Measuring Zero Trust Maturity: An Evidence-Based Assessment Instrument Aligned with NIST SP 800-207, CISA's Maturity Model, and the 2024 Federal Milestone

Abstract

Background: Zero trust has become the organizing security paradigm of the mid-2020s, but its adoption is routinely claimed more often than it is demonstrated. The 2024 policy environment sharpened this problem: OMB M-22-09's federal zero-trust goals came due in September 2024, NIST's Cybersecurity Framework 2.0 (February 2024) elevated governance to a first-class function, and the NIST NCCoE's zero-trust practice guide drafts (2023–2024) pressed implementers toward measurable outcomes — yet the instruments most organizations use to report "zero trust maturity" remain largely self-assessed, declarative, and insensitive to the difference between a policy that exists and a control that is enforced. Objective: We design ZT-MMI, a Zero Trust Maturity Measurement Instrument that scores maturity on an evidence-tier basis — distinguishing declared policies (E0), configured controls (E1), observed behavior (E2), and enforced outcomes (E3) — across the five pillars and three cross-cutting capabilities of CISA's Zero Trust Maturity Model v2.0, anchored to the tenets of NIST SP 800-207. Methods: Following a design-science methodology, we (i) analyzed the authoritative zero-trust corpus (NIST SP 800-207, CISA ZTMM v2.0, OMB M-22-09, DoD Zero Trust Strategy, NIST CSF 2.0, NIST SP 1800-35 drafts), (ii) extracted requirements that any credible maturity instrument must satisfy, (iii) constructed the instrument's indicator set, evidence tiers, and aggregation model, and (iv) evaluated it through requirements mapping, cross-model alignment, and an illustrative synthetic assessment. Results: Existing instruments are complementary but incomplete: CISA's ZTMM defines stages but not evidence requirements; CSF 2.0 defines functions and tiers but not zero-trust-specific outcomes; DoD's strategy defines deadlines but not measurement semantics for civilian adopters. ZT-MMI composes their semantics into a single instrument in which every maturity claim carries an evidence tier; the synthetic walkthrough shows how evidence tiering surfaces the characteristic failure mode of declarative maturity reporting — high policy coverage with low enforcement. Conclusions: Zero trust maturity is only meaningful as a measured property of enforced behavior . Evidence-tiered scoring converts maturity from a label into an auditable claim, providing the digital-trust foundation that zero-trust transitions require as they move from aspiration to accountability.