CLEAREDFor Open Publicationd

Nov 07, 2022
Department of Defense

OFFICE OF PREPUBLICATION AND SECURITY REVIEW

Version 1.0

Pre-Decisional Draft
UNCLASSIFIED//FOR OFFICIAL USE ONLY

Zero Trust CONOPS

October 21, 2022

Prepared by: ZT PfMO

Change History
VersionDate

1.0

10/21/2022

October 21, 2022

Page(s) Changed

Comments
Initial published versioni

DoD Zero Trust Strategy

Foreword
Our adversaries are in our networks, exfiltrating our data, and exploiting the Department’s users.
The rapid growth of these offensive threats emphasizes the need for the Department of Defense(DoD) to adapt and significantly improve our deterrence strategies and cybersecurity
implementations. Defending DoD networks with high-powered and ever-more sophisticatedperimeter defenses is no longer sufficient for achieving cyber resiliency and securing our informationenterprise that spans geographic borders, interfaces with external partners, and support to millions ofauthorized users, many of which now require access to DoD networks outside traditional boundaries,
such as work from home. To meet these challenges, the DoD requires an enhanced cybersecurity
framework built upon Zero Trust principles that must be adopted across the Department,
enterprise-wide, as quickly as possible as described within this document.
This urgency means that our colleagues, our warfighters, and every member of DoD must adopt
a Zero Trust mindset, regardless of whether they work in technology or cybersecurity or the
Human Resource department. This “never trust, always verify” mindset requires us to takeresponsibility for the security of our devices, applications, assets, and services; users are granted
access to only the data they need and when needed. We all must play a role in combating ouradversaries by acting quickly and correctly to address security threats wherever and wheneverthey arise.
Zero Trust is much more than an IT solution. Zero Trust may include certain products but is nota capability or device that may be bought. The journey to Zero Trust requires all DoD
Components to adopt and integrate Zero Trust capabilities, technologies, solutions, andprocesses across their architectures, systems, and within their budget and execution plans.
Perhaps most importantly, they must also address Zero Trust requirements within their staffing,training, and professional development processes as well.
This Zero Trust strategy, the first of its kind for the Department, provides the necessary
guidance for advancing Zero Trust concept development; gap analysis, requirements
development, implementation, execution decision-making, and ultimately procurement anddeployment of required ZT capabilities and activities which will have meaningful andmeasurable cybersecurity impacts upon adversaries. Importantly, this document serves only as a
strategy, not a solution architecture. Zero Trust Solution Architectures can and should bedesigned and guided by the details found within this document.
In January 2022, the Department established the DoD Zero Trust Portfolio Management Office(ZT PfMO) within the DoD CIO, to orchestrate the DoD efforts outlined in this DoD Zero Trust
Strategy document and to accelerate ZT adoption through several courses of action. Recognizingthat the starting point for Zero Trust and maturity levels varies between components, Components

October 21, 2022

ii

DoD Zero Trust Strategy

must align their ZT solution architectures and execution plans accordingly to this strategy so that
overall DoD Enterprise ZT outcomes are achieved and in alignment to the DoD ZT PfMO schedule.
We must adapt, remain agile, and execute on synchronizing Zero Trust efforts across andthroughout the Department. If we do not do this together, our teammates' vulnerabilities willremain exposed and open to attack, which makes all of us less strong. We need to make certainthat when malicious actors attempt to breach our Zero Trust defenses; they can no longer roam
freely through our networks and threaten our ability to deliver maximum support to thewarfighter.

October 21, 2022

ll1

DoD Zero Trust Strategy

Executive Summary"Incremental improvements will not give us the security we need; instead, theFederal Government needs to make bold changes and significant investments inorder to defend the vital institutions that underpin the American way of life."— Executive Order on Improving the Nation’s Cybersecurity 12 May 2021

Five Years into the Future
The Department of Defense's (DoD) risk-based Zero Trust Framework employed across the Joint
Force and the defense ecosystem protects our information systems 1 from increasingly sophisticatedattacks as our adversaries seek to affect our warfighters and DoD mission success. Zero Trustprinciples are now integrated into each of the five cybersecurity functions that represent key elementsof a successful and holistic cybersecurity program – Identify, Protect, Detect, Respond, andRecover. 2 As a result, DoD will successfully mitigate attempts to deny, degrade, disrupt, deceive, or
destroy our information systems. Operators at all levels are confident that the data accessed, theassets deployed, the applications used, and the services provided are secured and resilient.

Today
The Department's Information Enterprise is under wide scale and persistent attack from known andunknown malicious actors. The Department’s most consequential strategic competitor and the pacing
challenge for the Department, the People’s Republic of China, 3 as well as other state-sponsoredadversaries and individual malicious actors often breach the Department’s defensive perimeter androam freely within our information systems. The Department must act now.
Vulnerabilities exposed by data breaches inside and outside the Department of Defense demonstrate
the need for a new, more robust cybersecurity framework that facilitates well-informed risk-based
decisions. 4 Zero Trust security eliminates the traditional idea of perimeters, trusted networks,
devices, personas, or processes and shifts to multi-attribute-based levels of confidence that enable
authentication and authorization policies founded on the concept of least privileged access.
Implementing the Zero Trust Framework requires designing a more efficient architecture thatenhances security, the user experience, and overall mission performance.
Zero Trust uses continuous multi-factor authentication, micro-segmentation, advanced encryption,
endpoint security, analytics, and robust auditing, among other capabilities, to fortify data,

Information system includes “a discrete set of information resources organized for the collection, processing,maintenance, use, sharing, dissemination, or disposition of information”. See DoD Instruction (DoDI) 5000.82,
Acquisition of Information Technology (IT), 21 Apr 2020, p. 17.
2
See US National Institute of Standards and Technology (NIST), Special Publication 1271, Getting Started with the
NIST Cybersecurity Framework: A Quick Start Guide, 6 August 2021, for descriptions of cybersecurity corefunctions and a set of guidelines for mitigating organizational cybersecurity risks.
3
Fact Sheet: 2022 National Defense Strategy, 28 March 2022.
4
Risk” refers to probability of an undesired event or condition and 2) the consequences, impact, or severity of theundesired event, were it to occur. See DoD Risk, Issue, and Opportunity Management Guide for Defense Acquisition
Programs, January 2017, p. 3
1

October 21, 2022

iv

DoD Zero Trust Strategy

applications, assets, and services to deliver cyber resiliency. The Department is evolving to become amore agile, more mobile, cloud-supported workforce, collaborating with the entirety of DoD
enterprise, including federal and non-federal organizations and mission partners working on a varietyof missions. The Zero Trust Framework will reduce the attack surface, reduce risk, offer
opportunities to manage the full range of risks (e.g., policy, programming, budgeting, execution,
cybersecurity-specific, and others) and enable more effective data-sharing in partnershipenvironments. It will also ensure that any adversary damage is quickly contained and remediated if a
device, network, user, or credential is compromised.
This strategy lays out the Department's vision for Zero Trust and sets a path to achieve it. It includes
the strategic assumptions and principles that will inform and guide the adoption of ZT and thestrategic goals and objectives. The four strategic goals outlined in this strategy are: 1. Zero Trust
Culture Adoption, 2. DoD Information Systems Secured and Defended, 3. Technology Acceleration,and 4. Zero Trust Enablement. The strategy also refers to the seven DoD Zero Trust Pillars, which isthe basis for the strategy's Zero Trust Capability Roadmap, a capabilities-based execution plan, andthe DoD Zero Trust and Cybersecurity Reference Architectures. Finally, this strategy provides highlevel guidance on resourcing and acquisition, measurement and metrics, and governance. The
appendices include strategic and execution milestones, as well as references and definitions.
To accelerate Zero Trust implementation within the DoD Information Enterprise, the Department
must continue to examine how to streamline and enforce resource priorities to meet the requirements
envisioned by this strategy. In January 2022, the DoD CIO established a Zero Trust Portfolio
Management Office (PfMO) to orchestrate DoD-wide Zero Trust execution, simplify and streamline
existing policies and coordinate the prioritization of resources to accelerate Zero Trust adoption
within the DODIN enterprise.
Figure 1 below depicts a concise view of the vision, goals, and objectives the Department willachieve by implementing the strategy. 5

5

See Figure 4 in this document for an outcome description of each goal and objective.

