Definition
Zero Trust is a security model where no implicit trust is granted based on network location, device, or asset ownership; every access decision is verified explicitly using identity, context, and policy.
Zero Trust replaces perimeter-based security ("trust everything inside the firewall") with continuous verification ("trust nothing; verify everything"). NIST SP 800-207 codified the architecture. Practical Zero Trust hinges on identity-centric access: a strong IdP, risk-based authentication, device-trust signals, and externalized authorization decisions.
The federal Zero Trust Strategy (OMB M-22-09) is the most prescriptive operational guide; many enterprises align voluntary programs to its 5-pillar model (identity, device, network, application, data).