The Zero Trust model has evolved from a theoretical concept into a mandatory architectural standard for ensuring the resilience of the public and corporate sectors. The traditional approach to cybersecurity, based on perimeter defense, has proven incapable of countering modern targeted attacks. According to the Cisco Cybersecurity Readiness Index 2025, organizational maturity assessment is now based on five key pillars, among which Identity Intelligence and Machine Trustworthiness are primary factors.
The main problem is that many IT leaders still confuse basic multi-factor authentication (MFA) implementation with a comprehensive security architecture overhaul. In practice, if an attacker compromises a single account in a traditional model, they often gain the ability to move laterally through the network due to a lack of dynamic access control. A true transition to Zero Trust requires assessing current infrastructure maturity and consistently implementing controls at the identity and data levels.
Why the CISA maturity model has become the benchmark for Ukrainian B2G and Enterprise
Assessing infrastructure readiness requires a structured approach. The CISA Zero Trust maturity model offers a clear migration path. This framework aligns perfectly with the updated NIST Cybersecurity Framework (CSF) 2.0, which introduced a new "Govern" function. According to this, cybersecurity is a fundamental part of corporate governance and risk assessment, rather than just a technical task.
For Ukrainian enterprises and government institutions (B2G), it is critical to begin the transformation with two fundamental pillars: Identity and Data. Moving from a "Traditional" state to a high level of maturity ("Advanced" or "Optimal") involves abandoning static rules in favor of dynamic verification of every request, adhering to the principle of least privilege.
Pillar 1: Identity — from simple passwords to continuous context verification
In the Zero Trust model, identity becomes the center of access management. The NIST SP 800-63 (Digital Identity Guidelines) standard defines clear Authentication Assurance Levels (AAL), emphasizing that the use of phishing-resistant multi-factor methods is a baseline requirement for critical systems.
However, advanced maturity requires more. Instead of a one-time check at the entry point, dynamic conditional access policies are implemented. The system analyzes the context of each request before granting access:
- Device state: whether the workstation complies with security policies (installed updates, active antivirus).
- Network context: whether the request is anomalous in terms of location or time.
- Lifecycle management: automation of onboarding and instant revocation of rights upon termination to avoid "orphaned" access, which increases the attack surface.
Pillar 2: Data — why channel encryption is insufficient and how Row-Level Security (RLS) works
Traditional data protection is limited to encryption in transit and at rest. This does not protect against an attacker or an insider with legitimate rights. To reach "Advanced" and "Optimal" maturity levels, protection must be integrated directly into the application software architecture.
- Row-Level Security (RLS): A mechanism that restricts access to specific database rows. Even with access to a table, the user sees only the records necessary for their job duties.
- Access Control Lists (ACL): Granular access control lists at the level of individual files or system objects.
- Dynamic control: Granting access rights in real-time based on context (data sensitivity, document status, employee clearance level).
Architectural approach instead of off-the-shelf solutions: the role of the UnityBase platform in building Zero Trust
Implementing Zero Trust is a choice of the right technological foundation. No "off-the-shelf" product will make an organization compliant with this model without architectural changes. Document management systems, state registries, and corporate portals must be designed with a "security by default" concept.
An example of such an architectural approach is the low-code platform UnityBase (a joint development of the Intecracy Group alliance, where InBase acts as a key developer). It is a full-stack JavaScript platform for enterprise applications where security is embedded at the level of a unified domain metadata model. Systems built on this platform (such as Megapolis.DocNet or Scriptum) utilize its built-in mechanisms:
- RLS and attribute-based access control: Rules for restricting data by rows are declared in metadata and applied at the ORM layer, blocking unauthorized access regardless of how the system is accessed.
- Audit trail: Detailed logging of data reads and changes, which is mandatory for timely detection of anomalous behavior.
On-premises deployment as a critical requirement for defense and critical infrastructure
For Ukrainian defense and critical infrastructure institutions, public cloud services often do not meet strict regulatory requirements. Full control over data storage and traffic makes on-premises deployment not just an alternative, but a necessity.
For high-load systems and projects with increased security requirements, the official UnityBase documentation recommends commercial Enterprise (EE) or Defence (DE) editions. The Defence edition, in particular, provides advanced key-based authentication capabilities, support for integration with certificate status services (CRL/OCSP), and tools for server module integrity control. This allows organizations to build a sovereign Zero Trust infrastructure locally without relying on external cloud services.
Zero Trust maturity assessment scale for Identity and Data (CISA Framework)
| Pillar | Traditional Level | Advanced Level | Optimal Level |
|---|---|---|---|
| Identity | Passwords or static MFA; limited integration between account stores; manual onboarding. | Context-aware MFA (location, device); integrated IDP; automated account lifecycle. | Continuous dynamic verification of every request; real-time user behavior analysis (UEBA); passwordless authentication. |
| Data | Data stored unencrypted or encrypted only on disk; access regulated by broad network rights. | Data encryption in transit and at rest; access regulated at file/table level using ACL. | Dynamic data access based on context; granular separation at row level (RLS/ABAC); automatic data labeling and classification. |
Consistent assessment of the IT environment against these criteria helps security architects identify vulnerabilities and plan migration. Zero Trust is a continuous risk management process that requires reliable technological tools and sound architecture.
FAQ
How to evaluate the maturity level of IT infrastructure according to the CISA model?
The assessment is conducted across five pillars (Identity, Devices, Networks, Applications, Data) by comparing current controls with the CISA scale. To achieve maturity, it is necessary to move from static perimeter defense to dynamic verification of every request and context.
What is the difference between Role-Based Access Control (RBAC) and dynamic Row-Level Security (RLS)?
RBAC defines general permissions (e.g., the right to read the 'Contracts' table for the 'Manager' role). RLS works at a more granular level, restricting access to specific rows of that table. Thanks to RLS, a manager will be able to see only the contracts belonging to their department, which reduces risks in the event of an account compromise.
Can a Zero Trust architecture be built on on-premises solutions without using Microsoft or Google cloud services?
Yes, the Zero Trust model is not tied to public clouds. A sovereign architecture is built locally (on-premises) using platforms that support granular access control, RLS, end-to-end auditing, and integration with secure identity providers (e.g., using Enterprise or Defence editions of the UnityBase platform).
Expert comment