Federal Modernization Workbook · Book 11
Book 11 — Zero Trust & Assessment
A Whole-Agency Property
Why Zero Trust is a property of the whole agency, not a product: what the mandates actually require, how SCuBA and the assessment tools fit, who owns it, and how to assess honestly and turn the findings into a program
This book is part of Release 2.0, the workbook’s baseline edition: it is complete, checked against every other book and approved by the workbook’s editor, and later changes are tracked against Release 2.0. Baseline is not a claim of independent peer review (Status labels). This book replaces the workbook’s Zero Trust whitepapers (whole-agency unification, governance principles and governance model, the ScubaGear integration, the SCuBA and Zero Trust Assessment relationship, and closing BOD 25-01 before assessing), the Zero Trust executive brief, the assessment guide and the Zero Trust spec. Every external claim was checked against a primary source between October 21 and October 31, 2026 (each footnote gives its access date) and carries a footnote. The earlier pages are kept in the repository’s archive/b11-zero-trust/ folder, and their old addresses forward to the chapters that replaced them.
b11-zero-trust-bundle.docx: the whole book as one Word document, regenerated on every site deploy.
15-minute presentation (about 13 minutes narrated): the Why / What / Who / How deck is on the Presentations page.
Executive briefing (about 30 minutes live, 22 narrated): for CISOs and authorizing officials, on the Presentations page.
Technical deep dive (about 50 minutes live, 18 narrated): the mandates, BOD 25-01 and the two assessment tools, ownership and closing before assessing, and running the assessment for evidence, in modules on the Presentations page.
Zero Trust maturity is a property of the whole agency: its identities, devices, networks, applications and data, across every cloud, every on-premises system and every virtualized estate. No single product or tenant score can certify it, because each tool sees only the part of the estate it was built for, and an attacker needs only the part nobody assessed. A whole-agency picture needs one naming and identity plane underneath the tools. CISA’s Zero Trust Maturity Model and OMB M-22-09 set the direction; CISA’s SCuBA baselines and BOD 25-01 set the required configuration for the agency’s cloud tenants. The order matters: close the known BOD 25-01 findings before assessing, so the assessment measures the target state rather than gaps everyone already knew about. And the assessment tools, CISA’s ScubaGear and Microsoft’s Zero Trust Assessment, produce evidence for the program to act on, not verdicts to report.
Why, what, who, how
| Question | Chapters | |
|---|---|---|
| Why | Why is Zero Trust a whole-agency property, and what principles govern it? | 01, 02 |
| What | What the mandates actually require, what SCuBA and BOD 25-01 demand, how the two assessment tools relate, and what lies beyond Microsoft 365 | 03, 04, 05, 06 |
| Who | Who owns Zero Trust, pillar by pillar | 07 |
| How | Close before you assess, run the assessment and ingest its evidence, and turn findings into a program | 08, 09, 10 |
Appendix: A — Requirements mapping: pillars, controls and books
Reading paths
- Executives (20 minutes): Chapters 01, 03 and 07, or the 15-minute presentation.
- CISO staff and architects: Chapters 01–06, then 10.
- Assessment and SOC teams: Chapters 04, 05, 08 and 09.
- Authorizing officials: Chapters 03, 08 and 10, with Appendix A.
Where this book sits in the workbook
This is Book 11 of the Federal Modernization Workbook. The pillars are carried in depth elsewhere: identity in Book 02 and Book 03, access in Book 04, devices in Book 05, networks in Book 08 and Book 09, and the cloud boundary in Book 10. Appendix A maps each pillar and control to the book that closes it.
New and revised procedures in this book follow the workbook’s implementation conventions (control states, the How-section template, authority labels, the evidence checklist, change safety and the Zero Trust mapping block), defined once in Book 00, Appendix D.
