Recommended Free Tools
It is better prepared when access to each resource depends on verified identity and device context—not on a user or system being inside a trusted network—and when the organization can monitor and test those decisions. Use CISA’s Zero Trust Maturity Model to find gaps across your environment, but treat it as a planning framework, not a certification or a guarantee that an attacker cannot get in.
What does “prepared” mean in a zero trust model?
Zero trust is an approach to controlling access, not a single product or a network setting. NIST’s SP 800-207 shifts the focus from trusting network segments to protecting individual resources. Network location should not be the primary basis for deciding whether a resource is secure or whether access should be granted.
That distinction matters in environments with remote users, bring-your-own-device (BYOD) access, cloud assets, and on-premises systems. If a person, device, application, or service can reach a resource simply because it is on an approved network, the design still relies on network placement for trust.
For an initial review, ask whether your organization can identify its important resources, verify the identities and context of the users and systems requesting access, grant only the necessary permissions, see what happens after access is granted, and improve controls when testing reveals a weakness.
#1 Best Overall
How can you assess zero trust maturity?
CISA’s Zero Trust Maturity Model Version 2, published in April 2023, is intended to help organizations plan and assess implementation. It covers five pillars and three cross-cutting capabilities. Use it to organize a gap assessment and roadmap; it does not certify an organization or prove that its controls will stop every attack.
For each area below, record the policy, the systems it covers, the evidence that it is enforced, and the owner responsible for fixing gaps. A written policy alone is not evidence that a control works in practice.
| Readiness area | Questions to ask | Evidence to look for |
|---|---|---|
| Critical resources and access policy | Have you identified the data, systems, and services that matter most? Are access decisions tied to the specific resource and the user’s or service’s need? | An inventory of important resources; documented, resource-specific access rules; and review records showing that permissions match current job or service needs. |
| User and privileged identity | Are high-impact accounts protected with phishing-resistant MFA? Can administrators identify and revoke risky or unnecessary privileged access? | Authentication policy and exception records; privileged-access assignments and reviews; and a demonstrated process for removing access when it is no longer justified. |
| Devices and context | Do access decisions account for device context, including remote and BYOD situations, rather than assuming that a connection from the corporate network is safe? | Policies that explain which device signals affect access and how the organization handles devices that do not meet its requirements. |
| Cloud identity and authentication | Are cloud identities, tokens, keys, third-party dependencies, and governance covered by security policy? Are relevant activity and authentication events logged? | Defined ownership and handling for credentials and keys; reviewable logs; and documented oversight of third-party access and dependencies. |
| Applications and services | Do applications and machine-to-machine services have identifiable identities and their own access policies, or do they inherit trust from their network location? | Application and service identities, plus policies governing which services can communicate and which resources they can reach. |
| Visibility and validation | Can teams collect and review relevant logs, investigate unusual activity, and test whether policies behave as intended? | Centralized log collection and review procedures, investigation records, and exercises or other documented tests with follow-up actions. |
Can zero trust protect against compromised credentials?
It can reduce the access a stolen credential provides, but it cannot make credential theft harmless. CISA’s #StopRansomware Guide describes compromised credentials and advanced social engineering as concerns in ransomware intrusions, and recommends granular access controls for user-to-resource and resource-to-resource access. That makes credential theft and lateral movement useful scenarios for testing your architecture—not proof that zero trust alone prevents ransomware.
Use phishing-resistant MFA for important access
CISA recommends phishing-resistant MFA for services such as email and VPNs, and for accounts that can reach critical systems. Review the exceptions as well as the coverage: an account excluded from the stronger authentication policy may remain an attractive route into important resources. A FIDO2-compatible hardware security key is one possible option, but verify that it works with the services you use and that account recovery is planned.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsLimit and remove privileged access
Check whether administrators have broad, standing permissions they do not need for routine work. Confirm that the organization can identify who has privileged access, review whether it remains necessary, and revoke risky or stale access. Include this in exercises: a model that specifies narrow permissions but cannot enforce or remove them promptly is not ready in practice.