October 21, 2022v

DoD Zero Trust Strategy

Figure 1. DoD Zero Trust Strategy-at-a-Glance

October 21, 2022

vi

DoD Zero Trust Strategy

Contents
Executive Summary ............................................................................................................................ iv
Introduction .......................................................................................................................................... 1
Vision..................................................................................................................................................... 4
DoD Zero Trust Approach .................................................................................................................. 7
Strategic Assumptions ......................................................................................................................... 7
Strategic Goals and Objectives ......................................................................................................... 11
Execution Approach .......................................................................................................................... 14
Summary ............................................................................................................................................. 21
APPENDIX A: DoD Zero Trust Capabilities (Target & Advanced Levels) ................................ 22
APPENDIX B: DoD Zero Trust Activities (Target & Advanced Levels) ..................................... 23
APPENDIX C: DoD Zero Trust Capability Roadmap (by Fiscal Year) ...................................... 24
APPENDIX D: DoD Zero Trust Strategic and Execution Milestones (FY2023 – FY2024) ........ 25
APPENDIX E: References ................................................................................................................ 26
APPENDIX F: Acronyms / Definitions ............................................................................................ 28

October 21, 2022

vii

DoD Zero Trust Strategy

Introduction
This Zero Trust Strategy defines an adaptive approach for how DoD must champion and accelerate
the shift to a Zero Trust architecture and framework that secures and protects DoD Information
Enterprise (IE) 6 within the Joint Information Environment (JIE) 7 and specifically the DoD
Information Network (DODIN). 8 The intent of the strategy is to establish the parameters and target
levels necessary to achieve Zero Trust (ZT) adoption across systems and networks (e.g., Nonclassified Internet Protocol Router Network (NIPRNet) and Secret Internet Protocol Router Network(SIPRNet)). This approach emphasizes the need for DoD and its Components 9 to embrace
evolving technology while adapting and responding to known and unknown malicious actors. It
involves the full breadth of stakeholders in the DoD ZT Ecosystem 10 and allows strategic
implementation to begin immediately.
Zero Trust is the term for an “evolving set of cybersecurity paradigms that move defenses from static,
network-based perimeters to focus on users, assets, and resources." 11 At its core, ZT assumes noimplicit trust is granted to assets or users based solely on their physical or network location (i.e.,
local area networks versus the Internet) or asset ownership (enterprise or personally owned). 12 This
shift in philosophy is a significant change in legacy authentication and security mechanisms. It also
represents a major cultural change that stakeholders throughout the DoD ZT Ecosystem, including
the Defense Industrial Base (DIB), will need to embrace and execute beginning with FY2023 throughFY2027 and in the future.

DoD Directive (DoDD) 8000.01, Chg 1; Management of the Department of Defense Information Enterprise (DoD
IE), Section 3(d), 17 July 2017, defines the DoD IE to include: “the DoD information network infrastructure, DoD
enterprise IT service and solutions, National Security Systems, Industrial Control Systems, andembedded computing of wired, wireless, mobile communication, and platforms.”
7
DoD Digital Modernization Strategy, 5 June 2019, pp. 35 -36 defines the Joint Information Environment (JIE) as“a framework comprising a set of discrete initiatives developed and delivered as funded to support continual,comprehensive Department-wide IT Modernization and advance DoD information superiority in a common,
coordinated way.” It also notes “the JIE also includes deployed tactical components that are designed to work withcore infrastructure and also operate autonomously, should connectivity to the core JIE be lost or denied.”
8
Joint Publication 6-0 Joint Communications System, 10 June 2015, Incorporating Change 1, 04 October 2019,
defines DODIN as “The set of information capabilities and associated processes for collecting, processing, storing,
disseminating, and managing information on demand to warfighters, policy makers, and support personnel, whether
interconnected or stand-alone.”
9
IBID defines DoD Components as the Office of the Secretary of Defense, the Military Departments, the Office of
the Chairman of the Joint Chiefs of Staff and the Joint Staff, the Combatant Commands, the Office of the Inspector
General of the Department of Defense, the Defense Agencies, the DoD Field Activities, and all other organizational
entities within DoD.
10
See Appendix F for definition of DoD ZT Ecosystem, which consists of the breadth of DoD leaders, mission
owners, and partners (internal and external) who are key stakeholders to successfully implement Zero Trust acrossthe Information Enterprise (IE).
11
The DoD defines Zero Trust in accordance with NIST SP 800-207, Zero Trust Architecture, August 2020, p. ii.
12
IBID.
6

1

DoD Zero Trust Strategy

This strategy also highlights DoD CIO-led efforts, through the ZT Portfolio Management Office(PfMO), to accelerate ZT as part of its responsibilities for all matters relating to the DoD IE: 13 1)
Component information network infrastructure; 2) DoD enterprise IT service and solutions; 3)
National Security Systems; 14 4) Industrial Control Systems; 5) and embedded computing of wired,wireless, mobile communication, and platforms. 15

Strategic Context
Warfighter missions demand secure, interoperable
information systems. The intended outcomes and actionsof the DoD ZT Framework 16 must support and enhance
warfighter mission-critical priorities at all levels of the
Department and align with the DoD National Defense
Strategy. These outcomes and actions must be applied
across all military multi-domain operations (cyber, space,
air, ground, and sea) and supporting business assets. As
coalition warfare becomes increasingly prevalent,interoperability of the DoD IE, with coalition networks,

Trusted Interoperability Data for
Warfighters
Military targeteers need secure accessto data at the speed of relevance they
can use and trust. Warfighters need totarget the right adversaries, accurately,while minimizing civilian and othercasualties. Today, DoD data is often
siloed, in impractical formats, and not
fully vetted or secured from point oforigin to use. The execution of Zero
Trust provides targeteers trusted,tagged, and labeled data so they canconfidently employ and share it withtrusted partners, assured that the data
is protected, secure, and accessed byonly the people who need it, when
they need it, using least privilege
principles.

DoDD 5144.02, Chg 1: DoD Chief Information Officer, Section 3, 19 September 2017, notes “The DoD CIO is
responsible for all matters relating to the DoD information enterprise, including communications; spectrum
management; network policy and standards; information systems; cybersecurity; positioning, navigation, and timing(PNT) policy; and the DoD information enterprise that supports DoD command and control (C2).”
14
Although applicable to all the DoD, including Components that own and operate National Security Systems(NSS), this Strategy does not impact the authority and responsibilities of the Director of the National Security
Agency (NSA) in connection with the National Manager responsibilities for NSS assigned to the Director of the
NSA by National Security Directive 42 (NSD-42), National Policy for the Security of National Security
Telecommunications and Information Systems, 5 July 1990. The NSS National Manager rather than the DoD sets
NSS Zero Trust guidance.
15
DoDD 8000.01, Chg 1; Management of the Department of Defense Information Enterprise (DoD IE), Section
3(d), 17 July 2017, directs that all aspects of the IE “will be planned, designed, developed, architected, configured,acquired, managed, operated, and protected in order to help achieve an information advantage and full spectrum
superiority, deliver mission assurance, improve mission effectiveness, and realize IT efficiencies.” Available at
16
For purposes of this Strategy, the DoD ZT Framework is defined as “an official cybersecurity blueprint, based on
the seven DoD Zero Trust Capability Pillars, which describes how the Department will achieve ZT by providing thefoundation and the direction to help align on-going and future ZT-related efforts, investments and initiatives”. See
13

2

DoD Zero Trust Strategy

is critical. 17 ZT enables information dominance across the communications spectrum in thetactical environment by ensuring the security of data, applications, assets and services (DAAS).
Execution plans must account for the potential ramifications of ZT in the tactical environment.
Mission impacts and vulnerabilities exposed by breaches and threats from inside and outside
DoD and its Components, near-peer adversaries, geopolitical changes, and disruptive events,
such as the global COVID pandemic, increase cybersecurity risks and the need for more
resilient, scalable, and multi-disciplinary cybersecurity defense.
DoD's migration to increased remote work, an unprecedented technology refresh while divestingoutdated technologies, shifts to artificial intelligence and cloud-based technologies complicate
these trends. Advances in technology amplify the means to exfiltrate sensitive data from DoD
and National Security Systems (NSS) and allow malicious actors the potential to inflict serious
damage to DoD’s information environment. These factors, combined with the expansion ofpartner relationships, create opportunities for malicious actors, using limited technical resources,
to impact national security.
Cyber threats and attacks are evolving at an ever-increasing pace and requiring a coordinated,defensive response that is adaptive, flexible, and agile. 18 Traditional perimeter or "castle-andmoat" security approaches based on conventional authentication and authorization models do
not work effectively to thwart current (and future) cyber-attack vectors. Mission and systemowners, as well as operators, increasingly embrace this view as fact. They also see the journey to
ZT as an opportunity to affect positively the mission by addressing technology modernizations,refining security processes, and improving operational performance.
Recognizing the need to address these cybersecurity challenges, the U.S. Federal Government ismoving to a Zero Trust Architecture. 19 The DoD Zero Trust Strategy aligns with and responds to thisExecutive-level guidance for the Department. For example, the Executive Order on Improving the
Nation's Cybersecurity (EO 14028) (12 May 2021), the National Defense Authorization Act for
Fiscal Year 2022 (27 December 2021), the Federal Zero Trust Architecture Strategy (26 Jan 2022),
National Security Memorandum-8, Improving the Cybersecurity of National Security, Department of
Defense, and Intelligence Community Systems (19 January 2022), and numerous memoranda fromthe NSS National Manager directing all NSS’s move to Zero Trust and act now. 20

Appendix F.
17
Mission partner environment (MPE) initiatives and secret and below releasable environment (SABRE) software
seek to achieve network interoperability with coalition partners. See “Mission Partner Environment Cuts Decision
Making, Kill Chain,” DoD News, 29 November 2021.
18
See the classified 2018 DoD Cyber Strategy for further details on the strategic environment.
19
Office of Management and Budget (OMB) Memorandum M-22-09,“Moving the U.S. Government Toward Zero
Trust Cybersecurity Principles,” 26 January 2022.
20
Executive Order on Improving the Nation’s Cybersecurity (EO 14028), 12 May 2021; National Defense
Authorization Act for Fiscal Year 2022, 27 December 2021; OMB M-22-09, 26 January 2022; National Defense
Strategy, 22 March 2022; National Security Memorandum 8, Task 3: National Manager for National Security
Systems Requirement Exception Provision Process (NMM-2022-03),” 25 February 2022, and others.

