[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AF1CX9J64TXXSTFKK09K9X":3,"skill-same:01M6AF1CX9J64TXXSTFKK09K9X":187},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":34,"publishedAt":55,"linkOnly":56,"markdownContent":57,"markdownBody":58,"frontMatter":59,"refName":84,"commitSha":85,"skillDirectory":86,"forksCount":87,"repositoryHtmlUrl":88,"repositoryHomepageUrl":89,"ownerHtmlUrl":90,"ownerBlogUrl":91,"ownerDescription":92,"updatedAt":93,"install":94,"resources":107},"01M6AF1CX9J64TXXSTFKK09K9X","implementing-cisa-zero-trust-maturity-model",null,"Assess, gap-analyze, and progressively implement the CISA Zero Trust Maturity Model v2.0 across five pillars (Identity, Devices, Networks, Applications & Workloads, Data) and three cross-cutting capabilities (Visibility\u002FAnalytics, Automation\u002FOrchestration, Governance), from Traditional through Optimal maturity. Use for a federal\u002Fenterprise ZTMM assessment, phased roadmap, or mapping controls to NIST SP 800-207 and EO 14028.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",35925,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-cisa-zero-trust-maturity-model\u002FSKILL.md",[18,23,26,31],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000013","分析与可视化","SCENARIO","使用场景",{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发",{"categoryNo":27,"categoryName":28,"taxonomyType":29,"taxonomyTypeDesc":30},"01JBSEEDCAT000000000000033","数据分析师","PROFESSION","适用职业",{"categoryNo":32,"categoryName":33,"taxonomyType":29,"taxonomyTypeDesc":30},"01JBSEEDCAT000000000000037","律师与法务",[35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54],"implementing cisa zero trust maturity model","ZeRO","CISA","data","devices","nist-800-207","federal-compliance","maturity-model","t1078","zero-trust","NIST","security","capabilities","assessment","pr","analytics","identity","architecture","orchestration","cybersecurity","2026-11-10 10:12:30",false,"---\nname: implementing-cisa-zero-trust-maturity-model\ndescription: Assess, gap-analyze, and progressively implement the CISA Zero Trust\n  Maturity Model v2.0 across five pillars (Identity, Devices, Networks, Applications\n  & Workloads, Data) and three cross-cutting capabilities (Visibility\u002FAnalytics, Automation\u002FOrchestration,\n  Governance), from Traditional through Optimal maturity. Use for a federal\u002Fenterprise\n  ZTMM assessment, phased roadmap, or mapping controls to NIST SP 800-207 and EO 14028.\ndomain: cybersecurity\nsubdomain: zero-trust-architecture\ntags:\n- zero-trust\n- cisa\n- maturity-model\n- federal-compliance\n- governance\n- nist-800-207\n- identity\n- devices\n- networks\n- applications\n- data-security\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nnist_ai_rmf:\n- GOVERN-1.1\n- GOVERN-1.7\n- MAP-1.1\n- GOVERN-4.2\n- MAP-2.3\nnist_csf:\n- PR.AA-01\n- PR.AA-05\n- PR.IR-01\n- GV.PO-01\nmitre_attack:\n- T1078\n- T1190\n- T1059\n---\n\n# Implementing CISA Zero Trust Maturity Model\n\n## Overview\n\nThe CISA Zero Trust Maturity Model (ZTMM) Version 2.0, released in April 2023, provides federal agencies and organizations with a structured roadmap for adopting zero trust architecture. The model defines five core pillars -- Identity, Devices, Networks, Applications & Workloads, and Data -- each progressing through four maturity stages: Traditional, Initial, Advanced, and Optimal. Three cross-cutting capabilities (Visibility and Analytics, Automation and Orchestration, and Governance) span all pillars. This skill covers assessment, gap analysis, and progressive implementation across all pillars and maturity levels.\n\n\n## When to Use\n\n- When deploying or configuring implementing cisa zero trust maturity model capabilities in your environment\n- When establishing security controls aligned to compliance requirements\n- When building or improving security architecture for this domain\n- When conducting security assessments that require this implementation\n\n## Prerequisites\n\n- Familiarity with NIST SP 800-207 Zero Trust Architecture\n- Understanding of federal cybersecurity mandates (EO 14028, OMB M-22-09)\n- Access to organizational IT asset inventory and network architecture documentation\n- Knowledge of identity and access management (IAM) fundamentals\n- Understanding of network segmentation and microsegmentation concepts\n\n## CISA ZTMM Five Pillars\n\n### Pillar 1: Identity\n\nIdentity refers to attributes that uniquely describe an agency user or entity, including non-person entities (NPEs) such as service accounts and machine identities.