In January 2026, the National Security Agency (NSA) released the first in a new series of Zero Trust Implementation Guidelines (ZIGs): a Primer and the Discovery Phase guideline. Together, these documents move Zero Trust from theory into practice, providing detailed, activity-level guidance for how organizations should begin implementing Zero Trust architectures aligned with U.S. government strategy.
For organizations across the federal ecosystem—and the commercial partners that support them—this release is significant. It clarifies what Zero Trust looks like operationally, why discovery is foundational, who is impacted, and how security platforms must evolve to support policy-driven, identity-centric access.
This blog breaks down the big announcement and explains how AppGate ZTNA aligns to, and supports, the intent of these new NSA guidelines.
What Did the NSA Release?
The NSA released two tightly related Zero Trust assets in January 2026:
- The Zero Trust Implementation Guidelines (ZIGs) Primer, which establishes the foundational mindset, principles, terminology, and design concepts for Zero Trust implementation
- The Zero Trust Implementation Guideline: Discovery Phase (Version 1.0), which translates that foundation into concrete capabilities and activities
Together, the Primer and Discovery Phase mark a shift from conceptual Zero Trust guidance to execution-focused instruction. The Primer answers what Zero Trust is and how organizations should think about it, while the Discovery Phase explains how to begin implementing it in real-world environments.
The Primer reinforces core principles drawn from Executive Order 14028, NIST SP 800-207, CISA’s Zero Trust Maturity Model, and the Department of War (DoW) Zero Trust Strategy, positioning the ZIGs as an operational translation layer rather than a new standalone framework or regulatory mandate. It emphasizes that Zero Trust is not a product or a perimeter replacement but a holistic operating model built on continuous verification, explicit policy, and assumed breach.
The Discovery Phase then builds directly on that foundation, focusing on the visibility, inventories, and telemetry organizations must establish before Zero Trust enforcement can succeed.
The Discovery Phase guideline is part of the NSA’s broader Zero Trust Implementation Guidelines (ZIGs) series, designed to translate U.S. government Zero Trust strategy into phased, execution-ready guidance aligned with:
- Executive Order 14028 (Improving the Nation’s Cybersecurity)
- NIST SP 800-207 (Zero Trust Architecture)
- The DoW Zero Trust Strategy and Zero Trust Reference Architecture
- CISA’s Zero Trust Maturity Model
The ZIGs translate these high-level strategies into concrete capabilities and activities. Rather than prescribing specific vendors or architectures, the NSA provides modular guidance that organizations can adapt to their own environments.
The Discovery Phase is the first published implementation phase in the ZIGs series, with additional phases expected to follow as part of a broader, phased Zero Trust implementation model aligned to DoW target-state capabilities. Its purpose is straightforward but critical: build authoritative visibility into users, devices, applications, data, and traffic flows before enforcing Zero Trust controls.
Why the Discovery Phase Matters
A core message of the NSA guidance is that Zero Trust cannot be implemented effectively without first understanding the environment.
The Discovery Phase focuses on answering foundational questions such as:
- Who are the users and non-person entities accessing systems?
- What devices are connecting—and what is their security posture?
- Which applications and workloads exist, and how are they accessed?
- Where does sensitive data reside, and how does it move?
- How are policies defined, enforced, logged, and analyzed?
The NSA frames Zero Trust as a continuous verification model built on the assumptions of never trust, always verify and assume breach. Discovery supplies the authoritative data, inventories, and telemetry required to support continuous decision-making and future enforcement.
Without accurate inventories, identity sources, and telemetry, policy decisions become brittle, enforcement becomes inconsistent, and organizations risk replicating perimeter-era failures inside modern architectures.
Who Is Impacted by These Guidelines?
While authored by the NSA, the Discovery Phase guideline is not limited to intelligence agencies.
The stated target audience includes:
- U.S. DoW components
- National Security Systems (NSS)
- Defense Industrial Base (DIB) organizations
- Federal agencies and civilian departments
- Technology vendors and integrators
- Industry and academic partners supporting Zero Trust efforts
For many commercial organizations, this guidance matters because it establishes the operational baseline expected of organizations supporting federal and defense missions, and signals where Zero Trust expectations are converging across regulated industries.
