Zero Trust Architecture
Assessment That Tests
More Than Diagrams
Zero Trust architecture assessment
An Evidence-Based View of How Far Your Zero Trust Journey Has Really Come
iSpyCyber assesses your architecture against NIST SP 800-207 and the CISA Zero Trust Maturity Model, then tests whether the controls behave as designed. You receive a clear maturity baseline across identity, devices, networks, applications and data, validated gaps and a practical roadmap to your target state.
Why organisations choose iSpyCyber
Pillar-by-pillar maturity
Each CISA pillar and cross-cutting capability scored from Traditional to Optimal, with evidence behind every rating.
Controls tested, not assumed
Offensive testing confirms whether conditional access, segmentation and device trust actually stop an attacker.
Vendor-neutral advice
Recommendations based on your existing investments and risk, not on selling a particular product.
Practical roadmap
A phased plan that sequences quick wins and larger initiatives towards your target maturity.
Business-aligned
We work with security, IT, application and business owners so the roadmap fits how your organisation operates.
Progress you can measure
Reassessment tracks maturity over time, and iefyx, our AI-native VAPT and CTEM platform, keeps exposure visible between reviews.
Coverage
What We Assess Across Your Zero Trust Architecture
Our assessment covers the five CISA Zero Trust pillars and the cross-cutting capabilities that bind them, validated through hands-on testing.
Identity
Identity providers, MFA strength, phishing-resistant authentication, conditional access and privileged identity management.
Devices
Device inventory, compliance posture, endpoint protection and how device health feeds access decisions.
Networks
Micro-segmentation, encrypted traffic, software-defined perimeters and removal of implicit trust between zones.
Applications and workloads
Application access, per-session authorisation, secure development practices and workload isolation.
Data
Data inventory, classification, encryption, access controls and data loss prevention.
Visibility and analytics
Logging, telemetry and behavioural analytics that inform continuous trust evaluation.
Automation and orchestration
Automated policy enforcement, response playbooks and integration between security tools.
Governance
Policies, ownership and decision processes for defining and enforcing Zero Trust principles.
Control validation
Targeted testing to confirm policies block lateral movement, token misuse and unmanaged device access in practice.
Methodology
A Proven Six-Phase Assessment Methodology
Aligned to NIST SP 800-207 and the CISA Zero Trust Maturity Model, and tailored to your architecture, priorities and existing investments.
- NIST SP 800-207
- CISA ZTMM
- NIST SP 1800-35
- MITRE ATT&CK
- CVSS 3.1
3–6
weeks for a typical engagement
6
standards-aligned phases
100%
findings manually validated
01
- Week 1
Scope and plan
Objectives, pillars, stakeholders and target maturity agreed up front.
Key activities
- Confirm objectives and pillars in scope
- Identify stakeholders and data owners
- Agree testing boundaries and schedule
- Output: Assessment charter
02
- Weeks 1–2
Discover and document
Review of architecture, policies and tooling, supported by structured workshops.
Key activities
- Review architecture and policy documentation
- Run workshops with each pillar owner
- Inventory identity, device and network controls
- Output: Current-state architecture view
03
- Weeks 2–3
Maturity scoring
Each pillar and capability scored against the CISA Zero Trust Maturity Model with supporting evidence.
Key activities
- Score each pillar from Traditional to Optimal
- Collect configuration evidence
- Map gaps to NIST SP 800-207 tenets
- Output: Evidence-backed maturity baseline
04
- Weeks 3–4
Control validation
Hands-on testing confirms whether key controls enforce Zero Trust principles in practice.
Key activities
- Test conditional access and MFA bypass
- Attempt lateral movement across segments
- Test unmanaged device and token misuse
- Output: Validated control gaps
05
- Weeks 4–5
Roadmap and debrief
Target state, prioritised roadmap and a live walkthrough with security and leadership teams.
