Skip to content
FedXchange
Menu

Zero Trust and ICAM Implementation Plan

Use this free template to write your agency's Zero Trust and ICAM Implementation Plan. It maps to National Institute of Standards and Technology (NIST) Special Publication (SP) 800-53 Revision 5, and it sits with the Access Control (AC) family. This copy follows the Low baseline. It names 4 controls and leaves 72 values for your agency to fill in. It calls the agency that adopts it "the Organization", and it names each person by role and each tool by its function. It cites 28 federal sources.

Approved by: Chief Information Security Officer (CISO)

From the document: The Organization follows this plan to:

Download

Downloads need a free FedXchange account. Sign in, and the download starts.

Controls covered

  • AC-02
  • AC-06
  • CM-06
  • IA-02

Every Access Control (AC) template

The text of the Zero Trust and ICAM Implementation Plan

Approval #

Role Name Signature
Chief Information Security Officer (CISO)

Revision History #

Date Version Description Reviewer
2026-10-31 1.0 Initial issuance [Reviewer name]

Review cycle: Every year, under the Policy and Procedure Management Policy.

Mandate. Several federal sources require the Organization to move to a zero trust architecture and to manage identity, credentials, and access as one program:

  • Executive Order (EO) 14028 directs agencies to advance toward zero trust architecture and to adopt multi-factor authentication (MFA) and encryption. (EO 14028, §3)
  • Office of Management and Budget (OMB) M-22-09 sets the federal zero trust strategy and the actions for each pillar. It required each agency to name a zero trust strategy implementation lead.
  • OMB M-19-17 sets federal identity, credential, and access management (ICAM) policy. HSPD-12, Federal Information Processing Standards (FIPS) 201-3, and National Institute of Standards and Technology (NIST) SP 800-63-4 set the credential and digital identity rules.
  • EO 14144, as amended by EO 14306, requires encrypted Domain Name System (DNS) and encrypted email client connections.
  • The Cybersecurity and Infrastructure Security Agency (CISA) Zero Trust Maturity Model, NIST SP 800-207, and NIST SP 1800-35 describe the maturity stages and example designs.

The CISO owns this plan and approves it. It sets the Organization’s current maturity, its targets and dates, the milestones for each pillar, the ICAM strategy, and the measures. The family policies and procedures keep the rules, and this plan names them under Related Documents.

1. Purpose and Scope #

The Organization follows this plan to:

  • Decide every request for access to a resource per session, from the identity, the device, and the context of the request.
  • Give every person and every non-person entity one managed identity and a strong credential.
  • Reach the target maturity stage for each function in each pillar by the date the CISO sets.
  • Report progress to the Chief Information Officer (CIO), the agency head, OMB, and CISA.

The plan covers every system the Organization owns or that others run for it, including cloud services. It covers every user, device, network, application, workload, and data set those systems hold. National security systems are outside its scope.

2. Governance and Roles #

The Zero Trust Strategy Implementation Lead runs this plan and chairs the Zero Trust and ICAM Working Group. The working group is the Organization’s ICAM governance structure under OMB M-19-17. It meets [Assignment: organization-defined meeting frequency — to be defined] and reports to the CIO and the CISO.

Role Responsibilities
CIO Funds the plan through the IT budget. Sends OMB and CISA the reports they ask for. Resolves conflicts between pillar owners.
CISO Owns and approves this plan. Sets each target stage and date. Approves exceptions with the CIO.
Zero Trust Strategy Implementation Lead Runs the plan and the working group. Rates maturity each year. Tracks every milestone and reports status each quarter.
ICAM Program Manager Runs the ICAM program and the ICAM strategy in this plan. Proposes ICAM budgets and changes in ICAM policy. Keeps the list of approved ICAM services.
Enterprise Security Architect Designs the target architecture for each pillar. Reviews each new system and major change against it.
Chief Data Officer (CDO) Leads data categorization and tagging with the CISO.
Network engineering team Carries out the network milestones: segmentation, encrypted DNS, and Hypertext Transfer Protocol Secure (HTTPS).
Identity team Runs the identity services, the credential steps, and the access rules.
Security Operations Center (SOC) manager Runs the endpoint detection and response (EDR) tools and the security information and event management (SIEM) system, and reports detections that affect access decisions.
Personnel Security Officer Sponsors and adjudicates Personal Identity Verification (PIV) credentials, and tells the identity team when eligibility changes.
System Owners Bring their systems to each target. Record the system’s identity, authentication, and federation assurance levels in its System Security and Privacy Plan (SSPP).
Information System Security Officers (ISSOs) Check each system’s progress and record each gap as a plan of action and milestones (POA&M) item in the governance, risk, and compliance (GRC) system.
Contracting Officer (CO) and Contracting Officer’s Representative (COR) Put ICAM and zero trust terms in contracts, including PIV for contractor staff.
All users Use their PIV credential or other phishing-resistant authenticator. Never share a credential.

