How to Score an Agency Against the CISA Zero Trust Maturity Model

It is a guide from the Cybersecurity and Infrastructure Security Agency (CISA) for measuring progress toward zero trust. Version 2.0, dated April 2023, has five pillars: Identity, Devices, Networks, Applications and Workloads, and Data. Three cross-cutting capabilities run through them: Visibility and Analytics, Automation and Orchestration, and Governance.

Each row of the model describes four stages. They run from Traditional (manual lifecycles, static policies, one pillar at a time) through Initial (starting automation) and Advanced (automated controls "wherever applicable," coordinated across pillars) to Optimal ("fully automated, just-in-time lifecycles" and dynamic least privilege enterprise-wide).

The working unit is the function. Each pillar table lists its own functions (four each for Identity, Devices and Networks, five each for Applications and Data) plus the three cross-cutting capabilities. That comes to 37 rows, and Table 7 adds a high-level row for each of the three capabilities.

No, by its own description, though M-22-09 is. Page 12 says the model "should not be viewed as a strict set of requirements but as a general guide." OMB Memorandum M-22-09, issued January 26, 2022, "requires agencies to achieve specific zero trust security goals by the end of Fiscal Year (FY) 2024," and says those goals "are organized using the zero trust maturity model developed by CISA."

The FY 2024 date has passed, and OMB's August 31, 2026 memo M-26-18 still lists M-22-09 among the policies agencies should follow when managing digital identity. As of November 6, 2026, we didn't find a memo that replaces it, though OMB has rescinded the logging memo it relies on (more below). Ask your Chief Information Security Officer's office how OMB currently tracks these goals.

CPSC's audit assessed the agency's implementation "in accordance with" M-22-09 and version 2.0 of the model. Which measure applies in your own review is for your agency and its inspector general to decide. For the identity requirements, see our post on phishing-resistant MFA.

Mostly between Initial and Advanced, by our reading. Neither document publishes this crosswalk. We matched each action's wording to the stage cell it most resembles, so treat the right-hand column as a starting point for discussion. We picked nine actions that map to a single function; the memo has others, such as public vulnerability disclosure and third-party testing.

None of the nine actions, as OMB words them, reads like an Optimal cell. The memo's vision statements come closer: a "complete inventory of every device," against Optimal's "view of all assets," and "treat all applications as internet-connected," against Optimal's "all applicable applications." CPSC's auditor wrote that "under the ZTMM there is no mandated target maturity level, such as 'Advanced' or 'Optimal,' that agencies are required to achieve." The model says that when planning implementation, agencies should decide based on "risk, mission, federal requirements, and operating constraints," and that "required levels of effort and realized benefits will significantly increase" as maturity progresses.

The federal zero trust site's summary of the model does say it is "designed to provide agencies with a roadmap and resources to achieve an optimal zero trust environment," so expect the question to come up.

M-22-09's "initial automation" of data categorization lands in the model's Advanced cell, because the model's Initial cell is manual. Having a capability isn't the same as reaching a stage either: CPSC's report says the agency employs phishing-resistant MFA, and Authentication was still rated Initial.

The model says agencies should assess their current state first but doesn't prescribe a method. This is the sequence we'd use.

1. Set the scope. The model is "generally aligned to a federal enterprise's single administrative domain or accreditation boundary," so decide which one you're scoring and write it down. The model doesn't say how to roll boundary scores up to an agency, so decide and record that too.
2. Build one row per function. Record the current stage, the evidence, an owner, the date, the target stage and the reason for that target.
3. Score against the cell text, with evidence attached. Award a stage only if someone can show the statement is true today. Agree first on what "begins to" means, since many Initial and Advanced cells open with it and the phrase invites generous scoring. Cells often bundle several claims, such as encryption, key rotation and cryptographic agility, so decide up front whether a partial match earns the stage. The guiding criteria on page 9 are the tiebreaker.
4. Set targets by risk and mission.
5. Mark dependencies. Page 7 says each pillar "can progress at its own pace" until cross-pillar coordination is required. Continuous authorization under Application Access, for example, draws on signals other pillars have to supply, so check those rows before promising a date.
6. Date it and schedule the next one.

Score the cross-cutting rows too. Table 7's Governance row at Traditional describes policies enforced via "manual processes or static technical mechanisms," which fits a lot of written policy that nobody has automated.

CPSC's audit, report 26-A-02, is a public example. "Each function within the respective ZT pillars and cross-cutting capabilities was assessed independently." We counted the ratings from the report's five tables.

This is one agency, so it isn't a federal benchmark, and Traditional doesn't mean no controls. The auditor "verified the presence of baseline ZT controls across all five ZTMM pillars," said CPSC met M-22-09's requirement to provide a strategy, and issued no Notices of Findings. The audit covered activity through September 2025.

Read the match between self-assessment and audit with care. It held in every row, but the test plan "was specifically designed to validate whether the requirements associated with the CPSC's self-assigned maturity levels were met," and the auditor "did not conduct procedures to identify missing information" in the self-assessment. The evidence is concrete: Data Categorization was rated Traditional with the note that labels are "applied manually at the user's discretion rather than automatically."

The two suggestions were about upkeep. The self-assessment dated from February 2024, so the auditor suggested an update and a policy requiring regular ones, to reduce "the risk of control degradation, resource misalignment, or gaps in coverage."

Logging, for one. Page 11 says the model does not address incident response or "specifics for logging, monitoring, alerting, forensic analysis, risk acceptance, recovery." M-22-09 points to OMB M-21-31 for logging, but M-26-14, dated May 22, 2026, says "M-21-31 is rescinded." It also says CISA's logging reference architecture "will align with the Zero Trust Maturity Model." Appendix C of that memo has its own maturity model, with labels including Initial, Advanced and Optimal, scored per information system, so don't carry a logging level across as if it were the same scale.

Depth on individual functions also lives elsewhere. CISA's July 29, 2025 microsegmentation guidance addresses a topic the model places in the Networks pillar and offers a four-phase plan. Several encryption cells ask for cryptographic agility, which connects to the federal post-quantum migration.

Find your agency's last self-assessment and check its date. If it's older than your current architecture, it's the first gap. Start from the implementation plan your agency sent OMB and CISA under M-22-09, the first document CPSC's auditor lists inspecting. Then run the nine rows above, followed by the rest of the memo, and ask your inspector general's office which version of the model it expects to use. Resulting changes often touch authentication and network boundaries, so plan for security review as you would for any change affecting an ATO. Our cybersecurity practice covers Zero Trust aligned to NIST SP 800-207.