The Zero Trust principle is based on creating a framework that reduces and/or removes implicit trust in networked systems by addressing network identity, endpoint health, and data flows. The model considers potential risks to a mission or business process and how they can be mitigated. Ultimately, the zero trust implementation depends on organizational workflow and resources.

Ideally, organizations must build their zero trust architecture on the premise that they cannot fully trust systems, networks, or services, operating both outside and/or within the security perimeter. It calls for verification of everything and anything that is attempting to establish access to the organizational systems, networks, or services. The strategy leads to a paradigm shift in philosophy on securing infrastructure, networks, and data, from verifying once at the perimeter to continually verifying each user, device, application, and transaction.