DoD Zero Trust Capability
Execution Roadmap (COA 1)
06 January 2023

There is one destination (ZT) with many
paths (COAs) – COA 1 will be the focus
Under Development

Focus of this Briefing

COA 1

COA 2

COA 3

ZT Baseline

Commercial Cloud

Private Cloud▪ Leverages current infrastructure and▪ Relies on commercial provider(s) to develop ZT▪ Government Owned/Operated high-environment using Brownfield approach▪ Zero Trust “on the ground” modernization: ~ 5+
yr. (FYDP beginning FY23) Implementation
Plan▪ Establishes set capabilities and activities
needed to achieve Target and Advanced-levels
of Zero Trust▪ No constraints on tools or methods tocompliant cloud environments using Greenfieldapproach▪ Achieves DoD ZT quicker than COA-1▪ Mandate would be to achieve DoD ZT “Target”
level, at a minimum▪ Provides standardized tools and capabilities toperformance Native ZT Cloud (NZTC) using
Greenfield approach▪ Achieves DoD ZT quicker than COA-1▪ Achieves immediate DoD ZT “Advanced” levelby design, which needs to be independently
validated

support ZT execution

accomplish ZT

2

Zero Trust by 2027
Over the last several months, the ZT Portfolio Management Office (PfMO) has worked to establish the capabilities
necessary to successfully accomplish Zero Trust, and laid them out on a roadmap for execution across the DoD
with the following method:
DefineProducing a common lexicon
on capability descriptions,outcomes, and impact statements,
activity outcomes, and providing
appropriate references were thenecessary first steps

Understand andContextualize

Realizing the relationships anddependencies helped to drive
timeline development

Develop and Refine

Multiple iterations resulted in
one primary COA, opportunities
for acceleration with cloud, andother considerations supporting
an executable plan

The resulting plan supports the execution of Zero Trust across the DoD to the required level by FY2027
3

The Concept of COA 1
This stage was primarily about defining “WHAT” the DoD needed to do execute ZT – agnostic of COAs

ser

DeviceA

lication andor loadData
etwor andnvironment
Automationrchestration
isibilit
Anal tics

Target evel ZTAdvanced ZT

With this methodology, one iteration emerged
as the final timeline

What follows are layers of analysis andexplanation to support the detailed execution of
the plan over time

*Timelines and activity durations did account for high-level research-based considerations around these critical elements

Other Considerations – More to Come*
Limited development could be done in these areas until ZT capabilities were defined and mapped out
Budget and Acquisition – Capabilities were spread out over time with these concerns in mind, but will require much deeper considerations at thecapability and activity level
Technical Implementation – Defines “how” to accom lish ZT – COA 1 is about allowing organizations to choose their own methods. COA 2 /3 will
better address this. More guidance is coming on controls associated with capabilities, and implementation strategies
4

Table of Contents

1

COA 1: Recommendations and Other Relevant Timelines

2

Timeline Development and Methodology

3

Key Communications

Appendices
Appendix A: COA 1 Timeline Details (DoD Baseline)
Appendix B: Accelerated DoD Baseline Timeline Details
Appendix C: Capability Definitions

5

COA 1
Recommendations
and Other Relevant
Timelines

6After multiple iterations, this timeline is
now “COA 1 (DoD Baseline)”serDeviceA

lication andor loadData
etwor andnvironment
Automationrchestration
isibilit
Anal tics

Target evel ZTAdvanced ZTBalances an aggressive a roach to achieving “Target evel ZT” b FY27 with the DoD Budget C cle
by distributing activities over the FYDP and setting Department-Wide expectations
See Appendix A for methodology

7Other timelines provide amplifying points
and support additional PfMO analysis

serDeviceA lication andor loadData
etwor andnvironment

Automationrchestration
isibilit
Anal tics

DoD Accelerated Baseline:
see s to achieve “Advanced ZT” more quic lwith a more aggressive approach that pushes
start dates to the left as much as possible; thisaccelerated approach is included as an
example for organizations seeking to achieve“advanced ZT” more quic l

Forward/backward Pass Projections:assess the likely achievement date of Target
and Advanced ZT levels based on risk,
duration standard deviations, and cloud
employment

See Appendix B for methodology

8Timeline
Development andMethodology

Note: “Execution Enablers” as referenced in the following slides are cross-cutting, non-technical capabilities and activities that address culture, governance, and elements of DOTmLPF-P (e.g., ZT Training, etc.) that
support the design, development and deployment of the ZT Capabilities required to achieve the DoD Target and Advanced Levels. Details regarding supporting enablers will be further refined and integrated into next
versions of the DoD ZT Capability Roadmap and addressed in implementation plans. Enablers identified to-date include: ZT Awareness & Culture, Adaptive Implementation Governance, ZT Policy Framework, ZT
Training, and others.

9Note: Click on each Capability Title for details

DoD Zero Trust Capabilities
DeviceUser

Application &Workload

Data

Network &Environment

Automation &Orchestration

Visibility &Analytics

1.1 User Inventory

2.1 Device Inventory

3.1 Application Inventory

4.1 Data Catalog Risk
Assessment

5.1 Data Flow Mapping

6.1 Policy Decision Point(PDP) & Policy Orchestration

7.1 Log All Traffic (Network,
Data, Apps, Users)

1.2 Conditional User
Access

2.2 Device Detection andCompliance

3.2 Secure Software
Development & Integration

4.2 DoD Enterprise Data
Governance

5.2 Software Defined
Networking (SDN)

6.2 Critical Process
Automation

7.2 Security Information andEvent Management (SIEM)

1.3 Multi-Factor
Authentication

2.3 Device Authorization with
Real Time Inspection

3.3 Software Risk
Management

4.3 Data Labeling and
Tagging

5.3 Macro Segmentation

6.3 Machine Learning

7.3 Common Security and
Risk Analytics

1.4 Privileged Access
Management

2.4 Remote Access

3.4 Resource Authorization &Integration

4.4 Data Monitoring and
Sensing

5.4 Micro Segmentation

6.4 Artificial Intelligence

7.4 User and Entity Behavior
Analytics

1.5 Identity Federation &User Credentialing

2.5 Partially & Fully Automated
Asset, Vulnerability and PatchManagement

3.5 Continuous Monitoring
and Ongoing Authorizations

4.5 Data Encryption & Rights
Management

6.5 Security Orchestration,
Automation & Response(SOAR)

7.5 Threat Intelligence
Integration

1.6 Behavioral, Contextual
ID, and Biometrics

2.6 Unified Endpoint
Management (UEM) & Mobile
Device Management (MDM)

4.6 Data Loss Prevention(DLP)

6.6 API Standardization

7.6 Automated Dynamic
Policies

1.7 Least Privileged
Access

2.7 Endpoint & Extended
Detection & Response (EDR &XDR)

4.7 Data Access Control

6.7 Security Operations
Center (SOC) & Incident
Response (IR)

1.8 Continuous
Authentication
1.9 Integrated ICAM
Platform

EXECUTIONENABLERS
V1.0 as of 10/04/2022

Doctrine

Organization

Training

Material

Leadership &Education

Personnel

Facilities

Policy10

Capabilities, Activities, and their dependencies
were identified and aligned to ZT Levels
Capabilities
1.1 User Inventory
1.2 Conditional User
Access
1.3 Multi-Factor
Authentication
1.4 Privileged Access
Management

Activities and Level
Conditional User Access
ActivityLevel
1.2.1 App BasedZT Target
Permissions per Enterprise
1.2.2 Rule Based Dynamic
ZT Target
Access Pt1
1.2.3 Rule Based Dynamic
Advanced ZT
Access Pt2
1.2.4 Enterprise Gov't roles
Advanced ZT
and Permissions Pt1
1.2.5 Enterprise Gov't roles
Advanced ZT
and Permissions Pt2

Capabilities break down into activities with associated ZT Levels tobetter support appropriate sequencing and recognize predecessor,
successor relationships

Predecessor and Successor
Relationships

Cross-pillar Capability
Dependencies

Pillar and Cross-Pillar Activity
Dependencies

ZT Target Level = All DoD organizations must achieve this level
Advanced ZT = Certain organizations must reach this level based on system and information sensitivity
11

Timelines were developed by fixing theactivities to a set starting point
All DoD organizations are expected to achieve ZT Target Level by 2027

Activities & Durations – Each activity has time duration
assigned. Durations were calculated using a DELPHI method
employing three teams to determine the required level ofeffort. The durations were laid out over time based on thedependency relationships established

Set Starting Point – If capabilities are laid out over time
starting at 2023 and with all Target levels completed by 2027

12

Multiple timelines were generated foranalysis
The capabilities and activities, plus their associated durations, ZT Target designations,and sequencing dependencies were entered into an MS Project File (attached)1.

