Zero Trust Architecture
A security model that authenticates and authorizes every access, regardless of network location.
Definition
Zero Trust Architecture (ZTA) is a cybersecurity model - formalized by NIST SP 800-207 (2020) - that assumes no implicit trust based on network location and instead requires every access decision to be authenticated, authorized, and continuously validated. ZTA's tenets include: every resource is treated as a resource to be accessed, all communications are secured regardless of network location, access is granted on a per-session basis, and policies are dynamic and enforced at fine granularity.What this means in practice
Connected medical devices challenge classical Zero Trust assumptions because they are often resource-constrained, long-lived, and deployed on segmented OT networks. Practical MedTech ZTA usually means strong device identity (per-device certificates), mutual TLS for every service interaction, and centralized policy enforcement at the gateway or service mesh - not full ZTA inside the device itself.- •Treating Zero Trust as a product purchase rather than an architectural decision.
- •Forgetting that legacy medical devices cannot meet ZTA requirements without compensating controls.
- •Implementing mutual TLS without a credible certificate-rotation and revocation story.
Frequently asked questions
Related terms
Grouped by themeEditor's picks
· Hand-selected related conceptsInternational standard for risk management of IT networks that incorporate medical devices.
A risk-based framework of cybersecurity functions and outcomes published by NIST and widely used to organize MedTech security programs.
The bundle of cybersecurity artifacts a sponsor includes in a 510(k), De Novo, PMA, or HDE submission for a cyber device.
The federal statute that gives FDA explicit premarket authority over cybersecurity for cyber devices.
More in Cybersecurity
· Same categoryAAMI/ANSI standard establishing requirements for medical-device cybersecurity activities throughout the lifecycle.
AAMI Technical Information Report providing MedTech-specific guidance on cybersecurity risk management.
AAMI Technical Information Report on post-market security risk management for medical device manufacturers, the operational companion to TIR57.
Unauthorized remote control of an implanted neurostimulator (e.g., DBS) to alter stimulation parameters and harm a patient.
Primary references
3 sources- 1
NIST SP 800-207 Zero Trust ArchitectureVerifiedNISTcsrc.nist.gov
- 2
OMB M-22-09 Federal Zero Trust StrategyVerifiedOMBwhitehouse.gov
- 3
CISA - Healthcare and Public Health SectorVerifiedCISAcisa.gov
Inline markers like [1] jump to the matching reference above.