3. How the Organization Rates Maturity #

The Zero Trust Strategy Implementation Lead rates each function in the CISA Zero Trust Maturity Model as Traditional, Initial, Advanced, or Optimal. Each rating cites the evidence behind it, such as a configuration export, a coverage report, or a test result. The Enterprise Security Architect checks the ratings. The CISO approves the scorecard each year before the Federal Information Security Modernization Act (FISMA) report.

The CISO sets each target stage no lower than the federal floor the tables below list. Where no federal source sets a floor, the CISO sets the target from risk and cost. A target date may not fall after a federal deadline.

4. Current State and Targets by Pillar #

The Zero Trust Strategy Implementation Lead records the current stage for each function below. The CISO sets the target stage and date.

4.1 Identity #

Function Federal floor Current stage Target stage and date
Authentication Phishing-resistant MFA for staff, contractors, and partners; an option for the public (OMB M-22-09) [Current stage — to be recorded] [Target stage and date — to be defined]
Identity stores Central identity management systems that applications can use (OMB M-22-09) [Current stage — to be recorded] [Target stage and date — to be defined]
Risk assessments A digital identity risk assessment for each system (NIST SP 800-63-4) [Current stage — to be recorded] [Target stage and date — to be defined]
Access management Access decided per session, with at least one device signal (OMB M-22-09) [Current stage — to be recorded] [Target stage and date — to be defined]

4.2 Devices #

Function Federal floor Current stage Target stage and date
Policy enforcement and compliance monitoring Device settings checked against the approved baseline (NIST SP 800-53 CM-6) [Current stage — to be recorded] [Target stage and date — to be defined]
Asset and supply chain risk management A complete, current asset inventory through Continuous Diagnostics and Mitigation (CDM) (OMB M-22-09) [Current stage — to be recorded] [Target stage and date — to be defined]
Resource access Device health considered when granting access (OMB M-22-09) [Current stage — to be recorded] [Target stage and date — to be defined]
Device threat protection EDR tools that meet CISA’s requirements, widely deployed (OMB M-22-09) [Current stage — to be recorded] [Target stage and date — to be defined]

4.3 Networks #

Function Federal floor Current stage Target stage and date
Network segmentation A plan to divide the network into isolated environments (OMB M-22-09) [Current stage — to be recorded] [Target stage and date — to be defined]
Network traffic management Managed interfaces mapped to Trusted Internet Connections (TIC) 3.0 use cases (OMB M-19-26) [Current stage — to be recorded] [Target stage and date — to be defined]
Traffic encryption Encrypted DNS where supported, and HTTPS for all internal web traffic (OMB M-22-09) [Current stage — to be recorded] [Target stage and date — to be defined]
Network resilience No federal floor beyond the system’s contingency plan [Current stage — to be recorded] [Target stage and date — to be defined]

4.4 Applications and workloads #

Function Federal floor Current stage Target stage and date
Application access Access decided per request, without relying on a network tunnel (OMB M-22-09) [Current stage — to be recorded] [Target stage and date — to be defined]
Application threat protections Every application treated as reachable from the internet (OMB M-22-09) [Current stage — to be recorded] [Target stage and date — to be defined]
Accessible applications At least one internal FISMA Moderate application made safe to reach over the internet (OMB M-22-09) [Current stage — to be recorded] [Target stage and date — to be defined]
Secure development and deployment Secure software development practices (OMB M-26-05) [Current stage — to be recorded] [Target stage and date — to be defined]
Application security testing A dedicated application security testing program (OMB M-22-09) [Current stage — to be recorded] [Target stage and date — to be defined]

