Free tool · No login
Zero Trust Baseline Assessment
A free, self-reported Zero Trust assessment informed by CISA Zero Trust Maturity Model (ZTMM) v2.0 Initial-stage capabilities. Answer 18–21 questions across the five CISA pillars and three cross-cutting capabilities, and get a scored snapshot, your key gaps, and up to three suggested next actions.
- 18–21 questions
- About 10 minutes
- No login, nothing stored
- Printable report
Loading the assessment. It runs entirely in your browser and needs JavaScript enabled.
What the assessment covers
The eight areas of CISA ZTMM v2.0, with two to four foundational questions each. They cover what most Zero Trust programs need in place before advanced capabilities pay off.
Five pillars
- Identity: How workforce users sign in, and how their access is granted, changed, and removed.
- Devices: Endpoints, servers, mobile devices, and cloud workloads, and how they are inventoried, protected, patched, and checked before access.
- Networks: The on-premises and cloud networking your scope operates, and how critical systems and internal traffic are protected.
- Applications & Workloads: The applications in use, including SaaS, how access to them is granted, and how software you build is tested.
- Data: Where sensitive data lives, how it is classified, and how it is encrypted.
Three cross-cutting capabilities
- Visibility & Analytics: Collecting security logs across the pillars and turning them into alerts someone acts on.
- Automation & Orchestration: Automating identity lifecycle and security response.
- Governance: The strategy, ownership, and plans that keep a Zero Trust program accountable.
How it works
Set the scope
Choose the whole organization, a business unit, or one application or environment. Two routing questions remove what doesn't apply, such as software development or networks you don't operate.
Answer area by area
One area at a time, with guidance on what counts as Yes and what counts as Partially. "Don't know" is a valid answer.
Review your results
An overall result, a result for each area, key gaps, key capabilities to verify, and up to three suggested next actions.
Keep a copy
Print the report or save it as a PDF, open a summary in your own email app, or copy it.
How results are scored
Each answer earns credit toward the area's score:
| Answer | Credit | How the report treats it |
|---|---|---|
| Yes | 1 | Reported as implemented within the selected scope |
| Partially | 0.5 | Reported as partly implemented, with a next step |
| No | 0 | Reported as absent, with a next step |
| Don't know | 0 | Reported as unconfirmed, with who should verify it; counted separately, never as an absent control |
Each area, and the assessment overall, gets one of four results, checked in this order:
- Not enough confirmed answers: half or more of the answers are "Don't know".
- Significant foundational gaps: a score below 40%.
- Foundations partly implemented: a score from 40% to just under 80%, or 80% and above with a key capability not answered Yes.
- Most assessed foundations reported in place: 80% and above, with every key capability answered Yes.
Five capabilities are treated as key: MFA, centralized sign-in, EDR, central security logging, and knowing where high-risk data lives. A key capability answered No or Partially is listed as a key implementation gap. A key capability answered "Don't know" is listed as a key capability to verify. Both are shown whatever the score.
Suggested next actions follow Zephon's suggested starting sequence, which puts foundational capabilities first. Your organization's risk, existing investments, and dependencies determine final priority.
What this assessment is not
It is not a CISA assessment, and it is not affiliated with or endorsed by CISA. The results are self-reported and are not checked against evidence. The result labels and scoring are Zephon's method, not CISA maturity stages. A small set of questions can't place an organization at a CISA stage. It can show where foundations look solid and where to look next.
Free baseline or full AISE assessment?
The baseline is a quick, self-reported snapshot. AISE, Zephon's Zero Trust Maturity & Governance Platform, is for when leadership, auditors, or acquisition teams need evidence.
| Free baseline | AISE | |
|---|---|---|
| Questions | 18–21 foundational questions | 1,384 questions built on the CISA ZTMM v2.0 and DoD Zero Trust frameworks, with stop-gate logic |
| Basis for answers | Your own knowledge | AI reviews the reports, policies, and configurations you upload and recommends answers with a confidence score; your team confirms every answer |
| Output | Area results, key gaps, up to three next actions | Detailed gap analysis, strong and weak areas, and an executive briefing |
| Roadmap | Suggested starting sequence | Dependency-aware roadmap with specific steps and rough-order-of-magnitude (ROM) effort estimates |
| Over time | A one-time snapshot; nothing is saved | Re-assess each cycle and track maturity gains |
Frequently asked questions
What is the CISA Zero Trust Maturity Model?
The Cybersecurity and Infrastructure Security Agency (CISA) Zero Trust Maturity Model, version 2.0 (April 2023), describes Zero Trust across five pillars: Identity, Devices, Networks, Applications and Workloads, and Data. Three cross-cutting capabilities span all of them: Visibility and Analytics, Automation and Orchestration, and Governance. It defines four maturity stages: Traditional, Initial, Advanced, and Optimal. Read the model at cisa.gov.
What does the Initial stage mean?
Initial is the first stage beyond Traditional. At this stage an organization starts automating access lifecycles and policy enforcement, begins integrating across pillars, and puts foundational capabilities in place for at least some of its resources. This assessment asks about those foundational capabilities.
Is this an official CISA assessment?
No. It is informed by CISA ZTMM v2.0 Initial-stage capabilities, but the questions, scoring, and result labels are Zephon's. It is not affiliated with or endorsed by CISA.
How long does it take?
About 10 minutes. You answer 18 to 21 questions, depending on whether your scope builds software and operates its own networks.
Do I need to sign up or log in?
No. There is no sign-up, no login, and no form to submit.
Are my answers stored or sent anywhere?
No. The assessment runs entirely in your browser. Your answers, scores, and scope details are not stored or sent to Zephon, and reloading the page clears them. Google Analytics records usage events, such as starting the assessment and how long it took, but not your answers. See the privacy page.
Who should take it?
CISOs, Zero Trust program leads, identity and access management (IAM) leaders, and security architects who want a quick view of foundational Zero Trust capabilities. If some answers sit with other teams, answer "Don't know". The results tell you who should verify each one.
What should I answer if I'm not sure?
Answer "Don't know". It earns no credit, but it is reported as unconfirmed, separately from controls you reported as absent, so your results don't overstate the gaps.
How do I answer for controls a supplier runs?
Answer Yes only if you have confirmed the control is in place for your scope, through a contract, an attestation, or settings you can see. If you assume it but haven't confirmed it, answer "Don't know".
Can I save or share my results?
Yes. Print the report or save it as a PDF from your browser's print dialog, open a summary as a draft in your own email app, or copy the summary. Nothing is saved on our side, so keep a copy before you leave the page.
How is this different from a full Zero Trust maturity assessment?
This baseline asks a small set of foundational questions and relies on your own knowledge. A full assessment, such as one run in AISE, covers each framework in depth, bases answers on evidence from your documents and configurations, sequences the work by dependency, and tracks progress across assessment cycles.
Question set version 1 (pilot), November 2026.
Ready for an evidence-based Zero Trust baseline?
AISE assesses maturity from your own reports, policies, and configurations, builds a sequenced roadmap, and tracks progress across cycles. Book 30 minutes for a walkthrough.