Does your zero trust design cover cloud identities and services?
Cloud identity needs its own scrutiny. In a July 15, 2025 article, CISA Joint Cyber Defense Collaborative Associate Director Clayton Romans warned of increasingly sophisticated activity targeting cloud identity and authentication systems. He highlighted concerns involving token authentication, key management, logging, third-party dependencies, and governance. This is a dated warning about areas to examine, not a measurement of how prevalent a particular weakness is.
For cloud applications, inventory how people and services authenticate, who controls credentials and keys, which external providers are involved, and whether the resulting activity can be reviewed. Make sure policies cover both human access and service-to-service access; a cloud workload should not receive broad trust merely because it runs in an approved environment.
NIST SP 800-207A, finalized September 13, 2023, addresses application and service identities in hybrid and multi-cloud environments. It describes moving beyond network-only segmentation toward granular application-level enforcement. Approaches discussed in the publication include API gateways, sidecar proxies, and application identity infrastructure. The practical readiness question is whether your organization can express and enforce which application or service may access which other service or resource, across the locations where they run.
Free tools Windows power users keep installed
One-click scans. No signup required.
Are remote, BYOD, cloud, and on-premises systems all in scope?
Check the boundaries of the design against the way people and workloads actually connect. NIST’s zero-trust architecture context includes remote users, BYOD environments, and cloud assets outside an enterprise-owned boundary. A design limited to office users or on-premises servers can leave important paths governed by older assumptions.
Rank #4
- Trace access by remote users to important services, including the role of device context.
- Check how BYOD access is handled and whether it is subject to explicit policy rather than implicit trust.
- Include cloud workloads and their service identities in access rules and monitoring.
- Check whether on-premises resources use resource-specific decisions rather than treating internal network placement as sufficient trust.
- Review paths between environments, such as cloud-to-on-premises and service-to-service connections, for unnecessary permissions.
Can you see and test whether the controls work?
A zero-trust policy is only useful if teams can observe its outcomes and respond when access is misused. CISA’s red-team advisory emphasizes logging, monitoring, continuous testing, and exercises. Treat these as operational requirements: they help reveal where a policy is missing, too broad, or not producing useful evidence.
Test realistic failure paths
Exercises should examine what happens after a credential is compromised, a privileged account is abused, or a cloud service identity is used in an unexpected way. Check whether the access policy limits the path to other resources, whether the event is visible in logs, and whether responders know how to revoke the access. Record gaps and assign owners and deadlines rather than treating a test as complete when the exercise ends.
Review exceptions and recovery
Include authentication and access-policy exceptions in leadership reviews. Also test the recovery path: a control that blocks legitimate users without a workable way to restore access can encourage unsafe workarounds. Confirm that the people responsible for response know how to disable a credential, key, or permission and can do so without losing the visibility needed to investigate.
Best Value
- Used Book in Good Condition
What should you fix first?
Prioritize gaps according to the resources and access paths they affect, not according to a product category or a maturity label alone. Start with the accounts and services that can reach critical systems, then address broad permissions and unmonitored access paths that could enable movement to other resources.
- Identify critical resources and their access paths. Record which users, administrators, applications, and services can reach them.
- Close high-impact identity gaps. Prioritize phishing-resistant MFA for important accounts and review privileged access, exceptions, and stale permissions.
- Govern cloud credentials and dependencies. Assign ownership for tokens and keys, review third-party access, and ensure relevant identity activity is logged.
- Make service-to-service access explicit. Give applications and workloads identities and policies that define the resources they may reach.
- Validate, monitor, and remediate. Test realistic compromise scenarios, confirm that activity is detectable and access can be revoked, and track fixes to completion.
When evaluating a proposed approach or platform, compare identity coverage for users, devices, applications, and services; phishing-resistant MFA and privileged-access controls; policy granularity; hybrid and multi-cloud coverage; logging and testability; and operational complexity, including recovery. CISA and NIST guidance supports these as useful evaluation dimensions, but it does not establish that a particular vendor or category is universally preferable.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
