MAY NOT BE REPRODUCED WITHOUT PERMISSION
The frequency and sophistication of cyberattacks against government agencies and contractors are growing at an alarming rate. Threats to critical government systems, infrastructure, and sensitive data can threaten national security and the privacy of citizens.
“Adversarial nation-states continue to use cyber tactics to access and steal sensitive information from US networks, including those of entities that are part of critical infrastructure, for broader espionage purposes to advance their military, diplomatic, and economic goals.” — Homeland Threat Assessment 2025, Homeland Security Office of Intelligence and Analysis.
Here are just a few recent headlines that illustrate the scope of the problem:
- In February 2025, compromised login credentials were found for sale on the dark web from the U.S. Army, Navy, FBI, and Government Accountability Office (GAO) along with login information from Lockheed Martin, Boeing, and Honeywell.
- More than 60 espionage cases across 20 states have been linked to the Chinese Communist Party (CCP), including operations to gather intelligence on sensitive military information.
LINK: - The known exploited vulnerabilities (KEV) catalog from the Cybersecurity & Infrastructure Security Agency (CISA) now numbers in the hundreds in 2025.
The increase in threat requires a fundamental shift in the way government agencies protect their networks. Mandating Zero Trust Architecture (ZTA) becomes critical.
Meeting Zero Trust Architecture in Government
In 2021, the federal government took a step toward a more secure future. Executive Order 14028 mandated federal agencies meet zero trust architecture standards by the end of fiscal year 2024.
However. It’s not been an easy transition. For example, as of February of 2025, the Pentagon reported they are only 14% to zero trust compliance with a goal of all enterprise compliance by the end of fiscal 2027. Col. Gary Kipe, chief of staff of the DoD’s zero trust portfolio management office, said 14% constitutes areas where “we could stop adversarial lateral movement within our network.”
Significant challenges remain, including a lack of identity, credential, and access management (ICAM) tools for constant checks and automated data tagging to label and categorize data for protection from unauthorized users.
The biggest challenge is a significant amount of legacy technical debt. For government agencies, some systems are decades old and will require working with third parties to ensure interoperability among systems and solutions.
“There’s no question that the legacy environment and the technical debt in the government is a huge problem, and we need the vendor community to help us overcome this,” said Paul Selby, Department of Energy’s chief information security officer.
Zero Trust Architecture Principles
Zero trust is more a set of principles than a specific set of technologies. At its core, ZTA assumes a hostile environment and continuously verifies users, devices, and activity within networks — never trust, always verify.
There are different frameworks for compliance. One of the most commonly cited is the five key components of zero trust implementation from the Department of Defense:
- Assume a hostile environment: All users, devices, and systems within the network are assumed to be compromised or potentially compromised. This assumption dictates that security measures must be designed to protect against threats from both external and internal actors.
- Presume breach: The idea that breaches are inevitable or have already occurred informs the security posture. Agencies must implement constant monitoring, detection, and response mechanisms to identify and mitigate threats at every level of the network.
- Never trust, always verify: Trust is never automatically granted to any user or system. Authentication and authorization processes must be rigorously enforced and continuously evaluated to ensure that only trusted entities can access sensitive resources.
- Scrutinize explicitly: Every request for access or data exchange is treated with suspicion. Access is granted based on specific, granular policies that consider the context of the request, including user identity, location, device, and other behavioral factors.
- Apply unified analytics: Zero trust requires the integration of advanced analytics to monitor network activities continuously. By leveraging artificial intelligence (AI) and machine learning (ML), agencies can identify anomalies and potential threats in real-time.
Key Technologies for Zero Trust
ZTA does not rely on one specific technology. It uses a combination of approaches that work together to enforce these principles, including:
Identity and Access Management (IAM)
IAM solutions are crucial for managing who can access specific resources and data. These systems enable agencies to enforce role-based or attribute-based access controls, ensuring that only authorized users are granted access based on their credentials and job responsibilities.
Multi-Factor Authentication (MFA)
MFA is a fundamental component of zero trust requiring multiple forms of authentication. For example:
- Something the user knows (password)
- Something the user has (smartphone)
- Something the user is (biometric verification)
MFA provides an added layer of security to prevent unauthorized access.
Network Segmentation and Software-Defined Perimeters (SDP)
Network segmentation restricts lateral movement within the network, limiting the scope of potential breaches. SDPs create a virtual boundary around sensitive systems, ensuring that only authorized users can access specific applications or data.
Endpoint Detection and Response (EDR)
Endpoint detection and response (EDR) has become more challenging in recent years as the number of endpoints continues to expand. The prevalence of IoT devices, sensors, edge computing, and complex connections with databases and multiple cloud resources create a more expansive threat surface.
Michele Pelino, an analyst at Forrester Research, put it this way: “We’re talking about fragmented connected devices that open up doors to more bad things happening.”
EDR solutions continuously monitor endpoints for signs of malicious activity. These tools provide real-time alerts and help detect and respond to threats before they can spread across the network.
AI-Driven Threat Analytics
AI-powered analytics can analyze vast amounts of data to detect abnormal behavior patterns or threats. These tools help agencies proactively identify and mitigate potential risks, reducing the time to detect and respond to cyberattacks.
Implementing ZTNA in Government Agencies
Effective implementation requires a structured approach.
Assess Current Cybersecurity Posture
The first step in implementing Zero Trust is conducting a comprehensive security audit to identify existing vulnerabilities and areas of risk. This audit should evaluate current identity and access control policies, network configurations, and data protection practices.
Establish Strong Identity and Access Management
A core principle of zero trust is ensuring that only authorized users and devices can access critical systems. Implementing MFA across all systems and adopting role-based and attribute-based access control will strengthen the agency’s security posture.
Segment Networks and Secure Data
To limit lateral movement, agencies should implement network segmentation and secure data with encryption both at rest and in transit. This ensures that sensitive data is protected, even if an attacker gains access to one part of the network.
Deploy Continuous Monitoring and AI-Powered Threat Detection
By utilizing behavioral analytics and Security Information and Event Management (SIEM) systems, agencies can detect unusual activity in real-time. Continuous monitoring ensures that potential threats are identified and mitigated before they can cause significant damage.
Enhance Endpoint Security and Device Trust
It is essential to require device authentication before granting access to government systems. Deploying EDR solutions ensures that endpoints are continuously monitored and protected from emerging threats.
Ensure Compliance with Government Cybersecurity Standards
Aligning zero trust initiatives with the National Institute of Standards and Technology (NIST) Zero Trust Architecture standards and integrating with CISA’s Zero Trust Maturity Model will help agencies ensure compliance with federal cybersecurity regulations.
Government Cybersecurity with Zero Trust
By implementing ZTA, government agencies, and co-contract partners can better protect sensitive data, thwart cyberattacks, and meet regulatory compliance. As the risks continue to grow, government leaders must prioritize the adoption of zero trust to strengthen defenses.
The time to act is now.
Future-ready networks. Mission-ready operations. Modernizing your base network infrastructure is critical to increasing mission readiness, scalability, and security. Sumaria Systems provides the expertise and innovative solutions to integrate, protect, and optimize your network for peak performance. Discover how Sumaria Systems can assist you in building a resilient, future-ready infrastructure.