# Zero Trust Readiness Assessment: Where Your Architecture Actually Stands > Source: https://netray.co/tools/zero-trust-readiness-assessment > Publisher: Netray (netray.co), AI and integration engineering for ERP and manufacturing systems. > Section: Free Tools ## Short answer Answer 8 questions on identity, device posture, segmentation, and access policy to get a scored zero trust maturity band with a specific remediation roadmap. ## Category aerospace-defense ## Tool **Kind:** assessment **Questions:** #### How is user identity verified before granting access to applications? **Help:** Consider your baseline for a typical office or remote employee, not just privileged admin accounts. **Options:** ##### Password only, no MFA required **Score:** 0 ##### MFA required for some systems, VPN as the main gate **Score:** 4 ##### MFA enforced everywhere with conditional access policies **Score:** 7 ##### Phishing-resistant MFA (FIDO2/PIV) with continuous risk-based verification **Score:** 10 #### How do you verify device health before granting access to corporate resources? **Options:** ##### No device checks performed **Score:** 0 ##### Basic antivirus/EDR agent required, not continuously verified **Score:** 3 ##### MDM enrollment and compliance policy required **Score:** 7 ##### Continuous device posture and certificate-based trust evaluated per session **Score:** 10 #### How is your network segmented? **Options:** ##### Largely flat network, minimal internal segmentation **Score:** 0 ##### VLAN-based segmentation between major zones **Score:** 4 ##### Microsegmentation applied to critical systems (ERP, PLM, production) **Score:** 7 ##### Full microsegmentation with a software-defined perimeter across the environment **Score:** 10 #### How are access privileges assigned and reviewed? **Options:** ##### Broad or standing admin access, rarely reviewed **Score:** 0 ##### Role-based access defined, but with known overprivileged accounts **Score:** 4 ##### RBAC in place with quarterly access reviews **Score:** 7 ##### Just-in-time, least-privilege access with automated expiration **Score:** 10 #### How do users and services access internal applications like your ERP or file shares? **Options:** ##### Direct network access or flat VPN into the internal network **Score:** 0 ##### Application-level SSO with a static, one-time trust decision **Score:** 4 ##### Per-session policy enforcement through a ZTNA broker **Score:** 7 ##### Continuous authorization evaluating identity, device, and contextual signals per request **Score:** 10 #### How is access activity logged and monitored? **Options:** ##### Minimal or inconsistent logging **Score:** 0 ##### Centralized logs collected, but no active alerting **Score:** 4 ##### SIEM in place with alerting on anomalous access patterns **Score:** 7 ##### Real-time behavioral analytics feeding automated containment response **Score:** 10 #### How do contractors and third parties access your systems? **Options:** ##### Shared credentials or standing VPN access **Score:** 0 ##### Individual accounts issued, but with no expiration or scope limits **Score:** 4 ##### Scoped access with defined expiration dates **Score:** 7 ##### Fully brokered zero trust vendor access with session recording and just-in-time approval **Score:** 10 #### Where are access policies actually enforced? **Options:** ##### Perimeter firewall only **Score:** 0 ##### Some application-level controls layered on top of the perimeter **Score:** 4 ##### A policy engine evaluates access per resource **Score:** 7 ##### A centralized policy engine evaluates identity, device, and context for every request **Score:** 10 **Bands:** #### Perimeter-Only Security **Min:** 0 **Max:** 24 **Verdict:** Your access model still relies primarily on network location and a hardened perimeter rather than continuous verification. This is the highest-risk posture against modern ransomware and insider threats, and it will not satisfy CMMC Level 2 or DoD zero trust strategy requirements without substantial rework. **Recommendations:** - Enforce MFA for all users as the immediate first step, prioritizing privileged and remote access accounts. - Inventory every standing VPN and flat network access path as your first segmentation project. - Start a phased microsegmentation plan beginning with your most critical systems (ERP, PLM, production control). - Stand up centralized logging even before you can act on alerts; you cannot improve what you cannot see. - Engage a zero trust architecture assessment before committing budget to point tools that will not integrate. #### Fragmented Controls **Min:** 25 **Max:** 49 **Verdict:** You have meaningful controls in specific areas, MFA in some places, VLAN segmentation, an MDM rollout, but they are not integrated into a coherent policy model. Attackers who compromise one weak link (an unenrolled device, a standing vendor account) can often move laterally with little additional friction. **Recommendations:** - Consolidate access policy enforcement points; count how many separate systems currently make access decisions. - Close the gap on device posture checks for any remote or BYOD access path. - Move privileged access from standing to just-in-time with automated expiration. - Formalize a third-party access process with individual accounts, scoping, and expiration by default. - Pilot a ZTNA broker for your highest-value application before a full rollout. #### Zero Trust in Progress **Min:** 50 **Max:** 74 **Verdict:** Core building blocks, MFA, MDM, RBAC with reviews, are in place and integrated in most areas. The remaining gap is usually consistency: a few legacy systems or vendor relationships still operate on implicit trust, and monitoring is reactive rather than continuous. **Recommendations:** - Extend continuous verification to any remaining legacy systems still relying on network-location trust. - Move from periodic access reviews to continuous entitlement monitoring where your tooling supports it. - Close out microsegmentation for any critical system still sitting on a shared VLAN. - Add behavioral analytics on top of existing SIEM alerting to catch anomalies static rules miss. - Document your architecture against NIST SP 800-207 and DoD zero trust reference architecture for compliance mapping. #### Mature Zero Trust Architecture **Min:** 75 **Max:** 100 **Verdict:** Your organization enforces continuous, context-aware access decisions across identity, device, and network layers, with monitoring capable of automated response. This posture supports CMMC Level 2+ requirements and DoD zero trust strategy