Zero Trust verifies every access request rather than automatically trusting users or devices inside a network. US government agencies have been implementing the model for years, and reports and audits by the Government Accountability Office (GAO), Treasury Inspector General for Tax Administration (TIGTA), and Department of Defense (DoD) Inspector General show where implementation often falls short—and what organizations can do to improve security.
Four factors largely determine whether Zero Trust succeeds or stalls: the complexity of existing systems, integration with current infrastructure, effective segmentation and data protection, and user acceptance. Reports from U.S. oversight agencies provide valuable insight into how organizations can address these challenges in large, complex IT environments.
Complexity: Multiple Systems Make Consistent Policies Difficult
Many organizations operate across several cloud platforms and private data centers. Their applications and directory services may come from different periods or previous acquisitions.
A Cloud Security Alliance survey of 950 IT professionals shows how these environments affect daily operations: 75 percent of companies manage at least two identity providers, while 11 percent manage as many as five or more.
A DoD Inspector General audit provides a real-world example: In 2025, the Defense Media Activity had to revise its Zero Trust plan because its original asset inventory was incomplete. Without a full inventory, organizations cannot apply consistent access policies.
Starting over with an entirely new environment is rarely practical. Employees and partners still need uninterrupted access to critical applications. Security teams typically add Zero Trust controls to existing VPN and network infrastructure rather than replacing everything at once.
Google encountered similar challenges during its BeyondCorp migration: The final stages required significant effort because outdated protocols and hard-to-find legacy applications slowed progress.
NIST laboratory testing of 19 example Zero Trust implementations involving 24 technology collaborators reached a similar conclusion: integrating identity platforms with network technologies was especially difficult.
User Experience: Single Sign-On Improves Adoption
Repeated verification can disrupt workflows, especially when employees must enter different credentials several times a day.
Single Sign-On (SSO) reduces this friction. Users sign in through a central portal and can then access approved applications without repeatedly entering credentials.
Context-based checks provide additional protection. They request further verification only when, for example, a location appears unusual or a user attempts a sensitive action.
Zero Trust separates applications, users, systems, and data into smaller zones. This prevents attackers from moving freely through a network after compromising a single account or device.
The GAO found that 21 of the 23 agencies it reviewed in 2025 had incomplete network security and data protection capabilities, even though federal requirements had been in place for years.
Data protection was a particular weakness. According to a TIGTA report, the IRS had centrally cataloged only 41 of 187 databases as of October 2025 and lacked automated data classification.
The Federal Zero Trust Data Security Guide recommends involving data owners and security teams from the beginning. This helps organizations create access policies that reflect operational needs.
The Cybersecurity and Infrastructure Security Agency (CISA) divides Zero Trust maturity into four levels: Traditional, Initial, Advanced, and Optimal. The model evaluates five areas: Identity, Devices, Networks, Applications, and Data.
Authentication clearly shows the difference between maturity levels. Traditional environments verify identity at sign-in using a password or multifactor authentication. Optimal environments continuously evaluate identity and access throughout a session. Organizations can assess each area separately and use the results to prioritize their next steps.
Zero Trust initially increases operational work. Security teams must maintain additional policies, manage legacy-system exceptions, and review growing volumes of access data.
The U.S. Department of Education demonstrates the scale a full implementation can require: With $20 million in funding, the department created a dedicated program office and consolidated security functions across 15 field offices and two data centers.
Centralized platforms can reduce this workload by combining access decisions, identity management, and threat detection. Automated policies can also block suspicious activity immediately, reducing the need for manual reviews.
Begin with a sensitive application or a small group of users. Decide what should happen when security signals are missing or conflicting.
Zero Trust rarely fails because of the technology itself. More often, implementation stalls because of incomplete inventories, weak segmentation, and unclear data ownership. Organizations that address these issues early can reduce operational friction and improve security.
The most effective approach is to strengthen existing infrastructure gradually rather than replace it all at once. This allows security to improve without disrupting critical operations.
A Practical Building Block for Your Zero Trust Strategy
Does Zero Trust replace an Existing VPN?
Zero Trust rarely replaces an entire VPN infrastructure. Organizations usually add identity management, device health checks, and continuous access controls to their existing environment.
How Long Does Zero Trust Take to Implement?
Individual applications may operate successfully under Zero Trust within a few months. Implementing the model across an entire organization can take several years, as Google’s BeyondCorp project demonstrates.
Why Is Data Security Often the Weakest Part of Zero Trust?
Many organizations do not have complete data inventories or automated classification processes. Without clear data ownership, they cannot create complete and consistent access policies.
How Can an Organization Assess Its Zero Trust Maturity?
CISA’s maturity model evaluates organizations across four levels and five areas, including identity, devices, networks, applications, and data. At the highest level, identity and access are evaluated continuously—not only when users sign in.
How Does Zero Trust Manage External Suppliers and Service Providers?
External partners receive access only to the specific applications and resources they need. This limited, case-by-case access reduces the potential damage caused by a compromised partner account.
Learn More
Zero Trust for Small and Midsize Businesses: How to achieve meaningful results on a limited budget.
You might also be interested in:
Digital Sovereignty: Regaining Control Over Data, Access and Digital Infrastructure
Digital sovereignty starts with control over your data. Learn how GDPR, the US Cloud Act, data localisation, encryption and secure remote access help organisations strengthen compliance and reduce digital dependencies.
What International Collaboration Really Looks Like
Different Countries. Different Routines. One Team - What International Collaboration Really Looks Like
Always-On VPN vs. On-Demand VPN: What Matters for Your Network Security
Compare Always-On VPN and On-Demand VPN for secure remote access. Learn which VPN strategy supports Zero Trust security, compliance requirements, and optimal network performance.
![[Translate to Englisch:]](/fileadmin/user_upload/NCP_Blog/2026/collage_international_work.png "[Translate to Englisch:]")
