Key Takeaways
- NIST published SP 800-207, Zero Trust Architecture, in August 2020, with seven tenets and three logical components.
- The Policy Engine and Policy Administrator form the Policy Decision Point, and the Policy Enforcement Point enforces its decisions.
- NIST does not certify products or programs against NIST 800-207.
- Network access control (NAC) acts as an enforcement point and a source of device posture data.
NIST published Special Publication 800-207 in August 2020, and its definition of zero trust still rests on seven tenets and three logical components.
NIST 800-207 is a National Institute of Standards and Technology publication, titled Zero Trust Architecture, that defines zero trust, its logical components and deployment models, and a migration path. It describes architecture, not products, and it moves defenses from network perimeters to individual resources.
Portnox builds access control that checks device identity and posture before it grants access. This page walks through the tenets, components and deployment models, then shows where network access control fits, so you can map a product to the document without overstating what either one does.
What NIST SP 800-207 Is and What It Is Not
NIST SP 800-207 is the NIST zero trust architecture reference. It is not a product list, a checklist or a certification.
Scott Rose, Oliver Borchert, Stu Mitchell and Sean Connelly wrote the 59-page document. It defines zero trust, gives deployment models and use cases, and offers a migration roadmap. You can read the full text at doi.org/10.6028/NIST.SP.800-207.
For background, see zero trust architecture (ZTA) and the zero trust framework.
The Seven Tenets
The seven tenets of zero trust define the model under NIST SP 800-207. Section 2.1 of the document lists them. These paraphrases keep each to one line:
- All data sources and computing services count as resources.
- You secure all communication regardless of network location.
- You grant per-session access to each resource.
- Dynamic policy decides access, using the state of the client, the application and the requesting asset.
- The enterprise monitors the integrity and security posture of all owned and associated assets.
- Authentication and authorization are dynamic and strictly enforced before access.
- The enterprise collects data about assets, infrastructure and communications to improve its security posture.
See examining zero trust principles for more.
The Logical Components
Three logical components make each access decision. The Policy Engine decides, the Policy Administrator sets up or tears down the session path, and the Policy Enforcement Point opens and closes the connection.
The Policy Engine and Policy Administrator together form the Policy Decision Point. The decision draws on data sources such as:
- A continuous diagnostics and mitigation (CDM) system
- Threat intelligence feeds
- Network and system activity logs
- Data access policies
- Enterprise public key infrastructure (PKI)
- An identity management system
- A security information and event management (SIEM) system
How the Trust Algorithm Decides
The trust algorithm is the logic the Policy Engine uses to grant or deny a request. NIST describes two choices: criteria-based or score-based, and singular or contextual evaluation.
A criteria-based algorithm requires a request to meet a set of conditions. A score-based algorithm builds a confidence value and compares it with a threshold. A singular algorithm judges each request alone, and a contextual one also weighs recent history.
Here is an illustrative example, not one from the document. A managed laptop with an out-of-date patch level requests access to a finance application. A criteria-based algorithm denies the request if patch level is a required condition. A score-based algorithm lowers the confidence value and may still allow access to less sensitive resources.
Three Approaches and Four Deployment Models
NIST describes three approaches to building a zero trust architecture and four ways to deploy it. The approaches are enhanced identity governance, microsegmentation and network infrastructure with software defined perimeters.
The four zero trust deployment models differ in where enforcement happens:
| Deployment model | Where enforcement happens | Main trade-off |
|---|---|---|
| Device agent or gateway | An agent on the device and a gateway in front of the resource | Needs software on every device |
| Enclave | A gateway in front of a group of resources, such as a data center | One policy covers the whole group |
| Resource portal | A portal gateway that users reach without a device agent | Limited view of device posture |
| Device application sandboxing | Vetted applications run in sandboxes on the asset | Every application needs vetting |
The takeaway: the model you pick decides how much device posture data reaches the policy engine.
