the pillar organisations skip or defer, and it is also the one that data loss prevention and context-based access control depend on entirely. DLP rules with no underlying classification are guessing at what matters; this is the most common reason a Zero Trust data initiative stalls after an initial burst of activity.

NCA ECC-2:2024 and NCNICC-1:2025 both name controls, multi-factor authentication, privileged access management, network segmentation, that map directly onto specific Zero Trust pillars. A Zero Trust programme run in the sequence above produces compliance evidence as a byproduct of the work, though it is worth being precise: Zero Trust is an architecture model, not a compliance framework, and it does not substitute for a dedicated gap assessment against whichever regulation applies to your organisation.

Smaller organisations do not need to defer this until they reach enterprise scale. The full CISA maturity model scales down: a 50-person organisation still benefits meaningfully from unified identity with MFA and device posture checks as an access precondition, simply without pursuing the most advanced maturity stages, continuous risk scoring, full micro-segmentation, that make sense at larger scale.

A free Zero Trust Maturity Assessment scores your current posture across all five CISA pillars in about 15 minutes and returns which pillar is the weakest starting point for your specific environment, rather than assuming identity is automatically first for every organisation, since it usually is but is worth confirming rather than assuming.