A structured series of actionable, technical playbooks released by the National Security Agency (NSA). Developed in alignment with the Department of Defense (DoD/DoW) Chief Information Officer’s Zero Trust Portfolio, the ZIGs break down dense theoretical security concepts into sequential, concrete engineering activities. The primary goal of the guidelines is to shift organizations away from traditional, perimeter-focused defenses (castle-and-moat) and toward a continuous validation paradigm: never trust, always verify and assume breach.
Core Structure and Phased Approach
To organize the numerous security activities required for a fully mature architecture, the NSA utilizes a modular, phased framework across seven core pillars (User, Device, Application/Workload, Data, Network, Automation, and Visibility):
- The Primer: The conceptual baseline and roadmap that establishes the design methodology, terms, and dependencies required before beginning implementation.
- Discovery Phase: Focuses on establishing comprehensive visibility. Organizations use this phase to inventory and baseline their critical data, applications, assets, services, and current access patterns.
- Phase One: Outlines 36 foundational activities to establish core security controls, such as deploying robust Multi-Factor Authentication (MFA) and initial data classification.
- Phase Two: Details 41 advanced activities focused on deep infrastructure integration, shifting toward behavior-based access controls and identity-aware network microsegmentation.
Key Technical Pillars Addressed
The guidelines map technical execution tasks directly across critical corporate environments:
- Identity & Device Security: Continuous inspection of the health, posture, and patch status of devices alongside granular user authentication.
- Network Containment: Microsegmentation to strictly limit lateral movement, ensuring that if a single asset is compromised, the blast radius is isolated.
- Automation & Analytics: Leveraging machine learning and procedural automation to enforce dynamic, real-time security policies, heavily reducing human error and manual overhead.
Target Audience
While explicitly designed to safeguard National Security Systems, the Department of Defense, and the Defense Industrial Base, the NSA's ZIGs are highly modular. This allows private-sector enterprises, such as healthcare systems and critical infrastructure operators, to adapt and scale the checklists to fit their specific risk tolerances and operational budgets.
