Zero trust: principles, architecture and a step-by-step roll-out

Zero trust is a security model in which no user, device or traffic flow is trusted simply because of where it sits on the network: every access to a resource is checked against identity, device health and context, and limited to what is strictly needed. Its reference is SP 800-207 from NIST, the US National Institute of Standards and Technology. In France, ANSSI, the national cybersecurity agency, welcomes it while insisting on one point: it is a gradual approach that complements defence in depth rather than replacing it.

The classic model protects a perimeter: inside the corporate network, you trust; outside, you filter. That model has two weaknesses. First, the perimeter has dissolved: remote work, online services, cloud, connected contractors, mobile devices. Second, an attacker who gets past the barrier, through a stolen password or a vulnerable edge device, then moves freely from one server to the next.

NIST SP 800-207, published in August 2020, defines zero trust as a set of concepts meant to minimise uncertainty when making accurate, least-privilege access decisions per request, with the network viewed as already compromised. A zero trust architecture is the plan that applies these concepts to an organisation's workflows, components and access policies.

Zero trust is therefore neither a product nor a single technology: it is a way of designing access, implemented with several components (identity management, strong authentication, device management, segmentation, logging).

1. Everything is a resource: data, applications, services, including small devices and online services.
2. All communication is secured, wherever on the network it comes from: being on the internal network removes neither authentication nor encryption.
3. Access is granted per session, with least privilege; access to one resource does not open another.
4. Access is determined by dynamic policy, taking into account the requester's identity, the application, the device state and other behavioural or environmental attributes.
5. The organisation monitors the integrity and security posture of all assets it owns or that are associated with it.
6. Authentication and authorisation are dynamic and strictly enforced before access, and reassessed during the session.
7. The organisation collects as much information as possible about its assets, network and communications, and uses it to improve its security.

NIST describes a logical architecture that clearly separates the component that decides from the one that enforces:

• the policy engine decides to grant, deny or revoke access, based on the organisation's policy and available signals;
• the policy administrator carries out the decision: it opens or closes the path between requester and resource, for example by issuing a session token. Together, they form the policy decision point;
• the policy enforcement point sits in front of the resource, lets traffic through or blocks it, and monitors the connection.

The signals feeding the decision come from many sources: directory and identity management, device compliance, threat intelligence, activity logs, data classification. NIST distinguishes three ways to build the whole, often combined: leading with enhanced identity governance, with micro-segmentation of the network, or with a software-defined perimeter that only exposes applications to authorised requesters.

The model has its own weak points, which NIST lists: the decision point becomes a prime target (if it is bypassed or unavailable, everything stops or everything opens), stolen credentials remain a threat, encrypted traffic limits visibility, and reliance on proprietary formats can lock the organisation into one supplier. These components must therefore be protected, made redundant and monitored themselves.

In its scientific and technical opinion of April 2021, ANSSI finds that zero trust fits the defence-in-depth approach it has long promoted, while breaking with the paradigm of a strict perimeter. It highlights regular, dynamic and granular checks, least privilege, verification regardless of where on the network a request comes from, and periodic re-authentication. But it sets three limits:

• migration must be gradual: new solutions are integrated into an overall defence set-up, they do not replace it;
• solutions are still maturing: poorly installed or configured, they can weaken the information system instead of strengthening it;
• the risk of a false sense of security is real if people believe a “zero trust” product is enough.

In June 2025, the agency published Zero Trust model: the fundamentals (in French), with around a dozen recommendations for adopting the model in a controlled, gradual way, aimed at a broad audience: CISOs, IT directors, administrators, developers and users. For a CISO, the message is clear: zero trust is run as a transformation programme, written into the security policy, not as a purchase.

No law requires zero trust by name. Yet the two main European cybersecurity texts include its building blocks:

• NIS 2: recital 89 lists zero-trust principles among the cyber hygiene practices entities should adopt, alongside software updates, network segmentation, identity and access management and user awareness. Article 21 requires, among other things, access control policies and multi-factor authentication where appropriate.
• DORA: Article 9 requires financial entities to limit physical and logical access to information and ICT assets to what is needed for legitimate and approved functions, and to implement strong authentication mechanisms.

In the cloud, a qualification such as SecNumCloud guarantees the host's security level, but how your users reach your applications remains your responsibility: that is where zero trust comes in.