If you’ve read anything technical about Zero Trust, you’ve likely seen a reference to NIST Special Publication 800-207. It’s the U.S. National Institute of Standards and Technology’s reference architecture for Zero Trust, and it’s become the de facto standard that vendors, auditors, and consultants (including us) measure against. The document itself is written in dense government-standard language. Here are its seven foundational tenets, translated into plain English.
1. All Data Sources and Computing Services Are Resources
Everything that can be accessed — an application, a database, a cloud storage bucket, even an API — is treated as a protected resource requiring deliberate access control. Nothing is exempt just because it seems low-risk or is “only used internally.”
2. All Communication Is Secured Regardless of Network Location
Traffic between two internal systems on the same office network gets the same protection as traffic crossing the public internet. Physical or network proximity no longer implies safety.
3. Access to Individual Resources Is Granted Per-Session
Rather than a login that grants standing access to a broad set of systems for the rest of the day, access is evaluated and granted per session, for the specific resource being requested. This limits how much damage a single compromised session can do.
4. Access Is Determined by Dynamic Policy
Access decisions incorporate more than “does this user have a valid password” — they factor in device health, behavioral patterns, and contextual signals like location or time of access. The same user might be granted access from a managed corporate laptop but denied from an unrecognized personal device, even with correct credentials.
5. The Enterprise Monitors and Measures the Integrity and Security Posture of All Assets
Devices and systems are continuously assessed, not evaluated once at enrollment and forgotten. A previously-trusted device that falls out of compliance (missed patches, disabled endpoint protection) can have its access automatically restricted.
6. All Resource Authentication and Authorization Are Dynamic and Strictly Enforced Before Access Is Allowed
Authentication isn’t a one-time event at login — it’s a continuous, enforced cycle applied before every access decision, closing the gap where a session, once established, was implicitly trusted indefinitely.
7. The Enterprise Collects as Much Information as Possible About the Current State of Assets, Network Infrastructure, and Communications
Comprehensive telemetry — logs, network traffic data, asset state — feeds back into policy decisions and improves them over time. Zero Trust isn’t a static configuration; it’s a system that’s supposed to get more accurate as it observes more.
Why These Tenets Matter Beyond Compliance Checkbox Language
These aren’t abstract principles for their own sake — each one closes a specific gap that the old perimeter-based model left open. Tenet 3 (per-session access) directly addresses the problem of a single compromised VPN session having broad standing reach. Tenet 5 (continuous posture monitoring) addresses devices that were secure at enrollment but have since drifted out of compliance.
Translating This Into an Actual Architecture
NIST 800-207 describes principles, not a shopping list of products. Translating it into a working architecture for your specific business — deciding what a “resource” means for you, what dynamic policy actually evaluates, what monitoring coverage looks like in practice — is the design work that turns the standard into something deployable. That’s the process our sample Zero Trust & SASE roadmap walks through for a fictionalized client, mapping each tenet to a concrete design decision.