4.5 Data #

Function Federal floor Current stage Target stage and date
Data inventory management An inventory of the Organization’s data assets (OMB Circular A-130) [Current stage — to be recorded] [Target stage and date — to be defined]
Data categorization Initial categories for sensitive electronic documents, with automated tagging (OMB M-22-09) [Current stage — to be recorded] [Target stage and date — to be defined]
Data availability No federal floor beyond the system’s contingency plan [Current stage — to be recorded] [Target stage and date — to be defined]
Data access Audit of access to data encrypted at rest in commercial clouds (OMB M-22-09) [Current stage — to be recorded] [Target stage and date — to be defined]
Data encryption Encryption at rest and in transit (EO 14028) [Current stage — to be recorded] [Target stage and date — to be defined]

4.6 Cross-cutting capabilities #

Function Federal floor Current stage Target stage and date
Visibility and analytics Logging to the CISA Logging Reference Architecture (OMB M-26-14) [Current stage — to be recorded] [Target stage and date — to be defined]
Automation and orchestration No federal floor; the CISO sets the target [Current stage — to be recorded] [Target stage and date — to be defined]
Governance A named zero trust lead and an ICAM governance structure (OMB M-22-09; OMB M-19-17) [Current stage — to be recorded] [Target stage and date — to be defined]

5. Milestones by Pillar #

Each milestone has one owner. The owner reports its status to the Zero Trust Strategy Implementation Lead each month. A milestone that slips more than [Assignment: organization-defined number of days — to be defined] becomes a POA&M item in the GRC system.

5.1 Identity milestones #

Milestone Owner Due Evidence
Require phishing-resistant MFA, PIV first, for every staff, contractor, and partner account on agency-hosted systems. ICAM Program Manager Federal date passed (September 30, 2024); finish by [Date — to be defined] MFA coverage report from the single sign-on (SSO) service
Offer phishing-resistant MFA as an option on every public-facing system that supports MFA. System Owners Federal date passed (September 30, 2024); finish by [Date — to be defined] Sign-in options on each public system
Remove password rules that force special characters or regular rotation. Identity team Federal date passed (January 26, 2023); confirm each year Directory password settings
Connect every application to the central identity service for sign-on. ICAM Program Manager [Date — to be defined] Application integration list
Add at least one device signal to every access decision. Identity team [Date — to be defined] Access policy settings in the cloud directory
Send OMB the inventory of public-facing websites that ask users to sign in. CIO October 30, 2026 (OMB M-26-18) Inventory sent to OMB
Complete a digital identity risk assessment for each public-facing service. System Owners April 28, 2027 (OMB M-26-18) Digital Identity Acceptance Statement for each service
Identify the covered services to connect to America.gov: public services with more than 100,000 users a year that people can use online. CIO On the schedule in OMB’s memorandum under EO 14432, due by December 28, 2026 List of covered services

5.2 Device milestones #

Milestone Owner Due Evidence
Keep a complete device inventory that reports to the CDM Agency Dashboard. IT Asset Manager Ongoing; reconcile every 7 days (CISA Binding Operational Directive (BOD) 23-01) Weekly reconciliation report
Run the EDR tools on every endpoint and server that supports them, and share data with CISA. SOC manager Federal date passed (September 30, 2024); finish by [Date — to be defined] EDR coverage report
Check each device against its approved baseline before it receives access. Identity team [Date — to be defined] Device compliance policy and reports from the mobile device management (MDM) tool
Enroll every mobile device in the MDM tool under the Mobile Device Policy. Service Desk [Date — to be defined] Enrollment report

5.3 Network milestones #

Milestone Owner Due Evidence
Resolve DNS queries with encrypted DNS on every client and server that supports it. Network engineering team Federal date passed (July 15, 2025, EO 14144) Resolver settings and DNS logs from the encrypted DNS filtering service
Enforce HTTPS for all internal web and application programming interface (API) traffic. Network engineering team Federal date passed (September 30, 2024); finish by [Date — to be defined] Scan showing no plain Hypertext Transfer Protocol (HTTP) services
Encrypt and authenticate every connection between email clients and email servers. Messaging team Federal date passed (May 16, 2025, EO 14144) Email server settings
Approve and carry out the plan that divides the network into isolated environments. Enterprise Security Architect [Date — to be defined] Approved segmentation plan and change records
Support Transport Layer Security (TLS) 1.3 or a successor on every system that uses TLS. System Owners January 2, 2030 (OMB M-26-15) TLS settings in the cryptographic inventory

