Key Takeaways
- The NSA zero trust implementation guidelines list 91 Target-level activities: 14 in Discovery, 36 in Phase One and 41 in Phase Two.
- The Department of War (DoW), formerly the Department of Defense, sets 152 activities, which leaves 61 at Advanced-level.
- Network access control (NAC) supports the device and network work, and other tools cover identity, data and applications.
The NSA’s Zero Trust Implementation Guidelines list 91 Target-level activities: 14 in Discovery, 36 in Phase One and 41 in Phase Two.
The NSA zero trust implementation guidelines (ZIGs) are technical reports from the National Security Agency that break the DoW zero trust strategy into phased activities. Each report names the pillar an activity belongs to and which activities come before and after it.
Portnox builds agentless access control that identifies, authenticates and controls devices before they connect. This page covers what the guidelines contain, who they apply to and which activities depend on device and network access control, so you know where to start.
What the Guidelines Contain
The series has a Primer plus Discovery, Phase One and Phase Two guidelines. Phases Three and Four cover Advanced-level work, and the Primer says they may be developed at a later time.
The Primer counts zero trust activities and capabilities by phase:
- Discovery: 14 activities supporting 13 capabilities.
- Phase One: 36 activities supporting 30 capabilities.
- Phase Two: 41 activities supporting 34 capabilities.
Together they make 91 Target-level activities. The DoW Zero Trust Strategy sets 152 activities in total, so Advanced-level work adds 61 more. The strategy puts the Target-level deadline at the end of fiscal year 2027 and the Advanced-level deadline at fiscal year 2032.
NSA released the Primer and Discovery guideline in early January 2026 and Phases One and Two on January 30, 2026.
How the Phases Are Organized
The guidelines sort every activity under one of seven pillars and list its predecessors and successors. That structure lets you plan work by dependency instead of by calendar.
The Primer calls the guidelines neither a one-size-fits-all guide nor a step-by-step sequential guide. It says activities can be implemented concurrently.
The seven DoW pillars are:
- User
- Device
- Application and Workload
- Data
- Network and Environment
- Automation and Orchestration
- Visibility and Analytics
NAC work sits mostly in the Device and Network and Environment pillars. Read the zero trust implementation page for the general approach behind this structure.
Why Discovery Comes First
Discovery comes first because enforcement cannot cover assets nobody has listed. The phase builds visibility into data, applications, assets, services and access activity before later phases add enforcement.
A 2020 Cybersecurity Insiders report found that 60% of organizations are aware of fewer than 75% of the devices on their network. A device that no asset inventory lists cannot receive a policy. Unmanaged devices and IoT devices stay outside policy until Discovery finds them. Closing that gap is the first job the guidelines set.
Where Access Control and Enforcement Fit
NAC supports the device and network work in the guidelines. It identifies each device, authenticates it, checks its posture and limits what it can reach.
A NAC policy decision follows these steps:
- Identify the device that is requesting access.
- Authenticate it with certificate-based authentication or the 802.1X port-based authentication standard.
- Check its device posture against policy.
- Limit what the device can reach, on a least privilege basis.
- Record the decision for audit.
Coverage of the Phase One and Phase Two guidelines describes a staged path for authentication:
- Standardize legacy authentication into an approved identity provider.
- Add periodic re-authentication.
- Mature to continuous authentication based on the privileges requested.
NAC supports the device-level steps. It does not replace the identity provider. Learn more about device posture assessment, and see how network microsegmentation limits what an authenticated device reaches.
What the Guidelines Do Not Do
The guidelines do not bind commercial companies, and they do not name or certify products. The Primer says DoW, the Defense Industrial Base, national security systems, industry, academia and affiliated organizations may use them.
Three limits matter in practice:
- Each guideline runs to hundreds of pages.
- NAC covers part of the Device and Network and Environment work, and identity provider, data and application activities need other tools.
- The series maps no product to any activity.
The common wrong turn is treating 91 activities as a score to chase. Some summaries cite 77 activities. That figure is Phase One plus Phase Two and leaves out the 14 Discovery activities. The Primer counts 91. Use the predecessor and successor fields to plan the work, not the total.
How Commercial Teams Can Borrow the Guidelines
Commercial teams can borrow the pattern, not the mandate. Start with what you have, build a foundation, then add enforcement.
Defense suppliers feel the pressure first. If you supply the DoW, you also work with the Cybersecurity Maturity Model Certification (CMMC). The guidelines and CMMC are separate documents, and this page does not map one to the other.
Everyone else can use the same pattern as a template for any zero trust program that aims to remove implicit trust. The zero trust maturity model gives a second way to measure progress.
Frequently Asked Questions
What are the NSA Zero Trust Implementation Guidelines?
The NSA Zero Trust Implementation Guidelines (ZIGs) are technical reports that organize zero trust activities into five phases. They support the Department of War’s zero trust strategy and give practitioners the activities, requirements and dependencies needed to reach Target-level maturity. The series includes a Primer plus Discovery, Phase One and Phase Two guidelines, with Phases Three and Four possible later.
Who has to follow the NSA zero trust guidelines?
The guidelines are written for the Department of War, the Defense Industrial Base and national security systems. They are technical guidance, not a regulation for commercial companies. The fiscal year 2027 Target-level deadline comes from the Department of War’s strategy, so it applies to those programs. Any other organization can use the guidelines as a roadmap.
What is Target-level zero trust maturity?
Target-level is the baseline maturity the Department of War set in its zero trust strategy. It covers 91 activities, made up of 14 in the Discovery Phase, 36 in Phase One and 41 in Phase Two, due by the end of fiscal year 2027. Advanced-level adds 61 more activities, for 152 in total, with a fiscal year 2032 target.
Are the NSA zero trust guidelines the same as NIST SP 800-207?
No. NIST SP 800-207 defines zero trust architecture in abstract terms, with seven tenets and logical components. The NSA guidelines turn that thinking into specific activities for Department of War environments. They draw on NIST SP 800-207, the CISA Zero Trust Maturity Model Version 2.0 and the DoW Zero Trust Reference Architecture. NIST sets the model, and NSA lists the work.
Where does network access control fit in the NSA zero trust guidelines?
Network access control (NAC) decides which devices connect to the network and what they can reach. That work lines up with device and network activities such as identifying devices, authenticating them and restricting access by policy. NAC does not cover the full guidelines, because identity, data and application activities need other tools. Portnox’s agentless NAC supports the device and network side.
What the Federal Timeline Signals for Everyone Else
The timeline signals that zero trust is moving from principle to dated activity lists. The guidelines build on NIST SP 800-207, the Cybersecurity and Infrastructure Security Agency (CISA) Zero Trust Maturity Model Version 2.0 and the DoW Zero Trust Reference Architecture. Executive Order 14028 set the mandate for zero trust strategies at federal agencies.
Portnox covered an earlier NSA publication in A Closer Look at the New NSA Zero Trust Guidelines, which focuses on segmentation. For the federal maturity view, read the CISA Zero Trust Maturity Model post. For the architecture behind the guidelines, see the NIST SP 800-207 page.
Zero Trust Starts With Knowing What Is on the Network
The guidelines let you plan by dependency, and every dependency chain in the device and network work starts with an inventory. Enforcement that runs on an incomplete list leaves the unlisted devices outside policy.
Request a Demo to see how Portnox’s agentless NAC identifies and controls devices before they connect. You can also read the NAC buyer’s guide or the benefits of network access control.