3

DoD Zero Trust Strategy

The DoD Zero Trust Strategy is part of a family of strategies depicted in Figure 2 below.21
Figure 2. Alignment with National and DoD Strategies

The DoD Zero Trust Strategy also provides the foundation for refinements to the DoD Cybersecurity
Reference Architecture (CS RA) 22 and DoD Zero Trust Reference Architecture Version 2.0 (ZT RA
v2.0) 23, as well as Component-level strategies and ZT execution plans.

VisionDoD Zero Trust Strategic Vision
A DoD Information Enterprise secured by a fully implemented, Department-wide Zero Trust
cybersecurity framework.
The Department envisions a scalable, resilient, auditable, and defendable environment centered on
securing and protecting all DoD DAAS in cyberspace.
This strategy establishes the ZT goals and objectives needed within the five-year planning horizon of
the Future Years Defense Program (FYDP) starting in FY2023 to FY2027 and beyond. To accelerate
the adoption of the full set of ZT capabilities, the Department is also considering several courses of

DoD CIO releases an annual update to the Capability Planning Guidance (CPG) which supports each of thestrategies identified. There are two additional strategies in draft format as of this publication: Information Security
Continuous Monitoring (ISCM) and Endpoint Security (ES).
22
DoD Cyber Security Reference Architecture, version 4.2, approval, January 2022.
23
DoD ZT RA v2.0, July 2022.
21

4

DoD Zero Trust Strategy

action (COAs) to include commercial and Government-owned cloud-based enterprise services. Theseand other adoption acceleration opportunities, including compressed or accelerated execution
timelines, will be iteratively defined, developed, and deployed as part of future strategy execution.
The DoD IE and, specifically, the DODIN's cybersecurity capabilities must be able to prevent
malicious actors from affecting DoD’s ability to detect, deter, deny, defend, and recover frommalicious cyber activity across all operational environments.
The Target Level ZT 24 is the minimum set of ZT capability outcomes and activities necessary tosecure and protect the Department's DAAS to manage risks from currently known threats. While theDoD ZT Framework will mature and adapt over time, the current strategic context dictates animmediate focus on expediting investments in core ZT capabilities and technologies. The Department
and its Components must achieve the Target Level ZT as soon as possible.
With the Target Level ZT achieved, the ZT PfMO will monitor continued compliance and guide
movement to Advanced ZT as DoD mitigates current risks. Based on the need to continue theevolution towards a next-generation security architecture and address new threats as malicious actors
adjust to DoD’s improved security posture, the ZT PfMO may also modify how this strategy defines
the Target Level ZT. Using a phased approach to achieve all targeted ZT capabilities will makerealizing the Vision of the DoD Zero Trust Strategy possible.

Capabilities and activities required to achieve Target Level are depicted in Appendix A-D; includes basic andintermediate Zero Trust maturity as defined by the ZT RA.
24

5

DoD Zero Trust Strategy

Strategic Outcomes
Achieving the DoD Zero Trust Strategy results in several significant benefits to the Department, its
Components, its partners, and most importantly – the warfighter – in executing missions.
These benefits include:
•

•

•

•

•

•

•

The ability of a user to access required data fromanywhere, from any authorized and authenticateduser and device, fully secured.
Secured and protected information systems
facilitating the Department's evolution into a
more agile, more mobile, cloud-supported
workforce.
Reduced attack surface risk profiles throughprotective actions enabled by micro
segmentation of the DoD IE.
Threats to Cloud, Artificial Intelligence (AI),and Command, Control, Communications,
Computers, and Intelligence (C4I) remediatedthrough risk-based cybersecurity protocols andpolicies.
Effective damage containment, mitigation, andremediation when a device, network, user, or
credential is compromised.
Consistent, aligned, and effectively resourced
ZT capabilities for advanced cybersecurity
operations.
A resilient DoD IE that recovers rapidly fromattacks and minimizes damage throughenablement of ZT.

6

Increasing Accessibility:
User Checks and Balances
Challenge: Warfighter interoperability andmissions require a wide spectrum of partners,
including DIB users, to access DoD networks
safely and securely. Authorization to be on andauthentication to get onto networks both need tooccur. Simultaneously, DoD must institutesafeguards to keep malicious actors out –whether state-sponsored seeking intellectual
property or persons with malicious intentions.
Pre-ZT Architectures: Attempts to “lockdown” networks (e.g., from certain locations ortime periods) and/or to overly restrict access toessential data (e.g., data base or file restrictions)hinder collaboration between DIB users. This
increasingly occurs out of an abundance of
caution to keep malicious actors out – andimpacts interoperability at all mission levels.
Post-ZT Architectures: Adoption of a new, Zero
Trust cybersecurity approach results in an effective
set of checks and balances. DIB users locatedoverseas and working outside “normal” businesshours now can quickly gain authorization to accessa sensitive network once they are authorized andauthenticated successfully. This enables partners toaccess data WHEREVER and WHENEVER
needed.

DoD Zero Trust Strategy

DoD Zero Trust Approach
The approach to adopt and accelerate the DoD ZT Framework includes a set of key assumptions andprinciples that guide execution of the strategy. This Framework outlines an official blueprint tomodernize cybersecurity for the DODIN enterprise NIPRNet and SIPRNet. This Framework, basedon the seven DoD Zero Trust Pillars, describes how the Department will achieve ZT by providing thefoundation and the direction to help align ongoing and future ZT-related efforts, investments, andinitiatives across all elements of Doctrine, Organization, Training, materiel, Leadership and
Education, Personnel, Facilities, and Policy (DOTmLPF-P). This strategy recognizes that the
adoption of ZT will require changes in DOTmLPF-P not only across the Department but also in its
Components, to be addressed in their ZT execution plans.

Strategic Assumptions
The following core assumptions drive Department-wideplanning for the successful implementation of ZT. 25
•

•

•

25
26

Increasing Interoperability:
Secured Network Communications

Complex Security Threats Persist. DoD andComplex and fragmented information
systems environments plague
Components must accelerate ZT implementation andWarfighters on the ground. The
migrate DoD environments to the ZT Framework asvarying controls, inconsistent policies,
quickly as possible to proactively stay ahead of all
and manual processes make obtaining
threat actors and hostile environments, including cyberaccess to the applications and datacriminals, nation-state sponsored disrupters, andthey need to support us in the fight a
malicious insiders. As DoD mitigates current
long and cumbersome process. Zeroweaknesses, new threats will always develop,
Trust-based Department architectures,
communications and other networks
necessitating course corrections and the ongoingusedby our warfighter Coalition
necessity of Zero Trust “station-keeping” to maintainpartners will enhance connectivity
maximum Zero Trust discipline in a strategic andacross our Joint Force Command andtactical sense.
Control environments, enable rapid
Culture, not just Technology. How The Department
integration of communications
protects and secures the DoD IE is not solvable bysystems, and facilitate access andsharing of large volumes of secure,technology alone; it requires a change in mindset andactionable data.
culture, from DoD leadership down to mission operators,
spanning all users of the DoD IE.
Modernization Requires Rethinking. “Implementing ZT requires rethinking how weutilize existing infrastructure to implement security by design in a simpler and more efficientway,” 26 all while improving warfighter performance, increasing interoperability, andenabling unimpeded operations and resiliency.

