What it covers. NIST publication that defines zero trust concepts and describes logical components and deployment models for a zero trust architecture. It moves protection from network perimeters to individual resources, with access decisions made per request based on identity, device state and other context.
In practice. Applying it well usually means a gradual migration: identifying critical resources and data flows, strengthening identity and device posture, and introducing policy decision and enforcement points in front of resources. Access is granted with least privilege and continuously re-evaluated, with comprehensive logging of decisions. Managers should expect a roadmap, inventories of resources and flows, and measurable progress on removing implicit trust.
Common gaps. Common gaps are treating zero trust as a product purchase, keeping broad network-level trust for legacy systems, and weak device inventory that undermines policy decisions.