Zero Trust Maturity Assessment
Rate your organization on all 40 rows of CISA's Zero Trust Maturity Model 2.0, from Traditional to Optimal, and see the next stage for each.
Presets
A stage preset shows what that stage means on every row; the two examples show an uneven profile.
Rate each row
Pick the stage whose description matches your organization today. Tap a stage to read it; the last one you pick counts.
0 of 40 rows rated
An identity refers to an attribute or set of attributes that uniquely describes an agency user or entity, including non-person entities.
Authentication
Choose a stage to see its description.
Identity Stores
Choose a stage to see its description.
Risk Assessments
Choose a stage to see its description.
Access Management
New in v2.0Choose a stage to see its description.
Visibility and Analytics Capability
Choose a stage to see its description.
Automation and Orchestration Capability
Choose a stage to see its description.
Governance Capability
Choose a stage to see its description.
CISA's four stages
ZTMM v2.0, section 5: the criteria CISA gives for identifying the stage of each pillar.
| Stage | Guiding criteria |
|---|---|
| Traditional | Manually configured lifecycles (i.e., from establishment to decommissioning) and assignments of attributes (security and logging); static security policies and solutions that address one pillar at a time with discrete dependencies on external systems; least privilege established only at provisioning; siloed pillars of policy enforcement; manual response and mitigation deployment; and limited correlation of dependencies, logs, and telemetry. |
| Initial | Starting automation of attribute assignment and configuration of lifecycles, policy decisions and enforcement, and initial cross-pillar solutions with integration of external systems; some responsive changes to least privilege after provisioning; and aggregated visibility for internal systems. |
| Advanced | Wherever applicable, automated controls for lifecycle and assignment of configurations and policies with cross-pillar coordination; centralized visibility and identity control; policy enforcement integrated across pillars; response to pre-defined mitigations; changes to least privilege based on risk and posture assessments; and building toward enterprise-wide awareness (including externally hosted resources). |
| Optimal | Fully automated, just-in-time lifecycles and assignments of attributes to assets and resources that self-report with dynamic policies based on automated/ |
This page reproduces CISA's Zero Trust Maturity Model, Version 2.0, for self-assessment. A self-rating is not an audit or a certification. CISA calls the model a general guide rather than a strict set of requirements, written for US federal agencies; weigh your own risk, mission and constraints when you plan.
Related Calculators
You might also find these calculators useful
Security Maturity Assessment
Rate the 22 NIST CSF 2.0 Categories on NIST's four Tiers and see the gaps
Risk Matrix Calculator
Rate a risk on four published risk matrices, now and after planned controls
CVSS Score Calculator
Score CVSS 4.0 and 3.1 vulnerabilities, or paste a vector to decode it
SSL Certificate Expiry Calculator
Days left, renewal date and the maximum lifetime for any TLS certificate
CISA's Zero Trust Maturity Model, row by row
This assessment puts the whole of CISA's Zero Trust Maturity Model (ZTMM), Version 2.0, in front of you: the five pillars (Identity, Devices, Networks, Applications and Workloads, and Data), the three capabilities inside each pillar, and the three cross-cutting capabilities. For each of the 40 rows you pick the stage whose description, in CISA's own words, matches your organization today. The page then shows your profile pillar by pillar, your lowest and highest stage, and CISA's description of the next stage for every row. It gives no score, because the model does not have one.
What is the CISA Zero Trust Maturity Model?
The Zero Trust Maturity Model is CISA's roadmap for moving an organization from perimeter-based security to zero trust. Version 2.0, published in April 2023, rates five pillars and three cross-cutting capabilities across four stages: Traditional, Initial, Advanced and Optimal. CISA wrote it for US federal civilian agencies building the zero trust plans that Executive Order 14028 requires, and says every organization should consider its approaches. It calls the model a general guide rather than a strict set of requirements, and lets each pillar progress at its own pace.
How this page summarizes your ratings
Lowest stage = the earliest stage among your rated rows (Traditional < Initial < Advanced < Optimal)How to assess your zero trust maturity
Start with a preset to see what one stage looks like across the whole model, or go straight to the pillars.
Open a pillar and, for each row, tap the stage whose CISA description matches you today. Tap another stage to compare; the last one you pick counts.
