From Guidance to Measurement: Zero Trust Engineering Practice after the Final NIST SP 1800-35 Practice Guide (2025)

Abstract

Background: In June 2025, NIST published the final version of Special Publication 1800-35, Implementing a Zero Trust Architecture — the National Cybersecurity Center of Excellence practice guide built with 24 collaborating vendors, documenting end-to-end zero-trust reference builds, the integration failures encountered, and the migration steps organizations can replay. Together with SP 800-207 (the architecture), CISA's Zero Trust Maturity Model v2.0 (the stages), and the 2024 federal zero-trust milestone, the guidance stack for zero trust is now, for the first time, complete. Objective: This paper assesses what the completed guidance stack changes for zero-trust engineering practice — and what it still does not supply. Methods: Documentary analysis of the final practice guide against the rest of the guidance corpus; alignment analysis across the three instrument classes (architecture, practice, measurement); and a coverage assessment of the guide's artifacts against the measurement dimensions an auditor or program owner needs. Results: SP 1800-35 converts zero trust from doctrine into engineering: its reference builds, documented integration failures, and vendor-validated interop turn SP 800-207's tenets into replayable configurations. But the guide is a build record, not a measurement instrument: it defines no evidence classes, no maturity semantics, and no weakest-link handling — a measurement gap remains open, now with a concrete artifact base that measurement instruments can finally consume. Conclusions: 2025 closes the guidance era of zero trust. The open engineering problems are now measurement and operations: instruments that score enforced behavior (not declarations), telemetry standards that make evidence collectable, and adoption paths for the long tail that the practice guide's 24-vendor, enterprise-scale builds do not represent.