Identity will form a core component of an agency’s ZTA. Least privilege access, which underpins zero trust, depends on the ability to assure the identity of the entity receiving access. The Zero Trust Maturity Model moves away from simply using passwords to validate identity and instead uses a combination of factors to validate and continuously verify that identity throughout the duration of their interactions with services or data.

As agencies migrate services to the cloud, their users will have identities among a variety of providers. To effectively manage these identities and align security protections holistically, agencies will need to integrate their on-premises identities with those in the cloud environments. These integrated identities, however, can increase the attack surface of the agency because a compromised identity or identity provider may permit access across the broader agency environment.