Rate the three cross-cutting capabilities (Visibility and Analytics, Automation and Orchestration, Governance) for the organization as a whole.
Read your profile: the lowest and highest stage, and how each pillar's rows spread across the stages.
Use the next-stage list as your roadmap, starting with the rows at your lowest stage.
When to use it
Planning a zero trust roadmap
Record where each function stands and what its next stage requires, in the model's own terms, before choosing projects or products.
Federal zero trust plans
Executive Order 14028 requires federal agencies to plan a zero trust architecture, and OMB memorandum M-22-09 aligned its actions with the ZTMM's pillars.
A vendor-neutral baseline
Rate against CISA's text before running a vendor's product-specific assessment, so the baseline does not depend on one product.
Explaining zero trust
Show leadership what Initial, Advanced or Optimal means for a specific function, in the words of the model.
Why use this assessment
CISA's own words
Every stage description is CISA's text, in English or in CISA's official Spanish translation, so each rating is a match against the model itself, not against a paraphrase.
No invented score
The model has no points, weights or percentages. The page reports your ratings as they are instead of a number the model never defines.
Uneven maturity stays visible
An average lets four strong pillars hide one that is still Traditional. The profile shows every row, and the lowest stage is the floor every rated row has reached.
A next step for every row
For each row below Optimal the page shows CISA's description of the next stage, lowest rows first: the plan the model is meant to support.
Zero trust maturity: frequently asked questions
It is CISA's model for measuring progress toward a zero trust architecture. Version 2.0 (April 2023) describes, for each of 40 rows across five pillars and three cross-cutting capabilities, what an organization looks like at each of four stages. CISA wrote it for US federal civilian agencies and says every organization should consider its approaches.
In CISA's model they are Identity, Devices, Networks, Applications and Workloads, and Data. Three cross-cutting capabilities run across them: Visibility and Analytics, Automation and Orchestration, and Governance. Each pillar's table rates its own functions and then those three capabilities within the pillar.
Traditional, Initial, Advanced and Optimal: four stages, not five. Traditional is the starting point, with manually configured lifecycles, static policies and siloed pillars. Optimal means fully automated, just-in-time lifecycles, dynamic least privilege across the enterprise and cross-pillar interoperability with continuous monitoring. CISA added Initial in version 2.0; version 1.0 went from Traditional straight to Advanced.
Seven pillars are the Department of Defense's zero trust framework: User, Device, Application and Workload, Data, Network and Environment, Automation and Orchestration, and Visibility and Analytics. The NSA published maturity guidance for each of them in 2023 and 2024. CISA's model has five pillars and treats visibility, automation and governance as cross-cutting capabilities instead.
No. It has no points, weights, percentages or formula for combining rows, and it lets each pillar progress at its own pace. That is why this page reports your ratings as a profile (counts per stage, the lowest and the highest stage) instead of a single number.
Take each function and capability in turn, read CISA's four descriptions, and pick the one that matches what you do today rather than what is planned. CISA advises assessing current systems, resources, infrastructure, personnel and processes before investing, so that gaps can be prioritized. Rate the cross-cutting capabilities for the organization as a whole.
Yes. Version 2.0, dated April 2023, is the latest version; CISA has published none since. In mid-2025 CISA marked the model's original web page as archived, but its current resource page still lists version 2.0 with a Spanish translation, and CISA's zero trust page still presents it as one of the roadmaps agencies can use.
NIST SP 800-207 (2020) defines zero trust and zero trust architecture: seven tenets, the logical components and the deployment models. It does not define pillars or maturity stages. CISA's model reflects those seven tenets and turns them into a maturity roadmap across five pillars.
For US federal civilian agencies, Executive Order 14028 (2021) requires a plan to implement a zero trust architecture, and OMB memorandum M-22-09 set specific goals for the end of fiscal year 2024. Both apply to federal agencies, not to private organizations.
CISA lists what it leaves out: incident response, specifics of logging, monitoring and alerting, forensic analysis, risk acceptance and recovery. It does not address challenges specific to operational technology or certain classes of IoT devices, and it does not cover machine learning or artificial intelligence capabilities within zero trust solutions.
CISA gives no timeline. It calls the path to zero trust an incremental process that may take years to implement, and expects both the effort and the benefits to grow as maturity progresses. The stages are meant to be dynamic, so what a stage requires can shift over time.