Zero Trust Architecture (ZTA) for hybrid cloud is a security model that grants no implicit trust to any user, device, or workload and verifies every access request, on every connection, using identity, device posture, and real-time context. Because a hybrid estate spanning on-premises data centers and multiple public clouds has no single perimeter to defend, ZTA re-anchors the control plane to identity and continuous verification, following NIST SP 800-207, NIST SP 800-207A, and the CISA Zero Trust Maturity Model.
Executive Summary
- The perimeter is gone. In hybrid cloud, network location no longer implies trust; identity becomes the control plane, and every request is authenticated and authorized per-session (NIST SP 800-207).
- The core pattern is PDP/PEP. A Policy Decision Point makes the access decision; distributed Policy Enforcement Points sit in front of every resource, on-prem or in any cloud.
- Multi-cloud needs identity-tier policy. NIST SP 800-207A enforces authorization on workload identity (service mesh, SPIFFE/SPIRE, mTLS), not IP addresses.
- Maturity is measurable. The CISA ZTMM v2.0 scores five pillars and three cross-cutting capabilities across four stages.
- Execution lags intent. Gartner predicted only about 10% of large enterprises would have a mature program by 2026; the usual gap is east-west microsegmentation and workload identity.
The Logical Core (NIST SP 800-207)
NIST SP 800-207 separates the access decision from its enforcement. The Policy Decision Point (PDP) combines the Policy Engine (PE), which runs the trust algorithm to compute grant/deny/revoke from policy plus signals, and the Policy Administrator (PA), which establishes or tears down the session. The Policy Enforcement Point (PEP) sits inline and is the only component the subject’s traffic traverses (NIST SP 800-207 §3).
Figure 1. NIST SP 800-207 logical core: a centralized PDP and distributed PEPs across the hybrid estate.
In hybrid, the PDP stays logically centralized while PEPs are distributed in front of every resource (on-prem, cloud VM, container, or SaaS), keeping decision logic unified across providers. The PE’s quality depends on its data sources (identity, device posture, threat intel, logs), which is why continuous monitoring (Section 5) is architectural, not optional.
Enforcing Across Multi-Cloud (NIST SP 800-207A, CSA, CNCF)
NIST SP 800-207A pivots control from network parameters (IP, subnet) toward identity, because ephemeral workloads have no stable address. It defines a two-tier model: network-tier policies at ingress/egress/transit gateways, and identity-tier policies enforced by service mesh sidecar proxies against the authenticated workload identity, independent of location.
Figure 2. Identity-tier east-west enforcement via service mesh sidecars and SPIFFE/SPIRE.
The hardest hybrid problem legacy tools ignore is east-west (service-to-service) traffic. The answer, aligned with the CNCF Cloud Native Security Whitepaper, is mutual TLS keyed to cryptographic workload identity: SPIFFE/SPIRE attests a workload and issues a short-lived SVID, platform-agnostic across clouds and on-prem (Red Hat). Network-tier segmentation uses Kubernetes NetworkPolicy. The CSA Software-Defined Perimeter v2.0 supplies the ZTNA pattern: its Controller acts as a Zero Trust PDP, using authenticate-before-connect and Single Packet Authorization to hide assets from unauthorized hosts.
Where Do You Stand? CISA Maturity Model (ZTMM v2.0)
The CISA Zero Trust Maturity Model defines five pillars (Identity, Devices, Networks, Applications & Workloads, Data) plus three cross-cutting capabilities (Visibility & Analytics, Automation & Orchestration, Governance), scored across four stages. Use this matrix as a candid hybrid self-assessment:
| Pillar | Traditional | Advanced | Optimal |
|---|---|---|---|
| Identity | Passwords; on-prem AD | Phishing-resistant MFA; risk-based | Continuous, dynamic across all clouds |
| Devices | No unified inventory | Posture enforced at access time | Real-time posture feeds the PE |
| Networks | Flat network; VPN trust | Microsegmentation; encrypted east-west | Identity-bound microsegments |
| Apps & Workloads | Perimeter-protected monoliths | mTLS + workload identity in mesh | Continuous authz per API call |
| Data | Implicit trust, little classification | Tagging + access policy enforced | Attribute-based access control |
Heuristic for CISOs: most hybrid enterprises sit at Initial on Identity and Devices and Traditional on east-west Networks. The gap to Advanced is microsegmentation and workload identity (Section 2), not another perimeter appliance.
