Why Identity is the Foundation of Zero Trust

Zero Trust is often described in network terms, but at its center is identity. Every access decision in a Zero Trust model turns on who or what is asking, and whether that identity can be trusted for this request, right now. This guide explains why identity is the foundation of Zero Trust, how the NIST and CISA frameworks place it there, and what an identity-first Zero Trust program actually requires.

What is Zero Trust?

Zero Trust is a security model that treats all traffic as untrusted and removes the old assumption that anything inside the network perimeter is safe. It was introduced by analyst John Kindervag at Forrester in 2010, in the report No More Chewy Centers: Introducing the Zero Trust Model of Information Security. The model is commonly summarized as never trust, always verify, which Kindervag originally framed as verify and never trust, the reversal of the old trust but verify maxim.

Forrester's original model rested on three principles: secure all resources regardless of location, enforce least privilege and strict access control, and inspect and log all traffic. The core idea is that trust is never granted by default based on where a request comes from. It must be established for each request.

Why is identity the foundation of Zero Trust?

When location no longer confers trust, the question becomes: what does? The answer is identity, together with the signals around it. If you cannot determine who or what is making a request, and whether it should be allowed, you cannot make a Zero Trust access decision at all. This is why identity is widely described as the new control plane. Microsoft states that identity is central to a successful Zero Trust strategy and frames it as the foundation, putting identity verification in the path of every access request.

Google's BeyondCorp, one of the earliest production Zero Trust implementations, captures the same shift in its principles: connecting from a particular network must not determine which services you can access, and access is granted based on what is known about the user and their device. The perimeter moves from the network to the identity.

How NIST SP 800-207 places identity at the center

NIST Special Publication 800-207, Zero Trust Architecture, published in August 2020, is the authoritative reference. It sets out seven tenets of Zero Trust. Two of them make identity explicit. The fourth tenet establishes that access to resources is determined by dynamic policy, and NIST names the observable state of client identity as one of the inputs to that policy. The sixth tenet states that all resource authentication and authorization are dynamic and strictly enforced before access is allowed.

Read together, these tenets make identity a first-named, continuously evaluated input to every access decision, not a one-time gate at login. The 2023 companion document, NIST SP 800-207A, goes further for cloud-native environments, shifting the focus of access control toward application and service identities.

Identity is the first pillar of the CISA Zero Trust Maturity Model

CISA's Zero Trust Maturity Model, version 2.0, released in April 2023, organizes Zero Trust into five pillars: Identity, Devices, Networks, Applications and Workloads, and Data. Identity is deliberately the first pillar. The model then describes four maturity stages for each pillar, Traditional, Initial, Advanced, and Optimal, so an organization can measure how far its identity controls have matured rather than treating Zero Trust as a single switch.

The sequencing is not accidental. Identity is where most organizations begin a Zero Trust journey, because the other pillars depend on being able to trust the identity behind a request in the first place.

What identity capabilities does Zero Trust require?

An identity-first Zero Trust program needs a specific set of capabilities. Strong authentication is foundational, with phishing-resistant MFA the standard that CISA and NIST point to for reducing credential risk. Access must follow least privilege, granting only what is needed for the shortest time required. Verification must be explicit, authenticating and authorizing every request using all available signals including user, device, location, and behavior.

Crucially, verification is continuous, not a single event at login. Trust is re-evaluated throughout a session as risk signals change, which is what the NIST tenets on dynamic, per-session, strictly enforced access describe. And underpinning all of it is the assume breach posture: controls are designed on the expectation that an attacker may already be operating inside the environment.

Where identity posture and detection fit

The NIST tenets require that the enterprise monitors and measures the integrity and security posture of all owned and associated assets, and collects as much information as possible about their current state to improve security posture. The identity estate is one of those asset classes, which means Zero Trust for identity is impossible without continuous visibility into it.

This is where two industry categories operationalize the requirement. Identity Security Posture Management (ISPM) is the continuous assessment of the identity estate, finding accounts without MFA, over-privileged or stale accounts, and misconfigurations. Identity Threat Detection and Response (ITDR) detects and responds to active identity attacks such as credential misuse and privilege escalation. These are market terms rather than NIST or CISA terms, but they are the mechanisms that actually implement the monitor posture and collect state requirements for the identity pillar. You cannot satisfy those tenets without them.

Why it matters: identity is where attacks land

The case for an identity-first Zero Trust approach is in the breach data. The IBM Cost of a Data Breach Report 2024 found that using compromised credentials was the single most common initial attack vector, and that breaches involving stolen or compromised credentials took the longest to identify and contain, at 292 days. Credentials are both the easiest way in and the hardest intrusion to catch.

The Verizon 2025 Data Breach Investigations Report reinforces it, with the human element involved in 60 percent of breaches and credential abuse the starting point of 22 percent of breaches. When attackers are logging in with valid identities rather than exploiting software, the identity pillar is not one part of Zero Trust. It is the part that decides whether the model works.

Where 8Layers fits

A Zero Trust identity program needs continuous posture and detection across the identity estate, which is exactly the layer 8Layers focuses on: identity posture, detection, and compliance. It gives you the continuous visibility the NIST tenets and the CISA Identity pillar call for, across human and non-human identities, so that every access decision is made on current, trustworthy information. To see how your identity estate measures up against a Zero Trust standard, request a demo.

Frequently asked questions

Why is identity the foundation of Zero Trust?

Because Zero Trust removes trust based on network location, every access decision has to be made on the identity behind the request and the signals around it. NIST SP 800-207 names client identity as a primary input to access policy, and CISA makes Identity the first pillar of its maturity model. Without trustworthy identity, you cannot make a Zero Trust decision.

What does NIST say about identity in Zero Trust?

NIST SP 800-207 sets out seven tenets. The fourth makes access depend on dynamic policy, with the state of client identity named as one of the inputs, and the sixth requires authentication and authorization to be dynamic and strictly enforced before access is allowed. Identity is a continuous input, not a one-time login gate.

What are the pillars of the CISA Zero Trust Maturity Model?

Version 2.0 defines five pillars: Identity, Devices, Networks, Applications and Workloads, and Data. Identity is the first pillar. Each pillar is measured across four maturity stages: Traditional, Initial, Advanced, and Optimal.

How do ISPM and ITDR relate to Zero Trust identity?

ISPM and ITDR are the industry categories that operationalize the identity pillar. ISPM provides the continuous posture visibility the NIST tenets require, and ITDR provides the detection and response for active identity attacks. They are the practical mechanisms behind a Zero Trust identity program, though the terms themselves come from the market, not NIST or CISA.