New Federal Guidance Helps Organizations Secure Their Networks with 19 Practical Zero Trust Examples

Businesses and government agencies looking to upgrade their cybersecurity defenses now have detailed help from the federal government. A new publication from the National Institute of Standards and Technology (NIST) outlines 19 real-world examples of zero trust architectures (ZTAs), providing a valuable roadmap for organizations to secure complex networks and protect against both internal and external cyber threats.

Zero trust is an increasingly adopted cybersecurity model that assumes no user or device—inside or outside the network—can be inherently trusted. This approach replaces traditional perimeter-based security with continuous verification of access requests and dynamic policy enforcement. The shift is especially timely as remote work, cloud services, and distributed infrastructure have made legacy security models largely obsolete.

To guide this transition, NIST Special Publication 1800-35, developed at the National Cybersecurity Center of Excellence, presents 19 example ZTAs built using commercial, off-the-shelf technologies. Each scenario addresses a different organizational challenge, such as securing data centers, cloud platforms, and public Wi-Fi environments like a coffee shop. The publication includes configuration details, test results, and best practices gleaned from a four-year collaboration with 24 industry partners.

Unlike NIST’s earlier conceptual publication on zero trust (SP 800-207), the new guidance is highly practical, aiming to help organizations tailor solutions to their own needs. Each implementation demonstrates how to use existing tools to build a functioning ZTA and maps those solutions to widely used cybersecurity frameworks, including the NIST Cybersecurity Framework and SP 800-53. While specific technologies are described, NIST emphasizes that inclusion does not constitute an endorsement.

Organizations planning to modernize their cybersecurity posture—whether to meet compliance requirements or to defend against rising threats—can use these examples as a foundation. Given the increasing complexity of digital networks, adopting a ZTA is becoming not only a best practice but in some sectors, a necessity.

Article by multiple contributors, based upon information from a press release by the National Institute of Standards and Technology (NIST)

---