The boundary is only one part of the defense
Firewalls, gateways and protected remote access remain useful. The weakness is granting excessive trust after a user or device passes one of those controls. Cloud services, coalition connections, remote personnel and connected devices make a single inside-versus-outside distinction an incomplete basis for security.
The SolarWinds incident illustrates why trusted tools and accounts need scrutiny. CISA documented compromise of the Orion software supply chain and abuse of authentication mechanisms. Its original advisory explained that Orion often operated with extensive privileges to monitor infrastructure. That does not mean every affected network lacked internal controls; it shows how a trusted management function can create a consequential path into an organization.
Defense teams should therefore examine both entry and reach. If a credential or component is compromised, which resources become accessible, what actions remain possible and how quickly can that access be constrained?
What changes in the access decision
NIST describes zero trust as an approach that does not grant implicit trust solely because of physical or network location or ownership. Access is evaluated for individual resources with the least privilege needed for the task. The policy decision can consider the requester, the device, the resource and other relevant context.
For an operational team, that means paying attention to several connected elements:
- Identity: Know who or what is requesting access, including service accounts and automated workloads. For human access, prioritize phishing-resistant multifactor authentication where supported and appropriate.
- Authorization: Grant the permissions required for the role and task, with an owner responsible for reviewing them.
- Device and workload condition: Incorporate relevant evidence about the system making the request rather than treating a valid credential as the entire decision.
- Segmentation: Limit pathways between resources and enforce the intended boundaries.
- Data protection: Match access and handling to the information and its mission use.
- Visibility: Retain useful records of decisions, changes and activity so defenders can investigate and respond.
Continuous assessment does not require repeatedly interrupting a user with a login prompt for every packet. The implementation should make policy enforceable while preserving the timing and usability the mission requires.
Modernize around a real workflow
Legacy applications can complicate the transition. Some lack modern identity interfaces, assume broad connectivity or depend on older protocols. Their constraints need to be documented rather than hidden behind an exception that never receives another review.
NIST describes gateway approaches that can protect legacy resources, while noting that protecting an enclave may provide less granularity than protecting each resource individually. That is a useful tradeoff to make explicit. An encryption gateway can protect a path without fixing every weakness in the endpoint or application behind it.
A manageable implementation sequence is:
- Choose a mission workflow. Identify its users, data, applications, service accounts and supporting systems.
- Map the actual paths. Include remote administration, batch jobs, backups, partner connections and failure-recovery paths.
- Define necessary access. Separate ordinary use, privileged maintenance and exceptional operations.
- Introduce controls in a testable increment. Validate identity and policy enforcement against the workflow before expanding the boundary.
- Exercise failure and recovery. Test loss of an identity service, incorrect policy and revoked access as well as normal operation.
- Review the evidence and expand. Fix gaps, record remaining limits and apply what worked to the next workflow.
This sequence is a practical implementation recommendation. It keeps the engineering effort tied to a mission outcome and gives operators a way to identify breakage before a wider rollout.
Use the Department's framework without reducing it to a purchase
The Department's 2022 Zero Trust Strategy established a target-level goal by fiscal year 2027, with 91 target activities across seven pillars. Identity, devices, applications and workloads, data, networks and environments, automation and orchestration, and visibility and analytics all contribute. A product can support parts of the architecture; it cannot establish the organization's policies, inventories and operating responsibilities on its own.
September 2026 review update: NSA's January 2026 implementation guidance adds practical considerations for carrying out Department activities. Teams should use such guidance with the requirements and architecture applicable to their environment, rather than assume that buying a tool bearing a zero-trust label completes the work.
Coordination is as important as the technical change. An application owner needs to understand why a service account's permissions changed. A help desk needs to recognize a policy denial. A mission owner needs to understand the available alternatives when a security service is unavailable.
Measure whether the architecture improves defense
Useful measures go beyond the number of products installed. Review whether unnecessary privileges were removed, important access paths became visible and a compromised account can be constrained without disabling unrelated mission functions.
Monitoring also needs validation. More logs do not automatically create an accurate behavioral baseline or a usable alert. Test whether the records explain the decision, whether time and identity information agree across systems and whether responders can find the evidence within the required period.
The operational benefit is better control over how a compromise can spread and better information for deciding what to do next. It should be demonstrated through realistic access, containment and recovery tests as the architecture evolves.
Sources and further reading
- NIST SP 800-207: Zero Trust Architecture
- CISA: original SolarWinds-related compromise advisory
- CISA: software supply-chain and authentication compromise context
- Department of Defense: 2022 Zero Trust Strategy
- NSA: January 2026 Zero Trust Implementation Guideline, Phase One
Spartan X's cybersecurity and engineering practices connect access policy to the systems and workflows it must protect, helping turn zero-trust principles into operational controls that teams can test, maintain and use.
