# What is Zero Trust Architecture?

> Zero trust architecture (ZTA) is an enterprise security design in which access is not implicitly trusted solely because of network location, device ownership, or an earlier login.

- Canonical URL: https://yellowcube.eu/glossary/zero-trust-architecture/
- Publisher: Yellow Cube
- Language: en
- Contact: hello@yellowcube.eu

## Content

It protects resources by making authentication and authorization explicit policy decisions informed by identity, device posture, requested action, resource sensitivity, and other risk signals.

A ZTA applies zero trust principles through inventories, identity and device management, policy decision and enforcement components, application and data controls, and telemetry. Access should be narrowly scoped and reevaluated as conditions change. Deployment patterns include identity-governed gateways, microsegmentation, software-defined perimeters, and resource portals; no single product or topology constitutes ZTA.

### Key points

- **Inventory:** Identify the subjects, devices, workloads, data, services, communication paths, and dependencies that policy must govern.
- **Decision and enforcement:** Evaluate each requested action against policy and enforce the result close to the protected resource, with only the necessary access granted.
- **Reevaluation:** Monitor relevant identity, device, resource, and environmental signals so a meaningful change can alter or end access.
- **Important limitation:** Zero trust does not eliminate every form of trust, guarantee prevention, or mean that users are treated as malicious. Incorrect inventories, stolen identities, unreliable posture data, excessive privileges, enforcement gaps, and unavailable control services can still undermine the architecture.

### Related terms

[Zero trust network access (ZTNA)](<https://yellowcube.eu/glossary/zero-trust-network-access/>) · [Software-defined perimeter (SDP)](<https://yellowcube.eu/glossary/software-defined-perimeter/>) · [Microsegmentation](<https://yellowcube.eu/glossary/microsegmentation/>) · [Identity and access management (IAM)](<https://yellowcube.eu/glossary/identity-and-access-management/>) · [Network segmentation](<https://yellowcube.eu/glossary/network-segmentation/>)

### Sources

[NIST SP 800-207: Zero Trust Architecture](https://csrc.nist.gov/pubs/sp/800/207/final) · [NIST SP 1800-35: Implementing a Zero Trust Architecture](https://csrc.nist.gov/pubs/sp/1800/35/final) · [CISA Zero Trust Maturity Model Version 2.0](https://www.cisa.gov/sites/default/files/2023-04/CISA_Zero_Trust_Maturity_Model_Version_2_508c.pdf)

## Attribution and scope

This Markdown representation is generated from the same approved content records as the canonical HTML page. Cite the canonical URL above when referencing this material. Product and service descriptions are informational; confirm project-specific requirements with Yellow Cube.