See DoD ZT RA, v2.0 for additional design-level assumptions and constraints (Section 1.7 – 1.9, pp. 19-20).
DoD ZT RA, v2.0, July 2022 (Section 2.1, p.20)

7

DoD Zero Trust Strategy

•

•

•

•

Increasing Global and Industry Partner Collaboration. Access to mission information
systems and mission partner interoperability are becoming increasingly important as the DIB andforeign partners are significant to coalition warfare and the Joint Warfighting Concept (JWC). 27
Information and data must be effectively shared, accessed and protected based on user attributes,
operational need, and delivered by least privilege policies.
Concurrent Enterprise and Mission Owner Implementation. ZT must be implemented
concurrently across all levels of the Department, enterprise-wide and orchestrated across DoD
and its Components to preclude mission, organizational, governance, and technical silos. ZT
must be driven by a unified Enterprise policy that accounts for varied capabilities and associateddecisions across the combination of both Enterprise-level and Mission Owner-level interests.
Real-time, Risk-based Response. ZT accelerates theUnderstanding What Devices Needshift from compliance-based to risk-based security
Protected
approaches as the complexity of threats andChallenge: The expansion in the number
vulnerabilities increases. This acceleration is imperativeof devices, machines, and other NPEs on
to address future performance and interoperability
the DODIN combined with the significant
challenge of verifying changes to
expectations for initiatives such as JADC2.
hardware, firmware, and software
Legacy IT Remains a Challenge. Not every legacy
increases daily.
infrastructure and system will require or justify an
Pre-ZT: The absence of a robust, modern
immediate and/or complete ZT retrofit. However,cybersecurity strategy puts systems
appropriate security controls must be designed andadministrators in an unenviable position of
enforced to counter new cyber attack vectors andconstant worry. They do not fully understandwhat is on the network nor are they able toemerging threats until a full rationalization of those
ensure those devices do not threaten thesystems can be conducted to either eliminate or
security and functionality of transport
modernize accordingly. 28
services.
Leadership and Operator Buy-in. Clear direction
Post-ZT: Now that ZT is fully implemented
and adoption across the ZT Ecosystem, fromacross the DODIN, all NPEs are checked andtechnical, DOTmLPF-P, and functional leaders toverified at multiple points prior to them being
allowed to get onto or remain connected tooperators of the information systems, is vital for a
the system. Systems Administrators now
successful enterprise ZT strategy.

Strategic Principles
A series of guiding principles provide guardrails or
parameters for DoD and Component leaders when
making decisions regarding how best to implement thestrategy and execute the ZT Capability Execution

check that everything on the network is
appropriately patched and updated, nothinghas been unknowingly changed or modified,and everything on the network is fully
enrolled. Because this is done on a real-time,
automatic basis, systems administrators can
now focus on items of highest-risk and havea fighting chance to stay ahead of threats asthey mutate and/or persist.

Joint All Domain Command and Control (JADC2), Mission Partner Environment (MPE) and several otherinitiatives support the JWC.
28
For infrastructure or systems unable to comply with mandated ZT adoption, Components and system owners must
submit on an annual basis any request for waiver to the ZT PfMO for DoD CIO approval. See “Execution
Approach” (page 16 in this document) for additional information. In addition, per the 2022 National Defense
Authorization Act “ Not later than 270 days after the date of the enactment of this Act, the Secretaries of the Army,
Navy, and Air Force shall each initiate efforts to identify legacy applications, software, and information technology
with their respective Departments and eliminate any such application, software, or information technology that is nolonger required.”27

8

DoD Zero Trust Strategy

Roadmap. These principles will guide the creation and revision of strategy, policy, design, andexecution documents.
•

•

•

•

Mission-Oriented– Hybrid Work and Location Agnostic. All users and non-person entities (NPEs) must access,collaborate, work, and execute missions on any network where they both have the need andright to access, governed with least privilege, from any location, based on dynamic
credentials, governed by principles of least privilege and safeguarding information.
Organizational– Presume Breach. Limit the "blast radius" – the extent and reach of potential damage incurredby a breach – by segmenting access, reducing the attack surface, and monitoring risks in realtime within DoD's risk tolerance levels and thresholds. 29– Incorporate DOTmLPF-P. The design, development, deployment, and operations of ZT
capabilities must account for changes and/or additions to how DoD Components execute ZT
across elements of DOTmLPF-P. 30
Governance– Simplify and Automate. Establish appropriate governance controls that continuously
modernize the existing fragmented approaches to data management, IT modernization, andcybersecurity policies and solutions.
– Never Trust, Always Verify Explicitly. Treat every user, device, and application as untrusted
and unauthenticated. Authenticate and explicitly authorize to the least privilege using
dynamic security policies.
Technical– Least Privilege. "Subject/entity should be given only those privileges needed for it tocomplete its task”. 31– Scrutinize and Analyze Behavior. All events within our IE must be continuously monitored,
collected, stored, and analyzed based on risk profiles and generated in near-real time for bothuser and device behaviors.
– Architectural Alignment. ZT design and architectures must align with the DoD Zero Trust
Reference Architecture (ZT RA) design tenets 32 and Committee on National Security“Presume Breach” is defined as “Consciously operate and defend resources with the assumption that an adversary
has presence within your environment. Enhanced scrutiny of access and authorization decisions to improve response
outcomes”. See DoD ZT RA v2.0, July 2022, p. 21.
30
DOTmLPF-P analysis is the first step in Functional Solutions Analysis. It determines/recommends if a nonmaterial approach or a material approach is required to fill a capability gap identified in the Functional Needs
Analysis.
31
The concept of least privileged access" refers to eliminating "the idea of trusted or untrusted networks, devices,personas, or processes, and shifts to multi-attribute-based confidence levels that enable authentication andauthorization policies.” See DoD ZT RA v 2.0, July 2022 v. 2 p. 14.
32
DoD ZT RA, v.2.0, p.21 delineates five (5) tenets that represent the foundational elements and influence all aspects
with ZT. These include: 1) Assume a Hostile Environment; 2) Presume Breach; 3) Never Trust, Aways Verify; 4)
Scrutinize Explicitly; and 5) Apply Unified Analytics.
29

9

DoD Zero Trust Strategy

–Systems Policy 21 (CNSSP 21), and account for the National Institute of Standards andTechnology's (NIST) ZT tenets. 33
Reduce Complexity. Align technical and security programs with ZT goals and mission
objectives to streamline regulations and standards for managing security and risk.

DoD Zero Trust Pillars
Zero Trust capabilities across the IE must be developed, deployed, and operated within an organizing
construct defined by seven DoD Zero Trust Pillars and their enablers to ensure standardization of
execution. These pillars, as depicted in Figure 3, provide the foundational areas for the DoD Zero
Trust Security Model and the DoD Zero Trust Architecture. 34 The execution enablers are crosscutting, non-technical capabilities and activities that address culture, governance, and elements of
DOTmLPF-P (e.g., ZT Training, etc.). 35 This ZT security model re-thinks the implementation of
security access to resources and is determined by dynamic policy, including observable state of user
Figure 3. DoD Zero Trust Pillars

33
The seven tenets of zero trust are outlined in the National Institute of Standards and Technology (NIST) Special
Publication (SP) 800-207, Zero Trust Architecture, p. 6. These include: 1) All data sources and computing services
are considered resources; 2) All communication is secured regardless of network location; 3) Access to individual
enterprise resources is granted on a per-session basis; 4) Access to resources is determined by dynamic policy; 5)
The enterprise monitors and measures the integrity and security posture of all owned and associated assets; 6) All
resource authentication and authorization are dynamic and strictly enforced before access is allowed; 7) The
enterprise collects as much information as possible about the current state of assets, network infrastructure, andcommunications and uses it to improve its security posture.
34
See the DoD ZT RA, v2.0, Sections 2.2 – 2.3, pp. 20 - 23 for a more detailed explanation of the DoD ZT Security
Model, the strategic benefit for each pillar and the intended result of all seven pillars working together.
35
Details regarding supporting enablers will be further refined and integrated into next versions of the DoD ZTCapability Roadmap and addressed in implementation plans. Enablers identified to-date include: ZT Awareness &Culture, Adaptive Implementation Governance, ZT Policy Framework, ZT Training, and others.

10

DoD Zero Trust Strategy

and endpoint identity, application/service, and the requesting asset. All capabilities within the Pillars
must work together in an integrated fashion to secure effectively the Data Pillar, which is central tothe model.

