Zero Trust is a security model that removes automatic trust based on network location and instead verifies every request as though it came from an open, hostile network. The guiding assumption is that a breach has already happened, so no user, device, or service is trusted by default.
Putting it into practice means verifying explicitly with strong authentication, granting least privilege, and shrinking the blast radius through segmentation and continuous monitoring. Identity becomes the real perimeter. A common misunderstanding is treating Zero Trust as a product you can buy, when it is an architecture assembled from existing tools like identity providers, device posture checks, and micro-segmentation working together. Tearing down the old perimeter before those pieces are mature tends to open gaps rather than close them.
Why does Zero Trust matter for the CISSP exam?
Zero Trust sits mainly in Domain 3, Security Architecture and Engineering, though it reaches into network and identity topics too. The exam expects you to contrast it with perimeter-based designs and recognize the technologies that enable it. Read Domain 3: Security Architecture and Engineering for the architectural context.
NIST defines the model in SP 800-207 Zero Trust Architecture.