\n\n**Traditional Stage:**\n- Password-based authentication\n- Limited identity validation\n- Manual provisioning and deprovisioning\n\n**Initial Stage:**\n- MFA deployed for privileged users\n- Identity governance initiated\n- Basic identity lifecycle management\n\n**Advanced Stage:**\n- Phishing-resistant MFA for all users (FIDO2\u002FWebAuthn)\n- Continuous identity validation\n- Automated provisioning tied to HR systems\n- Identity threat detection and response (ITDR)\n\n**Optimal Stage:**\n- Continuous, real-time identity verification\n- Passwordless authentication across all systems\n- AI-driven anomaly detection for identity behaviors\n- Full integration of identity signals into access decisions\n\n### Pillar 2: Devices\n\nDevices include any hardware, software, or firmware asset that connects to a network -- servers, laptops, mobile phones, IoT devices, and network equipment.\n\n**Traditional Stage:**\n- Limited device inventory\n- Basic endpoint protection (antivirus)\n- No device compliance checks\n\n**Initial Stage:**\n- Comprehensive device inventory\n- Endpoint Detection and Response (EDR) deployment\n- Basic device health checks before network access\n\n**Advanced Stage:**\n- Real-time device posture assessment\n- Automated compliance enforcement\n- Device certificates for machine identity\n- Vulnerability scanning integrated into access decisions\n\n**Optimal Stage:**\n- Continuous device trust scoring\n- Automated remediation of non-compliant devices\n- Full device lifecycle management integrated with zero trust policies\n- Firmware integrity verification\n\n### Pillar 3: Networks\n\nNetworks encompass all communications media including internal networks, wireless, and the internet.\n\n**Traditional Stage:**\n- Perimeter-based security (firewalls, VPNs)\n- Flat internal networks\n- Minimal east-west traffic inspection\n\n**Initial Stage:**\n- Initial network segmentation\n- Encrypted DNS and internal traffic\n- Basic network monitoring and logging\n\n**Advanced Stage:**\n- Microsegmentation of critical assets\n- Software-defined networking (SDN) for dynamic policy enforcement\n- Full TLS encryption for all internal communications\n- Network Detection and Response (NDR)\n\n**Optimal Stage:**\n- Fully software-defined, policy-driven network\n- Zero implicit trust zones\n- AI-driven network anomaly detection\n- Automated threat response integrated with network controls\n\n### Pillar 4: Applications and Workloads\n\nApplications and workloads include agency systems, programs, and services running on-premises, on mobile devices, and in cloud environments.\n\n**Traditional Stage:**\n- Perimeter-protected applications\n- Manual vulnerability patching\n- Limited application-level logging\n\n**Initial Stage:**\n- Application-level access controls\n- Web Application Firewalls (WAF)\n- Regular vulnerability scanning\n- Application inventory established\n\n**Advanced Stage:**\n- Continuous integration of security testing (SAST\u002FDAST)\n- Application-aware microsegmentation\n- API security gateways\n- Immutable infrastructure patterns\n\n**Optimal Stage:**\n- Runtime application self-protection (RASP)\n- Automated application security orchestration\n- Full DevSecOps pipeline integration\n- Zero-standing privileges for application access\n\n### Pillar 5: Data\n\nData encompasses all structured and unstructured information, at rest, in transit, and in use.\n\n**Traditional Stage:**\n- Basic encryption for data at rest\n- Limited data classification\n- No data loss prevention\n\n**Initial Stage:**\n- Data classification scheme implemented\n- DLP policies for sensitive data\n- Encryption for data in transit (TLS 1.2+)\n- Basic data inventory\n\n**Advanced Stage:**\n- Automated data classification\n- Fine-grained data access controls\n- Data activity monitoring\n- Rights management for sensitive documents\n\n**Optimal Stage:**\n- Real-time data flow analytics\n- AI-driven data classification and protection\n- Automated response to data exfiltration attempts\n- Full data lifecycle governance with zero trust principles\n\n## Cross-Cutting Capabilities\n\n### Visibility and Analytics\n\n```\nMaturity Progression:\nTraditional -> Manual log review, limited SIEM\nInitial     -> Centralized logging, basic SIEM correlation\nAdvanced    -> UEBA, automated threat detection, data lake analytics\nOptimal     -> AI\u002FML-driven continuous monitoring, predictive analytics\n```\n\n### Automation and Orchestration\n\n```\nMaturity Progression:\nTraditional -> Manual incident response, ad-hoc scripts\nInitial     -> Basic SOAR playbooks, automated alerting\nAdvanced    -> Integrated SOAR with multi-pillar orchestration\nOptimal     -> Fully autonomous response, self-healing infrastructure\n```\n\n### Governance\n\n```\nMaturity Progression:\nTraditional -> Ad-hoc policies, manual compliance checks\nInitial     -> Documented zero trust strategy, basic policy framework\nAdvanced    -> Policy-as-code, continuous compliance monitoring\nOptimal     -> Dynamic policy engine, real-time governance decisions\n```\n\n## Implementation Process\n\n### Phase 1: Assessment and Baseline\n\n1. **Inventory all assets** across the five pillars\n2. **Map current capabilities** to ZTMM maturity stages\n3. **Conduct gap analysis** between current and target states\n4. **Identify quick wins** that move from Traditional to Initial stage\n5. **Document dependencies** between pillars\n\n```python\n# Example: CISA ZTMM Maturity Assessment Scoring\nclass ZTMMAssessment:\n    PILLARS = ['Identity', 'Devices', 'Networks', 'Applications', 'Data']\n    STAGES = ['Traditional', 'Initial', 'Advanced', 'Optimal']\n    CROSS_CUTTING = ['Visibility_Analytics', 'Automation_Orchestration', 'Governance']\n\n    def __init__(self):\n        self.scores = {}\n\n    def assess_pillar(self, pillar, capabilities):\n        \"\"\"\n        Assess a pillar against ZTMM criteria.