Zero trust in practice: reading CISA's maturity model alongside Thailand's NCSA guidelines

The starting point: NIST SP 800-207

NIST published SP 800-207, Zero Trust Architecture, in August 2020. Its argument is that defences should narrow from wide network perimeters to individual resources, because users work from outside the office and a great deal of what they use no longer sits on a network the organisation owns. It is written for enterprise security architects and is not tied to any vendor's product.

The five pillars of CISA's model

CISA published version 2.0 of its maturity model in April 2023. It divides the work into five pillars with three further capabilities that cut across all of them, which lets an organisation say which part it is currently improving instead of arguing about whether it 'is zero trust' yet.

• Pillars: Identity, Devices, Networks, Applications and Workloads, and Data
• Cross-cutting capabilities: Visibility and Analytics, Automation and Orchestration, and Governance
• Maturity stages: Traditional, Initial, Advanced and Optimal, with examples given for each pillar at each stage

The Thai guidelines

Thailand's National Cyber Security Agency published its zero trust guidelines in early February 2026, built on the principle of never trust, always verify, and written so that public and private organisations can apply the ideas step by step in their own context. For a Thai organisation that has to explain its plan to domestic auditors, citing this alongside the international documents makes the conversation easier.

Our view: start with the pillar that hurts most

Five pillars does not mean five parallel programmes. In practice most organisations see the fastest return from Identity, because multi-factor authentication and control of administrative access remove a lot of risk for the effort involved, and because the other pillars depend on it anyway. The most commonly skipped part is a cross-cutting one — Visibility and Analytics. While an organisation cannot say who is using what, any policy it writes will be unenforceable.