Zero Trust Must Go Beyond Login

The National Security Agency is sharpening expectations for how government agencies should achieve zero trust in guidance promoting continuous, behavior-driven security frameworks amid fears that cyberattacks targeting the U.S. government increasingly bypass traditional controls.

See Also: Zero Trust Under Strain as Organizations Favor Just-in-Time Access

The NSA published Friday phase one and phase two zero trust recommendations to help agencies reach what the Department of Defense defines as “target-level zero trust maturity.” The guidance expands on earlier federal frameworks and describes zero trust as an operating model that should persist throughout an entire user or system session.

The agency framed the guidance as an effort to move organizations from discovery to implementation through a series of steps designed to encourage modularity and customizability. The guidance pushes maturity beyond “authenticate, then trust” toward ongoing decisions driven by what the user is doing, what privileges are being requested and what resources are being touched, said Brian Soby, co-founder of the SaaS security firm AppOmni.

The guidance aims to close reported longstanding gaps between agencies’ stated zero trust strategies and how access decisions are actually enforced in real environments. Analysts said one of the most significant shifts in the new guidance is its insistence on continuous evaluation after login, rather than treating authentication as a one-time gate.

“That matters because the attacks that are winning right now are post-auth,” Soby said. He added that – while necessary – device posture and login checks “can be largely performative if you cannot detect abuse happening inside the session [and] inside the application.”

Many agencies still rely on device posture checks or identity verification at the point of access, even as the most damaging attacks now unfold after credentials have already been compromised. The guidance says policy decision and enforcement points should be coordinated across the enterprise to ensure proper coordination.

The NSA guidance leans heavily into behavior-based analytics, urging agencies to move away from more simplistic indicators like login location or device type. Instead, the agency calls for baselining normal activity within applications and detecting anomalies tied to privilege escalation, unusual data access or lateral movement across services.

The guidance is structured to help direct agencies through building their custom zero trust foundations incrementally, aligning identity, device, application, data, network and automation pillars into an enterprise-wide system. The agency said the approach is intended to allow agencies to implement “foundational and advanced activities as applicable and the ability to tailor the [zero trust implementation guidelines] to align with unique goals and restraints.”

While the guidance is formally aimed at national security systems and the defense community, the guidance was also released publicly to allow civilian agencies and industry partners to standardize expectations across the public sector.