The initial outcomes were mapped to visualize
when pillars would achieve the ZT Target levels

MS Project File2

Activity dependencies were re-evaluated, resulting
in an updated timeline to achieve ZT Target Levels

3

serDeviceDates are calculated start and finish from the activity
level through the pillar levelA

lication andor loadData
etwor andnvironment
Automationrchestration

isibilit
Anal tics

Leveling activity distribution over FYs resulted in
COA 1 and supported further acceleration efforts
13Each pillar has an associated timeline
broken down into activities
Pillar-Capability Timelines

MS Project File

Each Pillar-Capability Timeline is structured based on the dependency relationships (at theactivity level) and ZT execution levels as detailed in the attached MS Project document
Activity dates are recommendations and not intended to serve as a formal requirement
14Key Communications

15

Note: Click on each Capability Title for details

DoD Zero Trust Capabilities
DeviceUser

Application &Workload

Data

Network &Environment

Automation &Orchestration

Visibility &Analytics

1.1 User Inventory

2.1 Device Inventory

3.1 Application Inventory

4.1 Data Catalog Risk
Assessment

5.1 Data Flow Mapping

6.1 Policy Decision Point(PDP) & Policy Orchestration

7.1 Log All Traffic (Network,
Data, Apps, Users)

1.2 Conditional User
Access

2.2 Device Detection andCompliance

3.2 Secure Software
Development & Integration

4.2 DoD Enterprise Data
Governance

5.2 Software Defined
Networking (SDN)

6.2 Critical Process
Automation

7.2 Security Information andEvent Management (SIEM)

1.3 Multi-Factor
Authentication

2.3 Device Authorization with
Real Time Inspection

3.3 Software Risk
Management

4.3 Data Labeling and
Tagging

5.3 Macro Segmentation

6.3 Machine Learning

7.3 Common Security and
Risk Analytics

1.4 Privileged Access
Management

2.4 Remote Access

3.4 Resource Authorization &Integration

4.4 Data Monitoring and
Sensing

5.4 Micro Segmentation

6.4 Artificial Intelligence

7.4 User and Entity Behavior
Analytics

1.5 Identity Federation &User Credentialing

2.5 Partially & Fully Automated
Asset, Vulnerability and PatchManagement

3.5 Continuous Monitoring
and Ongoing Authorizations

4.5 Data Encryption & Rights
Management

6.5 Security Orchestration,
Automation & Response(SOAR)

7.5 Threat Intelligence
Integration

1.6 Behavioral, Contextual
ID, and Biometrics

2.6 Unified Endpoint
Management (UEM) & Mobile
Device Management (MDM)

4.6 Data Loss Prevention(DLP)

6.6 API Standardization

7.6 Automated Dynamic
Policies

1.7 Least Privileged
Access

2.7 Endpoint & Extended
Detection & Response (EDR &XDR)

4.7 Data Access Control

6.7 Security Operations
Center (SOC) & Incident
Response (IR)

1.8 Continuous
Authentication
1.9 Integrated ICAM
Platform

EXECUTIONENABLERS
V1.0 as of 10/04/2022

Doctrine

Organization

Training

Material

Leadership &Education

Personnel

Facilities

Policy16

The 45 Capabilities support Target Level
and Advanced ZT

Many capabilities have multiple activities that span from target to advanced – Accomplishment of “ZT Target
Level” and “Advanced ZT” will be determined at the Activity level17Advanced Zero Trust

Zero Trust Target evel
ser nventor
7 east rivileged Accessoctrinerganization
raining
aterieleadershiersonnelacilities
olicducation

2 5 artiall
Full Automated Assetulnerabilit and atch Mgmt

A
7
og
All
Traffic
7

lication nventor

Data Catalog
is Alignment

CommonecuritisAnal tics

Machineearning

5 DataFlow
Ma ingA

M

Mobileoftw are isManagement

2 DoD nter rise
Data overnance5

7 5 Threat
ntelligencentegration2
nified nd oint Management
Device Management MDM

Macroegmentation

tandardization
5 Continuous Monitoring andngoing Authorizations

7
Automated
D namic
olicies

Artificial
ntelligence

ZT Ca abilities in bold font and dis la ed on the ZT Target
line contain activities s anning both Target and Advanced ZT
as of

2 22

18

Once capabilities are broken out into
activities, ZT Target Level andAdvanced ZT provide a much moredefinitive path to execution.

19

COA 1 (DoD Baseline) achieves Target
Level ZT by the end of FY27
▪ Assumes a start date of FY23;▪ It provides a baseline roadmap
for a stakeholder who has not
yet commenced efforts indeveloping ZT;▪ Stakeholders who haveachieved activities on theroadma can “move ahead”;▪ Does not proscribe specificsolutions to achieving theactivities required;▪ It allows for some buffer inTarget ZT achievement date to
the stated goal (end of FY27) if
delays occur.

ser

DeviceA

lication andor loadData
etwor andnvironment
Automationrchestration
isibilit
Anal tics

Target evel ZTAdvanced ZT
20

Appendix A: COA 1
Timeline Details (DoD
Baseline)

Note 1: The timeline depicted is meant to show how activities may be sequenced to achieve Target Level ZT by the end of FY27 as proscribed in the DoD Zero Trust Strategy; these activity durations are meant to serve as
estimates for planning purposes only
Note 2: The DoD Zero Trust Capability Roadmap described in the High-Level Capability Roadmap section below provides a guide to follow for the DoD baseline course of action (COA). Additionally, to accelerate Zero
Trust adoption, the Department is considering several additional complementary COAs including commercial and Government-owned cloud-based enterprise services

Back to Table of Contents

21

COA 1 (DoD Baseline) Timeline Estimatesser

DeviceA lication andor loadData
etwor andnvironment

Automationrchestration
isibilit
Anal tics
V1.0 as of 10/04/2022= Target Level ZT= Advanced ZT
22

User (1 of 2) – COA 1
Capability
1.1 User Inventory

FY23

FY24

FY25

FY26

FY27

FY28

FY29

FY30

FY31

FY32

Inventory Users
App-Based Permission
Per Enterprise
Rule Based Dynamic Access
Pt. 1

1.2 Conditional User Access

Rule Based Dynamic
Access Pt. 2Enterprise Roles and Permissions Pt. 1

1.0 UserEnterprise Roles and Permissions Pt. 2
Organizational MFA/IDP
Alternative Flexible MFA
Pt. 1

1.3 Multifactor Authentication(MFA)

Alternative Flexible
MFA Pt. 2
Implement System and Mitigate Privileged Users Pt. 1
Implement System and Mitigate Privileged Users Pt. 2

1.4 Privileged Access
Management (PAM)

Real time Approvals & JIT/JEA Analytics Pt. 1
Real time Approvals & JIT/JEA Analytics Pt. 2
Organization Identity Life-cycle Management

Enterprise Identity Life-cycle Management Pt. 1

1.5 Identify Federation & User
Credentialing

Enterprise Identity Life-cycle Management Pt. 2Enterprise Identity Life-cycle Management Pt. 3
Implement UEBA and UAM Tooling

1.6 Behavioral, Contextual ID,
and Biometrics= Target Level ZT

User Activity Monitoring Pt. 1
User Activity Monitoring Pt. 2= Advanced ZT
23

1.0 User

User (2 of 2) – COA 1
Capability

FY23

FY24

1.7 Least Privileged Access

Deny User by Default Policy

FY25

FY26

FY27

FY28

FY29

FY30

FY31

FY32

Single Authentication
Periodic Authentication

1.8 Continuous Authentication

Continuous
Authentication Pt. 1

Continuous
Authentication Pt. 2Enterprise PKI/IDP Pt. 1

1.9 Integrated ICAM Platform

Enterprise PKI/IDP Pt. 2Enterprise PKI/IDP Pt. 3= Target Level ZT= Advanced ZT
24

Device (1 of 2) – COA 1
Capability

FY23

FY24

FY25

FY26

FY27

FY28

FY29

FY30

FY31

FY32

Device Health Tool Gap Analysis
NPE/PKI Device Under
Management
Enterprise IDP Pt.
1

2.1 Device Inventory

Implement C2C/Compliance Based Network Authorization Pt. 1

2.2 Device Detection andCompliance

2.0 Device

Enterprise
IDP Pt. 2

Implement C2C/Compliance Based Network Authorization Pt. 2
Integrate Next Gen AV
Tools with C2C

Implement Application
Control & FIM Tools

2.3 Device Authorization w/ RealTime Inspection

Entity Activity Monitoring
Pt. 1

Entity Activity Monitoring
Pt. 2
Fully Integrate Device Security Stack w/ C2C as appropriate
Enterprise PKI Pt. 1
Enterprise PKI
Pt. 2

Deny Device by
Default Policy

Managed and Limited BYOD & IOT Support

2.4 Remote Access

Managed and Full BYOD & IOT Support Pt. 1
Managed and Full BYOD & IOT
Support Pt. 2

2.5 Partially & Fully Automated
Asset, Vulnerability and PatchManagement= Target Level ZT

Implement Asset, Vulnerability and Patch Management Tools= Advanced ZT
25

Device (2 of 2) – COA 1

2.0 Device

Capability

FY23

FY24

FY25

FY26

FY27

FY28

FY29

FY30

FY31

FY32

2.6 Unified Endpoint
Management (UEM) & Mobile
Device Management (MDM)

Implement UEDM or equivalent Tools

2.7 Endpoint & Extended
Detection & Response (EDR &XDR)Implement Endpoint Detection & Response (EDR) Tools & Integrate w / C2C= Target Level ZTEnterprise Device Management Pt. 1
Enterprise Device Management Pt. 2