\n        capabilities: dict of capability_name -> maturity_stage\n        \"\"\"\n        stage_values = {stage: i for i, stage in enumerate(self.STAGES)}\n        scores = [stage_values.get(stage, 0) for stage in capabilities.values()]\n        avg_score = sum(scores) \u002F len(scores) if scores else 0\n\n        overall_stage = self.STAGES[int(avg_score)]\n        self.scores[pillar] = {\n            'capabilities': capabilities,\n            'average_score': avg_score,\n            'overall_stage': overall_stage\n        }\n        return self.scores[pillar]\n\n    def generate_roadmap(self):\n        \"\"\"Generate prioritized improvement roadmap.\"\"\"\n        roadmap = []\n        for pillar, data in self.scores.items():\n            for capability, stage in data['capabilities'].items():\n                stage_idx = self.STAGES.index(stage)\n                if stage_idx \u003C 3:  # Not yet Optimal\n                    next_stage = self.STAGES[stage_idx + 1]\n                    roadmap.append({\n                        'pillar': pillar,\n                        'capability': capability,\n                        'current': stage,\n                        'target': next_stage,\n                        'priority': 3 - stage_idx  # Higher priority for lower maturity\n                    })\n        return sorted(roadmap, key=lambda x: x['priority'], reverse=True)\n```\n\n### Phase 2: Identity Foundation\n\n1. Deploy phishing-resistant MFA (FIDO2\u002FWebAuthn)\n2. Implement identity governance and administration (IGA)\n3. Establish continuous identity verification\n4. Integrate identity providers with all applications\n5. Deploy identity threat detection and response\n\n### Phase 3: Device Trust\n\n1. Complete asset inventory with automated discovery\n2. Deploy EDR across all endpoints\n3. Implement device compliance checking\n4. Establish device certificate infrastructure\n5. Create device trust scoring mechanism\n\n### Phase 4: Network Transformation\n\n1. Implement network segmentation strategy\n2. Deploy microsegmentation for critical assets\n3. Enable encrypted DNS (DoH\u002FDoT)\n4. Enforce TLS 1.3 for all internal communications\n5. Deploy NDR capabilities\n\n### Phase 5: Application Security\n\n1. Implement application-level access controls\n2. Deploy WAF and API security gateways\n3. Integrate security testing into CI\u002FCD pipelines\n4. Establish application inventory and classification\n5. Implement runtime protection\n\n### Phase 6: Data Protection\n\n1. Implement data classification framework\n2. Deploy DLP across endpoints and network\n3. Enable data activity monitoring\n4. Implement rights management\n5. Establish data lifecycle governance\n\n## Compliance Mapping\n\n| CISA ZTMM Pillar | OMB M-22-09 Requirement | NIST 800-207 Section |\n|---|---|---|\n| Identity | MFA for agency staff | 3.1.1 |\n| Devices | EDR for federal endpoints | 3.1.2 |\n| Networks | Encrypt DNS traffic | 3.1.3 |\n| Applications | Application security testing | 3.1.4 |\n| Data | Data categorization | 3.1.5 |\n\n## Metrics and KPIs\n\n- **Identity Pillar**: Percentage of users with phishing-resistant MFA\n- **Device Pillar**: Percentage of devices with real-time posture assessment\n- **Network Pillar**: Percentage of network segments microsegmented\n- **Application Pillar**: Percentage of applications with zero trust access controls\n- **Data Pillar**: Percentage of sensitive data classified and protected\n- **Overall**: ZTMM stage achieved per pillar (target: Advanced minimum)\n\n## References\n\n- [CISA Zero Trust Maturity Model v2.0](https:\u002F\u002Fwww.cisa.gov\u002Fzero-trust-maturity-model)\n- [CISA ZTMM v2.0 PDF](https:\u002F\u002Fwww.cisa.gov\u002Fsites\u002Fdefault\u002Ffiles\u002F2023-04\u002Fzero_trust_maturity_model_v2_508.pdf)\n- [NIST SP 800-207 Zero Trust Architecture](https:\u002F\u002Fcsrc.nist.gov\u002Fpublications\u002Fdetail\u002Fsp\u002F800-207\u002Ffinal)\n- [OMB Memorandum M-22-09](https:\u002F\u002Fwww.whitehouse.gov\u002Fwp-content\u002Fuploads\u002F2022\u002F01\u002FM-22-09.pdf)\n- [NSA Zero Trust Pillars Guidance](https:\u002F\u002Fmedia.defense.gov\u002F2024\u002FApr\u002F09\u002F2003434442\u002F-1\u002F-1\u002F0\u002FCSI_DATA_PILLAR_ZT.PDF)\n- [Microsoft Guidance for CISA