Introduction to The ZTAID Model for Zero Trust Maturity Assessment (ZTMA)

Abstract

This paper discusses the progress of the implementation of Zero Trust Architecture (ZTA) in recent years, including the Zero Trust Architecture Standard (2020) of the National Institute of Standards and Technology (NIST), the technology pillars covered by the Zero Trust Strategy of the U.S. Department of Defense (2022), and the Zero Trust Maturity 4-Level Architecture of the U.S. Department of Homeland Security (2023). In combination with Taiwan authority’s promotion of Zero Trust Architecture starting in 2022, we share the ZTAID model suitable for organizations to implement Zero Trust Maturity Assessment. This model is designed based on the "Reference Guidelines for the Introduction of Zero Trust Architecture" (2024) of the Financial Supervisory Commission of Taiwan. It combines the aforementioned standards and conducts an inventory and assessment of the current status of zero trust maturity to identify potential risks and formulate future phased improvement measures. It is also supplemented by the five core functions of the Cybersecurity Framework (CSF) to integrate the pre-, mid- and post-event (identification, protection, detection, response and recovery) of the information security defense lifecycle management process, and finally quantifies and summarizes the organization's maturity in the zero trust framework. Finally, we can redesign phased improvement plans and implementation projects based on the evaluation results to gradually enhance its information security protection capabilities and achieve the information security protection goals of introducing and applying ZTA.