5.4 Application and workload milestones #

Milestone Owner Due Evidence
Put each internal application behind the zero trust network access (ZTNA) service or a per-request access check, and stop relying on a network tunnel. Enterprise Security Architect [Date — to be defined] Application access list
Make at least one internal FISMA Moderate application safe to reach over the internet. System Owner of the chosen application Federal date passed (September 30, 2024); finish by [Date — to be defined] Authorization record and test results
Run a dedicated application security testing program, including independent tests. CISO [Date — to be defined] Test schedule and reports
Accept vulnerability reports for every internet-accessible system under the Vulnerability Disclosure Policy. CISO Federal date passed (September 2022) Published policy and report log

5.5 Data milestones #

Milestone Owner Due Evidence
Set initial categories for sensitive electronic documents. CDO Federal date passed (May 26, 2022); confirm each year Approved category list
Tag documents in those categories automatically, in report-only mode first. CDO and CISO [Date — to be defined] Tagging rules and accuracy reports
Audit access to data encrypted at rest in commercial cloud services. System Owners Federal date passed (September 30, 2024); finish by [Date — to be defined] Key access logs in the SIEM system
Encrypt data at rest and in transit on every system. System Owners [Date — to be defined] Encryption settings in each SSPP

5.6 Cross-cutting milestones #

Milestone Owner Due Evidence
Send identity, device, network, application, and data logs to the SIEM system as the Agency Logging Plan requires. SOC manager As the Agency Logging Plan sets Log source list
Automate the access decisions and responses each pillar target names. Enterprise Security Architect [Date — to be defined] Automation runbooks
Rate maturity for every function, with evidence, before each yearly FISMA report. Zero Trust Strategy Implementation Lead Every year Maturity scorecard

6. Plan Rules #

6.1 Identity and access #

  1. System Owners must make each system authenticate, authorize, and encrypt every access request before it grants access. (NIST SP 800-207)
  2. The identity team must give each user one identity in a central identity management system that applications can use. (OMB M-22-09)
  3. Staff, contractors, and partners must use a phishing-resistant method to reach agency-hosted accounts. (OMB M-22-09)
  4. System Owners must offer phishing-resistant MFA as an option on public-facing systems that support MFA. (OMB M-22-09)
  5. The identity team must not require special characters or regular rotation in passwords. (OMB M-22-09)
  6. The identity team adds at least one device signal, alongside the user’s identity, to the access rules for enterprise resources. (OMB M-22-09)

6.2 Devices #

  1. The IT Asset Manager must keep a complete, current inventory of devices through the CDM program. (OMB M-22-09)
  2. The SOC manager must deploy the EDR tools that meet CISA’s technical requirements, and share data with CISA. (OMB M-22-09)
  3. Administrators configure devices to the baseline the Secure Configuration Baseline Standard (STD-CFG-001) selects. (NIST SP 800-53 CM-6)

6.3 Networks #

  1. Network engineers must resolve DNS queries with encrypted DNS wherever clients and servers support it. They enable it on new clients and servers within 180 days of support. (OMB M-22-09; EO 14144, §4(c)(ii))
  2. Network engineers must enforce HTTPS for all web and API traffic, including traffic inside the Organization’s networks. (OMB M-22-09)
  3. The messaging team must enforce encrypted and authenticated connections between email clients and email servers. (EO 14144, §4(d)(i))
  4. The Enterprise Security Architect must keep a plan that divides the network into isolated environments, approved by the CISO. (OMB M-22-09)

6.4 Applications and workloads #

  1. System Owners must treat every application as reachable from the internet when they design its protections. (OMB M-22-09)
  2. The CISO must run a dedicated application security testing program. (OMB M-22-09)
  3. The CISO must accept vulnerability reports for every internet-accessible system under the Vulnerability Disclosure Policy (POL-VDP-001). (OMB M-22-09)

6.5 Data #

  1. The CDO must set categories for sensitive electronic documents, with the CISO, and use them to tag and control those documents. (OMB M-22-09)
  2. Staff first run each automated data rule in report-only mode, and turn on blocking only after they check its accuracy. (OMB M-22-09)
  3. System Owners must audit access to data encrypted at rest in commercial cloud services. (OMB M-22-09)
  4. System Owners must encrypt data at rest and in transit. (EO 14028, §3(d))

7. ICAM Strategy #

The ICAM Program Manager runs these six parts of the ICAM program. The Federal ICAM Architecture and its playbooks guide the design of each part.