Implement Extended Detection & Response (XDR) & Integrate w / C2C Pt. 1
Implement Extended Detection & Response (XDR) & Integrate w / C2C Pt. 2= Advanced ZT
26

Application and Workload – COA 1
FY23

Capability

FY24

FY25

FY26

FY27

FY28

FY29

FY30

FY31

FY32

Application / Code Identification

3.1 Application Inventory

3.0 Application and Workload

Build DevSecOps Software Factory Pt. 1
Build DevSecOps Software Factory Pt. 2

3.2 Secure Software
Development & Integration

Automate Application Security & Code Remediation Pt. 1
Automate Application Security & Code Remediation Pt. 2
Approved Binaries / CodeVulnerability Management Program Pt. 1

3.3 Software Risk Management

Vulnerability Management Program Pt. 2
Continual Validation
Resource Authorization Pt. 1

Resource Authorization Pt. 2

SDC Resource Authorization Pt. 1

3.4 Resource Authorization &Integration

SDC Resource Authorization Pt. 2
Enrich Attributes for Resource Authorization Pt. 1
Enrich Attributes for Resource Authorization Pt. 2
REST API Micro-Segments

3.5 Continuous Monitoring andOngoing Authorizations= Target Level ZTContinuous Authorization to Operate (ATO) Pt. 1
Continuous Authorization to Operate (ATO) Pt. 2= Advanced ZT
27

Data (1 of 2) – COA 1
Capability

FY23

4.1 Data Catalog Risk Alignment

FY24

FY25

FY26

FY27

FY28

FY29

FY30

FY31

FY32

Data Analysis
Define Data Tagging Standards

4.2 DoD Enterprise Data
GovernanceInteroperability Standards
Develop Software Defined Storage (SDS) Policy
Implement Data Tagging & Classification Tools
Manual Data Tagging Pt. 1
Manual Data Tagging
Pt. 2

4.3 Data Labeling and Tagging

4.0 Data

Automated Data Tagging & Support Pt. 1
Automated Data Tagging & Support Pt. 2
DLP Enforcement Point Logging and Analysis
DRM Enforcement Point Logging and Analysis
File Activity Monitoring Pt. 1

4.4 Data Monitoring and Sensing

File Activity Monitoring Pt. 2
Database Activity Monitoring
Comprehensive Data Activity Monitoring

Implement DRM and Protection Tools Pt. 1
Implement DRM and Protection Tools Pt. 2

4.5 Data Encryption & Rights
Management

DRM Enforcement via Data Tags and Analytics Pt. 1
DRM Enforcement via Data Tags and Analytics Pt. 2
DRM Enforcement via Data Tags and Analytics Pt. 3= Target Level ZT= Advanced ZT
28

Data (2 of 2) – COA 1
Capability

FY23

FY24

FY25

FY26

FY27

FY28

FY29

FY30

FY31

FY32

Implement Enforcement Points
DLP Enforcement via Data Tags and Analytics Pt. 1

4.0 Data

4.6 Data Loss Prevention (DLP)DLP Enforcement via Data Tags and Analytics Pt. 2
DLP Enforcement via Data Tags and Analytics Pt. 3
Integrate DAAS Access w/SDS Policy Pt. 1
Integrate DAAS Access w/SDS Policy Pt. 2
Integrate DAAS Access w/SDS Policy Pt. 3

4.7 Data Access Control

Integrate SDS Solution(s) and Policy with Enterprise IDP Pt. 1
Integrate SDS Solution(s) and Policy with Enterprise IDP Pt. 2
Implement SDS Tool and/or integrate with DRM Tool Pt. 1
Implement SDS Tool and/or integrate with DRM Tool Pt. 2= Target Level ZT= Advanced ZT
29

Network and Environment – COA 1

5.0 Network & Environment

Capability

FY23

FY24

FY25

FY26

FY27

FY28

FY29

FY30

FY31

FY32

Define Granular Control Access Rules & Policies Pt. 1

5.1 Data Flow Mapping

Define Granular Control Access Rules & Policies Pt. 2
Define SDN APIs
Implement SDN Programmable Infrastructure

5.2 Software Defined Networking(SDN)

Segment Flows into Control, Management, and Data Planes
Network Asset Discovery & Optimization
Real-Time Access
Decisions
Datacenter Macro Segmentation

5.3 Macro Segmentation

B/C/P/S Macro Segmentation
Implement Micro segmentation
Application & Device Micro segmentation

5.4 Micro Segmentation

Process Micro segmentation
Protect Data In Transit= Target Level ZT= Advanced ZT
30

Automation & Orchestration – COA 1
Capability

FY23

FY24

FY25

FY26

FY27

FY28

FY29

FY30

FY31

FY32

Policy Inventory & Development
Organization Access Profile

6.1 Policy Decision Point (PDP)& Policy Orchestration

Enterprise Security Profile Pt. 1

6.0 Automation & Orchestration

Enterprise Security Profile Pt. 2
Task Automation Analysis

6.2 Critical Process Automation

Enterprise Integration & Workflow Provisioning Pt. 1
Enterprise Integration & Workflow Provisioning Pt. 2

6.3 Machine Learning

Implement Data Tagging & Classification ML Tools
Implement AI Automation Tools

6.4 Artificial Intelligence

AI Driven by Analytics decides A&O Modifications
Response Automation Analysis

6.5 Security Orchestration,
Automation & Response (SOAR)

Implement SOAR Tools
Implement Playbooks
Tool Compliance Analysis

6.6 API Standardization

Standardized API Calls & Schemas Pt. 1
Standardized API Calls & Schemas Pt. 2
Workflow Enrichment Pt. 1

6.7 Security Operation Center(SOC) & Incident Response (IR)Workflow Enrichment Pt. 2
Workflow Enrichment Pt. 3
Automated Workflow= Target Level ZT= Advanced ZT
31

Visibility & Analytics – COA 1
Capability

FY23

FY24

FY25

FY26

FY27

FY28

FY29

FY30

FY31

FY32

Scale Considerations

7.1 Log All Traffic (Network,
Data, Apps, Users)

Log Parsing
Log Analysis

7.0 Visibility & Analytics

Asset ID & Asset Correlation
Threat Alerting Pt. 1

7.2 Security Information andEvent Management (SIEM)

Threat Alerting Pt. 2
Threat Alerting Pt. 3
User/Device Baselines
Implement Analytics Tools

7.3 Common Security and Risk
Analytics

Establish User Baseline Behavior
Baseline & Profiling Pt. 1
Baseline & Profiling Pt. 2

7.4 User and Entity Behavior
Analytics (UEBA)

UEBA Baseline Support Pt. 1
UEBA Baseline Support Pt. 2

7.5 Threat Intelligence
Integration

Cyber Threat Intelligence Program Pt. 1
Cyber Threat Intelligence Program Pt. 2

7.6 Automated Dynamic Policies= Target Level ZT

AI-enabled Network Access
AI-enabled Dynamic Access Control= Advanced ZT
32

Appendix B:
Accelerated DoD
Baseline Timeline
Details

Back to Table of Contents

33

Accelerated COA 1 Timeline Estimatesser

DeviceA lication andor loadData
etwor andnvironment

Automationrchestration
isibilit
Anal tics= Target Level ZT= Advanced ZT
34

Aggressively shifting activity start dates to
FY23 accelerates ZT achievement dates
Shifting Target and Advanced ZT dates left as much as
possible (e.g., when not limited by predecessor activities)
significantly reduces the overall timeline to ZT
accomplishmentserDeviceA lication andor loadData
etwor andnvironment

Automationrchestration
isibilit
Anal tics

o change to Device ZT
Target Dateo change to A licationand or load ZT TargetDateo change to Data ZT
Target Dateo change to etwor
and nvironment ZT
Target Date

This timeline serves as a model for those stakeholders who
have the desire (and capacity) to achieve Advanced ZT
more quickly than the recommended baseline COA 1
Left-shifting Activities:✔ Reduces the time to achieving Target Level ZT✔ May result in increased financial and personnel
resourcing in the near term due to increased
requirements✔ Due to shifting priorities to the left, reduces the risk that
other priorities supersede Zero Trust in future years
X Stakeholders may view this timeline as unrealistic
X May result in misprioritization of activity accomplishment(e.g., by focusing on advanced activities too soon)

35

User (1 of 2) - Accelerated
Capability

FY23

1.1 User Inventory

FY24

FY25

FY26

FY27

FY28

FY29

FY30

FY31

FY32

User Inventory
App-Based Permission
Per Enterprise

Rule Based Dynamic Access
Pt. 1

1.2 Conditional User Access

Rule Based Dynamic
Access Pt. 2Enterprise Roles and Permissions Pt. 1
Enterprise Roles and Permissions Pt. 2