In practice, these guidelines influence how security leaders:
- Design identity and access architectures
- Evaluate vendor capabilities
- Prepare for audits, assessments, and compliance reviews
- Align security investments with long-term Zero Trust roadmaps
What the Discovery Phase Actually Covers
The Discovery Phase guideline maps directly to the DoW Zero Trust Framework and spans seven pillars:
- User
- Device
- Application & Workload
- Data
- Network & Environment
- Automation & Orchestration
- Visibility & Analytics
Across these pillars, the Discovery Phase defines 13 capabilities supported by 14 specific activities, such as:
- User and privileged account inventory
- Device inventory and health assessment
- Application and code identification
- Data cataloging and monitoring
- Data flow mapping
- Policy inventory and development
- Logging and traffic analysis across users, apps, and networks
Each activity includes scenarios, positive impacts, technology considerations, implementation guidance, and expected outcomes—making the document directly actionable for skilled practitioners.
Importantly, the NSA emphasizes that these activities are modular and non-sequential. Organizations can align them to their mission, environment, and maturity level rather than following a rigid checklist.
What This Means for the Broader Security Industry
The Discovery Phase guideline reinforces several industry trends:
- Identity is the new control plane. Users, devices, and workloads must be authenticated and authorized continuously, not implicitly trusted.
- Inventory precedes enforcement. You cannot apply least privilege without knowing what exists.
- Policy must be explicit and inspectable. Access decisions require context, attributes, and auditability.
- Zero Trust is operational, not theoretical. The focus has shifted from frameworks to execution.
While the NSA guidance does not prescribe specific access technologies or policy models, it reinforces the need for systems capable of supporting granular, identity- and context-informed access decisions once discovery activities are complete.
For vendors, this guidance raises the bar. Solutions must support granular policy enforcement, integrate with authoritative identity sources, and provide the visibility required to prove compliance and effectiveness.
How AppGate ZTNA Aligns with the NSA Discovery Phase
AppGate Zero Trust Network Access (ZTNA) was designed around the same principles emphasized in the NSA guidelines: identity-first access, explicit policy, and continuous verification.
Identity-Centric Access Control
AppGate ZTNA enforces access decisions based on authenticated identity, device posture, and contextual attributes—supporting the Discovery Phase’s focus on authoritative user and device inventories.
Granular, Policy-Based Enforcement
Access in AppGate ZTNA is defined at the application and service level, not the network level. This aligns directly with the NSA’s emphasis on granular access rules, deny-by-default policies, and least-privilege enforcement.
Discovery Without Exposure
By removing the need to expose applications to the network, AppGate ZTNA reduces attack surface while organizations inventory and map access paths—supporting discovery without increasing risk.
Continuous Verification and Logging
AppGate ZTNA integrates with identity providers, device signals, and security tooling to support continuous verification and detailed logging—key requirements across the Visibility & Analytics pillar.
Modular Integration
Consistent with the NSA’s vendor-agnostic guidance, AppGate ZTNA integrates into broader Zero Trust ecosystems, supporting policy orchestration, automation, and phased adoption rather than rip-and-replace approaches.
Turning Guidance into Action
The NSA’s Discovery Phase guideline makes one thing clear: Zero Trust success depends on disciplined groundwork.
Organizations that begin with authoritative identity, accurate inventories, explicit policies, and strong visibility are better positioned to advance into enforcement, automation, and advanced Zero Trust capabilities.
AppGate stands ready to support organizations navigating this journey—helping translate federal guidance into practical, scalable Zero Trust access architectures that meet today’s requirements and tomorrow’s expectations.
To learn more about how AppGate ZTNA supports Zero Trust discovery and implementation for organizations operating under federal and defense Zero Trust expectations, visit our Federal Division solutions page to see how AppGate ZTNA enables identity-centric, policy-driven access.