2023 - Measuring Your Zero Trust Maturity

### Overview In this talk, Elizabeth Schweinsberg, a Digital Services Expert at the U.S. Digital Service (USDS) working with the Centers for Medicare & Medicaid Services (CMS), shares how CMS adapted federal zero trust guidance into a practical framework to measure and improve organizational maturity. Drawing on her background in digital forensics, incident response, and corporate zero trust transformations, Schweinsberg explains the fundamentals of zero trust and walks through the steps CMS took to translate abstract frameworks into actionable, scalable evaluations for cloud and infrastructure environments.

### Key Topics - **Zero Trust Concepts and Analogies**: Zero trust shifts security from verifying permissions strictly at the network perimeter to continuously verifying trust throughout systems. Schweinsberg compares this model to entering and moving through a baseball stadium (such as Oriole Park at Camden Yards), where attendees go through perimeter checks (bag check/metal detector, ticket scanning), followed by subsequent checks at specific seating sections, club levels, and concession stands. - **Federal Zero Trust Frameworks**: The presentation highlights three primary frameworks: NIST SP 800-207 (seven tenets, three approaches), the DoD Zero Trust Reference Architecture (seven pillars, three maturity levels), and CISA's Zero Trust Maturity Model (five pillars, three cross-cutting functions, and four maturity levels—Traditional, Initial, Advanced, and Optimal—updated in Version 2). - **Tailoring Frameworks to Specific Environments**: Zero trust implementations must adjust depending on whether an environment is an enterprise network, an on-prem data center, or Infrastructure as a Service (IaaS). In IaaS environments, physical devices do not exist for tenants; instead, virtual assets such as virtual machines and containers must be treated and tracked as devices. - **Developing a Questionnaire and Scoring Model**: To evaluate over 100 teams at CMS without conducting non-scalable multi-hour interviews, CMS created a 50-question data call focused on their primary IaaS provider. Results were scored across functions and pillars, plotted on radar/spider charts, and shared back with teams to guide incremental improvements.

### Technical Details - **Identity & Authentication**: CMS separated identity and authentication requirements into three distinct profiles: developers, end users, and APIs. Maturity progression begins with basic passwords and light MFA (Traditional), moves to universal MFA with network broker/device signals like SASE (Initial), requires phishing-resistant MFA such as FIDO2/PIV (Advanced), and ultimately reaches dynamic re-evaluation upon context changes such as mid-session IP shifts (Optimal). - **Device Governance**: In the context of virtual machines and containers, physical sanitization is replaced by deletion and automated lifecycle management. Standards included establishing documented lifecycle plans, automating vulnerability scanning, using centralized gold images, and enforcing strict routine patching cadences (monthly in Initial, tightening to every two weeks in Advanced and Optimal). - **Data Encryption**: The data pillar evaluates encryption at rest and in transit. While initial levels focus on encrypting data at rest and external network transit, higher levels require full transit encryption within cloud accounts (e.g., via mutual TLS or service meshes), advanced key governance, and data-in-use encryption. - **Metrics and Variance Analysis**: CMS analyzed average scores and standard deviations across functions. Low-variance functions (such as developer authentication and identity stores) reflected areas where centralized tools and established standards already existed. High-variance areas highlighted gaps in documentation and guidance where teams required targeted assistance.

### Takeaways - **Incremental Progress Matters**: Organizations do not need to implement every optimal capability immediately. Moving from Traditional to Advanced and executing low-effort wins—such as documenting lifecycle plans or enabling MFA options—builds momentum. - **Avoid Survey Fatigue**: Early discovery interviews took 2.5 hours per team, and an initial draft questionnaire had 160 questions. Distilling the assessment to a 50-question data call—and leaning on a survey designer to ensure clarity—made organization-wide measurement feasible. - **Leverage Existing Data**: Avoid asking teams questions when answers can be gathered through configuration management tooling, compliance reporting, or cloud provider logs.