1.0 User

Organizational MFA/IDP

1.3 Multifactor Authentication(MFA)

Alternative Flexible MFA
Pt. 1

Alternative Flexible
MFA Pt. 2
Implement System and Mitigate Privileged Users Pt. 1
Implement System and Mitigate Privileged Users Pt. 2

1.4 Privileged Access
Management (PAM)

Real time Approvals & JIT/JEA Analytics Pt. 1
Real time Approvals & JIT/JEA Analytics Pt. 2
Organization Identity Life-cycle Management
Enterprise Identity Life-cycle Management Pt. 1

1.5 Identify Federation & User
Credentialing

Enterprise Identity Life-cycle Management Pt. 2Enterprise Identity Life-cycle Management Pt. 3
Implement UEBA and UAM Tooling

1.6 Behavioral, Contextual ID,
and Biometrics= Target Level ZT

User Activity
Monitoring Pt. 1

User Activity
Monitoring Pt. 2= Advanced ZT
36

1.0 User

User (2 of 2) - Accelerated
Capability

FY23

FY24

1.7 Least Privileged Access

Deny User by Default Policy

FY25

FY26

FY27

FY28

FY29

FY30

FY31

FY32

Single Authentication
Periodic Authentication

1.8 Continuous Authentication

Continuous
Authentication Pt. 1
Continuous
Authentication Pt. 2Enterprise PKI/IDP
Pt. 1

1.9 Integrated ICAM Platform

Enterprise PKI/IDP Pt. 2Enterprise PKI/IDP Pt. 3= Target Level ZT= Advanced ZT
37

Device (1 of 2) - Accelerated
Capability

FY23

FY24

FY25

FY26

FY27

FY28

FY29

FY30

FY31

FY32

Device Health Tool Gap Analysis

2.1 Device Inventory

Enterprise IDP Pt.
1

NPE/PKI Device Under
Management
Enterprise
IDP Pt. 2
Implement C2C/Compliance Based Network Authorization Pt. 1

2.0 Device

2.2 Device Detection andCompliance

Implement C2C/Compliance Based Network Authorization Pt. 2
Integrate Next Gen AV
Tools with C2C
Implement Application
Control & FIM Tools

2.3 Device Authorization w/ RealTime Inspection

Entity Activity Monitoring
Pt. 1

Entity Activity Monitoring
Pt. 2
Fully Integrate Device Security Stack w/ C2C as appropriate
Enterprise PKI Pt. 1
Enterprise PKI
Pt. 2

Deny Device by
Default Policy

Managed and Limited BYOD & IOT Support

2.4 Remote Access

Managed and Full BYOD & IOT
Support Pt. 1

2.5 Partially & Fully Automated
Asset, Vulnerability and PatchManagement= Target Level ZTManaged and Full BYOD & IOT
Support Pt. 2

Implement Asset, Vulnerability and Patch Management Tools= Advanced ZT
38

Device (2 of 2) - Accelerated

2.0 Device

Capability

FY23

FY24

FY25

FY26

FY27

FY28

FY29

FY30

FY31

FY32

2.6 Unified Endpoint
Management (UEM) & Mobile
Device Management (MDM)

Implement UEDM or equivalent Tools

2.7 Endpoint & Extended
Detection & Response (EDR &XDR)Implement Endpoint Detection & Response (EDR) Tools & Integrate w / C2C= Target Level ZTEnterprise Device Management Pt. 1
Enterprise Device Management Pt. 2

Implement Extended Detection & Response (XDR) & Integrate w / C2C Pt. 1
Implement Extended Detection & Response (XDR) & Integrate w / C2C Pt. 2= Advanced ZT
39

Application and Workload - Accelerated
Capability

FY23

FY24

3.1 Application Inventory

Application / CodeIdentification

FY25

FY26

FY27

FY28

FY29

FY30

FY31

FY32

3.0 Application and Workload

Build DevSecOps Software Factory Pt. 1

3.2 Secure Software
Development & Integration

Build DevSecOps Software Factory Pt. 2
Automate Application Security & Code Remediation Pt. 1
Automate Application Security & Code Remediation Pt. 2
Approved Binaries / CodeVulnerability Management Program Pt. 1

3.3 Software Risk Management

Vulnerability Management Program Pt. 2
Continual Validation
Resource Authorization Pt. 1
Resource Authorization Pt. 2
SDC Resource Authorization Pt. 1

3.4 Resource Authorization &Integration

SDC Resource Authorization
Pt. 2

Enrich Attributes for Resource Authorization Pt. 1
Enrich Attributes for Resource Authorization Pt. 2

REST API Micro-Segments

3.5 Continuous Monitoring andOngoing Authorizations= Target Level ZTContinuous Authorization to Operate (ATO) Pt. 1
Continuous Authorization to Operate (ATO) Pt. 2= Advanced ZT
40

Data (1 of 2) - Accelerated
Capability

FY23

4.1 Data Catalog Risk Alignment

FY24

FY25

FY26

FY27

FY28

FY29

FY30

FY31

FY32

Data Analysis
Define Data Tagging Standards

4.2 DoD Enterprise Data
GovernanceInteroperability Standards
Develop Software Defined Storage (SDS) Policy
Implement Data Tagging & Classification Tools
Manual Data Tagging Pt. 1

4.3 Data Labeling and Tagging

Manual Data Tagging
Pt. 2

4.0 Data

Automated Data Tagging & Support Pt. 1
Automated Data Tagging & Support Pt. 2
DLP Enforcement Point Logging and Analysis
DRM Enforcement Point Logging and Analysis
File Activity Monitoring Pt. 1

4.4 Data Monitoring and Sensing

File Activity Monitoring Pt. 2
Database Activity Monitoring
Comprehensive Data Activity Monitoring

Implement DRM and Protection Tools Pt. 1
Implement DRM and Protection Tools Pt. 2

4.5 Data Encryption & Rights
Management

DRM Enforcement via Data Tags and Analytics Pt. 1
DRM Enforcement via Data Tags and Analytics Pt. 2
DRM Enforcement via Data Tags and Analytics Pt. 3= Target Level ZT= Advanced ZT
41

Data (2 of 2) - Accelerated
Capability

FY23

FY24

FY25

FY26

FY27

FY28

FY29

FY30

FY31

FY32

Implement Enforcement Points

4.0 Data

4.6 Data Loss Prevention (DLP)DLP Enforcement via Data Tags and Analytics Pt. 1
DLP Enforcement via Data Tags and Analytics Pt. 2
DLP Enforcement via Data Tags and Analytics Pt. 3
Integrate DAAS Access w/SDS Policy Pt. 1
Integrate DAAS Access w/SDS Policy Pt. 2
Integrate DAAS Access w/SDS Policy Pt. 3

4.7 Data Access Control

Integrate Solution & Policy with Enterprise IDP Pt. 1
Integrate Solution & Policy with Enterprise IDP Pt. 2
Implement SDS Tool and/or integrate with DRM Tool Pt. 1
Implement SDS Tool and/or integrate with DRM Tool Pt. 2= Target Level ZT= Advanced ZT
42

Network and Environment - Accelerated

5.0 Network & Environment

Capability

FY23

FY24

FY25

FY26

FY27

FY28

FY29

FY30

FY31

FY32

Define Granular Control Access Rules & Policies Pt. 1

5.1 Data Flow Mapping

Define Granular Control Access Rules & Policies Pt. 2
Define SDN APIs
Implement SDN Programmable Infrastructure

5.2 Software Defined Networking(SDN)

Segment Flows into Control, Management, and Data Planes
Network Asset Discovery & Optimization
Real-Time Access
Decisions
Datacenter Macro Segmentation

5.3 Macro Segmentation

B/C/P/S Macro Segmentation
Implement Micro segmentation
Application & Device Micro segmentation

5.4 Micro Segmentation

Process Micro segmentation
Protect Data In Transit= Target Level ZT= Advanced ZT
43

Automation & Orchestration - Accelerated
Capability

FY23

FY24

FY25

FY26

FY27

FY28

FY29

FY30

FY31

FY32

Policy Inventory & Development
Organization Access Profile

6.1 Policy Decision Point (PDP)& Policy Orchestration

Enterprise Security Profile Pt. 1

6.0 Automation & Orchestration

Enterprise Security Profile Pt. 2
Task Automation Analysis

6.2 Critical Process Automation

Enterprise Integration & Workflow Provisioning Pt. 1
Enterprise Integration & Workflow Provisioning Pt. 2

6.3 Machine Learning

Implement Data Tagging & Classification ML Tools
Implement AI Automation Tools

6.4 Artificial Intelligence

AI Driven by Analytics decides A&O Modifications
Response Automation Analysis

6.5 Security Orchestration,
Automation & Response (SOAR)

Implement SOAR Tools
Implement Playbooks
Tool Compliance Analysis

6.6 API Standardization

Standardized API Calls & Schemas Pt. 1
Standardized API Calls & Schemas Pt. 2
Workflow Enrichment Pt. 1

6.7 Security Operation Center(SOC) & Incident Response (IR)Workflow Enrichment Pt. 2
Workflow Enrichment Pt. 3
Automated Workflows= Target Level ZT= Advanced ZT
44

