What category of architecture paradigm this is
NIST SP 800-207 is the subject. The official title is Zero Trust Architecture. NIST SP 800-207 Zero Trust Architecture is an architecture paradigm for resource protection. Resources are assets, services, workflows, and accounts. Network location is not the prime trust signal. There is no implicit trust from network location or from asset ownership. Authentication and authorization (subject and device) are discrete decisions before a session to a resource.
A common misread treats a zero-trust product or a ZTNA purchase as the architecture. Another misread treats a VLAN or an internal IP as trust. ZTA is an architecture paradigm. No U.S. statute requires it, and no scheme certifies against it.
A product purchase, a ZTNA path, a contractor VLAN, SSDF, and NIST AI RMF 1.0 are five different objects. The logical-component catalog and the deployment-model catalog stay in the NIST publication.
Edition covered
The edition string is NIST SP 800-207, Zero Trust Architecture, final, August 2020 (document history 11 August 2020). The DOI is 10.6028/NIST.SP.800-207. Official hubs are https://csrc.nist.gov/pubs/sp/800/207/final and https://doi.org/10.6028/NIST.SP.800-207. On 2026-09-26, the publication page still stated Date Published August 2020 and Document History 08/11/20 Final. It still listed the same DOI.
Three slogans are literacy terms
The first slogan is protection of resources. Network segments are not the prime trust signal. The second slogan is authentication and authorization before a session. A decision on the subject and on the device comes before access to a resource. The third slogan is the policy decision and owner. It covers who decides for this session, and what remains outside a product purchase.
A vendor device on an internal VLAN still needs a decision before a session to a resource.
The resource, the session decision, and the owner
The habit covers four points: the resource under protection, the decision required before a session, the owner of that decision, and the work that remains outside a product purchase. A named owner for one specific resource is a start. A slide that states zero trust certified is not evidence.
SP 800-207A is a companion, not this edition
SP 800-207A is a companion publication. Its Final date is September 2023 (document history 13 September 2023). Date Published September 2023. It does not go into the SP 800-207 edition string.
The NCCoE implementation project and the CISA Zero Trust Maturity Model are separate from SP 800-207.
Rewrite the one-line claim
The claims "we bought zero trust" and "the VLAN is done" treat a product and a network segment as the architecture. Exact replacement: "We use NIST SP 800-207 as a shared architecture vocabulary for specific resources, then cite the policy decision and owner for the session."
A slide can state "zero trust certified" or "ZTA complete." The team then checks the edition (SP 800-207, final, August 2020) and the live need. The live need can be this architecture vocabulary, a ZTNA access path, SSDF practice vocabulary, or AI RMF placement.
A product, a ZTNA path, and a VLAN are not the architecture
| Phrase people use | Literacy correction |
|---|---|
| We bought a zero-trust product, so ZTA is done. | SP 800-207 is an architecture paradigm. A purchase is one possible control context, not the architecture. M3: /learn/misconceptions/zero-trust-not-a-product/. |
| ZTNA means Zero Trust Architecture is complete. | Zero trust network access can be one access path. It does not finish the principles in SP 800-207. Secure-access landscape: /landscape/segments/secure-access/. |
| The contractor is on the VLAN / has an internal IP, so they are trusted. | SP 800-207 does not treat network location as enough trust for a resource. An internal address is also network location. F5: /learn/topics/least-privilege-and-layers/. M3: /learn/misconceptions/zero-trust-not-a-product/. |
| ZTA is SSDF. | SSDF (SP 800-218) is a software security practice vocabulary. ZTA is an architecture paradigm for resource protection. Explainer: /learn/explainers/ssdf/. |
| ZTA is AI RMF. | NIST AI RMF 1.0 is a separate voluntary AI risk framework. Explainer: /learn/explainers/nist-ai-rmf/. |
| We cited zero trust, so we are certified / covered. | A mention of a framework is not evidence of implementation, assessment, certification, or absence of risk. A citation is not a seal. Field guide: /reference/frameworks/nist-sp-800-207/. Cloud shared responsibility: /learn/topics/shared-responsibility-cloud/. Cloud-misconfig lab: /labs/cloud-misconfig/. |
Common misconceptions
A zero-trust product purchase means ZTA is done.
A product can support parts of the architecture. Each resource still needs a session decision and an owner.
ZTNA means Zero Trust Architecture is complete.
ZTNA covers one access path to some resources. Other resources and decisions sit outside that path.
A device on the internal network is trusted.
SP 800-207 grants no implicit trust from network location. An internal IP address is a network location too.
ZTA is SSDF.
SSDF covers software development practice. ZTA covers how a decision grants access to a resource.
ZTA is AI RMF.
AI RMF 1.0 organizes AI risk work in four functions. ZTA is about access to resources.
A mention of zero trust means a team is certified / covered.
A citation of zero trust shows no implementation. Evidence of a session decision on a specific resource is still needed.
SP 800-207A replaced SP 800-207.
SP 800-207A (final September 2023) is a companion on access control for cloud-native applications. SP 800-207 is still the core publication.
Resources, session decisions, and a specific owner
| Slogan | One-line literacy |
|---|---|
| Protection of resources | Assets, services, workflows, and accounts, not network segments as the prime trust signal |
| Authentication and authorization before a session | Subject and device decisions are discrete before access to a resource |
| The policy decision and owner | Who decides for this session, and what remains outside a product purchase |
CHECK THE CATEGORY
Which sentence matches NIST SP 800-207?
Glossary and nearby pages
- NIST SP 800-207 field guide (edition pin companion)
- Least privilege, secure defaults, trust boundaries, and layered controls (F5)
- Cloud and SaaS shared responsibility
- Misconception: zero trust is not a product or a VLAN (M3)
- Lab: Whose mistake is on the screenshot?
- Landscape: Secure access (ZTNA is an access path, not this architecture)
- NIST SSDF Version 1.1 explainer (software practice vocabulary, not this architecture)
- NIST AI RMF 1.0 explainer (voluntary AI framework, not this architecture)
- Outcomes first, then controls (F8a)
- Privacy is not a CIA checkbox
Use the agency page in the sources for the authoritative text.