Crosswalk
Zero Trust × NIST CSF 2.0 Crosswalk
Maps the DoD ZT RA 2.0 pillarsagainst the sixNIST Cybersecurity Framework 2.0functions: Govern, Identify, Protect, Detect, Respond, Recover. Each cell lists illustrative capabilities, not an exhaustive control set.
| Pillar | Govern | Identify | Protect | Detect | Respond | Recover |
|---|---|---|---|---|---|---|
| User | Identity governance policyRBAC/ABAC standardsaccess review cadence | Identity inventoryentitlement and privileged-account discoveryidentity risk scoring — | MFAconditional accessleast-privilege/just-in-time accessSSO and federation | Anomalous sign-in detectionUEBAimpossible-travel and risk-based alerts — | Automated session revocationforced password resetaccount lockout/quarantine — | Identity re-provisioningcredential rotation and re-validation post-incident — |
| Network & Environment | Network segmentation policyZTNA and remote-access standards — | Network asset and topology discoverytraffic baselining — | Micro-segmentationencrypted transport (TLS/IPsec)ZTNANGFW policy enforcement | Network traffic analyticsIDS/IPSencrypted-traffic analysis — | Automated isolation/quarantine of compromised network segments — | Network configuration restorationsegment and route re-provisioning — |
| Application & Workload | Secure SDLC policyapplication risk classification standards — | Application inventorydependency/SBOM trackingattack-surface mapping | SAST/DAST gating in CI/CDWAFAPI securityworkload identity (mTLS) | Runtime application monitoringanomalous API call detectionRASP telemetry — | Automated rollbackworkload isolation or kill-switch — | Redeploy from known-good artifactpatch, re-test, and re-release — |
| Data | Data classification policydata governance and retention standards — | Data discovery and classificationsensitive-data inventory and lineage — | Encryption at rest/in transitDLPtokenizationrights management | DLP alertsanomalous data access or exfiltration detection | Automated access revocationDLP block/quarantine of affected data flows — | Backup restorationkey re-issuancedata integrity verification — |
| Device | Infrastructure hardening baselinespatch and change-management policy — | Asset/CMDB inventoryvulnerability scanningconfiguration drift detection | Hardened/immutable imagesendpoint protectionautomated patching | Host-based EDRconfiguration and compliance drift alerts | Automated patching or quarantine of non-compliant hosts — | Rebuild from golden imageinfrastructure-as-code redeploy — |
| Visibility & Analytics | Logging and monitoring policytelemetry retention standards — | Log source inventoryvisibility coverage-gap analysis | Centralized, tamper-evident logginglog integrity protection — | SIEM correlationUEBAthreat-intelligence correlation | Automated alert triage and enrichment feeding SOAR — | Post-incident forensic analysistelemetry-driven lessons learned — |
| Automation & Orchestration | Automation and playbook governancechange control for policy-as-code — | Manual-process inventory (automation candidates)playbook coverage gaps — | Policy-as-code enforcementautomated compliance checks in CI/CD — | Cross-pillar signal correlation feeding SOAR — | SOAR playbooks (auto-contain, auto-notify)orchestrated cross-pillar response | Automated recovery runbooksself-healing infrastructure workflows — |
About the NIST CSF 2.0 functions
Govern (GV)
Establishes and monitors the organization's cybersecurity risk management strategy, expectations, and policy.
Identify (ID)
Understands current cybersecurity risk to systems, assets, data, and capabilities.
Protect (PR)
Implements safeguards to manage risk and limit or contain the impact of events.
Detect (DE)
Finds and analyzes possible cybersecurity attacks and compromises.
Respond (RS)
Takes action regarding a detected cybersecurity incident.
Recover (RC)
Restores assets and operations affected by a cybersecurity incident.