Strategic Goals and Objectives
The four high-level strategic goals and their corresponding objectives define what the Department
will do to achieve its vision for ZT. 36 These goals are synergistic and address the cultural,technological, and environmental requirements for the successful adoption and implementation of
ZT. They align with and informed by the strategic assumptions, priorities, and principles. Each goalin Table 1 has accompanying SMART (specific, measurable, achievable, relevant, and time-bound)objectives that direct what specific actions Mission Owners at all levels must do. 37
Table 1. Key Benefits of Realizing ZT Strategic Goals & Objectives
Goal

Impact to Warfighters / DoD / Components & Partners

1: Zero Trust
Cultural
Adoption•••

A cybersecurity-minded culture and workforce that embraces ZT
Increased collaboration and productivity
Increased commitment to cybersecurity

2: DoD
Information
Systems
Secured andDefended••••

Secured communications at all operational levels
Improved systems performance
Interoperable & secured data
Automated cyber and AI operations

3: Technology
Acceleration

•
•
•
•

Continually updated & advanced ZT enabled IT
Reduced silos
Simplified architecture
Efficient data management

4: Zero Trust
Enablement•••

Enhanced operations and support performance
Consistent, aligned, and effectively resourced ZT supporting functions
Speed of ZT acquisition-to-deployed capability

The strategic goals and corresponding objectives as listed are not prioritized. Rather, each needs to beaccomplished to meet the ZT Vision.
37
While the objectives prescribe “what” shall be done in furtherance of the goal, they do not prescribe “how,” as
DoD Components may need to undertake objectives in differing ways.
36

11

DoD Zero Trust Strategy

Goal 1: Zero Trust Cultural Adoption. A Zero Trust security framework and mindset thatguides the design, development, integration, and deployment of information technology acrossthe DoD Zero Trust Ecosystem.
All DoD personnel are aware, understand, commit to, and trained to embrace a ZT mindset andculture 38 and support integration of ZT technologies in their environments that includes crosscutting DOTmLPF-P enablers
Goal 2: DoD Information Systems Secured and Defended. DoD cybersecurity practices
incorporate and operationalize Zero Trust to achieve enterprise resilience in DoD information
systems.
Components apply the DoD ZT Framework to all new and legacy information systems andachieve the capability outcomes prescribed by the DoD Zero Trust Capability Roadmap 39 andaligned to the cyber resiliency focus of the National Defense Strategy 2022. Component level
execution plans provided to DoD CIO and Joint Force Headquarters – Defense Information
Networks (JFHQ-DODIN) through the DoD ZT PfMO no later than 23 September 2023 willaddress how Zero Trust is applied across their networks, including all infrastructure andsystems. 40 Additionally, Components must achieve the intended Target level outcomes of each
DoD Zero Trust Capability and execution enabler no later than the end of FY2027. Together,
these outcomes support the strengthening of the joint development, operational testing, andexisting interoperable capabilities that enhance DoD, Mission partner, and warfighter ability tooperate and achieve secure command and control communications from the national level to thewarfighter. 41
Goal 3: Technology Acceleration. Zero Trust-based technologies deploy at a pace equal to or
exceeding industry advancements to remain ahead of the changing threat environment.
The DoD IE and DODIN are secured and defended quickly and effectively (i.e., Goal 2), andinclude the best and most up to date technologies that allow for scaling, amplifying, and failingfast for innovation. The Department and Component architectures align with ZT efforts, include

38
Outcomes of Goal 1 also align with two (2) of the five (5) lines of effort defined in the 2018 DoD Cyber Strategy:“Reform the Department” and “Cultivate Talent.” See Summary: DoD Cyber Strategy, 2018, pp. 5-6.
39
The DoD Zero Trust Capability Roadmap was developed in conjunction with this Strategy.
40
The 2022 National Defense Authorization Act, Section 1528 (d) requires “not later than one year after the
finalization of the zero trust strategy, principles, and model architecture . . . the head of each component of the
Department of Defense shall transmit to the Chief Information Officer of the Department and the Commander of the
Joint Forces Headquarters – Department of Defense Information Network a draft plan to implement such zero trust
strategy, principles, and model architecture across the networks of their respective components and military
departments.” 41 Outcomes of Goal 2 also align with two (2) of the five (5) lines of effort defined in the 2018 DoD
Cyber Strategy: “Build a More Lethal Joint Force” and “Compete and Deter in Cyberspace.” See Summary: DoD
Cyber Strategy, 2018, p. 4.
41
Outcomes of Goal 2 also align with two (2) of the five (5) lines of effort defined in the 2018 DoD Cyber Strategy:“Build a More Lethal Joint Force” and “Compete and Deter in Cyberspace.” See Summary: DoD Cyber Strategy,
2018, p. 4.

12DoD Zero Trust Strategy

development testing, and ensure interoperable standards and assets. These efforts apply acrossthe DoD IE. 42
Goal 4: Zero Trust Enablement. DoD Zero Trust execution integrates with Department-level
and Component-level processes resulting in seamless and coordinated ZT execution.
Processes, policies, and funding are necessary to ensure that the ZT Framework is cemented
across the DoD IE. This means Department-level and Component-level processes and resourcesmust be reimagined or synchronized with ZT principles and approaches. This resourcing issustainable and built-in to adjacent, complementary, and synergistic DoD technology,
information security, and budgeting efforts and initiatives. This goal identifies the "tail" to the
ZT "tooth," the latter being unable to achieve its mission without the former, and requires thewhole of the ZT Ecosystem's attention and effort and cannot be addressed "at a later time." 43
See Figure 4 below for descriptions of the objectives needed to achieve each goal.

42
Outcomes of Goal 3 also align with two (2) of the five (5) lines of effort defined in the 2018 DoD Cyber Strategy:“Build a More Lethal Joint Force” and “Strengthen Alliances and Attract New Partnerships.” See Summary: DoD
Cyber Strategy, 2018, pp. 4-5.
43
Outcomes of Goal 4 also align with one (1) of the five (5) lines of effort defined in the 2018 DoD Cyber Strategy:“Reform the Department.” See Summary: DoD Cyber Strategy, 2018, pp. 5-6.

13

DoD Zero Trust Strategy

Figure 4. DoD Zero Trust Strategy Goals and Objectives
Goals

1. Zero Trust Cultural Adoption

A Zero Trust security framework andmindset that guides the design,development, integration, anddeployment of information technology
across the DoD Zero Trust Ecosystem

1.1 Commitment. Transform DoD
cybersecurity to a ZT frameworkthat is universally understood,
accepted, and embraced by DoD
Components Start: FY2023

Objectives

1.2 Outreach. Conduct acomprehensive ZT outreach
initiative to inform and share datafrom ZT efforts and to define
standards, minimize duplications,emphasize successes, and to
facilitate an open exchange of
information sharing with DoD,
federal, and academia partners by
end of FY2023, and iteratively
updated through FY2027
1.3 Awareness. Implement internaland external communication
campaigns at all levels, including
with the DIB and foreign allies asappropriate, to include
Department-wide advocacy,awareness, and support for the
implementation of the DoD ZTstrategy goals and objectives by end
of FY2023, and iteratively updated
through FY2027
1.4 Workforce. Identify and develop
a cadre of ZT professionals by end
of FY2025
1.5 Training. Embed ZT training
across DoD Components, related
workforce requirements, andcertification standards by end of
FY2024

2. DoD Information Systems
Secured & Defended
DoD cybersecurity practices incorporate
and operationalize Zero Trust toachieve enterprise resilience in DoD
information systems*

2.1 User. Secure, limit, and enforce
strong authentication of person andnon-person entity access
2.2 Device. Identify, inventory,
authorize, authenticate, and patch
all devices continuously and in realtime
2.3 Applications & Workloads.
Secure all applications andworkloads, to include theprotection of containers and virtual
machines
2.4 Data. Enable and secure datatransparency and visibility withenterprise infrastructure,applications, standards, robust
end-to-end encryption, and datatagging
2.5 Network & Environment.
Segment (both logically andphysically), isolate, and control the
network/environment (onpremises and off-premises) with
granular access and policy
restrictions
2.6 Automation & Orchestration.
Automate manual security andother applicable processes to takepolicy-based actions across theenterprise with speed and at scale
2.7 Visibility & Analytics. Analyze
events, activities, and behaviors toderive context and apply AI/ML toachieve models that improvedetection and reaction time inmaking real-time access decisions*Note: See the ZT Capability
Roadmap for timeline to achieve
objectives in this Goal

14

3. Technology Acceleration

4. Zero Trust Enablement

Zero Trust-based technologies deploy ata pace equal to or exceeding industry
advancements to remain ahead of thechanging threat environment

DoD Zero Trust execution integrates
with Department-level and Componentlevel processes resulting in seamlessand coordinated ZT execution

3.1 Capabilities. Achieve intended
outcomes for ZT capabilities alignedwith planned increments as
described in the DoD ZT Capability
Implementation Roadmap throughend of FY2027

4.1 Policy. Establish a unified policy
and other guidance to integrate thelatest tested and provencybersecurity best practices,
standardize management of
requirements, and share bestpractices by end of FY2023 andrefine iteratively through FY2027

3.2 Architecture: Align, update, andmaintain agile-based referencearchitectures and research,development, and engineering
efforts with ZT architecture
principles by end of FY2023
3.3 Interoperability. Ensure thecompatibility and integration of
established institutionalized
standards, leverage assets andknowledge, and ensurecompatibility between DoD
information systems and across theDoD IE by end of FY2024
3.4 Ideation / Innovation. Vet, scale
and amplify emerging practices,concepts, and technologies throughpilots and fast-fail, employing bestpractices and lessons learned, ongoing through FY2027

