NSA issues guidelines on zero trust architecture

The National Security Agency has released two phases of its Zero Trust Implementation Guidelines for organizations to improve their zero trust architecture. Zero trust is a cybersecurity strategy guided by the principle that no users or devices are safe and that they must always be verified. The guidance outlines activities and requirements to achieve zero trust standards from the Department of Defense. 

“Implementation of zero trust is resource intensive and may be cost prohibitive for some organizations,” said Scott Gee, AHA deputy national advisor for cybersecurity and risk. “However, with cybersecurity threats and attacks continuing to target the health care sector, adopting zero trust can help hospitals and health systems further reduce their cyber risk through a structured process. The NSA guidance is very detailed, and, while not tailored to health care, the process can be adapted to meet the needs of hospitals and health systems.” 

For more information on this or other cyber and risk issues, contact Gee at sgee@aha.org. For the latest cyber and risk resources and threat intelligence, visit aha.org/cybersecurity.