What is Zero Trust as Defined by NIST SP 800-297?

According to NIST Special Publication 800-207, Zero Trust is a cybersecurity approach that assumes no implicit trust is granted to users, devices, or services based solely on their location within a network. Instead, every access request is continuously verified, policies are enforced based on the principle of least privilege, and systems are designed to assume breach—limiting lateral movement and reducing the attack surface through strict authentication, authorization, and continuous monitoring.

Here’s a concise list of Zero Trust key points supported by Microsoft solutions:

1. Verify Explicitly – Authenticate and authorize based on all available data points (user identity, device health, location, service, and risk).
2. Use Least Privilege Access – Limit access with Just-In-Time (JIT) and Just-Enough-Access (JEA), enforced through Entra ID and Privileged Identity Management (PIM).
3. Assume Breach – Segment access, encrypt data, and use monitoring to contain damage, with Defender for Endpoint, Defender for Cloud, and Microsoft Sentinel.
4. Identities – Protected through Entra ID, Conditional Access, MFA, Identity Protection, and Verified ID.
5. Endpoints – Secured with Microsoft Defender for Endpoint (MDE) to detect, respond, and reduce attack surfaces.
6. Applications – Controlled with Entra ID SSO, Conditional Access, and Defender for Cloud Apps for visibility, governance, and protection.
7. Data – Classified, labeled, and protected using Microsoft Purview Information Protection and Data Loss Prevention (DLP).
8. Infrastructure – Safeguarded with Defender for Cloud, Azure Policy, and Secure Score for workloads across hybrid and multicloud environments.
9. Network – Secured through Azure Firewall, Azure DDoS Protection, VPN Gateway, and micro-segmentation for encrypted, least-privilege connectivity.
10. Visibility & Analytics – Continuous monitoring and threat detection via Microsoft Sentinel, Defender XDR, and advanced audit logs.

ZeroTrust with MS.pdf