<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:"Franklin Gothic Book";
panose-1:2 11 5 3 2 1 2 2 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
p.xmsonormal, li.xmsonormal, div.xmsonormal
{mso-style-name:x_msonormal;
margin:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
span.xcontentpasted0
{mso-style-name:x_contentpasted0;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple" style="word-wrap:break-word">
<div class="WordSection1">
<p class="xmsonormal"><span class="xcontentpasted0"><span style="font-family:"Franklin Gothic Book",sans-serif">FYSA<o:p></o:p></span></span></p>
<p class="xmsonormal"><span class="xcontentpasted0"><span style="font-family:"Franklin Gothic Book",sans-serif;color:black"> </span></span><span style="font-family:"Franklin Gothic Book",sans-serif;color:black"> </span><span style="font-size:12.0pt;color:black"><o:p></o:p></span></p>
<p class="xmsonormal"><span class="xcontentpasted0"><span style="font-family:"Franklin Gothic Book",sans-serif;color:#030303">The Cybersecurity and Infrastructure Security Agency (CISA) released <a href="https://www.cisa.gov/resources-tools/resources/zero-trust-maturity-model">Zero
Trust Maturity Model (ZTMM) version 2</a>, which provides a roadmap for agencies to reference as they transition towards a zero trust architecture. While the Zero Trust Maturity Model is specifically intended for federal agencies, all organizations should
review this guidance and take steps to advance their progress toward a zero trust model. </span></span><span style="font-size:12.0pt;color:black"><o:p></o:p></span></p>
<p class="xmsonormal"><span style="font-family:"Franklin Gothic Book",sans-serif;color:#030303"> </span><span style="font-size:12.0pt;color:black"><o:p></o:p></span></p>
<p class="xmsonormal"><span class="xcontentpasted0"><span style="font-family:"Franklin Gothic Book",sans-serif;color:#030303">In this update, a new maturity stage was added to the model that organizations can use as a guide to identify maturity for each pillar
and give consistency for a more gradual maturity evolution. The new stage, “Initial,” was added in part due to the recognition that federal agencies are at various points in starting their evolution towards zero trust architecture. Where the “Traditional”
starting stage provided criteria based on manually configured attributes, lifecycles and other criteria, the “Initial” stage provides criteria for those agencies that are starting automation. For all four stages of maturity, CISA added several new functions
and/or updated existing ones that should be considered when planning and making decisions for zero trust architecture implementation. The four criteria are: Traditional, Initial, Advanced, and Optimal. </span></span><span style="font-size:12.0pt;color:black"><o:p></o:p></span></p>
<p class="xmsonormal"><span style="font-family:"Franklin Gothic Book",sans-serif;color:#030303"> </span><span style="font-size:12.0pt;color:black"><o:p></o:p></span></p>
<p class="xmsonormal"><span class="xcontentpasted0"><span style="font-family:"Franklin Gothic Book",sans-serif;color:#030303">Also, the updated maturity model provides a gradient of implementation across the five distinct pillars to facilitate implementation,
allowing organizations to make minor advancements over time toward optimization of zero trust architecture. The five pillars of the Zero Trust Maturity Model are: Identity; Devices; Network, Data, and Applications and Workloads. </span></span><span style="font-size:12.0pt;color:black"><o:p></o:p></span></p>
<p class="xmsonormal"><span style="font-family:"Franklin Gothic Book",sans-serif;color:#030303"> </span><span style="font-size:12.0pt;color:black"><o:p></o:p></span></p>
<p class="xmsonormal"><span class="xcontentpasted0"><span lang="EN" style="font-family:"Franklin Gothic Book",sans-serif;color:black">Updates are outlined in the <a href="https://www.cisa.gov/resources-tools/resources/zero-trust-maturity-model-response-comments">Zero
Trust Maturity Model Response to Comments</a>.</span></span><span style="font-family:"Franklin Gothic Book",sans-serif;color:black"> </span><span style="font-size:12.0pt;color:black"><o:p></o:p></span></p>
<p class="xmsonormal"><span class="xcontentpasted0"><span style="font-family:"Franklin Gothic Book",sans-serif;color:#030303">All organizations are encouraged to review this roadmap and other zero trust resources on our </span></span><span style="font-family:"Franklin Gothic Book",sans-serif;color:black"><a href="https://cisa.gov/zero-trust-maturity-model" title="https://cisa.gov/zero-trust-maturity-model">Zero
Trust Maturity Model webpage</a></span><span class="xcontentpasted0"><span style="font-family:"Franklin Gothic Book",sans-serif;color:#030303">. </span></span><span class="xcontentpasted0"><span style="font-family:"Franklin Gothic Book",sans-serif"><o:p></o:p></span></span></p>
<p class="xmsonormal"><o:p> </o:p></p>
<p class="MsoNormal"><b><span style="color:#1F497D">Theresa A. Masse<o:p></o:p></span></b></p>
<p class="MsoNormal"><span style="font-size:10.0pt;color:#1F497D">Cybersecurity State Coordinator/Advisor, Region 10 (Oregon)
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;color:#1F497D">Cybersecurity and Infrastructure Security Agency<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;color:#1F497D">Department of Homeland Security<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;color:#1F497D">Phone: (503) 930-5671
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;color:#1F497D">Email:</span><span style="font-size:10.0pt;color:#777777">
</span><a href="mailto:theresa.masse@cisa.dhs.gov"><span style="font-size:10.0pt;color:#0563C1">theresa.masse@cisa.dhs.gov</span></a><u><span style="font-size:10.0pt;color:#0760C1"><o:p></o:p></span></u></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><img border="0" width="97" height="97" style="width:1.0138in;height:1.0138in" id="Picture_x0020_1" src="cid:image001.png@01D96C47.42E0D910"><span style="color:#1F497D"><o:p></o:p></span></p>
<p class="xmsonormal"><o:p> </o:p></p>
</div>
</body>
</html>