ZTMM](https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fblog\u002F2024\u002F12\u002F19\u002Fnew-microsoft-guidance-for-the-cisa-zero-trust-maturity-model\u002F)\n","# Implementing CISA Zero Trust Maturity Model\n\n## Overview\n\nThe CISA Zero Trust Maturity Model (ZTMM) Version 2.0, released in April 2023, provides federal agencies and organizations with a structured roadmap for adopting zero trust architecture. The model defines five core pillars -- Identity, Devices, Networks, Applications & Workloads, and Data -- each progressing through four maturity stages: Traditional, Initial, Advanced, and Optimal. Three cross-cutting capabilities (Visibility and Analytics, Automation and Orchestration, and Governance) span all pillars. This skill covers assessment, gap analysis, and progressive implementation across all pillars and maturity levels.\n\n\n## When to Use\n\n- When deploying or configuring implementing cisa zero trust maturity model capabilities in your environment\n- When establishing security controls aligned to compliance requirements\n- When building or improving security architecture for this domain\n- When conducting security assessments that require this implementation\n\n## Prerequisites\n\n- Familiarity with NIST SP 800-207 Zero Trust Architecture\n- Understanding of federal cybersecurity mandates (EO 14028, OMB M-22-09)\n- Access to organizational IT asset inventory and network architecture documentation\n- Knowledge of identity and access management (IAM) fundamentals\n- Understanding of network segmentation and microsegmentation concepts\n\n## CISA ZTMM Five Pillars\n\n### Pillar 1: Identity\n\nIdentity refers to attributes that uniquely describe an agency user or entity, including non-person entities (NPEs) such as service accounts and machine identities.\n\n**Traditional Stage:**\n- Password-based authentication\n- Limited identity validation\n- Manual provisioning and deprovisioning\n\n**Initial Stage:**\n- MFA deployed for privileged users\n- Identity governance initiated\n- Basic identity lifecycle management\n\n**Advanced Stage:**\n- Phishing-resistant MFA for all users (FIDO2\u002FWebAuthn)\n- Continuous identity validation\n- Automated provisioning tied to HR systems\n- Identity threat detection and response (ITDR)\n\n**Optimal Stage:**\n- Continuous, real-time identity verification\n- Passwordless authentication across all systems\n- AI-driven anomaly detection for identity behaviors\n- Full integration of identity signals into access decisions\n\n### Pillar 2: Devices\n\nDevices include any hardware, software, or firmware asset that connects to a network -- servers, laptops, mobile phones, IoT devices, and network equipment.\n\n**Traditional Stage:**\n- Limited device inventory\n- Basic endpoint protection (antivirus)\n- No device compliance checks\n\n**Initial Stage:**\n- Comprehensive device inventory\n- Endpoint Detection and Response (EDR) deployment\n- Basic device health checks before network access\n\n**Advanced Stage:**\n- Real-time device posture assessment\n- Automated compliance enforcement\n- Device certificates for machine identity\n- Vulnerability scanning integrated into access decisions\n\n**Optimal Stage:**\n- Continuous device trust scoring\n- Automated remediation of non-compliant devices\n- Full device lifecycle management integrated with zero trust policies\n- Firmware integrity verification\n\n### Pillar 3: Networks\n\nNetworks encompass all communications media including internal networks, wireless, and the internet.\n\n**Traditional Stage:**\n- Perimeter-based security (firewalls, VPNs)\n- Flat internal networks\n- Minimal east-west traffic inspection\n\n**Initial Stage:**\n- Initial network segmentation\n- Encrypted DNS and internal traffic\n- Basic network monitoring and logging\n\n**Advanced Stage:**\n- Microsegmentation of critical assets\n- Software-defined networking (SDN) for dynamic policy enforcement\n- Full TLS encryption for all internal communications\n- Network Detection and Response (NDR)\n\n**Optimal Stage:**\n- Fully software-defined, policy-driven network\n- Zero implicit trust zones\n- AI-driven network anomaly detection\n- Automated threat response integrated with network controls\n\n### Pillar 4: Applications and Workloads\n\nApplications and workloads include agency systems, programs, and services running on-premises, on mobile devices, and in cloud environments.\n\n**Traditional Stage:**\n- Perimeter-protected applications\n- Manual vulnerability patching\n- Limited application-level logging\n\n**Initial Stage:**\n- Application-level access controls\n- Web Application Firewalls (WAF)\n- Regular vulnerability scanning\n- Application inventory established\n\n**Advanced Stage:**\n- Continuous integration of security testing (SAST\u002FDAST)\n- Application-aware microsegmentation\n- API security gateways\n- Immutable infrastructure patterns\n\n**Optimal Stage:**\n- Runtime application self-protection (RASP)\n- Automated application security orchestration\n- Full DevSecOps pipeline integration\n- Zero-standing privileges for application access\n\n### Pillar 5: Data\n\nData encompasses all structured and unstructured information, at rest, in transit, and in use.