4.2 Planning. Incorporate ZT
requirements into DoD-wide andComponent-specific strategies,
policies, frameworks, anddirectives, and contracts by end of
FY2023 and next iteration throughFY 2027
4.3 Programming. Align DoD Future
Years Defense Program (FYDP) toadequately support execution of
the ZT Implementation Roadmap by
FY2023 and updated iteratively
through FY2027
4.4 Funding. Resource through the
FYDP process the ZT capabilities,
technologies, and initiatives by end
of FY2027
4.5 Acquisition. Develop a plan toacquire and deploy solutions andtechnologies that advance ZT byearly FY2023 and refine iteratively
through FY2027
4.6 Performance. Measure ZT
capability deployment and maturity
through key performance indicators
and associated metrics to monitor
and advance ZT execution throughFY2027
4.7 Zero Trust PfMO. Mature the ZT
PfMO by end of FY2023 to act as atrusted partner for orchestrating ZT
across the DoD IE and to provide
strategic oversight, execution
direction, and resource priorities toaccelerate ZT adoption

DoD Zero Trust Strategy

Execution Approach
The Department will achieve the ZT goals and objectives at the accelerated pace envisioned throughcontinual, adaptive, and centralized coordination of strategic guidance, resource prioritization, andalignment of enterprise-wide and Component-specific efforts. Achieving these goals and objectives
requires a multi-pronged approach that goes beyond technology solutions to address people,
processes, resources, governance, and risk management, among others. Specifically, the Department
and its Components will plan for and address all elements of ZT DOTmLPF-P solution gaps.
Resources will be aligned to diminish identified gaps and result in the ZT Framework across the
Department that meets national strategic guidance, protects national interest, and reduces malicious
actors. The path to achieving impactful security benefits with ZT is through an iterative process thatmust be continuously refined as the strategic context evolves as DoD and its Components execute
their action plans, and federal guidance evolves. The Department will periodically reevaluate theeffectiveness of its strategy and make course adjustments as needed.
Acting on behalf of the DoD Cyber Council and through applicable DoD offices of primary
responsibility and in coordination with the Components, the Director of the ZT PfMO orchestrates
overall strategy execution. The PfMO will work closely with Components to define, develop, andadapt execution plans to achieve each of the goals and objectives outlined in Figure 4.
The starting point for ZT and maturity levels vary across the DoD IE due to completed, ongoing, andplanned initiatives. Moving forward, Components must align their execution plans to this strategy toachieve the outcomes and identify implementation opportunities and obstacles.
Legacy infrastructure and systems may not require or justify immediate ZT retrofit and depending on
where and how installed, may not comply with mandated ZT adoption. Components and systemowners must submit on an annual basis any request for waiver to the ZT PfMO for DoD CIO
approval based on a pre-defined set of standards designed to ensure maximum security of DoD
networks.
System owners are responsible for executing and enforcing the move to ZT and must understandrisks associated with delaying implementation. Appropriate security controls, including potentialrefinements to how DoD implements the Risk Management Framework (RMF), must be designed
and enforced to counter new attack vectors and emerging threats until a full rationalization of thosesystems can be conducted to either eliminate or modernize accordingly.
In addition, Components must determine their intent to adopt enterprise solutions that comply with
the ZT RA and DoD CIO guidance. To achieve a fully secured and defended DoD IE (Goal 2) the
Department and Components must achieve all ZT capabilities shown in Figure 5.

15

DoD Zero Trust Strategy

Figure 5. DoD Zero Trust Capabilities

The Department and its Components must achieve the DoD “Target Level ZT” as soon as possible.
Target Level ZT includes the minimum set of ZT capability outcomes and activities necessary tosecure and protect the Department's DAAS to manage risks from currently known threats. It is thelevel set by the DoD ZT PfMO to which all of DoD must minimally achieve.
With the Target Level achieved, the ZT PfMO will monitor continued compliance and guide
movement to Advanced ZT as current risks are mitigated. Advanced capabilities include thecomplete set of identified ZT capability outcomes and activities that enable adaptive responses tocybersecurity risk and threats and offer the highest level of protection. Although a limited number ofsystems and DAAS will be specifically required to achieve this advanced level within the timeframeof this strategy, DoD will continue to seek the adoption of the advanced capabilities as outlined inAppendix B and C. Reaching an "advanced" state (Advanced ZT) does not mean an end to maturing
ZT; instead, protection of attack surfaces will continue to adapt and refine as the malicious actors
methods advance and mature.
Based on the need to continue the evolution towards a next-generation security architecture andaddress new threats as malicious actors adjust to the DoD’s improved security posture, the ZT PfMO
may also modify how this strategy defines the Target Level ZT.
Resourcing and acquisition guidance will ensure ZT capabilities and activities are sufficiently
contracted, received and deployed within schedules required for the DoD to meet ZT deployment
timelines across the DODIN enterprise. Strategy measures will provide a means to assess ZT
16

DoD Zero Trust Strategy

execution and effects. The governance concept will delineate roles and decision rights for
implementation.
The DoD Zero Trust Capability Roadmap described in the High-Level Capability Roadmap section
below provides a guide to follow for the DoD baseline course of action (COA). 44 Additionally, toaccelerate Zero Trust adoption, the Department is considering several additional complementary
COAs including commercial and Government-owned cloud-based enterprise services. These andother adoption acceleration opportunities, including compressed or accelerated execution timelines,
will be iteratively defined, developed, evaluated, and deployed as part of future strategy execution.

High-Level Capability Roadmap
The DoD Zero Trust Capability Roadmap describes how the Department currently envisions
achieving the capability-based outcomes and activities sequenced over time to achieve the DoD
Target Level ZT and Advanced ZT. 45 The Roadmap outlines dependencies and interdependencies
affecting sequence and parallel development and provides a general timeline to achieve outcomes by
fiscal year. Figure 6 provides a high-level depiction of a brownfield approach and shows whenoutcomes for each capability by pillar should be achieved, beginning in FY23 with Target Level ZT
achieved by FY27. 46 See Appendices A - D for details on when each ZT capability and supporting
activity should be achieved. Components will determine how (e.g., technologies, solutions, etc.)
these outcomes will be achieved and develop associated action plans.

The DoD Zero Trust Capability Execution Roadmap, v1, developed by the ZT PfMO will be finalized in parallelwith this Strategy in Summer, 2022. The Roadmap includes descriptions of each capability outcome.
45
Although the full set of DoD ZT Capabilities span from target to advanced, some capabilities are achieved at thetarget level, and a few are strictly advanced. The majority of capabilities have associated activities that include bothZT Target Level and Advanced ZT.
46Determination of Target Level and fiscal year projection is based on the DoD Baseline “COA 1” described in the
DoD Zero Trust Capability Execution Roadmap, v1.
44

17

DoD Zero Trust Strategy

Figure 6. DoD Zero Trust Capability by Pillar by Fiscal Year

Resourcing & Acquisition
The ZT PfMO serves as the customer-focused, multi-functional team responsible for orchestrating
and prioritizing ZT-related resources and acquisition decisions for the Department. In alignment, andin collaboration with other relevant DoD stakeholders, the ZT PfMO will develop strategic guidanceand ensure resources are properly managed.

Resourcing
ZT resourcing will be addressed for each organization impacted through a multi-pronged approach;
the DoD CIO's Capability Programming Guidance (CPG) and the Planning, Programming,
Budgeting and Execution (PPBE) process. This will enable each organization to appropriately
identify and prioritize new and existing resources necessary to execute the ZT capability and pillar
outcomes defined above (see High-Level Capability Roadmap). At the Enterprise-level, DoD CIO,
through the ZT PfMO, will guide ZT resource priorities through the annual CPG to ensure that allefforts across the DoD IE are appropriately aligned with the Strategy and Roadmap. DoD CIO will
work with Components to address any Component-level resourcing shortfalls, each fiscal year,
within the annual Program Objective Memorandum (POM) cycle, starting with the next immediate
submission. Additionally, DoD CIO will work with Components to submit requests for new funding
to Congressional appropriators through the regular DoD resourcing processes.