target-level expectations with focused validation rather than architectural rework. **Recommendations:** - Run periodic red-team or purple-team exercises to validate policy engine coverage against real attack paths. - Extend the same continuous verification model to OT and production systems if not already covered. - Formalize metrics (mean time to detect, policy exception rate) for ongoing executive reporting. - Audit third-party and supply chain access quarterly to prevent the model from eroding as vendors change. ## Content **Intro:** This free zero trust readiness assessment scores your organization's access control maturity across identity verification, device posture, network segmentation, and monitoring in eight questions, taking about four minutes to complete. It is built for CIOs, IT directors, and security leads at aerospace, defense, and manufacturing organizations who need to know where they stand against CMMC 2.0 and DoD zero trust strategy expectations before a customer flow-down clause or an assessor asks. The output is a scored maturity band with a specific, prioritized remediation list, not a generic maturity model. **Sections:** #### Why zero trust matters more for defense-adjacent manufacturers **Body:** Every DoD contractor and subcontractor is moving toward zero trust requirements as part of CMMC 2.0 rollout and the DoD's own zero trust strategy target-level goals. Flow-down clauses increasingly require demonstrable continuous verification, not just a perimeter firewall and a VPN, and assessors are trained to probe for exactly the gaps this assessment measures: standing privileged access, unverified device posture, and flat internal networks. **Bullets:** - CMMC Level 2 assessments increasingly probe for continuous verification, not just documented policy. - Prime contractors are pushing zero trust requirements down through flow-down clauses to subcontractors. - A flat internal network is one of the most common findings in defense supply chain security assessments. #### The gap between 'we have MFA' and true zero trust **Body:** Most organizations that describe themselves as having strong security have MFA and some segmentation, but that is necessary, not sufficient, for zero trust. True zero trust evaluates identity, device health, and contextual signals continuously, per request, not once at login. The most common gap this assessment surfaces is standing access: privileged accounts, VPN sessions, or vendor credentials that remain valid for weeks or months without re-verification. **Bullets:** - MFA at login is a starting point, not the finish line, for zero trust maturity. - Standing privileged access is the single most common finding this assessment exposes. - Device posture checks are frequently missing for remote and contractor-issued devices specifically. #### Where to start if you score low **Body:** Do not attempt a full zero trust architecture rebuild in one project. Start with the highest-leverage, lowest-disruption steps: enforce MFA everywhere, inventory and close standing access, and add device posture checks to your most sensitive applications first. A phased 12 to 18 month roadmap that starts with identity and access, then adds device and network segmentation, produces measurable maturity gains without the disruption of a big-bang rearchitecture. #### How Netray helps close the gap **Body:** Netray helps aerospace, defense, and electronics manufacturers translate a zero trust readiness score into a phased, budgeted roadmap aligned to CMMC and DoD zero trust target-level requirements, including on-prem and air-gapped deployments where cloud-based zero trust brokers are not an option. **Cta:** Get a phased zero trust roadmap mapped to CMMC 2.0 and your customer flow-down requirements. **Faq:** #### What is zero trust architecture in simple terms? **Answer:** Zero trust is a security model that assumes no user, device, or network location is automatically trusted, even inside the corporate network. Instead of trusting anything behind the firewall, every access request is verified based on identity, device health, and context, every time, not just once at login. It replaces implicit trust based on network location with continuous, explicit verification. #### Does CMMC 2.0 require zero trust architecture? **Answer:** CMMC 2.0 itself is built on NIST SP 800-171 and does not use the term zero trust directly, but many of its required controls (access control, identification and authentication, system and communications protection) align closely with zero trust principles, and the DoD's separate zero trust strategy sets target-level expectations that increasingly show up in flow-down requirements from prime contractors. Organizations building toward CMMC compliance should design controls with zero trust principles in mind. #### How long does it take to implement zero trust architecture? **Answer:** A phased implementation typically takes 12 to 24 months for a mid-size manufacturer, starting with identity and MFA (2 to 4 months), then device posture and access policy consolidation (4 to 8 months), then network microsegmentation for critical systems (6 to 12 months). Attempting a full rearchitecture in a single project is the most common cause of stalled zero trust initiatives. #### What is the difference between VPN access and ZTNA? **Answer:** A VPN grants broad network-level access once a user authenticates, effectively placing them inside the corporate network. Zero Trust Network Access (ZTNA) grants access to a specific application only, after evaluating identity, device posture, and context for that specific request, and re-evaluates continuously rather than trusting the initial session indefinitely. ZTNA significantly reduces lateral movement risk if an account or device is compromised. #### Can zero trust be implemented in an air-gapped environment? **Answer:** Yes, though cloud-based ZTNA brokers are not usable in fully air-gapped networks. On-prem zero trust architecture relies on locally hosted policy engines, certificate-based device trust, and internal microsegmentation enforced by on-prem network infrastructure rather than a cloud broker. This is common in classified and ITAR-controlled environments where no policy decision can transit an external network. ## Search terms zero trust readiness assessment, zero trust maturity, zero trust architecture assessment, CMMC zero trust, ZTNA assessment, zero trust checklist, DoD zero trust strategy, zero trust gap analysis --- Talk to an engineer: https://netray.co/contact?intent=erp_ai | Machine catalog: https://netray.co/agent/catalog.json