Zero Trust Maturity Calculator

Score zero trust maturity across identity, device, network, application, data, visibility and automation on the CISA model.

About Zero Trust Maturity Calculator

The seven pillars follow CISA's Zero Trust Maturity Model, weighted by dependency: identity carries the most because device, application and data decisions all consume it, while automation carries the least because it accelerates policy rather than creating it. Systems still reachable on implicit network trust are deducted separately, since one flat zone undermines the enforcement everywhere else. The result is a prioritisation estimate for sequencing investment, not a certification of maturity. Zero trust programmes fail by buying products per pillar in parallel; the weighting shows that identity first, then device posture, is the only sequence where each step actually works.

Formula

Zero Trust Maturity

maturity = (0.22×identity + 0.16×device + 0.15×network + 0.15×application + 0.14×data + 0.10×visibility + 0.08×automation) ÷ 4 × 100, minus up to 20 points for implicit trust zones.

identity: 1 traditional … 4 optimal on the CISA scale
implicitTrustZones: Share of systems still reachable purely by network position
÷ 4: Normalises the 1–4 stage scale to a percentage

Worked example

With the default values below, Zero Trust Maturity Calculator returns Zero Trust Maturity of 51.0. Change any input above and every figure here is recalculated in your browser.

Inputs used

Identity pillarone of Traditional — passwords and static roles, Initial — MFA on some applications, Advanced — phishing-resistant MFA, central identity, Optimal — continuous, risk-based authentication: Advanced — phishing-resistant MFA, central identity
Device pillarone of Traditional — no device inventory, Initial — inventory with basic compliance, Advanced — compliance enforced at access time, Optimal — continuous device posture in every decision: Initial — inventory with basic compliance
Network pillarone of Traditional — flat network, perimeter firewall, Initial — coarse VLAN segmentation, Advanced — microsegmentation of critical zones, Optimal — per-workload policy, encrypted everywhere: Initial — coarse VLAN segmentation
Application and workload pillarone of Traditional — implicit trust inside the perimeter, Initial — some applications behind a proxy, Advanced — per-application authorisation, Optimal — continuous authorisation with workload identity: Initial — some applications behind a proxy
Data pillarone of Traditional — unclassified, broadly shared, Initial — classification defined, partly applied, Advanced — labelling and encryption enforced, Optimal — automated, label-driven access control: Initial — classification defined, partly applied
Visibility and analyticsone of Traditional — siloed logs, Initial — central log collection, Advanced — correlated analytics across pillars, Optimal — analytics drive access decisions: Advanced — correlated analytics across pillars
Automation and orchestrationone of Traditional — manual changes, Initial — scripted tasks, Advanced — policy as code with automated response, Optimal — closed-loop automated enforcement: Initial — scripted tasks
Systems still reachable on implicit trustaccepts 0–100 %: 35 %

Results

Zero Trust Maturity: 51.0 / 100
CISA Maturity Stage: Initial
Weakest Pillar: Device — access decisions cannot consider posture
Implicit Trust Penalty: 7.0 points
Pillars at Advanced or Better: 2 pillars
Next Investment: Enforce device compliance at access time, not just at enrolment

Step by step

1Values used
2Zero Trust Maturity
3Zero Trust Maturity= 51.0 / 100
4CISA Maturity Stage= Initial
5Weakest Pillar= Device — access decisions cannot consider posture
6Implicit Trust Penalty= 7.0 points
7Pillars at Advanced or Better= 2 pillars
8Next Investment= Enforce device compliance at access time, not just at enrolment

Assumptions and limits

The result is derived only from the 8 inputs listed above. Anything not among them is not part of the calculation.
In particular, this calculator does not take inflation, tax or compounding frequency into account.
Figures are rounded for display to 1 decimal place, so totals built from several rounded parts can differ slightly from the unrounded arithmetic.

How these calculators are built and tested is described on the Methodology page. If a figure looks wrong, please report it.

Frequently Asked Questions

How is Zero Trust Maturity calculated?

maturity = (0.22×identity + 0.16×device + 0.15×network + 0.15×application + 0.14×data + 0.10×visibility + 0.08×automation) ÷ 4 × 100, minus up to 20 points for implicit trust zones. The seven pillars follow CISA's Zero Trust Maturity Model, weighted by dependency: identity carries the most because device, application and data decisions all consume it, while automation carries the least because it accelerates policy rather than creating it. Systems still reachable on implicit network trust are deducted separately, since one flat zone undermines the enforcement everywhere else. The result is a prioritisation estimate for sequencing investment, not a certification of maturity.

Why does Zero Trust Maturity matter?

Zero trust programmes fail by buying products per pillar in parallel; the weighting shows that identity first, then device posture, is the only sequence where each step actually works.

What values do I need to enter?

This calculator takes 8 inputs: Identity pillar, Device pillar, Network pillar, Application and workload pillar, Data pillar, Visibility and analytics, Automation and orchestration, Systems still reachable on implicit trust. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.

Why is identity weighted highest?

Because every other control consumes an identity decision. Microsegmentation, conditional access and data labelling all reduce to 'who is this' — and if that answer is a reusable password, the rest is decoration.

Can you reach optimal without automation?

Not in practice. Continuous verification means re-evaluating access as posture and risk change, and no team does that manually at estate scale. Automation is weighted low because it comes last, not because it is optional.