Certificate of Competence in Zero Trust (CCZT) Training

Develop a common ZT language and shared expectations for its use.

A review of the history of ZTA assists in avoiding past mistakes with security protections.

Define concepts and definitions of ZTA.

Frame basic planning considerations for a path to ZT.

Identify use cases for ZT that involve replacing VPNs and configuring micro-segmentation.

Identify use cases for ZT that include protecting SaaS, multi-cloud, and 5G.

Identify use cases for ZT, including protecting IoT, IIoT, OT, ICS, and CPS environments.

Summarize the business objectives of ZT.

Summarization of technology objectives sets the stage for translating architecture into design specifications.

Summarizing the benefits of ZT creates placeholders for later applying specific features.

Listing the components of ZTA provides a standard set of requirements needed for all ZTA implementations.

Defining NIST ZTA allows mapping for all ZTA implementation components and purposes.

Explaining the NIST ZTA system process provides expectations for technologies used to implement the architecture.

Listing components of ZTNA provides a standard set of requirements for implementation.

Listing components of BeyondCorp provides a standard set of requirements for implementation.

Identifying the history of SDP illuminates the timeline in ZT development.

Describing the essential components of SDP allows the path to identify technology that utilizes SDP architecture.

Assessing the SDP process provides information about what is expected from SDP technology.

Comparing and contrasting SDP deployment models provides the ability to choose the correct solution for business needs.

Listing initial considerations of ZT planning provides a path to making plans that have a greater chance of success.

Reviewing planning that involves roles and responsibilities increases the likelihood of success.

Reviewing planning that involves processes increases the likelihood of success.

Defining the scope of ZT projects helps align actions with business requirements.

Identify gaps between the current and future state to inform the development of a roadmap.

Defining protect surfaces allows for inside-out design, and attack surfaces allow for identifying vulnerabilities and are the first step to ZT implementation.

Itemizing traction flows is essential for developing a protective ZT, as it enables awareness of which transactions require protection and is the second step in ZT implementation.

Developing a target architecture establishes where the security technology will reside in relation to the assets and is the third step to ZT implementation.

Defining policy and monitoring are imperative to controlling access and providing the fourth and final fifth steps to ZT implementation.

Listing the strategy levels within the organization enables alignment across different parts of the business.

Reviewing drivers and buy-in for ZT implementation provides a framework for communication with the business.

Listing tactics for ZT implementation enables the identification of tools.

Reviewing ZT operations assists in managing day-to-day work necessary to keep ZT capabilities functional.

Assessing training and project implementation is necessary to equip each stakeholder with the necessary knowledge and expectations of their work to perform effectively.

Reviewing implementation preparation activities prepares a list of what needs to be accomplished to complete ZT work.

Listing target implementation by CISA ZTMM pillars provides the foundation for assessing ZT environments.

Listing cross-cutting target implementation integrates and harmonizes requirements for all pillars.