Visibility & Analytics - Accelerated
Capability

FY23

FY24

FY25

FY26

FY27

FY28

FY29

FY30

FY31

FY32

Scale Considerations

7.1 Log All Traffic (Network,
Data, Apps, Users)

Log Parsing
Log Analysis

7.0 Visibility & Analytics

Asset ID & Asset Correlation
Threat Alerting Pt. 1

7.2 Security Information andEvent Management (SIEM)

Threat Alerting Pt. 2
Threat Alerting Pt. 3
User/Device Baselines
Implement Analytics Tools

7.3 Common Security and Risk
Analytics

Establish User Baseline Behavior
Baseline & Profiling Pt. 1
Baseline & Profiling Pt. 2

7.4 User and Entity Behavior
Analytics (UEBA)

UEBA Baseline Support Pt. 1
UEBA Baseline Support Pt. 2

7.5 Threat Intelligence
Integration

Cyber Threat Intelligence Program Pt. 1
Cyber Threat Intelligence Program Pt. 2

7.6 Automated Dynamic Policies= Target Level ZT

AI-enabled Network Access
AI-enabled Dynamic Access Control= Advanced ZT
45

Appendix C:
Capability Definitions

Note: There are 45 capabilities and 152 activities. Each capability is defined in the subsequent slides and aligned with activities.
Activit
utcome descri tions are rovided in the e cel s readsheet titled “ DoD ZT Ca abilities and Activities”

Back to Table of Contents46

Capability Definitions
ID #

1.1

1.2

Capability

User Inventory

Conditional User
AccessPillarCapability Description

Capability Outcome

1 - User

Regular and Privileged users are identified andintegrated into an inventory supporting regular System owners have control (visibility andmodifications. Applications, software andadministrative rights) of all authorized andservices that have local users are all part of the authenticated users on the network
inventory and highlighted.

1 - UserThrough maturity levels Conditional Accessworks to create a dynamic level of access for Eventually, organizations control user, device,users in the environment. This starts withand non-user entity DAAS access throughtraditional role-based access controls across a dynamically changing user risk profiles andfederate ICAM, expands to be application
fine-grained access control to include the use
focused roles and ultimately utilizes enterprise of user risk assessments
attributes to provide dynamic access rules.

1.3

Multi-Factor
Authentication(MFA)

1 - User

1.4

Privileged Access
Management(PAM)

1 - User

Impact to ZT
Users not on the authorized user list
will be denied access by policy

Users not known to the system andusers who present an unacceptable
degree of risk will be denied accesswith greater accuracy

Activities* Inventory User

* Implement App Based Permissions perEnterprise* Rule Based Dynamic Access Pt1* Rule Based Dynamic Access Pt2* Enterprise Gov't roles and Permissions Pt1* Enterprise Gov't roles and Permissions Pt2

This capability initially focuses on developing
an organization focused MFA provider and
DoD organizations require users and non-user
Identity Provider to enable the centralization ofentities to authenticate using at least two ofusers. Retirement of local and/or built-in
Users not presenting multiple forms * Organizational MFA/IDP
the following three attributes: knowledge (useraccounts and groups is a critical piece to thisof authentication will be denied* Alternative Flexible MFA Pt1
ID/password), possession (CAC/token), or
capability. At the later maturity levels
access to DAAS system and resources * Alternative Flexible MFA Pt2
something you are (inherence, e.g.,alternative and flexible MFA tokens can beiris/fingerprints), in order to access DAAS
used to provide access for standard andexternal users.
The capability focuses on removal ofpermanent administrator/elevated privileges* Implement System and Migrate Privilegedby first creating a Privileged Account
DoD organizations control, monitor, secure,
Critical assets and applications
Users Pt1
Management (PAM) system and migrating
and audit privileged identities (e.g., throughsecured, controlled, monitored and * Implement System and Migrate Privileged
privileged users to it. The capability is thenpassword vaulting, JIT/JEA with PAWS) across managed through limits on admin
Users Pt2
expanded upon by using automation with
their IT environments
access* Real time Approvals & JIT/JEA Analytics Pt1
privilege escalation approvals and feeding* Real time Approvals & JIT/JEA Analytics Pt2
analytics into the system for anomaly
detection.

Return to Capability Overview

47Capability Definitions
ID #

1.5

Capability

Identity Federation& UserCredentialing

Pillar

1 - User

Capability Description

Capability Outcome

devices.

1.6

Behavioral,
Contextual ID, andBiometrics

1 - User

1.7

Least Privileged
Access

1 - User

1.8

Continuous
Authentication

1 - User

Impact to ZT

Activities

The initial scope of this capability focuses on DoD organizations manually issue, manage, andVisibility and accuracy of user
standardizing the Identity Lifecycle Management
revoke credentials bound to DoD person,
authentication information is(ILM) processes and integrating with the standard device, and NPE identities. Identity information
increased,
to include DoD users andorganizational IDP/IDM solution. Once completed is developed and shared across entitles andusers managed by other agencies.
the capability shifts to establishing an Enterprise
trust domains providing “single sign-on”
Users lacking sufficient credentials
ILM process/solution either through a single
convenience and efficiencies to identified
are denied access according tosolution or identity federation.
(authenticated and authorized) users andestablished policies.

* Organizational Identity Life-Cycle
Management* Enterprise Identity Life-Cycle Management
Pt1* Enterprise Identity Life-Cycle Management
Pt2* Enterprise Identity Life-Cycle Management
Pt3

Utilizing the Enterprise IDP, user and entity
behavioral analytics (UEBA) are enabled with
* Implement User & Entity Behavior Activity
DoD organizations utilize behavioral,
basic user attributes. Once completed this is(UEBA) and User Activity Monitoring (UAM)
contextual, and biometric telemetry to
Behavioral, contextual, and biometric
expanded into Organizational specific attributes
Toolingusing Organizational IDPs as available. Finallyenhance risk-based authentication and accesstelemetry enhances MFA with
* User Activity Monitoring Pt1
UEBA are integrated with the PAM and JIT/JEA
controls* User Activity Monitoring Pt2
systems to better detect anomalous andmalicious activities.
DoD organizations govern access to DAAS using
the absolute minimum access required toUsers on the network only have
perform routine, legitimate tasks or activities.
DoD organizations govern access to DAAS using
access to the DAAS for which they are
DoD Application Owners identify the necessary
the absolute minimum access required to* Deny User by Default Policy
roles and attributes for standard and privileged
authorized and authenticated over a
perform
routine,legitimate
tasksoractivities
user access. Privileged access for all DoD
specific timeframeorganization DAAS is audited and removed when
unneeded.
The DoD organizations and overall enterprise will
methodically move towards continuous attributebased authentication. Initially the capability
focuses on standardizing legacy single
Users not continuously presenting * Single Authentication
authentication to a organizationally approved IDP DoD organizations continuously authenticate multiple forms of authentication will * Periodic Authentication
with users and groups. The second stages adds in and authorize users' access to DAAS within and be denied access to DAAS system and * Continuous Authentication Pt1
across sessions using MFA
based rule based (time) authentication and* Continuous Authentication Pt2
resources
ultimately matures to Continuous Authentication
based on the application/software activities andprivileges requested.

Return to Capability Overview

48

Capability Definitions
ID #Capability

Pillar

1.9

Integrated ICAM
Platform

1 - User2.1

Device Inventory

2 - Device

2.2

Device Detection
and Compliance

2 - Device

Capability Description
Capability Outcome
Impact to ZT
Activities
DoD organizations and overall enterprise
employ enterprise-level identity management
and public key infrastructure (PKI) systems to
DoD organizations employ enterprise-level
track user, administrator and NPE identities
identity management systems to track user andacross the network and ensure access is limited
NPE identities across the network and ensure
to only those who have the need and the right
Identities of users and NPE areaccess is limited to only those who have the* Enterprise PKI/IDP Pt1
to know. Organizations can verify they needcentrally managed to ensureneed and the right to know; organizations can* Enterprise PKI/IDP Pt2
and have the right to access via credential
authorized and authenticated accessverify they need and have the right to access* Enterprise PKI/IDP Pt3
management systems, identity governance andto DAAS resources across platforms
via credential management systems, identity
administration tools, and an accessgovernance and administration tools, and an
management tool. PKI systems can beaccess management tool
federated but must either trust a central root
certificate authority (CA) and/or cross-sign
standardized organizational CA’s.
DoD organizations establish and maintain an
approved inventory list of all devices
authorized to access the network and enroll all
By default policy, devices will be
DoD organizations establish and maintain a* Device Health Tool Gap Analysis
devices on the network prior to network
denied network access; the only
trusted inventory list of all devices authorized* NPE/PKI, Device under Management
connection. Device attributes will include
devices permitted access to theto access the network and enroll all devices on* Enterprise IDP Pt1
technical details such as the PKI (802.1x)
network shall be known, authorized,* Enterprise IDP Pt2
the network prior to network connection
machine certificate, device object,and listed in the device inventory
patch/vulnerability status and others to enablesuccessor activities.
DoD organizations employ asset management DoD organizations employ asset management
Any device attempting to connect tosystems for user devices to maintain and report systems for user devices to maintain and report
the network will be detected; only * Implement C2C/Compliance Based Network
on IT and Cybersecurity compliance. Managed on IT compliance. Any device (including mobile,
those devices that are compliant (e.g., Authorization Pt1
devices (enterprise and mobile) attempting to IOT, managed, and unmanaged) attempting toanti-virus is up to date, approved * Implement C2C/Compliance Based Network
connect to a DoD network or access a DAAS
connect to a DoD network or access a DAAS
configuration) will receive access to Authorization Pt2
resource is detected and has its complianceresource is detected and has its compliancerequested DAAS
status confirmed (via C2C)
status confirmed (via C2C)

