CISA’s Zero Trust Maturity Model v2.0 requires agencies to reach Advanced maturity across Identity, Devices, Networks, Applications, and Data by end of FY2026. Most agencies are furthest behind on Data and Networks (micro-segmentation).
A practical 90-day roadmap: complete a maturity assessment (weeks 1-2), prioritize Identity and Devices (weeks 3-6), design micro-segmentation for high-risk segments (weeks 7-10), and encrypt your top 20% of sensitive datasets (weeks 11-12).