Zero trust architecture maturity assessment for [REDACTED] against the CISA Zero Trust Maturity Model across five pillars: Identity, Devices, Networks, Applications, and Data. Engagement ref. ENG-2025-0564.
Plaidnox assessed [REDACTED]' security architecture against the CISA Zero Trust Maturity Model v2.0. The overall maturity score of 1.8 out of 5 places the organisation at the Traditional level . consistent with a perimeter-centric security model built on network trust rather than continuous verification. The primary driver of the low score is the complete absence of micro-segmentation and a network architecture that implicitly trusts all east-west traffic once inside the perimeter.
The most critical gap is 4,200 warehouse and logistics devices operating on a flat, unsequenced network with no zone-based trust policy . a single compromised device can reach payment processing and HR systems directly.
| ZT Pillar | Score | Level | Key Gap |
|---|---|---|---|
| Identity | 2.4 / 5 | Initial | MFA not enforced for 31% of users; no PIM |
| Devices | 1.8 / 5 | Traditional | IoT/OT devices not inventoried or enrolled in MDM |
| Networks | 1.2 / 5 | Traditional | Flat network . no micro-segmentation, implicit east-west trust |
| Applications | 2.2 / 5 | Initial | No application-layer access policy . network access = app access |
| Data | 1.0 / 5 | Traditional | No data classification, no DLP, no encryption-in-use policy |
| ID | Finding | Priority |
|---|---|---|
| ZT-G01 | Flat network with no micro-segmentation . 4,200 warehouse devices can reach all internal systems | Critical |
| ZT-G02 | No data classification framework . cannot apply least-privilege data access without classification | Critical |
| ZT-G03 | IoT/logistics devices not in MDM . unknown device trust posture, no patch state visibility | High |
| ZT-G04 | No Conditional Access policies . location, device compliance, and risk level not evaluated at login | High |
| ZT-G05 | Application access granted via network . ZTNA / app proxy not deployed for any internal app | High |
| Phase | Actions | Target Score |
|---|---|---|
| Phase 1 (0-3 mo.) | Enforce MFA + Conditional Access; inventory all devices; classify top 20% of sensitive data | 2.5 / 5 |
| Phase 2 (3-9 mo.) | Micro-segment warehouse vs. corporate vs. payment networks; deploy Azure AD ZTNA for remote access | 3.2 / 5 |
| Phase 3 (9-18 mo.) | Deploy data classification labels across M365; implement application-layer access policies via Entra App Proxy | 3.8 / 5 |