Return to Capability Overview

49Capability Definitions
ID #

2.3

Capability

DeviceAuthorization w/
Real Time
Inspection

Pillar

2 - Device

2.4

Remote Access

2 - Device

2.5

Partially & Fully
Automated Asset,
Vulnerability and
PatchManagement

2 - Device

Capability Description

Capability Outcome

Impact to ZT

Activities

DoD organizations establish processes (e.g.,Components can use policies to deny * Entity Activity Monitoring Pt1
DoD Organizations conduct foundational andEnterprise PKI) and utilize tools to identify any
devices by default and explicitly allow * Entity Activity Monitoring Pt2
extended device tooling (NextGen AV,
device (including unmanaged devices,
access to DAAS resources only by* Implement Application Control & File Integrity
AppControl, File Integrity Monitoring (FIM), etc.)
infrastructure devices, and endpoint devices)
devices that meet mandated
Monitoring (FIM) Tools
integration to better understand the risk posture. attempting to access the network, and make aconfiguration standards. Security* Integrate NextGen AV Tools with C2C
Organizational PKI systems are integrated todetermination if the device should be authorized
threats identified are remediated faster * Fully Integrate Device Security stack with C2C as
expand the existing Enterprise PKI to devices as
to access the network. Maturation of thisthrough continuous activity inspection appropriate
well. Lastly Entity Activity Monitoring is also
capability monitoring and detection of thisenables faster remediation of security * Enterprise PKI Pt1
integrated to identify anomalous activities.
activity on endpoints and IT infrastructure in real
threats* Enterprise PKI Pt2
time

DoD organizations audit existing device accessprocesses and tooling to set a least privilege
baseline. In phase 2 this access is expanded to
DoD organizations establish policies to allow* Deny Device by Default Policy
Enables properly authorized andcover basic BYOD and IOT support using theauthorized users and devices access to the* Managed and Limited BYOD & IOT Support
authenticated users and NPEs to access* Managed and Full BYOD & IOT Support Pt1
Enterprise IDP for approved applications. The network or a device from a geographical distance
DAAS from remote locations
through a network connection* Managed and Full BYOD & IOT Support Pt2
final phases expand coverage to include all
BYOD and IOT devices for services using theapproved set of device attributes.
DoD organizations establish processes to
DoD organizations establish processes toautomatically test and deploy vendor patches
Risk is minimized by automaticallyautomatically test and deploy vendor patches for* Implement Asset, Vulnerability and Patch
deploying vendor patches to all
for connected devices; hybrid patch
connected devices; hybrid patch management
Management Tools
network devices
management (both human and automated) is(both human and automated) is employedemployed
DAAS resources are protected through

2.6

Unified Endpoint
Management(UEM) & Mobile
DeviceManagement(MDM)

2 - Device

agent and agentless management, IT is
DoD organizations establish a centralized UEM
able to manage, secure, and deploy
solution that provides the choices of agent
DoD organizations establish a centralized UEM
resources and applications on any
and/or agentless management of computer
tool that provides the choices of agent and/or device from a single console to provide * Implement UEDM or equivalent Tools
agentless management of computer and mobile
and mobile devices to a single console* Enterprise Device Management Pt1
redress of cybersecurity threats.
devices to a single console. DoD-issued mobile
regardless of device location. DoD-issued
Security vulnerabilities are mitigated, * Enterprise Device Management Pt2
devices are remotely managed and security
devices can be remotely managed and security
and policy enforcement measures arepolicies are enforced.
policies are enforced.
received through IT remotemanagement of DoD-issued mobile
devices

Return to Capability Overview

50Capability Definitions
ID #Capability

Pillar

2.7

Endpoint &Extended
Detection &Response (EDR &XDR)

2 - Device

3.1

3.2

3.3

Capability Description

Capability Outcome

Impact to ZT
Activities
Threats originating from networkconnected endpoints are initially
DoD organizations use endpoint detection and* Implement Endpoint Detection & Response
reduced through active investigation
response (EDR) tooling to monitor, detect, andDoD organizations use EDR tools to monitor,(EDR) Tools and Integrate with C2C
and response. Maturation focuses on
remediate malicious activity on endpoints.
detect, and remediate malicious activity on* Implement Extended Detection & Response
Expanding the capability to include XDR tooling endpoints as a baseline. Upgrading to XDR tools forensics and faster threat detection(XDR) Tools and Integrate with C2C Pt1
allows organizations to account for activity
allows organizations to account for activity
and remediation are enabled by* Implement Extended Detection & Response
beyond the endpoints such as cloud and network
beyond the endpoints.
correlating data across multiple(XDR) Tools and Integrate with C2C Pt2
as well.
security layers (e.g., email, cloud,endpoint)

System owners ensure that all applications and System owners ensure that all applications andapplication components are identified andapplication components are identified andUnauthorized applications and3 - Applications inventoried; only applications and application
Application
inventoried; only applications and application
application components are not used * Application/Code Identification
components that have been authorized by theInventory
and Workloads components that have been authorized by theon or within the systemappropriate authorizing official/CISO/CIO shall be appropriate authorizing official/CISO/CIO shall beutilized within the system owner's purview
utilized within the system owner's purview
Organization-defined security controls andZero Trust security concepts,
practices are integrated, to include Zero Trust
processes, and capabilities are* Build DevSecOps Software Factory Pt1
Foundational software and application security
security controls and virtualization, into theaccepted and integrated across the* Build DevSecOps Software Factory Pt2
processes and infrastructure are establishedsoftware development lifecycle and DevOps
DevOps toolchain, to include static
Secure Software
3 - Applications following Zero Trust principles and best practices. toolchain. Custom software development teams* Automate Application Security & Codeand dynamic application security
Development &Remediation Pt1
and Workloads Controls such as code review, runtime protection, use DevSecOps to integrate static and dynamic
Integration
secure API gateways, container and serverless application security testing into software delivery testing necessary for the discovery of * Automate Application Security & Codesecurity are integrated and automated.
workflows in accordance with the organization's weaknesses and vulnerabilities during Remediation Pt2
application development
requirements (policies, technologies, andprocesses).
DoD establishes policies and procedures to secure
DoD organizations establish software/application supply chain cybersecurity for code components
risk management program. Foundational controls within DoD and DIB systems by evaluating andinclude Bill of Materials risk management,
identifying supplier sourcing risk for approved
Code used in DAAS and associated * Approved Binaries/CodeSupplier Risk Management, approved repositories
sources, creating
components of the supply chain is * Vulnerability Management Program Pt1
Software Risk 3 - Applications
and update channels, and vulnerability
repositories and update channels for use by
secure, vulnerabilities are reduced, * Vulnerability Management Program Pt2
Management and Workloads
management program. Additional controls
development teams, creating Bill of Materials forinclude Continual validation within the CI/CD applications to identify source, supportability and and DoD is aware of potential risks * Continual Validation
pipelines and vulnerability maturation withrisk posture, and establishing industry standard
external sources.
(DIB) and approved vulnerability databases foruse in DevSecOps