Chapters
| Title | Description |
|---|---|
| Chapter 01 — Zero Trust Is a Whole-Agency Property | Why Zero Trust maturity belongs to the whole agency rather than to any tool or tenant: what the federal guidance actually describes, why stapled per-domain reports aren’t one score, the incidents that sit beneath any one tool’s view, and why assessment tools are evidence inputs rather than verdicts. |
| Chapter 02 — Governance Principles for Zero Trust | Why programs stall below the Advanced stage of CISA’s Zero Trust Maturity Model, and five governance principles that move them past it: identity as a defended anchor, controls for privileged identity, continuous evidence, enforcement rather than observation, and a modeled cloud boundary, with the decisions an agency can make this quarter. |
| Chapter 03 — What CISA’s Maturity Model and M-22-09 Actually Require | What the federal Zero Trust instruments require, read from the documents themselves as of October 2026: the kind of authority each carries, the specific actions OMB M-22-09 sets, what CISA’s Zero Trust Maturity Model v2.0 is and isn’t, what NIST SP 800-207 contributes, the requirements that circulate but don’t exist, and the design contract the program takes from all of them. |
| Chapter 04 — SCuBA and BOD 25-01 | What CISA’s SCuBA project provides, what Binding Operational Directive 25-01 requires of federal civilian agencies for their cloud tenants, which policies are mandatory, and where the directive stops. |
| Chapter 05 — ScubaGear and Microsoft’s Zero Trust Assessment | The two free, read-only assessments agencies run against their Microsoft cloud, what each one checks, where they overlap and where they don’t, and why both are evidence inputs rather than verdicts. |
| Chapter 06 — Beyond Microsoft 365: Networks, Other Clouds and Virtualized Estates | Why a whole-agency Zero Trust score needs the network, every cloud service provider and the virtualized estate to resolve against one inventory and one naming and identity plane first; what the federal documents say about scope; why the hypervisor is a distinct threat class; why the unification layer becomes the most valuable target in the estate; and why no provider’s native assessment tool can answer for the agency. |
| Chapter 07 — Who Owns Zero Trust | Who decides, who does the work and who is consulted when an agency sets its Zero Trust posture, runs its assessments and acts on the findings, with the roles of the CIO, the Zero Trust program lead, the CISO, the authorizing official, the pillar owners and security operations, a responsibility matrix and the access each team needs. |
| Chapter 08 — Close Before You Assess | Why the program builds the architecture a BOD 25-01 finding depends on before it runs ScubaGear and the Zero Trust Assessment as confirmation, how it routes every finding to one of three responses, and how continuous reassessment keeps every open deviation owned and dated. |
| Chapter 09 — Running the Assessment and Ingesting the Evidence | How to run CISA’s ScubaGear and Microsoft’s Zero Trust Assessment against a federal tenant, handle what they produce, and carry their findings into the program’s evidence chain as provenance-wrapped claims, sealed bundles and OSCAL artifacts an assessor can re-execute. |
| Chapter 10 — Evidence, Not Verdicts: From Findings to a Program | How to read ScubaGear and Zero Trust Assessment results correctly, score and rank the real findings, keep exceptions where the tools and the authorizing official can see them, and turn the worklist into a prioritized, re-assessed Zero Trust program whose evidence an assessor can reproduce. |
| Appendix A — Requirements Mapping: Pillars, Controls and Books | A compliance-enabling map, not a compliance claim: CISA’s Zero Trust Maturity Model pillars and cross-cutting capabilities, OMB M-22-09’s objectives and actions, the adjacent binding instruments and the NIST SP 800-53 controls a Zero Trust program asserts, each with what it actually asks, where Book 11 addresses it, the workbook book that carries it and the evidence it calls for; then the requirements that are cited but don’t exist, and the sources. |
Version and revision history
Version 2.0, in edition 2026.11.5 (November 8, 2026). Every edition is kept on the Archive page; every change between editions is in the commit history.
| Version | Edition | Date | Changes |
|---|---|---|---|
| 2.0 | 2026.11.5 | 2026-11-08 | Release 2.0, the baseline: checked against every other book; Draft becomes Baseline; Edition 2026.11.4: record the edition and point deck links at it (#362); Book 11: fix confirmed crosswalk errors (vendor-tool wording, Book 09/12/02 pointers, drift classes, Appendix A) (#386); External Partner Person: light edits to existing pages, held findings, links (E0 to E9) (#419); Book 11: fix 19 cross-page inconsistencies (Security Suite, pillars, stall point, role set, Book 12/13 links, drift status, dates) (#433); Nov 8 fixes: Start Here about 7 minutes; BOD 25-01 reporting methods per CISA; EO 14144 4(c) in Book 08; SP access review stage (#466); Claim language: supports, not satisfies (rule, check, first sweep) (#474); Consistency read C (Books 10 to 14): BOD 25-01 methods, anchor, closes-to-supports (#480); and 4 more (all changes) |
| 1.4 | 2026.11.4 | 2026-11-05 | Sweep stale wording, and link sources on every deck (#361) |
| 1.3 | 2026.11.3 | 2026-11-05 | Book decks: narration names the book or the original source, and 68 videos re-exported (#344) |
| 1.2 | 2026.11.1 | 2026-11-01 | Edition 2026.11: record the edition, and publish the four gate-level decks and videos (#282) |
| 1.1 | 2026.11 | 2026-11-01 | Move the decks and narration audio out of git, onto edition 2026.10 (#260); Cite CISA’s Hybrid Identity Solutions Guidance and its sources (#265) |
| 1.0 | 2026.10 | 2026-10-31 | First edition (17 merged changes since the book began) |