Pillars of a Zero Trust Architecture (NIST SP 800-207)
The key components according to the NIST standard
The NIST SP 800-207 document formalizes Zero Trust principles into a set of logical components any organization can use as a reference when designing its architecture, including the policy engine that decides whether access is granted, the policy administrator that applies that decision, and the policy enforcement point that acts as the gateway for each request. Knowing this framework matters in practice because it keeps companies from confusing Zero Trust with a specific product that's bought and installed, when in reality it's an architecture that integrates identity, device telemetry, risk analysis and automation in a coordinated way. A relevant nuance is that NIST insists on continuous, not one-off, evaluation of the trust granted, so a session correctly authenticated in the morning can lose privileges if the device changes location or shows signs of compromise during the day.