Return to Capability Overview

51

Capability Definitions
ID #

3.4

3.5

4.1

4.2

4.3

Capability

PillarCapability Description

Capability Outcome

Impact to ZT

Activities

DoD establishes a standardized resource
authorization gateway for authorizations via* Resource Authorization Pt1
the CI/CD pipelines in a risk approach that
* Resource Authorization Pt2
Resource authorization enables thereviews the User, Device and Data security* SDC Resource Authorization Pt1
DoD establishes a standard approach managing ability for limited access to thoseposture. Authorizations utilize a programmatic
Resource* SDC Resource Authorization Pt2
3 - Applications
the authorizations of resources in a risk
resources and in a programmatic way(e.g., Software Defined) approach in a
Authorization &* Enrich Attributes for Resource Authorization
approach that reviews the User, Device andin later stages. This improvise theand Workloads
live/production environment. Attributes are
Pt1
Integration
ability to remove access when it is not
Data security posture.
enriched utilizing other pillar activities and the* Enrich Attributes for Resource Authorizationneeded.
API and Authorization gateway. Approved
Pt2
enterprise APIs are micro-segmented using* REST API Micro-Segments
authorizations.
DoD organizations employ automated tools
Continuous* Continuous Authorization to Operate (cATO)
DoD organizations employ automated tools andNear real time visibility into theand processes to continuously monitor
Monitoring and 3 - Applications
Pt1
processes to continuously monitor applications
effectiveness of deployed security
applications and assess their authorization to
Ongoing* Continuous Authorization to Operate (cATO)and Workloads
and assess their authorization to operatecontrols
Pt2
operateAuthorizations
Data owners ensure that data is identified and Data owners ensure that data is identified andData assets are known and caninventoried and any changes to the data
inventoried and any changes to the data
therefore be collected, tagged, andlandscape are automatically detected andlandscape are automatically detected andData Catalog Risk
protected according to risk levels inincluded within the catalog. The data landscape included within the catalog. The data landscape* Data Analysis
4 - Dataalignment with a prioritization
Alignment
must then be reviewed to identify potential
must then be reviewed to identify potential
framework, and encrypted forrisks related to data loss, attack, or any other risks related to data loss, attack, or any otherprotection
unauthorized alteration and/or access
unauthorized alteration and/or access
DoD establishes enterprise data
Decision rights and accountability
labeling/tagging and DAAS access
DoD establishes enterprise data
* Define Data Tagging Standards
framework ensure appropriate
control/sharing policies (e.g., SDS policy) thatlabeling/tagging and DAAS access
DoD Enterprise* Interoperability Standards
behavior in the valuation, creation,
4 - Data
are enforceable. Developed enterprisecontrol/sharing policies (e.g., SDS policy) that* Develop Software Defined Storage (SDS)
Data Governanceconsumption, and control of data andstandards ensure an appropriate level of
Policyare enforceable at the field level
analytics
interoperability between DoD Organizations.
* Implement Data Tagging & Classification
Data owners label and tag data in compliance
Establishing machine enforceable
Toolswith DoD enterprise governance on
Data owners label and tag data in compliance data access controls, risk assessment,
Data Labeling and* Manual Data Tagging Pt1
labeling/tagging policy. As phases advancewith DoD enterprise governance on
and situational awareness require
4 - Data* Manual Data Tagging Pt2
Tagging
automation is used to meet scaling demands
consistently and correctly labeled andlabeling/tagging policy* Automated Data Tagging & Support Pt1
and provide better accuracy.
tagged data
* Automated Data Tagging & Support Pt2

Return to Capability Overview

52

Capability Definitions
ID #

4.4

4.5

4.6

4.7

Capability

Data Monitoringand Sensing

Data Encryption &RightsManagement

Data Loss
Prevention (DLP)

Data AccessControl

PillarCapability Description

Capability Outcome

Impact to ZT

Activities

4 - Data

Data owners will capture active metadata that
includes information about the access, sharing,transformation, and use of their data assets. Data
Loss Prevention (DLP) and Data Rights
Data owners will capture active metadata that
Data in all states are detectable andManagement (DRM) enforcement point analysis isincludes information about the access, sharing,
conducted to determine where tooling will beobservabletransformation, and use of their data assets
deployed. Data outside of DLP and DRM scope
such as File Shares and Databases is actively
monitored for anomalous and malicious activity
using alternative tooling.

4 - Data

DoD organizations establish and implement a
strategy for encrypting data at rest and in transit
DoD organizations establish and implement ausing Data Rights Management (DRM) tooling.
strategy for encrypting data at rest and in
The DRM solution utilizes data tags to determine
transitprotection and lastly integrates with ML and AI toautomate protection

4 - Data

DoD organizations utilize the identified
enforcement points to deploy approved DLP tools
and integrate tagged data attributes with DLP. DoD organizations have identified enforcement
Data breaches and data exfiltration
Initially the DLP solution is put into a "monitor- points, deployed approved DLP tools at thosetransmissions are detected andonly" mode to limit business impact and later enforcement points, and integrate tagged data
mitigatedusing analytics is put into a "prevent" mode.
attributes with DLPExtended data tag attributes are used to feed the
DLP solution and lastly integrate with ML and AI.

4 - Data* Integrate DAAS Access w/ SDS Policy Pt1* Integrate DAAS Access w/ SDS Policy Pt2* Integrate DAAS Access w/ SDS Policy Pt3
DoD organizations ensure appropriate access to
Unauthorized entities, or any entity* Integrate Solution(s) and Policy withand use of data based on the data andon an unauthorized device cannot
Enterprise IDP Pt1
user/NPE/device properties. Software Defined DoD organizations ensure appropriate access toaccess data; Zero Trust cybersecurity
Storage (SDS) is utilized to scale manage
and use of data based on the data and* Integrate Solution(s) and Policy withwill be sufficiently strong to separate
permissions to DAAS. Lastly the SDS solution(s) isEnterprise IDP Pt2
user/NPE/device properties
community of interest data access for
integrated with DRM tooling improving* Implement SDS Tool and/or integrate withdata in the same classification
protections.
DRM Tool Pt1* Implement SDS Tool and/or integrate with
DRM Tool Pt2* DLP Enforcement Point Logging and Analysis* DRM Enforcement Point Logging and Analysis* File Activity Monitoring Pt1* File Activity Monitoring Pt2* Database Activity Monitoring* Comprehensive Data Activity Monitoring* Implement DRM and Protection Tools Pt1* Implement DRM and Protection Tools Pt2* DRM Enforcement via Data Tags andEncrypting data in all states reduces
Analytics Pt1
the risk of unauthorized data access* DRM Enforcement via Data Tags andand improves data security
Analytics Pt2* DRM Enforcement via Data Tags andAnalytics Pt3* Implement Enforcement Points* DLP Enforcement via Data Tags and Analytics
Pt1* DLP Enforcement via Data Tags and Analytics
Pt2* DLP Enforcement via Data Tags and Analytics
Pt3

Return to Capability Overview

53

Capability Definitions
ID #

5.1

5.2

5.3

5.4

Capability

PillarCapability Description

Capability Outcome

Impact to ZT

Activities

DoD organizations reconcile data flows by
DoD organizations reconcile data flows bygathering, mapping, and visualizing network
Sets the foundation for network * Define Granular Control Access Rules &5 - Network
gathering, mapping, and visualizing network
traffic data flows and patterns to ensure
Data Flowsegmentation and tighter access Policies Pt1
andtraffic data flows and patterns to ensureauthorized access and protection for network
control by understanding data traffic * Define Granular Control Access Rules &Mappingauthorized access and protection for network
Environmentand DAAS resources specifically tagging
Policies Pt2
on the network
and DAAS resources
programmatic (e.g., API) access when possible.
DoD organizations define API decision points
and implement SDN programmableinfrastructure to separate the control and data
* Define SDN APIs* Implement SDN
DoD organizations define API decision points
planes and centrally manage and control the
Enables the control of packets to a Programable Infrastructure
5 - Network
and implement SDN programmableelements in the data plane. Integrations are
Software Defined
centralized server, provides* Segment Flows into Control, Management,
andinfrastructure to separate the control and data
conducted with decision points andadditional visibility into the network, and Data Planes
Networking (SDN)
planes and centrally manage and control theEnvironment
segmentation gateway to accomplish the planeand enables integration requirements * Network Asset Discovery & Optimization
elements in the data plane
separation. Analytics are then integrated to* Real-Time Access Decisions
real time decision making for access toresources.
DoD organizations establish network
boundaries and provide security against
networked assets located within anenvironment by validating the device, user, or
NPE on each attempt of accessing a remoteresource prior to connection.

DoD organizations establish network
perimeters and provide security against
Network segmentation is defined by adevices located within an environment bylarge perimeter to enable resource * Datacenter Macro segmentation
validating the device, user, or NPE on eachsegmentation by function and user * B/C/P/S Macro segmentation
attempt of accessing a remote resource priortype
to connection

Macro
Segmentation

5 - Network
andEnvironment

Micro
Segmentation

Network segmentation enabled bynarrower and specific segmentation
DoD organizations define and document
in a virtualized environment via
network segmentation based on identity and /identity and / or application access,or application access in their virtualized and/or
DoD organizations define and document* Implement Micro segmentation
5 - Network
allowing for improved protection ofcloud environments. Automation is used to network segmentation based on identity and /* Application & Device Micro segmentation
anddata in transit as it crosses systemapply policy changes through programmatic or application access in their virtualized cloud* Process Micro segmentation
boundaries (e.g., in a coalition
Environment(e.g., API) approaches. Lastly where possible* Protect Data In Transit
environments
environment, system highorganizations will utilize host-level process
boundaries) and supported dynamic,
micro segmentation.
real-time access decisions and policychanges

Return to Capability Overview

54Capability Definitions
ID #Capability

6.1

Policy Decision
Point (PDP) &PolicyOrchestration

Capability Description
Capability Outcome
Impact to ZT
Activities
DoD organizations initially collect andDoD organizations initially collect anddocument all rule-based policies to orchestrate document all rule-based policies to orchestrateacross the security stack for effective
across the security stack for effective
automation; DAAS access procedures andautomation; DAAS access procedures and
PDPs and PEPs ensure proper
policies will be defined, implemented, andpolicies will be defined, implemented, and* Policy Inventory & Development
6 - Automation
implementation of DAAS accessupdated. Organizations mature this capability updated. Organizations mature this capability* Organization Access Profile
andpolicies to users or endpoints that are
by establishing PDPs and PEPs (including theby establishing PDPs and PEPs (including the* Enterprise Security Profile Pt1
properly connected (or denied access)Orchestration
Next Generation Firewall) to make DAAS
Next Generation Firewall) to make DAAS
* Enterprise Security Profile Pt2
to requested resources
resource determinations and enable, monitor, resource determinations and enable, monitor,
and terminate connections between aand terminate connections between auser/device and DAAS resources according to user/device and DAAS resources according topredefined policy.
predefined policy
Pillar

DoD organizations employ automation
methods, such as RPA, to address repetitive,
6 - Automation
predictable tasks for critical functions such as
anddata enrichment, security controls, andOrchestration
incident response workflows according tosystem security engineering principles.