Where Network Access Control Fits
NAC fits as an enforcement point and as a source of posture data for the Policy Engine. It supports the tenets that depend on device state.
Three tenets map to NAC work:
- Dynamic policy that includes the state of the requesting asset.
- Monitoring the posture of owned and associated assets.
- Enforcing authentication before access.
A 2020 Cybersecurity Insiders report found that 60% of organizations are aware of fewer than 75% of the devices on their network. A Policy Engine cannot weigh posture it never receives. NAC improves visibility by identifying devices and sending their state into the decision.
NAC supports these tenets and does not implement the document. See the benefits of network access control and Portnox NAC. For remote sessions, Zero Trust Network Access (ZTNA) enforces the same tenets.
What the Document Leaves Open
NIST SP 800-207 leaves product choice, scoring and migration detail to you. NIST does not certify products or programs against the document.
Three gaps matter when you plan:
- The document leaves the trust algorithm to the implementer.
- It gives migration guidance at a high level.
- NAC is one enforcement option, not the whole decision system.
The common wrong turn is asking whether a product is “NIST 800-207 compliant.” NIST publishes no conformance test, so the question has no official answer. Ask which tenet the product helps enforce and which component it plays.
The document also lists threats to the architecture itself. Two examples are subversion of the decision process and denial of service.
Frequently Asked Questions
What is NIST SP 800-207?
NIST Special Publication 800-207, Zero Trust Architecture, is the National Institute of Standards and Technology document that defines zero trust and describes how a zero trust architecture works. Published in August 2020, it sets out seven tenets, the core logical components, deployment models and a migration roadmap. It describes architecture and does not recommend specific products.
What are the seven tenets of NIST SP 800-207?
The seven tenets are the principles every zero trust architecture follows under NIST SP 800-207. They treat all data sources and services as resources, secure all communication regardless of location, grant access per session, decide access with dynamic policy, monitor asset posture, enforce dynamic authentication and authorization before access, and collect data to improve security posture.
What are the Policy Engine, Policy Administrator and Policy Enforcement Point?
These are the three logical components that make access decisions in NIST SP 800-207. The Policy Engine decides whether to grant access to a resource. The Policy Administrator sets up or shuts down the communication path based on that decision, and the Policy Enforcement Point opens and closes the connection. The first two together form the Policy Decision Point.
Is NIST SP 800-207 a compliance requirement?
NIST SP 800-207 is guidance, not a certification you can earn. NIST does not certify products or programs against it. Federal agencies follow it through policy, including Executive Order 14028 and Office of Management and Budget (OMB) memorandum M-22-09, which direct agencies toward zero trust architecture. Commercial organizations use it as a reference when they design and describe their own programs.
How is NIST SP 800-207 different from the CISA Zero Trust Maturity Model?
NIST SP 800-207 describes what a zero trust architecture is, while the CISA Zero Trust Maturity Model describes how far an organization has progressed toward one. Version 2.0 of the CISA model scores progress across five pillars: identity, devices, networks, applications and workloads, and data. Use NIST to design the architecture and CISA to measure the journey.
Why a 2020 Document Still Anchors 2026 Programs
Federal policy points agencies to NIST SP 800-207, and newer guidance builds on it. Executive Order 14028 and OMB M-22-09 direct agencies toward zero trust architecture, and the NSA Zero Trust Implementation Guidelines draw on the document.
The Cybersecurity and Infrastructure Security Agency (CISA) uses the same ideas to measure progress. See the CISA Zero Trust Maturity Model post and the zero trust maturity model page. For the defense view, see the NSA zero trust implementation guidelines page.
The NIST compliance resource and the NIST SP 800-53 access control requirements cover related controls.
Every Access Request Is a Decision
NIST 800-207 describes a decision made for every access request. The architecture is where that decision gets made and enforced, and the decision is only as good as the data that reaches it.
Request a Demo to see how Portnox checks device identity and posture before it grants access. You can also read the NAC buyers guide.