18

DoD Zero Trust Strategy

Acquisition
Developing a ZT acquisition strategy should align with the Department’s priority to build a resilient
Joint Force and defense ecosystem that involves undertaking reforms to accelerate force development
and technology acquisition. 47 DoD CIO will coordinate the identification and determination of theapplications, assets, and services that DoD, or designated executive agents, will procure and acquireat the Enterprise-level. Components will be responsible for the overall management and oversight oftechnology development, acquisition, and product support suitable for their respective missions while
ensuring their strategies align with applicable Enterprise-level strategies.
Market research provides necessary information such as: whether products/services required for an
acquisition are available in the marketplace, how the marketplace is currently implementing thecapabilities, and whether any existing contract vehicles are available to execute and expedite therequirement(s). Additionally, the DIB, as well as research and development labs, Red Teaming, andOperational Test & Evaluation (OT&E) activities, plays a critical role in identifying anddemonstrating potential ZT capabilities and solutions that should also be considered.
Depending on their ZT Execution plans, each Component will be responsible for conducting
additional market research and requirements definition to determine whether they need to revise theircurrent and/or create new acquisition strategies. Acquisition strategies will ultimately identify
existing and/or the need to create new, contract mechanisms to make this a reality.
This ZT strategy does not mandate or prescribe specific technologies or potential solutions. Rather, it
describes all the ZT capabilities that must be implemented to reach both the Target and Advanced
Level ZT. The Components are free to select their own solutions and solution architectures, as longas they deliver the specified ZT Capability outcomes needed to reach the Target or Advanced Level
ZT and are able to show that proof to their Authorizing Official and/or the ZT PfMO. Components
must procure and deploy products and solutions that hit target levels. DoD shall define the logicalarchitecture schema against which the macro level cybersecurity polies are consistently aligned andimplemented against all environments.

47

Fact Sheet: National Defense Strategy, 28 March 2022.

19

DoD Zero Trust Strategy

Measurement and Metrics
To assist in remaining vigilant and accountable to this strategy, the ZT PfMO will develop anddeploy a metrics-based approach for measuring and reporting the Department's progress towardmeeting the four strategic goals outlined in this strategy.
Each goal contains SMART objectives that can be used to
Cybersecurity Operations Visibility
measure goal progress. Additional metrics will be required
Cybersecurity and intelligence analysts
for specific objectives and goals, for example, measurement
working on the front lines of theof the capability implementation according to the Zero Trust Department’s security operations
centers struggle to maintain an
Capability Implementation Roadmap. In addition toenterprise view of common threats andmeasuring DoD Zero Trust Strategy goals and objectives,
vulnerabilities and to communicate
metrics will be developed to measure the impact and benefit
effectively when incidents emerge.
of what each strategy goal sets out to achieve.
Employing specific, qualitative, and quantitative metrics tomeasure Department progress toward achieving the strategic
goals is necessary to measure the progress of ZT adoption
across DoD, ensure compliance with governance and otherstandards, align funding and programming, and to provide
senior leadership with periodic assessments of the securityof the DoD IE.

Siloed domains and manualinterventions are par for the course in
today’s conventional architectures andresult in increased security risks andinconsistent policies, data, logs, andanalytics. With Zero Trust executed,
these analysts in the Department’s
cybersecurity operations centers will
have the ability to maintain dynamic
security monitoring, receive real-timealerts, and automatic incident response–providing the best chance of keeping
malicious actors out, and getting themoff DoD’s networks.

Measurements and metrics are also critically important todetermine the status and effectiveness of ZT implementationand must be available to ascertain what impact andrequirements are required. They will be used to validate thesecurity of our systems and networks and specificcomponent level DAAS. Future decisions on theincorporation of ZT technologies and concepts will be informed by ZT measurement.

Each Component shall contribute data to support the analysis of the effectiveness and progress of thisstrategy. Component reporting requirements will be part of the ZT adoption measurements andmetrics. The ZT PfMO will provide the DoD Cyber Council with a combined scorecard to measure
this strategic plan's progress and identify additional risks that need to be mitigated to advance overall
ZT strategic objectives.

Governance
ZT is governed by existing DoD CIO committee structures as overseen by DoD CIO and JFHQDODIN. The DoD Cyber Council (CC) is the primary authority for ZT technical and strategic
direction and is co-chaired by the DoD CIO and Principal Cyber Advisor on behalf of the Deputy

20

DoD Zero Trust Strategy

Secretary of Defense. 48 The Director of the ZT PfMO acts on CC direction and orchestrates overall
ZT strategy execution. This includes providing strategic guidance, directing the alignment of efforts,
and prioritizing resources to accelerate ZT adoption across the DoD. 49 The ZT PfMO Director willbring other non-technical decisions to the applicable DoD governance forum or DoD CIO committee.
In support of Department-wide ZT governance, the ZT PfMO develops, issues, and tracks ZT-related
governance decisions (including roles and responsibilities), policy, and processes for the Department.
It serves as the coordinator for ZT efforts and supports the DoD Cyber Council regarding all mattersrelated to ZT implementation. ZT PfMO guidance will align with all applicable DoD CIO
governance and directives.

Summary
Executing and achieving the objectives laid out in this strategy requires the coordinated efforts of the
Joint Force and the entire defense ecosystem. Everyone in the Department has a role to ensure thesuccess of ZT. While protecting data is central to ZT, successfully implementing our ZT Framework
requires that the entire Department understands and embraces a culture of ZT.
To achieve the DoD Zero Trust Strategic Vision, the Department must pursue the strategic goals
outlined above as an enterprise. While this is an enormous task, DoD has already made significant
progress. Dating over a decade, DoD has advanced cybersecurity through initiatives such ascontinuous monitoring, multifactor authentication, and others. The technologies and solutions thatcreate ZT, and the benefits it provides, must become a part of the Department’s lexicon and be
accounted for in every plan and operation.
Cybersecurity in the world today is, by definition, a moving target, and while it may move, theconcept and the culture will remain the same, even as the Department adapts and refines the strategy.
Ongoing and open communication and coordination, underpinned by proper funding and resourcing,are key to the strategy's success.
The Department’s ability to protect, and by extension, DoD personnel against the array of
increasingly sophisticated cybersecurity threats depends on it.

The DoD Cyber Council is a “Supporting Tier Forum” as part of the DoD Supporting Tier Governance Forum
Structure defined by DOD Directive 5105.79 DoD Senior Governance Framework, 8 November 2021, p. 10.
49
The DoD ZT PfMO capabilities and services are derived from existing DoD CIO authorities. 40 U.S. Code §11315 assigns general responsibilities, duties, and qualifications to the CIOs of executive agencies. 10 U.S. Code §142 assigns authorities specifically to the DoD CIO. DoDD 5144.02 (DoD Chief Information Officer) (dtd11/21/2014; incorporating Change 1 dtd 9/19/2017) assigns the responsibilities, functions, relationships, andauthorities of the DoD CIO, pursuant to Title 10 and Tile 40 of the United States Code.
48

21

DoD Zero Trust Strategy

APPENDIX A: DoD Zero Trust Capabilities (Target & Advanced Levels)
Summary. Each DoD ZT Capability aligns to one of the seven DoD ZT Pillars (depicted horizontally). Although the full set of DoD ZT Capabilities span from target to advanced, some capabilities are achieved at the target level, anda few are strictly advanced. The majority of capabilities have associated activities that include both ZT Target Level and Advanced ZT (depicted vertically by the center column). The execution enablers are cross-cutting, non-technicalcapabilities and activities that address culture, governance, and elements of DOTmLPF-P. Contact the DoD ZT PfMO at osd.pentagon.dod-cio.mbx.zero-trust-portfolio-management-office@mail.mil for outcome descriptions of eachcapability.

22

DoD Zero Trust Strategy

APPENDIX B: DoD Zero Trust Activities (Target & Advanced Levels)
Summary. Each DoD ZT Capability breaks down into a series of associated activities achieved at ZT Target Level (represented by the inner light blue arc) or at Advanced ZT (represented by outer dark blue arc). The execution
enablers are cross-cutting, non-technical capabilities and activities that address culture, governance, and elements of DOTmLPF-P. When viewing the illustration electronically, magnify the zoom level to see the title of each activity.
When printing, configure the page setting to Ledger (11” x 17”). Security Control overlay is under development; contact the DoD ZT PfMO at osd.pentagon.dod-cio.mbx.zero-trust-portfolio-management-office@mail.mil for outcome
descriptions of each activity.

23

DoD Zero Trust Strategy

APPENDIX C: DoD Zero Trust Capability Roadmap (by Fiscal Year)
Summary. The ZT Capability baseline timelines, depicted by DoD ZT Pillar and Fiscal Year, provide the projected roadmap for achieving the ZT Target Level by the end of FY2027. Each ZT Capability includes its associatedpredecessor/successor relationships. Capabilities with no predecessors can begin earlier when resourced appropriately. When viewing the illustration electronically, magnify the zoom level to see the title of each capability. Whenprinting, configure the page setting to Ledger (11” x 17”). Contact the DoD ZT PfMO at osd.pentagon.dod-cio.mbx.zero-trust-portfolio-management-office@mail.mil for further information.

24

DoD Zero Trust Strategy

APPENDIX D: DoD Zero Trust Strategic and Execution Milestones (FY2023 – FY2024)
Summary. The DoD ZT Strategy implementation timeline below depicts the strategic and execution milestone due dates, events, and processes for FY2023 and FY2024 as currently envisioned. When viewing the illustrationelectronically, magnify the zoom level to see the title of each milestone. When printing, configure the page setting to Ledger (11” x 17”). Contact the DoD ZT PfMO at osd.pentagon.dod-cio.mbx.zero-trust-portfolio-managementoffice@mail.mil for further information.

