Zero Trust Maturity (CISA ZTMM v2.0)
167 questions against CISA's zero trust maturity model, scored per function from Traditional to Optimal.
167 controls · 6 pillars · 40 categories · evidence can be collected automatically
167 questions against CISA's zero trust maturity model, scored per function from Traditional to Optimal.
167 controls · 6 pillars · 40 categories · evidence can be collected automatically
Zero trust is bought as a product far more often than it is reached as an architecture, and the gap between the two is where budget disappears. CISA publish a maturity model that describes the journey in stages, which makes it possible to say where an organisation actually is rather than which tools it owns. This review produces that position, pillar by pillar, with the next stage described as work rather than as licences.
167 questions across six pillars - identity (28), devices (29), networks (29), applications and workloads (33), data (33) and cross-cutting capabilities (15) - grouped into 40 categories and scored per question. Each function is placed at Traditional, Initial, Advanced or Optimal, with a zero beneath that for functions nobody performs at all, so a gap reads as a stage to reach rather than a pass or a fail. Read-only collector scripts your own team runs in your own tenancy answer the cloud and identity questions, which keeps the interview time on the categories that genuinely need a conversation.
The questions ask what is enforced rather than what is configured somewhere: whether every user and non-person identity authenticates with phishing-resistant multi-factor authentication instead of a password alone, whether an administrator can inspect a device's actual configuration and patch level rather than trust what the device reports about itself, and whether the network is divided more finely than one large perimeter with critical workloads isolated. Evidence comes from read-only collector scripts the client runs in their own tenancy - cloud control-plane reads against AWS, Azure and GCP, plus GitHub and Azure DevOps project settings - written out as one JSON file in a fixed schema. The collector answers nothing on its own: each signal is mapped to the questions it evidences and offered as a suggested score the assessor accepts or overrides.
167 controls across 6 pillars and 40 categories. Every one is scored, and a control nobody can answer is recorded as unanswered rather than counted as a pass.
Your team runs read-only collector scripts in your own tenancy against AWS, Azure, GCP, GitHub and Azure DevOps, and the JSON they produce is mapped to the questions it evidences as a suggested score the assessor accepts or overrides.
A collector reads configuration, not intent, so it cannot tell you whether a policy that exists is enforced on the live request path or merely present in the tenancy.
Public-sector bodies are increasingly asked to state a zero trust position in a programme business case, and scoring against a published model makes that statement defensible.
Defence and critical infrastructure estates mix modern cloud with systems that cannot be re-architected, and a stage per function lets each be scored honestly instead of averaged away.
Financial services firms usually score well on identity already, so the findings that matter sit in the applications and data pillars where 66 of the questions live.
A fixed fee for the engagement, not an annual licence. The band follows the size of the bank: this one is standard at 167 controls.
£3,500
Per engagement, excluding VAT.
£9,000
Per engagement, excluding VAT.
Hold three or more and the Combined Security View is produced at no extra charge: it is derived from the banks you already hold rather than assessed again. See the full assessment rate card, or build a quote with this assessment in it.
There are 16 of them, and the honest answer is that most organisations need two or three rather than all of them. Tell us what you run and what you are being asked to prove.