7.1 Identity lifecycle #

  1. Human Resources and the COR are the authoritative sources for people. The identity team creates, changes, and ends identities only from their records. (OMB M-19-17)
  2. The identity team creates each account when the person starts, changes access when the person moves, and disables the account when the person leaves. The Access Control Procedures (PROC-AC) give the steps and times. (NIST SP 800-53 AC-2)
  3. The ICAM Program Manager sets measures for security and privacy risk across the identity lifecycle and reports them to the working group. (OMB M-19-17)

7.2 Credentials #

  1. PIV credentials are the primary way employees and contractors sign in to federal systems and enter federal facilities. (OMB M-19-17; HSPD-12; FIPS 201-3)
  2. The identity team issues derived PIV credentials for mobile devices and other devices that cannot use a PIV card. (OMB M-19-17; FIPS 201-3)
  3. When a system cannot accept PIV yet, the CISO may approve another phishing-resistant authenticator, such as hardware security keys. The System Owner records the plan to move to PIV. (OMB M-22-09)
  4. Physical access systems use PIV under NIST SP 800-116 Rev. 1. (NIST SP 800-116 Rev. 1)
  5. Contracts that give contractor staff access to federal facilities or systems include the PIV clause. (FAR 4.1301; FAR 52.204-9)

7.3 Access management #

  1. Each System Owner completes a digital identity risk assessment and records the selected assurance levels for the system. (NIST SP 800-63-4)
  2. The identity team grants access through the SSO service and cloud directory conditional access, using role and attribute rules. (OMB M-22-09)
  3. Session limits follow the system’s authentication assurance level, as the Access Control Policy (POL-AC) sets. (NIST SP 800-63B-4)

7.4 Federation #

  1. System Owners accept PIV identity assertions from other agencies where the person is authorized. (OMB M-19-17)
  2. Public-facing websites that ask users to sign in use Login.gov for sign-in and identity verification, or the CIO sends OMB the notice OMB M-26-18 requires. (OMB M-26-18)
  3. System Owners connect each covered public service to America.gov in a secure way that protects privacy. They complete its Login.gov integration as OMB M-26-18 requires. (EO 14432, §5(b))

7.5 Privileged access #

  1. Each administrator uses a separate privileged account with phishing-resistant MFA. (OMB M-22-09; NIST SP 800-53 AC-6)
  2. The identity team grants privileged roles only for the time a task needs, through privileged identity management. (NIST SP 800-53 AC-6)
  3. The Identification and Authentication Procedures (PROC-IA) give the steps for privileged credentials. (NIST SP 800-53 IA-2)

7.6 Non-person entities #

  1. The identity team manages the identities of devices, service accounts, workloads, and automated tools, including Super Intelligence (SI) agents, so each one is distinct, auditable, and managed the same way. (OMB M-19-17)
  2. Each non-person identity has a named human owner. The owner rotates or revokes its credentials, and ends the identity when its use ends. (OMB M-19-17)

8. Dependencies #

Dependency Why the plan needs it Owner
IT asset inventory Access decisions need a complete list of devices IT Asset Manager
Agency Logging Plan Visibility and analytics depend on the logs it requires SOC manager
Secure Configuration Baseline Standard Device compliance checks use its baselines Configuration management team
Post-Quantum Cryptography Migration Plan Encryption milestones must use quantum-resistant algorithms when available Migration lead for post-quantum cryptography
PIV issuance and Human Resources records Credentials depend on adjudication and accurate personnel data Personnel Security Officer
CDM program tools Asset and identity data flow to the CDM Agency Dashboard CISO
Funding Each milestone needs money in the IT budget CIO

9. Measures #

The Zero Trust Strategy Implementation Lead reports these measures to the CIO and the CISO each quarter.