\n\n**Traditional Stage:**\n- Basic encryption for data at rest\n- Limited data classification\n- No data loss prevention\n\n**Initial Stage:**\n- Data classification scheme implemented\n- DLP policies for sensitive data\n- Encryption for data in transit (TLS 1.2+)\n- Basic data inventory\n\n**Advanced Stage:**\n- Automated data classification\n- Fine-grained data access controls\n- Data activity monitoring\n- Rights management for sensitive documents\n\n**Optimal Stage:**\n- Real-time data flow analytics\n- AI-driven data classification and protection\n- Automated response to data exfiltration attempts\n- Full data lifecycle governance with zero trust principles\n\n## Cross-Cutting Capabilities\n\n### Visibility and Analytics\n\n```\nMaturity Progression:\nTraditional -> Manual log review, limited SIEM\nInitial     -> Centralized logging, basic SIEM correlation\nAdvanced    -> UEBA, automated threat detection, data lake analytics\nOptimal     -> AI\u002FML-driven continuous monitoring, predictive analytics\n```\n\n### Automation and Orchestration\n\n```\nMaturity Progression:\nTraditional -> Manual incident response, ad-hoc scripts\nInitial     -> Basic SOAR playbooks, automated alerting\nAdvanced    -> Integrated SOAR with multi-pillar orchestration\nOptimal     -> Fully autonomous response, self-healing infrastructure\n```\n\n### Governance\n\n```\nMaturity Progression:\nTraditional -> Ad-hoc policies, manual compliance checks\nInitial     -> Documented zero trust strategy, basic policy framework\nAdvanced    -> Policy-as-code, continuous compliance monitoring\nOptimal     -> Dynamic policy engine, real-time governance decisions\n```\n\n## Implementation Process\n\n### Phase 1: Assessment and Baseline\n\n1. **Inventory all assets** across the five pillars\n2. **Map current capabilities** to ZTMM maturity stages\n3. **Conduct gap analysis** between current and target states\n4. **Identify quick wins** that move from Traditional to Initial stage\n5. **Document dependencies** between pillars\n\n```python\n# Example: CISA ZTMM Maturity Assessment Scoring\nclass ZTMMAssessment:\n    PILLARS = ['Identity', 'Devices', 'Networks', 'Applications', 'Data']\n    STAGES = ['Traditional', 'Initial', 'Advanced', 'Optimal']\n    CROSS_CUTTING = ['Visibility_Analytics', 'Automation_Orchestration', 'Governance']\n\n    def __init__(self):\n        self.scores = {}\n\n    def assess_pillar(self, pillar, capabilities):\n        \"\"\"\n        Assess a pillar against ZTMM criteria.\n        capabilities: dict of capability_name -> maturity_stage\n        \"\"\"\n        stage_values = {stage: i for i, stage in enumerate(self.STAGES)}\n        scores = [stage_values.get(stage, 0) for stage in capabilities.values()]\n        avg_score = sum(scores) \u002F len(scores) if scores else 0\n\n        overall_stage = self.STAGES[int(avg_score)]\n        self.scores[pillar] = {\n            'capabilities': capabilities,\n            'average_score': avg_score,\n            'overall_stage': overall_stage\n        }\n        return self.scores[pillar]\n\n    def generate_roadmap(self):\n        \"\"\"Generate prioritized improvement roadmap.\"\"\"\n        roadmap = []\n        for pillar, data in self.scores.items():\n            for capability, stage in data['capabilities'].items():\n                stage_idx = self.STAGES.index(stage)\n                if stage_idx \u003C 3:  # Not yet Optimal\n                    next_stage = self.STAGES[stage_idx + 1]\n                    roadmap.append({\n                        'pillar': pillar,\n                        'capability': capability,\n                        'current': stage,\n                        'target': next_stage,\n                        'priority': 3 - stage_idx  # Higher priority for lower maturity\n                    })\n        return sorted(roadmap, key=lambda x: x['priority'], reverse=True)\n```\n\n### Phase 2: Identity Foundation\n\n1. Deploy phishing-resistant MFA (FIDO2\u002FWebAuthn)\n2. Implement identity governance and administration (IGA)\n3. Establish continuous identity verification\n4. Integrate identity providers with all applications\n5. Deploy identity threat detection and response\n\n### Phase 3: Device Trust\n\n1. Complete asset inventory with automated discovery\n2. Deploy EDR across all endpoints\n3. Implement device compliance checking\n4. Establish device certificate infrastructure\n5. Create device trust scoring mechanism\n\n### Phase 4: Network Transformation\n\n1. Implement network segmentation strategy\n2. Deploy microsegmentation for critical assets\n3. Enable encrypted DNS (DoH\u002FDoT)\n4. Enforce TLS 1.3 for all internal communications\n5. Deploy NDR capabilities\n\n### Phase 5: Application