Zero Trust Architecture
Hosted formally by The Open Group Security Forum, the Zero Trust Architecture (ZTA) Working Group is a collaboration between the Security Forum and Architecture Forum—participation in this working group is granted to all Silver and Academic Members of both the Security Forum and the Architecture Forum as well as all Gold and Platinum Members of The Open Group. The ZTA Working Group intends to provide clarity by creating an ecosystem of interested end-user and vendor organizations, publish vendor- and technology-neutral standards, and create business guidance for industry participants.
The ZTA Working Group is an industry-wide initiative to establish standards and best practices for Zero Trust as
the overarching information security approach for the Digital Age.
To inquire about joining the ZTA Working Group or participating in any of the active Projects within the ZTA Working Group, contact Forum Director John Linford at j.linford@opengroup.org.
Zero Trust Reference Architecture Project
The ultimate goal of the ZTA Working Group is to create and publish a Zero Trust Reference Architecture that demonstrates and defines how to implement Zero Trust. The first stage of this has been to produce the Zero Trust Reference Model Snapshot based on industry input and use cases. The Reference Model is a higher-level document focused more on strategic direction and conceptual guidance and will allow for reference implementations to be contributed. These reference implementations will aid in the creation of the Zero Trust Reference Architecture.
This project will utilize The Open Group Snapshot process, publishing regular updates as progress is made and soliciting input from both Members and non-Members of The Open Group to ensure the Zero Trust Reference Model and eventual Zero Trust Reference Architecture meet industry requirements and desires.
This project will also aim to develop complementary documents in order to aid those implementing Zero Trust. Among these are a Business Guide, which will be intended for senior and C-level executives and enterprise architects, that explains what Zero Trust is, its impact on business, and the reasoning for implementing it, as well as a Practitioners Guide, which will be intended for those implementing Zero Trust, that provides a process framework and develops an ontology for Zero Trust.
Project Facilitators:
- Mark Simos, Microsoft
- Nikhil Kumar, Applied Technology Solutions, Inc.
Zero Trust Implementation Project
The Zero Trust Implementation Project is focused on producing a guide that allows organizations to identify their starting part in the process of implementing Zero Trust and to prioritize actions based on the identified starting point and goals. Implementing Zero Trust requires collaboration and increased communication across the entire organization as well as efficient, deliberate use of new tools. This project will describe the process required to implement Zero Trust and improve the security of the organization.
The Guide will deliberately complement the Zero Trust Commandments and the Zero Trust Reference Model publications from the ZTA Working Group, referencing the 3-Pillar Model and capabilities detailed in the Zero Trust Reference Model and providing specific guidance on practicable steps to take when implementing Zero Trust, while remaining neutral on tools and products. The Guide will also work to complement the Open Dependability through Assuredness (O-DA) Framework.
This project will also incorporate business considerations from implementing Zero Trust, addressing impacts on people and process (i.e., going beyond technical implementation considerations). This will allow organizations to communicate across teams and ensure consistent and coherent implementation throughout the organization.
Project Facilitators:
- Hasan Yasar, CMU SEI
- Mark Simos, Microsoft
- Nikhil Kumar, Applied Technology Solutions, Inc.
Zero Trust Glossary and Roles Project
The Zero Trust Glossary & Roles Project is focused on producing a set of top-level, relevant terms and definitions pertaining to Zero Trust. This work will be included in the Portfolio of Open Digital Standards – Glossary & Roles (S222) document. The terms and roles identified will be included in the forthcoming knowledge-based, individual Zero Trust Certification Program.
The objective is to provide definitions of glossary items and roles used within the Zero Trust Body of Knowledge and supporting materials, including but not limited to…
- Zero Trust Reference Model (Standard)
- Zero Trust Commandments Standard
Project Facilitators:
- Mark Simos, Microsoft
- Nikhil Kumar, Applied Technology Solutions, Inc.
- John Linford, The Open Group