GRC в кибербезопасности Пунктов: 17
Zero Trust Architecture Assessment (NIST 800-207)
Этот чек-лист на английском языке.
Assesses maturity against the zero trust tenets and pillars defined in NIST SP 800-207 and the CISA Zero Trust Maturity Model.
NIST 800-207CISA ZTMMNIST 800-53
Бесплатно в PDF или Word · укажите email, чтобы скачать.
Zero Trust Tenets & Governance
- Has the organization defined protect surfaces and mapped transaction flows for critical resources? *
- Is access to resources granted per-session on a least-privilege basis? *
- Are access decisions made by a policy decision point evaluating dynamic signals? *
- Is a documented zero trust strategy and roadmap approved by leadership?
Identity Pillar
- Is every access request authenticated regardless of network location? *
- Is phishing-resistant MFA enforced for all users? *
- Are risk-based and continuous authentication signals evaluated at access time? *
Device Pillar
- Is device posture (patch level, EDR status, compliance) verified before granting access? *
- Is a real-time inventory of all assets accessing resources maintained? *
- Are non-compliant or unmanaged devices denied or quarantined? *
Network & Environment
- Is the network micro-segmented so lateral movement is restricted? *
- Is all traffic, including internal east-west, encrypted? *
- Are software-defined perimeters or identity-aware proxies used in place of implicit trust zones?
Application, Data & Visibility
- Are applications accessed through brokered, authenticated sessions rather than direct network exposure? *
- Is data classified and access governed by data-centric policies? *
- Are all access decisions and resource activity logged for analytics? *
- Is telemetry aggregated to continuously improve policy?
Скачайте полный чек-лист «Zero Trust Architecture Assessment (NIST 800-207)»
Получите его бесплатно в виде аккуратного PDF для печати или редактируемого документа Word.