Zero Trust Cybersecurity Maturity Level Report

Zero Trust Maturity Level 0 (Non - Existent)
Companies at this level have not yet decided to include zero trust in the roadmap.
Level 1 (Initial)
Zero Trust is on the roadmap. In this preparatory phase, organizations are deploying initial discovery and assessment activities.
Level 2 (Basic)
At this basic level, fundamental zero trust capabilities are implemented. The strategy here is to start small and focus on strategic wins.
Level 3 (Intermediate)
At the intermediate level, the capabilities are further integrated and refined. The strategy at this level is to advance zero trust through more robust identity management, data security, and advanced threat detection and response capabilities.
Level 4 (Advanced)
At this matured level, organizations have deployed advanced controls with robust analytics and orchestration. The strategy for this level is to mature and extend Zero Trust to advance threat intelligence, automation of the SOC, seamless access for end-users and so on.
Level 5 (Optimised)
At this level of optimization, there is an enterprise-wide, integrated, and highly automated approach to zero trust implementation and its monitoring and reporting, which is being refined through continuous improvement.
Source: Adapted from "Zero Trust Journey Across the Digital Estate" by authors Abbas Kudrati and Binil A. Pillai.
The book is available at: Amazon.
Zero Trust Dimension
There are eight dimensions that organizations should work on to effectively improve the maturity of their zero trust implementations. They are: Identity, Endpoint/Devices, Application & Workload, Infrastructure, Data, Network, Visibility & Analytics and Automation & Orchestration.
Identity (ID)
Identities are defined as the common dominator across networks, endpoints, and applications, such as people, services, or IoT devices.
Endpoint/Device (EN)
Devices refer to various hardware assets that access data on the Internet, such as smartphones, IoT devices, laptops, bring your own device (BYOD), partner-managed devices, and cloud-hosted servers.
Application & Workload (AW)
Applications and workloads consist of computer programs, systems, and services (whether executed on-premises or in the cloud).
Infrastructure (DA)
Infrastructure can be described as the hardware, software (open source, first-and third-party), microservices (functions, APIs), networking infrastructure, facilities and so forth necessary to develop, test, deliver, monitor, or support IT services, whether local or multi-cloud (Microsoft, 2021).
Network (NE)
The network dimension of a zero trust implementation involves essentially segmentation, isolation, and control of the network.
Data (IN)
In a zero-trust environment, data security is primarily concerned with managing data, classifying data, designing data classification schemas, encrypting data both in transit and at rest (Cunningham, 2018).
Visibility & Analytics (VA)
Visibility and analytics refer to making all security-relevant activities occurring in the network visible and understanding them through analytics.
Automation & Orchestration (AO)
Automation and Orchestration comprise the utilization of tools and technologies to automate and orchestrate processes across organizations.