The National Security Agency has released new Zero Trust implementation guidelines that emphasize a fundamental truth: knowing who a user is isn't enough. You must know exactly what they can do, and whether they should still have that access at all.
The NSA's Zero Trust Framework
The NSA's latest guidance documents provide a practical roadmap for organizations implementing Zero Trust architecture. Rather than treating security as a perimeter problem, these guidelines shift focus to continuous verification of every identity, every access request, and every permission.
At its core, Zero Trust assumes that threats exist both outside and inside the network. This means organizations can no longer rely on "trusted" zones or verified credentials alone. Context matters just as much as identity.
Zero Trust Implementation Primer [https://media.defense.gov/2026/Jan/08/2003852320/-1/-1/0/CTR_ZERO_TRUST_IMPLEMENTATION_GUIDELINE_PRIMER.PDF] ZIG Discovery Phase Guide [https://media.defense.gov/2026/Jan/08/2003852321/-1/-1/0/CTR_ZIG_DISCOVERY_PHASE.PDF]
The Challenge: The "Over-Permissioned" Blind Spot
While many organizations have a basic directory service, the NSA guidelines highlight a critical gap: Context.
It is not enough to know who a user is; you must know what they can do.
A "verified" user with excessive, unchecked permissions is just as dangerous as an unverified one. In the scenario outlined by the NSA, a threat actor used credentials from a terminated contractor to attempt access, a classic example of identity lifecycle management failure.
The hidden risks include:
- Dormant accounts with active credentials
- Service accounts with privileges accumulated over years
- API keys and tokens that outlive their original purpose
- Access patterns that don't match current job functions
Key Pillars from the NSA Guidance
Comprehensive User Inventory
Organizations must maintain a complete inventory of all identities (human and non-human) with full visibility into their permissions, access patterns, and lifecycle status.
Full Permission Context
Beyond knowing who has access, organizations need to understand what each identity can do, what they actually do, and whether that access is still appropriate.
Continuous Verification
Static access reviews are insufficient. The guidance emphasizes real-time monitoring and continuous validation of access against current job requirements.
How Avistar Helps You Meet the NSA Standard
We help organizations meet the NSA's standard by quantifying identity risk in real time. You get clear visibility into over-permissioned accounts, dormant users, and access patterns that don't match job functions.
- Surface Hidden Exposure: Automatically discover over-permissioned accounts, dormant identities, and privilege bloat across your environment.
- Quantify Financial Risk: Translate identity gaps into board-ready financial exposure metrics so you can prioritize what matters most.
- Monitor Continuously: Move beyond point-in-time audits to real-time monitoring that catches permission drift before it becomes a breach.
Getting Started with Zero Trust Identity
If you're working toward Zero Trust compliance, start with what the NSA emphasizes: comprehensive user inventory with full permission context.
- Inventory all identities: Human users, service accounts, API keys, and machine credentials, everything that can access your systems.
- Map permissions to job functions: Identify where access exceeds what's actually needed for each role.
- Identify dormant accounts: Find identities that haven't been used but still have active credentials and permissions.
- Establish continuous monitoring: Move from periodic audits to real-time visibility into permission changes.
- Quantify your exposure: Translate identity gaps into financial risk so you can prioritize remediation.
Conclusion
The NSA's Zero Trust guidance makes clear that identity verification alone isn't enough. Organizations must understand the full permission context of every identity, and maintain that visibility continuously.
The terminated contractor scenario isn't hypothetical. It's happening in organizations every day. The question is: do you have the visibility to catch it before attackers exploit it?
Ready to see what's hiding in your identity layer? Get a risk assessment and discover exactly where your permission gaps are, before they become your next breach.