Security\n\n1. Implement application-level access controls\n2. Deploy WAF and API security gateways\n3. Integrate security testing into CI\u002FCD pipelines\n4. Establish application inventory and classification\n5. Implement runtime protection\n\n### Phase 6: Data Protection\n\n1. Implement data classification framework\n2. Deploy DLP across endpoints and network\n3. Enable data activity monitoring\n4. Implement rights management\n5. Establish data lifecycle governance\n\n## Compliance Mapping\n\n| CISA ZTMM Pillar | OMB M-22-09 Requirement | NIST 800-207 Section |\n|---|---|---|\n| Identity | MFA for agency staff | 3.1.1 |\n| Devices | EDR for federal endpoints | 3.1.2 |\n| Networks | Encrypt DNS traffic | 3.1.3 |\n| Applications | Application security testing | 3.1.4 |\n| Data | Data categorization | 3.1.5 |\n\n## Metrics and KPIs\n\n- **Identity Pillar**: Percentage of users with phishing-resistant MFA\n- **Device Pillar**: Percentage of devices with real-time posture assessment\n- **Network Pillar**: Percentage of network segments microsegmented\n- **Application Pillar**: Percentage of applications with zero trust access controls\n- **Data Pillar**: Percentage of sensitive data classified and protected\n- **Overall**: ZTMM stage achieved per pillar (target: Advanced minimum)\n\n## References\n\n- [CISA Zero Trust Maturity Model v2.0](https:\u002F\u002Fwww.cisa.gov\u002Fzero-trust-maturity-model)\n- [CISA ZTMM v2.0 PDF](https:\u002F\u002Fwww.cisa.gov\u002Fsites\u002Fdefault\u002Ffiles\u002F2023-04\u002Fzero_trust_maturity_model_v2_508.pdf)\n- [NIST SP 800-207 Zero Trust Architecture](https:\u002F\u002Fcsrc.nist.gov\u002Fpublications\u002Fdetail\u002Fsp\u002F800-207\u002Ffinal)\n- [OMB Memorandum M-22-09](https:\u002F\u002Fwww.whitehouse.gov\u002Fwp-content\u002Fuploads\u002F2022\u002F01\u002FM-22-09.pdf)\n- [NSA Zero Trust Pillars Guidance](https:\u002F\u002Fmedia.defense.gov\u002F2024\u002FApr\u002F09\u002F2003434442\u002F-1\u002F-1\u002F0\u002FCSI_DATA_PILLAR_ZT.PDF)\n- [Microsoft Guidance for CISA ZTMM](https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fblog\u002F2024\u002F12\u002F19\u002Fnew-microsoft-guidance-for-the-cisa-zero-trust-maturity-model\u002F)\n",{"name":5,"tags":60,"author":66,"domain":54,"license":15,"version":67,"nist_csf":68,"subdomain":73,"description":7,"nist_ai_rmf":74,"mitre_attack":80},[44,61,42,41,62,40,51,39,63,64,65],"cisa","governance","networks","applications","data-security","mahipal","1.0",[69,70,71,72],"PR.AA-01","PR.AA-05","PR.IR-01","GV.PO-01","zero-trust-architecture",[75,76,77,78,79],"GOVERN-1.1","GOVERN-1.7","MAP-1.1","GOVERN-4.2","MAP-2.3",[81,82,83],"T1078","T1190","T1059","main","54a798831d2266a3ca61ce68a7acb80b81160d57","skills\u002Fimplementing-cisa-zero-trust-maturity-model",4384,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","https:\u002F\u002Fmahipal.engineer\u002FAnthropic-Cybersecurity-Skills\u002F","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-08-31 12:32:44",{"source":8,"skillName":5,"commands":95,"prompt":105,"zipAvailable":106},[96,99,102],{"tool":97,"command":98},"npx","npx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill implementing-cisa-zero-trust-maturity-model",{"tool":100,"command":101},"bunx","bunx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill implementing-cisa-zero-trust-maturity-model",{"tool":103,"command":104},"pnpm","pnpm dlx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill implementing-cisa-zero-trust-maturity-model","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-cisa-zero-trust-maturity-model\u002FSKILL.md",true,[108,114,120,124,128,134,138,142,147,151,155,159,163,167,171,175,179,183],{"path":109,"resourceType":110,"resourceTypeDesc":111,"sizeBytes":112,"sourceHtmlUrl":113},"agents\u002Fobserver-loop.sh","SCRIPT","脚本",11502,"https:\u002F\u002Fgithub.com\u002Fnoirelab\u002Flinux-setup\u002Fblob\u002Fmain\u002Fconfigs\u002Fcommon\u002Fclaude\u002Fskills\u002Fcontinuous-learning-v2\u002Fagents\u002Fobserver-loop.sh",{"path":115,"resourceType":116,"resourceTypeDesc":117,"sizeBytes":118,"sourceHtmlUrl":119},"agents\u002Fobserver.md","REFERENCE","参考文档",7504,"https:\u002F\u002Fgithub.com\u002Fnoirelab\u002Flinux-setup\u002Fblob\u002Fmain\u002Fconfigs\u002Fcommon\u002Fclaude\u002Fskills\u002Fcontinuous-learning-v2\u002Fagents\u002Fobserver.md",{"path":121,"resourceType":110,"resourceTypeDesc":111,"sizeBytes":122,"sourceHtmlUrl":123},"agents\u002Fsession-guardian.sh",6392,"https:\u002F\u002Fgithub.com\u002Fnoirelab\u002Flinux-setup\u002Fblob\u002Fmain\u002Fconfigs\u002Fcommon\u002Fclaude\u002Fskills\u002Fcontinuous-learning-v2\u002Fagents\u002Fsession-guardian.sh",{"path":125,"resourceType":110,"resourceTypeDesc":111,"sizeBytes":126,"sourceHtmlUrl":127},"agents\u002Fstart-observer.sh",7690,"https:\u002F\u002Fgithub.com\u002Fnoirelab\u002Flinux-setup\u002Fblob\u002Fmain\u002Fconfigs\u002Fcommon\u002Fclaude\u002Fskills\u002Fcontinuous-learning-