OMB memo set zero-trust deadline for agencies by FY 2024

OMB issued M-22-09 in September 2022, requiring agencies to achieve specific zero-trust maturity targets by the end of fiscal year 2024. Most federal agencies have not met the OMB M-22-09 zero-trust maturity deadline.

the Interior Department reported it is running a zero‑trust (a model that assumes no implicit trust based on network location) training program that has certified over 200 staff and brought in outside speakers, while its community of practice has grown to roughly 1,000 participants, and Louis Eichenbaum said cultural change is the biggest challenge in zero‑trust implementation. Louis Eichenbaum served as the Acting Chief Information Security Officer of the U.S. Department of the Interior and had led its zero-trust program.

Before serving as Interior CISO, Louis Eichenbaum had led a 170-person zero-trust implementation team and helped secure congressional support for zero-trust adoption. Liza Briggs warned that technical security fatigue can arise when constantly shifting cyber protocols overload employees and that the term “zero trust” may alienate staff without proper explanation.

NIST SP 800-207 (the National Institute of Standards and Technology publication outlining zero‑trust architecture) defines the five zero trust pillars—identity, device, network, application, and data—and states that no implicit trust should be granted based on network location. Agencies that migrate systems to GovCloud while advancing zero trust maturity can see their POA&M (Plan of Action and Milestones) backlog grow unmanageable if remediation lacks clear ownership, realistic timelines, and executive visibility. Some federal agencies treat authorization artifacts such as System Security Plans (documents detailing an information system’s security controls), continuous monitoring reports (ongoing assessments of security control effectiveness), and POA&Ms as active management tools for measuring zero trust maturity rather than as mere compliance paperwork.

When a System Security Plan reflects actual system behavior and implemented controls, it functions as a living instrument to identify remaining implicit trust in a zero-trust environment. Cross-functional collaboration among security, engineering, and architecture teams, with clear escalation paths to the CISO when remediation conflicts with system availability, has driven zero-trust progress. Treating zero-trust solely as a perimeter replacement and focusing on network segmentation without addressing identity governance is a common shortcoming in legacy federal environments.

Federal agencies that handle sensitive personal data need to integrate data loss prevention controls with zero-trust identity decisions and assess access to such data rather than granting it only at login. Many agencies have not linked their data loss prevention posture to their zero-trust roadmap, leaving these workstreams separate. Agencies that view zero-trust solely as a security issue tend to stall, whereas those that treat it as an enterprise architecture challenge make progress.