25

DoD Zero Trust Strategy

APPENDIX E: References
Name

Table 2. References

Committee on National Security Systems Policy 21, National Cybersecurity Policy on Enterprise Architecture
Frameworks for National Security Systems, 30 July 2016
DoD Artificial Intelligence Strategy, 12 February 2019
DoD C3 Modernization Strategy, September 2020
DoD Cloud Strategy, 18 December 2018
DoD Cyber Risk Strategy*
DoD Cyber Security Reference Architecture, version 4.2, January 2022*
DoD Cyber Strategy, September 2018*
DoD Data Strategy, 30 September 2020*
DoD Defense Planning Guidance*
DoD Digital Modernization Strategy, 12 July 2019
DoD Directive 5105.79, DoD Senior Governance Framework, 8 November 2021
DoD Directive 5144.02, DoD Chief Information Officer (DoD CIO), Chg 1, 19 September 2017
DoD Directive 8000.01, Chg 1; Management of the Department of Defense Information Enterprise (DoD IE),
Section 2(a), 17 July 2017
DoD ICAM Strategy, 30 March 2020
DoD Instruction (DODI) 5000.82, Acquisition of Information Technology (IT), 21 Apr 2020
DoD OCONUS Cloud Strategy, 26 May 2021
DoD Risk, Issue, and Opportunity Management Guide for Defense Acquisition Programs, January 2017
DoD Software Modernization Strategy, 2 February 2022
DoD Zero Trust Reference Architecture, February 2021
Executive Order on Improving the Nation’s Cybersecurity, 12 May 2021
Fact Sheet: National Defense Strategy, 28 March 2022
Joint Publication 6-0, Joint Communications System, 10 June 2015 Incorporating Change 1 04 October 2019
National Defense Authorization Act for Fiscal Year 2022, 21 December 2021
National Defense Business Operations Plan, 9 April 2018
“National Security Memorandum 8, Task 3: National Manager for National Security Systems Requirement
Exception Provision Process (NMM-2022-03),” 25 February 2022*“National Security Memorandum 8, Task 4: National Manager for National Security Systems Binding
Operational Directive and Emergency Directive Procedures (NMM-2022-04),” 25 February 2022**Contact the Zero Trust PfMO at osd.pentagon.dod-cio.mbx.zero-trust-portfolio-management-office@mail.mil if
you require access to classified, FOUO, or CUI documents marked with an asterisk

26

DoD Zero Trust Strategy

Name

Table 2. References (cont.)“(U//FOUO) National Security Memorandum 8, Task 5: Identification and Inventorying of National Security
Systems Guidance (NMM-2022-05),” 25 February 2022*“National Security Memorandum 8, Task 6: Multifactor Authentication and Encryption for National Security
Systems Data Guidance (NMM-2022-06),” 25 February 2022*“National Security Memorandum 8, Task 14: National Manager for National Security Systems Request forTechnical and/or Operational Assistance Procedures (NMM-2022-14),” 21 April 2022*
National Security Memorandum-8, “Memorandum on Improving the Cybersecurity of National Security,
Department of Defense, and Intelligence Community Systems,” 19 January 2022
National Security Strategy, 12 October 2022
National Institute of Standards and Technology (NIST) Special Publication (SP) 800-207, Zero Trust
Architecture, August 2020
National Institute of Standards and Technology (NIST) Special Publication (SP) 1271, Getting Started with
the NIST Cybersecurity Framework: A Quick Start Guide (6 August 2021)“Mission Partner Environment Cuts Decision Making, Kill Chain,” DoD News, 29 November 2021
Office of Management and Budget Memorandum M-22-01, “Improving Detection of Cybersecurity
Vulnerabilities and Incidents on Federal Government Systems through Endpoint Detection and Response,” 8
October 2021
Office of Management and Budget Memorandum M-22-09, “Moving the U.S. Government Toward Zero
Trust Cybersecurity Principles,” 26 January 2022
Summary: DoD Cyber Strategy 2018, September 2018
*Contact the Zero Trust PfMO at osd.pentagon.dod-cio.mbx.zero-trust-portfolio-management-office@mail.mil if you
require access to classified, FOUO, or CUI documents marked with an asterisk

27

DoD Zero Trust Strategy

APPENDIX F: Acronyms / Definitions
Table 3. Acronyms
AcronymAI

Description
Artificial Intelligence

BES

Budget Estimate Submission

C2C

Comply-to-Connect

C4I

Command, Control, Communications, Computers and Intelligence

CAPE

Office of Cost Assessment & Program Evaluation

CIO

Chief Information Officer

COA

Course of Action

CPG

DoD CIO Capability Programming Guidance

DAAS

Data, Applications, Assets, and Services

DAFAs

Defense Agencies and Field Activities

DA&M

Director, Administration and Management

DIB

Defense Industrial BaseDoD IE

Department of Defense Information EnterpriseDODIN

DoD Information Network

DOTmLPF-P
DPG

Doctrine, Organization, Training, Materiel, Leadership and Education, Personnel, Facilities,
and Policy
Defense Planning Guidance

FYDP

Future Years Defense Program

JADC2

Joint All Domain Command and Control

JFHQ-DODIN

Joint Force Headquarters – Defense Information Networks

JWC

Joint Warfighting Concept

MILDEP

Military Department

MPE

Mission Partner Environment

NDAA

National Defense Authorization Act

NIPRNetNon-classified Internet Protocol Router Network

NIST

National Institute of Standards and Technology

NPE

Non-person Entity

NSS

National Security Systems

OT&E

Operational Test & Evaluation

PfMO

Portfolio Management Office

POM

Program Objective Memorandum

PPBE

Planning, Programming, Budgeting & Execution

SIPRNetSecret Internet Protocol Router Network

SMART

Specific, Measurable, Achievable, Relevant, and Time-bound

ZT

Zero Trust

ZT RAZero Trust Reference Architecture

28

DoD Zero Trust Strategy

Table 4. Key Definitions
Term
DoD Advanced
Zero Trust

Definition
Achievement of the full set of identified Zero Trust capability outcomes and activities
that enable adaptive responses to cybersecurity risk and threats. Reaching an “advanced”
state does not mean an end to maturing ZT; rather, protection of attack surfaces willcontinue to adapt and refine as the adversary's attack approaches and vectors mutate.

DoD Zero Trust
Pillars

Seven capability pillars of Zero Trust that provide the foundational areas for the DoD
Zero Trust Security Model and DoD ZT Architectures, including focus for the
implementation of ZT controls (as defined by the DoD Zero Trust Reference
Architecture, v2).

DoD Zero Trust
Capability
Roadmap

Lays out how the Department currently envisions achieving capability-based outcomes.
The Roadmap defines ZT capability outcomes to achieve DoD Zero Trust Target Level,
identifies activities, outlines dependencies and interdependencies impacting sequence andparallel development, and provides a general timeline to achieve outcomes by fiscal year.

DoD Zero Trust
Ecosystem

Consists of the breadth of DoD leaders, mission owners, and partners (internal andexternal) who are stakeholders in the success of Zero Trust implemented across theInformation Enterprise (IE).

DoD Zero Trust
DOTmLPF-P
Execution
Enablers

Cross-cutting, non-technical capabilities and activities that address culture, governance,and elements of DOTmLPF-P (e.g., ZT Training, etc.) that support the design,development and deployment of the ZT Capabilities required to achieve the DoD Target
and Advanced Levels.

DoD Zero Trust
Framework

An official cybersecurity blueprint, based on the seven DoD Zero Trust Capability
Pillars, which describes how the Department will achieve ZT by providing the foundationand the direction to help align on-going and future ZT-related efforts, investments andinitiatives.

DoD Zero Trust
Maturity Model

Depiction of the logical progression of an as-is security model to an advanced Zero Trustarchitecture as defined by the DoD Zero Trust Reference Architecture, v2.

DoD Zero Trust
Portfolio
Management
OfficeDoD Zero Trust
Security Model

The Organization within the Office of the DoD CIO (CS) responsible for providing
strategic guidance, directing alignment of efforts, and prioritizing resources to accelerate
Zero Trust adoption and implementation across the DoD.

DoD Zero Trust
Target Level

The required minimum set of Zero Trust capability outcomes and activities necessary tosecure and protect the Department's DAAS to manage risks from currently known
threats; includes basic and intermediate Zero Trust maturity as defined by the ZT RA.

A more robust cybersecurity model that eliminates the idea of trusted or untrusted
networks, devices, personas, or processes, and shifts to multi-attribute-based confidence
levels that enable authentication and authorization policies based on the concept of leastprivileged access (as defined by the DoD Zero Trust Reference Architecture, v2).

29

DoD Zero Trust Strategy