Measure Target Data source
Staff, contractor, and partner accounts that sign in with phishing-resistant MFA 100 percent Sign-in reports from the SSO service
Privileged accounts that use phishing-resistant MFA and a separate administrator account 100 percent Privileged identity management reports
Applications that use the central identity service for sign-on [Assignment: organization-defined percent — to be defined] Application integration list
Endpoints and servers that report to the EDR tools [Assignment: organization-defined percent — to be defined] EDR coverage report
Clients and servers that use encrypted DNS, where they support it 100 percent DNS resolver logs
Internal web services that accept only HTTPS 100 percent Web scan results
Non-person accounts with a named owner and a credential rotation date 100 percent Directory export
Functions at or above their target stage [Assignment: organization-defined percent — to be defined] Maturity scorecard

10. Reporting to OMB and CISA #

  1. The CIO answers the identity, device, network, and data questions in the yearly CIO FISMA metrics. (FY 2026-2027 CIO FISMA Metrics)
  2. The Zero Trust Strategy Implementation Lead sends OMB and CISA an updated implementation plan whenever they ask for one. (OMB M-22-09)
  3. Until MFA and encryption are in place agency-wide, the CISO sends the progress reports EO 14028 requires, when CISA and OMB ask for them. (EO 14028, §3(d))
  4. The CIO sends OMB the website inventory and notices that OMB M-26-18 requires. (OMB M-26-18)

11. Exceptions #

A System Owner requests an exception for one system at a time, and the CISO and the CIO decide together. The request includes the technical reason and a dated plan to integrate or retire the system. Each exception lasts no longer than [Assignment: organization-defined maximum exception period, two years or less — to be defined], with no automatic renewal. Nobody may waive a rule that a law, an OMB memorandum, or a CISA directive sets. The ISSO records each exception in the GRC system.

12. Updating This Plan #

The CISO reviews this plan on the cycle the Policy and Procedure Management Policy sets, and after the events that policy lists. Each year before the FISMA report, the Zero Trust Strategy Implementation Lead updates the current stages, milestone status, and measures. The CISO approves that update, which does not change the rest of the plan.

14. Derived Governance Requirements #

  • Resolve DNS queries with encrypted DNS wherever clients and servers support it. (OMB M-22-09)
  • Enforce HTTPS for all web and API traffic inside the Organization’s environment, not only traffic to and from the internet. (OMB M-22-09)
  • Remove password rules that require special characters or regular rotation from every system. (OMB M-22-09)
  • Use at least one device signal alongside the user’s identity when deciding access to enterprise resources. (OMB M-22-09)
  • Operate a dedicated application security testing program. (OMB M-22-09)
  • Automate data categorization and security responses, starting with tagging and controlling access to sensitive documents. (OMB M-22-09)
  • Audit access to any data encrypted at rest in commercial cloud infrastructure. (OMB M-22-09)
  • Enable encrypted DNS protocols wherever existing clients and servers support them, and on new clients and servers within 180 days of support. (EO 14144, §4(c)(ii))
  • Enforce encrypted and authenticated transport for every connection between email clients and their email servers. (EO 14144, §4(d)(i))
  • Adopt multi-factor authentication and encryption for data at rest and in transit, as far as federal records laws allow. (EO 14028, §3(d))
  • Manage the digital identities of devices, non-person entities, and automated technologies so each is distinguishable, auditable, and consistently managed. (OMB M-19-17)
  • Issue derived PIV credentials where they apply, and make applications and devices accept them. (OMB M-19-17)
  • Accept PIV identity assertions from other agencies where the person is authorized, and resolve obstacles to federation. (OMB M-19-17)
  • Set agency-wide performance expectations for security and privacy risk management across the identity lifecycle. (OMB M-19-17)

Other sources: the CISA Zero Trust Maturity Model; NIST SP 1800-35, an example implementation of a zero trust architecture; the Federal ICAM Architecture; the FICAM Playbooks.

15. References #

These are the sources this document cites, with a link to each official text.

Sources on the governance tracker

The FedXchange governance tracker follows each source this document cites and records each change to it.

Change history

  1. : First published in the library. Template version 783d0494946e.