NIST Built 19 Working Zero Trust Architectures and Published the Configurations

Start with the qualifier, because it changes how you read everything else. SP 1800-35 is a NIST practice guide, not a standard. Nothing in it is required of anyone, and no auditor is working from a checklist derived from it. NIST also does not endorse the 24 vendors or their products. They participated under research agreements, and the builds are illustrative examples of how the pieces can fit together.

Treat it the way you would treat detailed build notes from a peer who had budget you do not have. The engineering is real. The endorsement is not. "We are in the NIST guide" means a vendor signed a research agreement, nothing more.

The companion document, SP 800-207, defines zero trust and names the deployment approaches. Worth noticing what is absent from it: vendor names. Not one appears. Zero trust is an architecture and a set of decisions about where trust gets evaluated and how often. It is not a product, and any conversation that opens with a product name has started in the wrong place.

The implementations span enhanced identity governance, software-defined perimeter, microsegmentation, and secure access service edge. That spread is the useful part, not any single build, because the guide does not assume one starting point. A company whose main risk is contractor access to a few SaaS applications and a company whose main risk is a converged OT network do not begin in the same place, and the document does not pretend they do.

Here is what I would actually read it for.

Any competent engineer can look at a finished zero trust diagram and understand it. The end state has never been the bottleneck. The hard-won knowledge is sequence: what got stood up first, what could not start until something else already existed, and where the integration effort actually landed compared with where the plan assumed it would.

That ordering information is normally the expensive part of a consulting engagement. In SP 1800-35 it sits in a free document, described build by build, because each of the 19 builds had to make those calls and then write down what happened. Read the sequence and the dependencies. Skim the product names.

CISA's Zero Trust Maturity Model v2.0, published in April 2023, sorts progress into four stages: Traditional, Initial, Advanced, and Optimal. Microsegmentation sits at Optimal. The last of the four.

Read that as a dependency statement rather than a difficulty rating. You cannot meaningfully segment what you have not inventoried. You cannot write a policy about which workload may talk to which until you know what the workloads are, who owns them, and what breaks when they stop talking. The microsegmentation projects I have watched go sideways went sideways for that reason, not because the technology failed.

This is also why the pitch that leads with segmentation tends to disappoint. The product usually works fine. The prerequisite data does not exist yet.

The best available reality check is CISA's FY2024 Report to Congress, dated 29 January 2025, after three years of a funded federal zero trust mandate. The headline wins were asset visibility and encrypted DNS.

CISA describes this as "considerable advancements," and the movement supports that description. But the report does not certify that agencies met the M-22-09 goals, and it should not be read as saying so. The blockers CISA named are the ones you would expect: vendor support, legacy technology, and funding.

Now sit with what those wins actually are. Knowing what hardware you own. Knowing what software is running. Getting DNS resolution somewhere it can be inspected. Asset visibility is a precondition for zero trust. It is not zero trust. Three funded years, and the durable result was largely knowing what was on the network. If that is what a federal mandate with dedicated money produced, a private company on a normal budget should expect the same shape of progress. The inventory work is the work.

Nineteen architectures assembled at a federally funded research center, with vendor engineers available to help, is not a two-person IT team building the same thing between tickets. The architectures are real and reproducible. The resourcing is not typical, and the guide is not a cost model.

So read SP 1800-35 for sequence and dependencies, not as an effort estimate. Scale the published builds into a project plan without adjusting for the specialist help those teams had on call, and your timeline will be wrong in a way that only surfaces in month four.

For a Texas company between 20 and 500 people, the order that keeps showing up in both the federal data and the practice guide looks like this:

• Inventory first. Hardware, then software, then who owns each system. Unglamorous, and the prerequisite for everything downstream.
• Fix identity next. Phishing-resistant multifactor authentication, conditional access, and a real joiner-mover-leaver process. This is where the security return per dollar is highest for most mid-sized organizations.
• Get privileged access under control. Standing administrative rights are the shortest path from one compromised laptop to a domain-wide incident. Our cybersecurity practice treats this as its own workstream rather than a feature bolted onto something else.
• Instrument before you enforce. Log and watch traffic in a segment before you start blocking in it. Automated monitoring runs 24/7; the people reading escalations work business hours with after-hours emergency response, and your enforcement plan should assume that.
• Segment last. Start with one high-value application, not the whole network.

None of that requires a zero trust product line. It requires a decision about ordering, which is exactly what NIST published 19 worked examples of. If you want a second opinion on where your environment sits today, the free IT assessment is a short, structured way to get one, and our managed IT services team can carry the inventory and identity work that follows.

Does SP 1800-35 mean my company is required to implement zero trust?

No. SP 1800-35 is a NIST practice guide, not a standard, and nothing in it is required of anyone. It creates no compliance obligation. Federal agencies operate under a separate mandate that does not extend to private companies. Read the guide as engineering reference material, not as an audit requirement.

Does NIST recommend the products used in the 19 builds?

No. The 24 collaborating vendors participated under Cooperative Research and Development Agreements, and NIST does not endorse their products. The builds are illustrative examples using commercially available technology. If a vendor implies that participation amounts to a NIST recommendation, that is a marketing claim rather than what the document says.

Where should a mid-sized company start with zero trust?

Asset inventory and identity, in that order. CISA's Zero Trust Maturity Model v2.0 places microsegmentation at the Optimal stage, the last of its four stages, which tells you it depends on work that comes earlier. The federal FY2024 results point the same way: after three funded years, the reported wins were asset visibility and encrypted DNS.

How long does a zero trust program take?

SP 1800-35 will not answer that, and be careful with anyone who quotes a timeline from it. The builds were assembled at a federally funded research center with vendor engineers available for the integration work. That resourcing is not typical, so the architectures are a reliable guide to sequence and dependencies but not to effort or duration.

Is zero trust a product we can buy?

No. NIST SP 800-207 defines zero trust and names its deployment approaches without naming a single vendor. It is an architecture and a set of decisions about where and how often trust is evaluated. Products implement parts of it. No product is it.

What is the practical difference between SP 800-207 and SP 1800-35?

SP 800-207 is the conceptual document that defines zero trust and its deployment approaches. SP 1800-35, finalized 10 June 2025, is the implementation guide showing 19 example architectures spanning enhanced identity governance, software-defined perimeter, microsegmentation, and secure access service edge. Read 800-207 for the vocabulary and 1800-35 for how the pieces were actually assembled.

If you want to talk through where your environment actually sits, or you want someone to run the inventory and identity work before anybody touches segmentation, call our Greater Houston office at 713-571-2390. We work from The Woodlands and Round Rock, with 20+ years of experience and 100% Texas-based support.