v2\u002Fagents\u002Fstart-observer.sh",{"path":129,"resourceType":130,"resourceTypeDesc":131,"sizeBytes":132,"sourceHtmlUrl":133},"assets\u002Ftemplate.md","ASSET","资产文件",4074,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-cisa-zero-trust-maturity-model\u002Fassets\u002Ftemplate.md",{"path":135,"resourceType":116,"resourceTypeDesc":117,"sizeBytes":136,"sourceHtmlUrl":137},"config.json",135,"https:\u002F\u002Fgithub.com\u002Fnoirelab\u002Flinux-setup\u002Fblob\u002Fmain\u002Fconfigs\u002Fcommon\u002Fclaude\u002Fskills\u002Fcontinuous-learning-v2\u002Fconfig.json",{"path":139,"resourceType":110,"resourceTypeDesc":111,"sizeBytes":140,"sourceHtmlUrl":141},"hooks\u002Fobserve.sh",18812,"https:\u002F\u002Fgithub.com\u002Fnoirelab\u002Flinux-setup\u002Fblob\u002Fmain\u002Fconfigs\u002Fcommon\u002Fclaude\u002Fskills\u002Fcontinuous-learning-v2\u002Fhooks\u002Fobserve.sh",{"path":143,"resourceType":143,"resourceTypeDesc":144,"sizeBytes":145,"sourceHtmlUrl":146},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-cisa-zero-trust-maturity-model\u002FLICENSE",{"path":148,"resourceType":116,"resourceTypeDesc":117,"sizeBytes":149,"sourceHtmlUrl":150},"references\u002Fapi-reference.md",1934,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-cisa-zero-trust-maturity-model\u002Freferences\u002Fapi-reference.md",{"path":152,"resourceType":116,"resourceTypeDesc":117,"sizeBytes":153,"sourceHtmlUrl":154},"references\u002Fstandards.md",2115,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-cisa-zero-trust-maturity-model\u002Freferences\u002Fstandards.md",{"path":156,"resourceType":116,"resourceTypeDesc":117,"sizeBytes":157,"sourceHtmlUrl":158},"references\u002Fworkflows.md",3806,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-cisa-zero-trust-maturity-model\u002Freferences\u002Fworkflows.md",{"path":160,"resourceType":110,"resourceTypeDesc":111,"sizeBytes":161,"sourceHtmlUrl":162},"scripts\u002Fagent.py",6254,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-cisa-zero-trust-maturity-model\u002Fscripts\u002Fagent.py",{"path":164,"resourceType":110,"resourceTypeDesc":111,"sizeBytes":165,"sourceHtmlUrl":166},"scripts\u002Fdetect-project.sh",10470,"https:\u002F\u002Fgithub.com\u002Fnoirelab\u002Flinux-setup\u002Fblob\u002Fmain\u002Fconfigs\u002Fcommon\u002Fclaude\u002Fskills\u002Fcontinuous-learning-v2\u002Fscripts\u002Fdetect-project.sh",{"path":168,"resourceType":110,"resourceTypeDesc":111,"sizeBytes":169,"sourceHtmlUrl":170},"scripts\u002Finstinct-cli.py",76111,"https:\u002F\u002Fgithub.com\u002Fnoirelab\u002Flinux-setup\u002Fblob\u002Fmain\u002Fconfigs\u002Fcommon\u002Fclaude\u002Fskills\u002Fcontinuous-learning-v2\u002Fscripts\u002Finstinct-cli.py",{"path":172,"resourceType":110,"resourceTypeDesc":111,"sizeBytes":173,"sourceHtmlUrl":174},"scripts\u002Flib\u002Fhomunculus-dir.sh",1009,"https:\u002F\u002Fgithub.com\u002Fnoirelab\u002Flinux-setup\u002Fblob\u002Fmain\u002Fconfigs\u002Fcommon\u002Fclaude\u002Fskills\u002Fcontinuous-learning-v2\u002Fscripts\u002Flib\u002Fhomunculus-dir.sh",{"path":176,"resourceType":110,"resourceTypeDesc":111,"sizeBytes":177,"sourceHtmlUrl":178},"scripts\u002Fmigrate-homunculus.sh",1785,"https:\u002F\u002Fgithub.com\u002Fnoirelab\u002Flinux-setup\u002Fblob\u002Fmain\u002Fconfigs\u002Fcommon\u002Fclaude\u002Fskills\u002Fcontinuous-learning-v2\u002Fscripts\u002Fmigrate-homunculus.sh",{"path":180,"resourceType":110,"resourceTypeDesc":111,"sizeBytes":181,"sourceHtmlUrl":182},"scripts\u002Fprocess.py",16055,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fimplementing-cisa-zero-trust-maturity-model\u002Fscripts\u002Fprocess.py",{"path":184,"resourceType":110,"resourceTypeDesc":111,"sizeBytes":185,"sourceHtmlUrl":186},"scripts\u002Ftest_parse_instinct.py",35323,"https:\u002F\u002Fgithub.com\u002Fnoirelab\u002Flinux-setup\u002Fblob\u002Fmain\u002Fconfigs\u002Fcommon\u002Fclaude\u002Fskills\u002Fcontinuous-learning-v2\u002Fscripts\u002Ftest_parse_instinct.py",[188,212,235,262,287,313],{"skillNo":189,"name":190,"nameZh":6,"description":191,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":192,"categories":193,"keywords":195,"publishedAt":55},"01M6AGDM3HJXTKXX15ZZ0ZVCJ3","verifying-build-provenance-with-slsa-sigstore","Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder identity and source repo against SLSA Build levels. Use in CI\u002FCD before deploying artifacts, when consuming third-party attestations, establishing a SLSA Build L3 pipeline, or confirming provenance during incident response or admission control.