ZTMM+
Numberline's enhanced, extended, and more effective version of the CISA Zero Trust Maturity Model.
CISA’s free, public-domain ZTMM is widely adopted and covers five key pillars: Identity, Devices, Networks, Applications and Workloads, and Data. Drawing on our experience applying it across the public and private sectors, we built a more robust, practical extension of it.
A clearer, more practical maturity model
Five enhancements make assessments more objective, repeatable, and useful across the enterprise.
Defined CISA's pillar functions
CISA's baseline model never actually defines its 40 functions across the pillars. ZTMM+ fills this gap with clear definitions, making the framework more approachable and objectively assessable.
Clarified maturity levels
Several functions' maturity progressions were off-target for private-sector environments. ZTMM+ clarifies and redefines fifteen of the functions' maturity levels.
Added new functions
ZTMM+ introduces entirely new functions across the pillars — including Device Lifecycle Management and Secure Internet Access — addressing gaps in the original model.
Created function attributes
Over 80 characteristics across functions, captured as specific prompt questions with four pre-written, level-mapped answers each, enable a clearer, more objective assessment.
Structured assessment methodology
A detailed, repeatable methodology for conducting maturity assessments and evaluating Zero Trust progress consistently across the enterprise.
Example: Access Management maturity
CISA's baseline progression versus ZTMM+'s clarified version, which calls out access review process and session/identity context.
CISA BASELINE
Traditional
Agency authorizes permanent access with periodic review for both privileged and unprivileged accounts.
Initial
Agency authorizes access, including privileged requests, that expires with automated review.
Advanced
Agency authorizes need- and session-based access, including privileged requests, tailored to actions and resources.
Optimal
Agency uses automation for just-in-time, just-enough access tailored to individual actions and resources.
ZTMM+ CLARIFIED
Traditional
Enterprise authorizes permanent access for privileged and unprivileged accounts. Basic, manual periodic reviews.
Initial
Access via request/approval processes. Reviews can result in removal. Privileged access may be temporary.
Advanced
Request- and session-based access tailored to actions and resources. Policies use session and identity attributes.
Optimal
Automation authorizes just-in-time, just-enough access. Policies use session and identity attributes, with minimal access granted.
Service offerings
Choose the level of support that fits your team, timeline, and desired outcome.
Self-Service Assessment
- Full ZTMM+ maturity model
- Interactive scoring spreadsheet
- Video training guide
- Execute at your own pace
Guided Assessment
- Full ZTMM+ maturity model
- Interactive scoring spreadsheet
- Video training guide
- Numberline- led Assessment kickoff, and selected pillar deep-dive
- Expert review and feedback
- Execute at your own pace, with our assistance
Full-Service Assessment
- Full ZTMM+ maturity model
- Kickoff and complete maturity assessment workshop led by Numberline
- Detailed report with observations, recommendation and peer comparison
- Executive stakeholder readout session
- Fastest execution backed by our expertise
ZTMM+ Self-Service Assessment Kit
Zero Trust Maturity Model Plus (ZTMM+) is Numberline’s enhanced, extended, and more effective version of the CISA Zero Trust Maturity Model. This Self-Assessment kit includes everything you need to evaluate the maturity of your enterprise’s environment, using an easy-to-understand and well-explained approach.