NIST SP 800-207

1. 2026-10-08 Medium
   CSA publishes "Integrating DNS and SDP: Enhanced Zero Trust Policy Enforcement 2.0"

   CSA has published "Integrating DNS and SDP: Enhanced Zero Trust Policy Enforcement 2.0," dated 10 July 2026, addressing DNS as a security blind spot in enterprise …

   New version Effective 2026-10-07 Action required

1. 2026-02-05 CISA BOD 26-02 on end-of-support edge devices tells agencies to keep M-22-09 zero trust requirements in mind and cites SP 800-207
2. 2025-06-10 NIST SP 1800-35, "Implementing a Zero Trust Architecture", published with results from NCCoE work with 24 collaborators
3. 2023-09-13 SP 800-207A, a zero trust model for access control in cloud-native applications in multi-cloud environments, published
4. 2022-01-26 OMB M-22-09 sets the federal zero trust architecture strategy and requires agencies to meet its zero trust goals by the end of fiscal year 2024

1. 2020-08-11
   SP 800-207 Major versionCurrent

   Final publication defining zero trust and zero trust architecture (ZTA), its logical components and deployment models, and a general road map for migrating an enterprise to it. source

   More

   • It has had no revision since.
2. 2020-02-13
   SP 800-207 (2nd public draft) Draft

   Second public draft; comments closed 13 March 2020. source

3. 2019-09-23
   SP 800-207 (initial public draft) Draft

   First public draft; comments closed 22 November 2019. source

SP 800-207 defines zero trust architecture; for US federal civilian agencies, Executive Order 14028 and OMB M-22-09 make zero trust mandatory policy.

Definition

SP 800-207 gives an abstract definition of zero trust architecture, with general deployment models and use cases. source

Federal agencies

For US federal civilian agencies, Executive Order 14028 and OMB M-22-09 make zero trust mandatory policy. source source

M-22-09

M-22-09 required specific standards and objectives by the end of fiscal year 2024 and refers to CISA's Zero Trust Maturity Model. source

Other organizations

Nongovernmental organizations may use SP 800-207 voluntarily. source

Under M-22-09, each federal agency submitted a zero trust implementation plan to OMB and CISA for OMB concurrence.

Federal plans

Under M-22-09, each federal agency submitted a FY22-FY24 zero trust implementation plan to OMB and CISA for OMB concurrence. source

Maturity model

M-22-09 also refers agencies to CISA's Zero Trust Maturity Model. source source

NIST is not a regulatory agency; federal agency obligations come from OMB M-22-09.

Not a regulator

NIST is not a regulatory agency. source

Federal agencies

Federal agency obligations come from OMB M-22-09, which requires agencies to achieve specific zero trust security goals by the end of fiscal year 2024. source

1. Standard NIST SP 800-207 – Zero Trust Architecture (PDF)
2. Guidance NIST SP 800-207A – Zero Trust Architecture Model for Access Control in Cloud-Native Applications (PDF)
3. Guidance NIST SP 1800-35 – Implementing a Zero Trust Architecture (June 2025)
4. Law text OMB M-22-09 – Moving the U.S. Government Toward Zero Trust Cybersecurity Principles
5. Guidance CISA Zero Trust Maturity Model

1. TIC 3.0

   TIC 3.0 is CISA's network security architecture for federal agencies; it is described as a pathway to zero trust, while SP 800-207 defines zero trust itself.

2. NIST SP 800-53

   SP 800-53 is the control catalog; SP 800-207 is an architecture describing how those controls fit around per-request access decisions.

3. NIST SP 800-63

   SP 800-63 sets identity proofing and authentication assurance levels, which zero trust access decisions depend on.

4. EO 14028

   Executive Order 14028 ordered federal agencies to move toward zero trust architecture; SP 800-207 supplies the definition.

Verified against official sources on 18 October 2026. We monitor the official sources for this framework. Watching since 19 September 2026. Subscribe to NIST SP 800-207 (RSS)