Zero Trust architecture assessment
A scored, pillar-by-pillar assessment against the CISA Zero Trust Maturity Model, with a roadmap phased so that legacy systems do not stall the whole program.
Bought under NAICS 541512 and 541519.
What this answers
Zero Trust has a definition problem: everyone sells it and few agree what it covers. Using a published maturity model solves that, because your score becomes comparable, portable and defensible rather than one vendor's opinion.
We assess against the CISA Zero Trust Maturity Model. Federal agencies have been working to the direction set out in OMB Memorandum M-22-09, issued in January 2022, and the same model gives commercial organizations a credible structure.
What is in scope
- Identity: authentication, lifecycle, and privileged access
- Devices: inventory, compliance state, and whether it is enforced
- Networks: segmentation, encryption, and east-west controls
- Applications and workloads: access control and deployment pipeline
- Data: classification, protection, and where it actually sits
- Cross-cutting: visibility and analytics, automation, and governance
- Legacy systems that cannot participate, and what surrounds them
How it runs
A short, fixed-scope engagement. We tell you the duration before you commit.
Current-state discovery
Architecture review, configuration collection, and interviews with the people who operate the systems rather than the people who designed them.
Pillar scoring
Each pillar scored against the maturity model stages, with the evidence for each score recorded.
Attack-path validation
We test whether the controls hold, rather than accepting the architecture diagram. This is what separates an assessment from a questionnaire.
Target architecture
A target state appropriate to your risk and budget. Advanced maturity in every pillar is rarely the right answer.
Phased roadmap
Sequenced by risk reduction per unit of effort, with legacy systems isolated rather than treated as blockers.
What you receive
- Maturity score for every pillar with evidence
- Attack-path validation results
- Target architecture appropriate to your risk tolerance
- Phased implementation roadmap with dependencies
- Legacy system register with compensating controls
- Briefing material for agency sponsors or your board
For federal programs
If you are reporting Zero Trust progress to an agency sponsor, scoring against the CISA model produces output in a form they already recognize, which is usually worth more than a bespoke scoring scheme however well designed.
Scope it before you budget it
Tell us the environment and the obligation. We come back with the approach, the duration, and what drives the price.