DoD Zero Trust Reference Architecture v2.0

Why does it matter?

The ZT RA replaces the assumption that a network perimeter protects data with a model in which every user, device, application and data flow is verified for each access. It matters because the DoD's own stated problem is that defense in depth produced complicated and redundant capabilities, while teleworking and cloud moved DoD data onto platforms outside the traditional boundary (section 1.5).

Key benefits include:

• A common vocabulary

The seven pillars and a capability taxonomy give DoD and vendors the same terms for identity, devices, networks, applications, data, visibility and automation (sections 2.3 and 3.1).

• Five tenets that drive design

Assume a hostile environment, presume breach, never trust and always verify, scrutinize explicitly, and apply unified analytics (section 2.2).

• Data at the center

The data pillar sits at the center of the model, surrounded by the protection pillars that work together to secure it (section 2.3).

• Use cases that show the pattern

The use cases in section 4 and the architecture patterns in section 7, such as micro-segmentation and conditional authorization, show how capabilities combine.

• A transition path

A maturity model, baseline and transition view guide movement from today's environment to the target (section 8).

How does it work?

The architecture is organized in ten sections: purpose and strategic goals (1), pillars and principles (2), capabilities (3), use cases (4), technical positions (5), security assessment (6), architecture patterns (7), transition architecture planning (8), an appendix (9) and references (10). It uses DoD Architecture Framework viewpoints such as OV, SV and CV for its diagrams.

The seven pillars are User, Device, Network/Environment, Applications and Workload, Data, Visibility and Analytics, and Automation and Orchestration. The capability taxonomy groups capabilities into continuous authentication, conditional authorization, enabling infrastructure, securing application and workload, securing data, and automation, analytics and orchestration.

Mission Owners apply the principles to their own environments, aligning with the DoD Cybersecurity Reference Architecture, the DoD identity, credential and access management design and NIST SP 800-207 (section 5.3). The DoD CIO Zero Trust Strategy sets the vision, goals and roadmap that this architecture supports.

Key Elements

• Five tenets (section 2.2)

Assume a hostile environment, presume breach, never trust and always verify, scrutinize explicitly, and apply unified analytics to data, applications, assets and services.

• Seven pillars (section 2.3)

User, Device, Network/Environment, Applications and Workload, Data, Visibility and Analytics, and Automation and Orchestration. Each is a key focus area for implementing zero trust controls.

• Seven principles (section 2.4)

No implicit trusted zone, identity-based authentication for all connections, machine-to-machine authentication, risk profiles from near-real-time monitoring, encryption of sensitive data in transit and at rest, continuous monitoring of events, and centralized policy management.

• Capability taxonomy (section 3 and Appendix 9.6)

A layered set of capabilities and sub-capabilities mapped to the pillars, with a table of definitions in the appendix.

• Use cases and patterns (sections 4 and 7)

Data-centric protections, VPN-less implementation, east-west segmentation, device hygiene, continuous authentication, conditional authorization, software defined perimeter, micro-segmentation and macro-segmentation.

• Transition planning (section 8)

A maturity model plus baseline and transition views that show how to move toward the target state.

What does it cover?

The ZT RA applies to DoD Mission Owners, the individuals and organizations responsible for a mission environment and its functional and cybersecurity requirements, and to the DoD enterprise capabilities they use. It describes enterprise standards and capabilities, not specific products, and it is meant to be updated as requirements and technology change (section 1.3).

What are its objectives?

The ZT RA gives DoD a shared zero trust target and a shared language for reaching it.

Move defenses from static network perimeters to users, assets and data.

Define seven pillars and a capability taxonomy that Mission Owners and vendors can both use.

Apply five tenets and seven principles consistently to design decisions.

Show how capabilities combine through use cases and architecture patterns.

Support an incremental migration from a baseline to a target state.

Framework in Context

The ZT RA is one of a family of DoD architectures. It extends the DoD Cybersecurity Reference Architecture toward a data-centric model and ties to the DoD ICAM design, and it follows NIST SP 800-207, which the RA summarizes in section 5.3.3 and which CISA adapts in its Zero Trust Maturity Model. The DoD Zero Trust Strategy sets goals and a roadmap, while this document describes the architecture.

Common Framework Mappings

Organizations commonly map the DoD Zero Trust Reference Architecture v2.0 to established cybersecurity frameworks to unify controls, strengthen risk management, and simplify compliance across multi-framework environments.

Mapped frameworks include:

CIS Critical Security Controls

CISA Zero Trust Maturity Model

DISA Security Technical Implementation Guides (STIGs)

ISO/IEC 27001

MITRE ATT&CK

NIST Cybersecurity Framework

NIST SP 800-207

NIST SP 800-53