Technical reference
NIST SP 800-207 — Zero Trust Architecture
The seven NIST Zero Trust tenets — and exactly how Okta's identity platform addresses each one.
Assess my maturityAll data sources and computing services are considered resources
Every device, service, and data store is a resource that must be protected — regardless of location.
All communication is secured regardless of network location
Network location confers no trust. All sessions must be authenticated and encrypted end-to-end.
Access to individual resources is granted on a per-session basis
Access is not persistent. Each session is evaluated independently based on current context.
Access is determined by dynamic policy
Policy evaluates identity, device health, behavioral signals, and environmental context in real time.
The enterprise monitors and measures the integrity of all assets
Device and workload integrity is continuously monitored and factored into access decisions.
All authentication and authorization is dynamic and strictly enforced
Static credentials and long-lived sessions are eliminated. Least-privilege is enforced at every step.
The enterprise collects as much information as possible to improve security posture
Telemetry from every access event feeds continuous learning and posture improvement.
Map your architecture to NIST ZTA
Book a 30-minute session to walk through your current state against all seven tenets.