The DoD Zero Trust Strategy, explained

Zero trust, as the National Institute of Standards and Technology (NIST) describes it in Special Publication (SP) 800-207 of August 2020, assumes no implicit trust is granted to assets or user accounts based solely on their physical or network location. The DoD Zero Trust Strategy, dated October 21, 2022 and cleared for open publication on November 7, 2022, applies that idea across the Department of Defense (DoD). It sets four goals, seven pillars, and a target level that DoD Components must reach by the end of fiscal year (FY) 2027. A July 2025 directive-type memorandum (DTM) restates that deadline for all unclassified and classified systems, including national security systems.

Goals, pillars, and what the strategy leaves to Components

The four strategic goals are Zero Trust Culture Adoption, DoD Information Systems Secured and Defended, Technology Acceleration, and Zero Trust Enablement. The seven pillars are:

• User
• Device
• Applications & Workloads
• Data
• Network & Environment
• Automation & Orchestration
• Visibility & Analytics

The strategy says the capabilities in every pillar must work together to secure the Data pillar, which is central to the model. It names the Nonclassified Internet Protocol Router Network (NIPRNet) and the Secret Internet Protocol Router Network (SIPRNet) as examples of networks in scope. From the DoD Zero Trust Reference Architecture, version 2.0, it repeats five tenets: Assume a Hostile Environment, Presume Breach, Never Trust Always Verify, Scrutinize Explicitly, and Apply Unified Analytics.

The document calls itself a strategy, not a solution architecture. It does not mandate specific technologies. Components may select their own solutions, provided they deliver the specified capability outcomes and can show that proof to their authorizing official or the Zero Trust Portfolio Management Office (ZT PfMO).

Target level, advanced level, and the count

Target Level ZT is the minimum set of capability outcomes and activities needed to protect DoD data, applications, assets, and services against currently known threats, and the strategy says all of DoD must minimally achieve it. Advanced ZT is the complete set, offering adaptive responses and the highest level of protection. Only a limited number of systems will be specifically required to reach advanced level within the strategy's timeframe, and reaching it does not end the work.

The counts come from the Zero Trust Execution Roadmap v1.1, dated November 22, 2024. It lists 42 capabilities at target level and 3 at advanced level, for 45 in all, and 91 activities at target level and 61 at advanced level, for 152 in all. The roadmap describes three courses of action (COAs): uplifting legacy infrastructure (COA 1), commercial cloud (COA 2), and a purpose-built on-premises cloud (COA 3). Components may combine them, and the roadmap calls its COA 1 durations notional.

A revision of the January 6, 2023 capabilities and activities list updates only the target-level activities and says the mandated deadline for target level remains the end of FY2027.

Deadlines and later guidance

The 2022 strategy required Component execution plans by September 23, 2023 and target-level outcomes no later than the end of FY2027.

DTM 25-003, dated July 17, 2025 and changed September 2, 2025, establishes the ZT PfMO and a Chief ZT Officer. It directs Component heads to achieve at minimum target level across all unclassified and classified systems on the DoD Information Network, with priority on NIPRNet and SIPRNet, by the end of FY2027. It also tells them to bring zero trust principles to weapons systems at the combined joint tactical environment, so data stays secured in denied, degraded, intermittent, and limited bandwidth environments. The DTM states it will be converted into a DoD instruction and expires effective July 17, 2026.

The capabilities list adds a limit for national security systems (NSS): the NSS National Manager, the Director of the National Security Agency, sets NSS zero trust guidance rather than DoD.

Zero trust on an isolated network

NIST's second tenet is that network location alone does not imply trust. A request from inside a legacy perimeter must meet the same requirements as one from any other network.

DoD's zero trust guidance for operational technology (OT), cleared November 18, 2025, applies that to isolated networks directly. It says many OT environments have no persistent connection to any IT environment or external network, and that the activities apply equally to them. It names insider threats, temporary device connections, data transfer media, and installed software and hardware as attack vectors, and says that in some ways isolated systems presume a false sense of security in the air-gapped boundary.

The same guidance allows exceptions. A standalone system may not be able to ingest threat streams. In that case the assessor documents and reports the justification and removes the activity from that system's target-level requirements. Tools such as credentialing, asset management, and threat detection may first be installed locally and integrated with enterprise tools later.

NIST's draft SP 800-82 Revision 4, open for comment from September 21 to November 30, 2026, applies zero trust logic to content rather than users. Nothing is trusted because it reached the demilitarized zone (DMZ) or passed the USB scanning kiosk once. Each artifact is scanned, validated, and quarantined on failure.

What to check

• Does a zero trust claim name target or advanced level, and does it map to the 152 activities in the roadmap, 91 of them at target level?
• Which course of action does the program follow: legacy infrastructure, commercial cloud, on-premises cloud, or a mix?
• For an isolated system, which activities were removed as inapplicable, and where is the documented justification?
• Does any capability depend on an enterprise service, such as a threat feed, that an isolated enclave cannot reach?
• Has DTM 25-003, which states it expires effective July 17, 2026, been converted into a DoD instruction?
• For a national security system, does the plan follow guidance from the NSS National Manager?

Azcuna's BABEL reads, translates, and searches foreign-language documents entirely on-device, with no cloud and no connection, and keeps every claim tied to the passage it came from.

Sources

1. 1NIST SP 800-207, Zero Trust Architecture · National Institute of Standards and Technology, August 2020
2. 2DoD Zero Trust Strategy · DoD Chief Information Officer, dated October 21, 2022
3. 3Zero Trust Execution Roadmap v1.1 · DoD CIO Zero Trust Portfolio Management Office, November 22, 2024
4. 4Directive-Type Memorandum 25-003, Implementing the DoD Zero Trust Strategy · DoD Chief Information Officer, July 17, 2025, Incorporating Change 1, September 2, 2025
5. 5DoD Zero Trust Capabilities and Activities · Department of War Chief Information Officer, Zero Trust Portfolio Management Office
6. 6Zero Trust for Operational Technology Activities and Outcomes · Department of War Chief Information Officer, cleared for open publication November 18, 2025
7. 7NIST SP 800-82r4 ipd, Guide to Operational Technology (OT) Security (Initial Public Draft) · National Institute of Standards and Technology, September 2026

Where this shows up in our work

• ELLMENT, the offline LLM for E-2D crews answers a crew's question from the aircraft's own manuals and cites the page, with no network.
• BABEL, offline multilingual translation and search translates and searches foreign-language documents on-device, every fact tied to its source passage.
• TRACE, the offline S1000D and IETM viewer opens S1000D, MIL-STD-3001 and PDF technical manuals on a tablet with every marking intact.