NIST SP 800-207, titled “Zero Trust Architecture,” is a comprehensive guidance document from the National Institute of Standards and Technology that outlines the principles, components, and strategies for implementing Zero Trust in organizational IT environments. Zero Trust Architecture (ZTA) is based on the core principle of “never trust, always verify,” meaning that no user, device, or system—whether inside or outside the network perimeter—is automatically trusted. The document details how organizations should continuously authenticate and authorize every access request using dynamic, context-driven policies, enforce least privilege access, and secure all communications regardless of network location. It introduces key architectural components such as the Policy Engine, Policy Administrator, and Policy Enforcement Point, and emphasizes the need for comprehensive monitoring, micro-segmentation, and rigorous access controls to protect resources from both external and internal threats. NIST SP 800-207 also provides guidance on migration strategies from traditional perimeter-based security to a Zero Trust model, helping organizations enhance their security posture and resilience against modern cyber threats.
This standard is the foundational / theoretical guidance, which is supplemented by implementation guide NIST SP 1800-35 on Implementing a Zero Trust Architecture.