6.2

Critical Process
Automation

DoD organizations employ automation
methods, such as RPA, to address repetitive,
predictable tasks for critical functions such asdata enrichment, security controls, andincident response workflows according tosystem security engineering principles

Response time and capability is
increased with orchestrated
workflows and risk management
processes* Task Automation Analysis* Enterprise Integration & Workflow
Provisioning Pt1* Enterprise Integration & Workflow
Provisioning Pt2

6.3

DoD organizations employ ML to execute (and DoD organizations employ ML to execute (and6 - Automation
enhance execution of) critical functions such as enhance execution of) critical functions such as
andMachine Learning
incident response, anomaly detection, user
incident response, anomaly detection, user
Orchestration
baselining, and data tagging.
baselining, and data tagging

Response time and capability is
increased with orchestrated
workflows and risk management
processes* Implement Data Tagging & Classification ML
Tools

DoD organizations employ AI to execute (and DoD organizations employ AI to execute (and6 - Automation
enhance execution of) critical functions enhance execution of) critical functions andparticularly risk and access determinations and particularly risk and access determinations andOrchestration
environmental analysis.
environmental analysis

Response time and capability is
increased with orchestrated
workflows and risk management
processes* Implement AI automation tools* AI Driven by Analytics decides A&O
modifications

6.4

Artificial
Intelligence

Return to Capability Overview

55Capability Definitions
ID #Capability

PillarCapability Description

Capability Outcome

Impact to ZT

Activities

6.5

DoD organizations achieve initial operational
DoD organizations achieve IOC of security
capability of security technologies totechnologies to orchestrate and automate
Pre-defined playbooks from collection
orchestrate and automate policies (e.g., PEPs policies (e.g., PEPs and PDPs) and rulesets toSecurity
6 - Automation
to incident response and triage* Response Automation Analysis
and PDPs) and rulesets to improve security
Orchestration,
improve security operations, threat andandenables initial process automation * Implement SOAR Tools
operations, threat and vulnerability
Automation &vulnerability management, and security
that accelerates a security team's * Implement Playbooks
Orchestration
management, and security incident response
incident response by ingesting alert data,
Response (SOAR)
decision and response speed
by ingesting alert data, triggering playbooks for triggering playbooks for automated response
automated response and remediation.
and remediation

6.6

DoD establishes and enforces enterprise-wide
DoD establishes and enforces enterprise-wide
API
6 - Applications programmatic interface (e.g., API ) standards;
API standards; all non-compliant APIs are
all non-compliant APIs are identified andStandardization and Workloads
identified and replaced
replaced.

6.7

7.1

Standardizing APIs across the* Tool Compliance Analysis
department improves application* Standardized API Calls & Schemas Pt1
interfaces, enabling orchestration,* Standardized API Calls & Schemas Pt2
and enhancing interoperability

In the event a computer network defense
service provider (CNDSP) does not exist, DoD
organizations define and stand up security
In the event a CNDSP does not exist, DoD
operations centers (SOC) to deploy, operate,
7 - Visibility
organizations define and stand up SOCs toand maintain security monitoring, protections
Security* Workflow Enrichment Pt1
and Analytics 6
deploy, operate, and maintain security
Standardized, coordinated, andand response for DAAS; SOCs provide security
Operations Center* Workflow Enrichment Pt2- Automation
monitoring, protections and response foraccelerated incident response andmanagement visibility for status (upward(SOC) & Incident* Workflow Enrichment Pt3
and
DAAS; SOCs provide security management
investigative efforts
visibility) and tactical implementation* Automated Workflow
Response (IR)visibility for status (upward visibility) and
Orchestration(downward visibility). Workflows within thetactical implementation (downward visibility)
SOC are automated using automation toolingand enrichment occurs between service
providers and technologies.
DoD organizations collect and process all logs
including network, data, application, device,
DoD organizations collect and process all logs
and user logs and make those logs available to
Log All Traffic
including network, data, application, device, Foundational to the development of * Scale Considerations
the appropriate Computer Network Defense
7 - Visibility(Network, Data,and user logs and make those logs available toautomated hunt and incident* Log Parsing
and Analytics Service Provider (CNDSP) or security operations
the appropriate Computer Network Defense* Log Analysis
Apps, Users)
response playbooks
center (SOC). Logs and events follow a
Service Provider (CNDSP) or SOC
standardized format and rules/analytics aredeveloped as needed.

Return to Capability Overview

56Capability Definitions
ID #Capability

PillarCapability Description

Capability Outcome

Impact to ZT

Activities

7.2

Security
Information and
EventManagement(SIEM)

Computer Network Defense Service Provider(CNDSP) or security operations centers (SOC)
monitor, detect, and analyze data logged into asecurity information and event management(SIEM) tool. User and device baselines are
7 - Visibility
and Analytics created using security controls and integrated
with the SIEM. Alerting within the SIEM ismatured over the phases to support moreadvanced data points (e.g., Cyber Threat Intel,
Baselines, etc.)

CNDSPs/SOCs monitor, detect, and analyze
data logged into a security information andevent management (SIEM) tool

Processing and exploiting data in the* Threat Alerting Pt1
SIEM enables effective security* Threat Alerting Pt2
analysis of anomalous user behavior,* Threat Alerting Pt3
alerting, and automation of relevant* Asset ID & Alert Correlation
incident response to common threat* User/Device Baselines
events7.3

Computer Network Defense Service Provider(CNDSP) or security operations centers (SOC)
Common Security 7 - Visibility
employ data tools across their enterprises for
and Risk Analytics and Analytics
multiple data types to unify data collection andexamine events, activities, and behaviors.

CNDSPs/SOCs employ big data tools acrosstheir enterprises for multiple data types tounify data collection and examine events,
activities, and behaviors

Analysis integrated across multiple* Implement Analytics Tools
data types to examine event,* Establish User Baseline Behavior
activities, and behaviors

7.4

7.5

DoD organizations initially employ analytics toprofile and baseline activity of users and
DoD organizations initially employ analytics toentities and to correlate user activities andprofile and baseline activity of users andbehaviors and detect anomalies. Computer
entities and to correlate user activities and* Baseline & Profiling Pt1
Network Defense Service Provider (CNDSP) or behaviors and detect anomalies. CNDSPs/SOCs Advanced analytics support detection
User and Entity
7 - Visibility* Baseline & Profiling Pt2
security operations centers (SOC) mature this mature this capability through the employment of anomalous users, devices, and NPE* UEBA Baseline Support Pt1
Behavior Analytics and Analytics
capability through the employment ofof advanced analytics to profile and baseline
actions and advanced threats* UEBA Baseline Support Pt2
advanced analytics to profile and baseline
activity of users and entities and to correlate
activity of users and entities and to correlateuser activities and behaviors, and detectuser activities and behaviors, and detect
anomalies
anomalies.
Computer Network Defense Service Provider(CNDSP) or security operations centers (SOC)
CNDSPs/SOCs integrate threat intelligence
integrate threat intelligence information andinformation and streams about identities,
Integrating threat intelligence into
Threat Intelligence 7 - Visibility* Cyber Threat Intelligence Program Pt1
streams about identities, motivations,motivations, characteristics, and tactics,
other SIEM data enhances monitoring* Cyber Threat Intelligence Program Pt2
Integration
and Analytics
characteristics, and tactics, techniques andtechniques and procedures (TTPs) with data
efforts and incident response
procedures (TTPs) with data collected in thecollected in the SIEM
SIEM.

Return to Capability Overview

57Capability Definitions
ID #

7.6

Capability

Automated
Dynamic Policies

PillarCapability Description

DoD Organization ML & AI solutions
dynamically and automatically update security
profiles and device configuration through7 - Visibility
and Analytics continuous security posture monitoring, risk
and confidence scoring, and automated patch
management.

Capability Outcome
CNDSPs/SOCs dynamically and automatically
update security profiles and device
configuration through continuous security
posture monitoring, risk and confidence
scoring, and automated patch management

Impact to ZT

Activities

Users and NPEs are denied accessbased on automated, real-time* AI-enabled Network Accesssecurity profiles based on external* AI-enabled Dynamic Access Control
conditions and evolving risk andconfidence scores

Return to Capability Overview

58