Key activities
- Define target maturity per pillar
- Sequence initiatives into a phased roadmap
- Present findings to leadership
- Output: Report, roadmap and debrief
06
- After implementation
Track and reassess
Advisory support and reassessment to confirm maturity gains and closed gaps.
Key activities
- Advisory support during implementation
- Retest remediated control gaps
- Updated maturity scores
- Output: Reassessment report
Effort distribution
Where the assessment time goes
Time is balanced between understanding your architecture, scoring maturity with evidence and testing the controls that matter most. Percentages are indicative for a typical assessment.
Quality built into every phase
Evidence behind every score
Ratings rest on configuration and test evidence, not opinion.
Vendor neutral
Advice fits your existing tools and risk.
Agreed rules of engagement
Control testing stays within agreed limits.
Progress confirmed
Reassessment shows real maturity gains.
Engagement models
Choose the Assessment Depth That Fits Your Journey
Every option uses the same framework. The difference is how much evidence we gather and how deeply we test.
Readiness review
Workshop-led review of strategy, architecture and policies against NIST SP 800-207. Best for organisations starting their Zero Trust programme.
Maturity assessment
Evidence-based scoring of every CISA pillar with a prioritised roadmap. Best for programmes that need a measurable baseline and plan.
Validated assessment
Full maturity assessment plus offensive testing of identity, device and segmentation controls. Best for mature programmes and high-risk environments.
Not sure which approach you need?
Our specialists will recommend a scope based on your architecture, current investments and business priorities.
Deliverables
Reports Built for Leadership, Engineering and Auditors
Clear business context for decision-makers, precise technical detail for architects and engineers, and evidence your auditors can rely on.
Executive summary
Overall Zero Trust maturity, key themes and business risk in plain language for leadership and boards.
Maturity scorecard
Current and target maturity for every pillar and cross-cutting capability, with supporting evidence.
Zero Trust roadmap
Phased, prioritised initiatives with dependencies, owners and quick wins identified.
Reassessment report
Independent confirmation of progress and closed gaps, ready to share with boards and auditors.
Supports your compliance and assurance requirements
- NIST SP 800-207
- CISA ZTMM
- ISO/IEC 27001
- SOC 2
- PCI DSS
- NIST CSF 2.0
- DPDP Act 2023
- CERT-In guidelines
- RBI guidelines
- GDPR
iSpyCyber provides independent security testing that supports these requirements. Certification and attestation are issued by accredited bodies and licensed auditors.
Zero Trust assessment for every industry
The basics
What is a Zero Trust architecture assessment?
It is a structured review of how well your organisation applies Zero Trust principles, measured against NIST SP 800-207 and the CISA Zero Trust Maturity Model, with hands-on testing to confirm that key controls work as intended.
What are the CISA Zero Trust pillars?
The CISA Zero Trust Maturity Model defines five pillars: identity, devices, networks, applications and workloads, and data. They are supported by cross-cutting capabilities for visibility and analytics, automation and orchestration, and governance.
Do we need to have started Zero Trust already?
No. A readiness review is ideal if you are just beginning, while a maturity or validated assessment suits organisations that already have initiatives in place.
Is this tied to a particular vendor?
No. iSpyCyber is vendor neutral. We assess the controls you already have and recommend improvements based on your risk and architecture.
Working with us
How long does an assessment take?
Most assessments take three to six weeks, depending on the size of your environment, the pillars in scope and whether control validation testing is included.
What do we receive at the end?
You receive an executive summary, an evidence-backed maturity scorecard, validated control gaps and a phased roadmap to your target state, followed by a live debrief.
How often should we reassess?
Most clients reassess annually or after major programme milestones, so progress can be measured against the original baseline.
Get started
Never Trust. Always Verify.
Then Prove It Works.
Talk to our specialists about a Zero Trust architecture assessment for your organisation.
- ISO/IEC 27001 and ISO 9001 certified
- 40+ enterprise and government clients
- 15+ countries