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fverifying-build-provenance-with-slsa-sigstore\u002FSKILL.md",[194],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[196,197,198,199,46,54,200,51,49,201,202,203,204,205,206,207,208,209,210,211],"sigstore","provenance","slsa","verifying build provenance with slsa sigstore","incident response","code","artifacts","ci","supply-chain","pipeline","supply-chain-security","t1195","attestation","code-signing","cosign","keyless",{"skillNo":213,"name":214,"nameZh":6,"description":215,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":216,"categories":217,"keywords":219,"publishedAt":55},"01M6AGDGBPWYVZ2F11GFKJ4HZ9","validating-tpm-measured-boot-attestation","Verifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating and checking signed quotes (tpm2_quote\u002Ftpm2_checkquote), and sealing secrets to a PCR policy. Use to confirm a system booted trusted firmware\u002Fkernel for Zero Trust device posture, detect boot-chain tampering via PCR drift, or build a golden-value baseline for fleet attestation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-tpm-measured-boot-attestation\u002FSKILL.md",[218],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[220,208,221,222,46,223,54,49,224,36,225,226,227,228,229,230,231,232,233,234],"boot","TPM","validating tpm measured boot attestation","policy","verification","firmware","Tools","measured-boot","PCR","integrity","secrets","remote-attestation","tpm2-tools","integrity-verification","trusted-computing",{"skillNo":236,"name":237,"nameZh":6,"description":238,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":239,"categories":240,"keywords":245,"publishedAt":55},"01M6AGDCW0Y4FXZ3362GT1941M","validating-backup-integrity-for-recovery","Validates backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to confirm backups are reliable for disaster recovery and ransomware response. Use before relying on backups for recovery, when building post-backup validation pipelines, auditing backup infrastructure for compliance, or checking immutable\u002Fair-gapped backups for silent corruption or tampering.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[241,244],{"categoryNo":242,"categoryName":243,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[229,246,247,248,249,54,250,251,224,252,253,254,255,256,257,43,258,259,260,261],"backup","recovery","validating backup integrity for recovery","testing","infrastructure","validation","compliance","hash-verification","incident-response","ransomware","cryptocurrency","detection","t1490","immutable","disaster-recovery","restore-testing",{"skillNo":263,"name":264,"nameZh":6,"description":265,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":266,"categories":267,"keywords":269,"publishedAt":55},"01M6AGD9GBG2KZ336AE763J3WH","triaging-windows-with-kape","Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted forensic artifacts (registry hives, $MFT, event logs, prefetch, browser data) via Targets and parse them with Modules wrapping Eric Zimmerman's EZ Tools (PECmd, MFTECmd, RECmd). Use during early incident containment\u002Ftriage when full disk imaging is impractical but a defensible, parseable Windows artifact set is needed quickly, including at-scale remote collection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-windows-with-kape\u002FSKILL.md",[268],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[270,271,272,54,273,274,275,276,277,278,279,38,280,281,282,283,226,284,285,286],"windows","kape","triaging windows with kape","registry","browser","logs","windows-forensics","dfir","mft","mftecmd","prefetch","eric-zimmerman","digital-forensics","SET","collection","pecmd","artifact-collection",{"skillNo":288,"name":289,"nameZh":6,"description":290,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":291,"categories":292,"keywords":294,"publishedAt":55},"01M6AGD5PW5J4EVZM958WD74ZQ","triaging-vulnerabilities-with-ssvc-framework","Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability, and mission prevalence to output Track\u002FTrack*\u002FAttend\u002FAct decisions. Use when prioritizing vulnerability scan results (OpenVAS, Nessus, Qualys) for remediation planning beyond raw CVSS scores.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[293],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[295,296,297,54,298,299,37,300,301,302,303,304,305,306,307,308,309,310,311,312],"vulnerabilities","framework","triaging vulnerabilities with ssvc framework","status","planning","vulnerability-management","risk-management","nessus","qualys","openvas","cvss","remediation","risk","vulnerability","api","prioritization","ssvc","decision-tree",{"skillNo":314,"name":315,"nameZh":6,"description":316,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":317,"categories":318,"keywords":320,"publishedAt":55},"01M6AGD24TTQQM4CXG69E3B9TJ","triaging-security-incident","Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM\u002FEDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident\u002FSKILL.md",[319],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[46,321,54,322,323,324,325,326,45,327,328,43,329,258,330,331,332,333,334,335],"triaging security incident","siem","file","ioc","soc","NIST-800-61","severity","edr","execution","analysis","classification","severity-classification","incident-triage","SANS-PICERL","SOC-operations"]