Vendor Reality: Frameworks to Hyperscaler Blueprints
The same architecture is realizable on all three hyperscalers, vendor-neutrally:
| Logical Role | AWS | Microsoft Azure | Google Cloud |
|---|---|---|---|
| PDP / Policy Engine | Verified Access (Cedar) | Entra Conditional Access | BeyondCorp |
| PEP / Access Proxy | Verified Access endpoint | Entra App Proxy | Identity-Aware Proxy |
| Continuous re-eval | Per-request eval + logging | Continuous Access Evaluation | Context-aware re-checks |
| Data / Keys | AWS KMS | Azure Key Vault | Cloud KMS |
| Telemetry / SOAR | CloudTrail + Security Lake | Sentinel + Defender | Google SecOps |
AWS Verified Access evaluates each request in real time against Cedar policies using identity and device claims (AWS). Microsoft states Conditional Access is its Zero Trust policy engine (Microsoft); Google BeyondCorp enforces by user and device context, never by network (Google).
Worked example: AWS plus on-prem VMware (vSphere/NSX). Regulated workloads stay on VMware; elastic workloads run in AWS; a PEP sits at each plane and east-west is identity-bound across the boundary.
Figure 3. Reference Architecture: AWS plus on-prem VMware (NSX).
| Requirement | Component | Framework Basis |
|---|---|---|
| Per-request user access, no VPN | AWS Verified Access (Cedar) | NIST 800-207 |
| Federated identity | AD to IAM Identity Center | CISA Identity |
| East-west control AWS to VMware | SPIFFE/SPIRE SVID + mTLS mesh | NIST 800-207A; CNCF |
| On-prem microsegmentation | NSX Distributed Firewall | CSA SDP |
| Data protection | AWS KMS | CISA Data |
Continuous Monitoring and a Phased Roadmap
NIST tenets 5 and 7 require continuous posture measurement and telemetry feeding policy; the SIEM/SOAR layer is a first-class data source for the PE, aggregating cloud, on-prem, EDR, mesh, and identity logs into risk signals that enable mid-session revocation (CAE). Credential abuse is the leading initial-access vector (Verizon 2025 DBIR); only continuous, context-aware evaluation can catch a valid credential used maliciously.
Sequence by pillar dependency, scored against CISA stages: (1) federate identity and add phishing-resistant MFA, stand up the PDP; (2) centralize hybrid telemetry before enforcing; (3) place PEPs in front of crown-jewel resources (ZTNA/SDP), retire broad VPN; (4) deploy SPIFFE/SPIRE plus a mesh for east-west mTLS and microsegmentation; (5) add attribute-based data controls; (6) automate to policy-as-code with continuous re-evaluation. Avoid treating ZTNA as “done” (it covers north-south only) and per-cloud identity silos (three IAMs is three perimeters, not Zero Trust).
How ServQual and SUSAN Support Zero Trust Governance
Zero Trust succeeds or stalls on governance: continuous assurance, audit-ready evidence, and a measurable maturity roadmap. ServQual provides this through advisory services and its AI-driven platform SUSAN, which moves teams from point-in-time assessments to continuous, evidence-backed compliance that feeds the Policy Engine:
- Governance, Risk, Compliance & Audits: aligns controls to EO 14028 / OMB M-22-09, ISO 27001, SOC 2, PCI-DSS, GDPR, and DPDP (CISA Governance).
- SUSAN AI platform: continuous assurance feeding risk signals to the trust algorithm (CISA Visibility & Analytics).
- Cybersecurity Services & vCISO: scores your CISA maturity stage and builds the multi-year roadmap with executive sponsorship.
- Incident Response & Managed Security (SOC): the SIEM/SOAR loop that detects credential misuse and automates revocation (NIST tenets 5 and 7).
- DevOps & DevSecOps: embeds mTLS, workload identity (SPIFFE/SPIRE), and policy-as-code into CI/CD (NIST SP 800-207A identity-tier).
- Privacy by Design: data classification, attribute-based access, encryption and key management (CISA Data).
ServQual supports security and infrastructure programs across cloud, identity, network and endpoint environments using vendor-aligned implementation practices.
References
"In hybrid cloud, Zero Trust succeeds when identity becomes the control plane and every request is continuously verified."
Sairaj Pawar
Cyber Security Solution Consultant | ServQual
FAQ
Most frequent questions and answers
Intent is near-universal but mature execution is rare: Gartner predicted only about 10% of large enterprises would have a mature, measurable program by 2026, up from under 1%. The gap is execution (east-west microsegmentation and workload identity), so treat it as a multi-year program scored against the CISA Maturity Model.
Because identity, not the network, is where attacks land: the Verizon 2025 DBIR found credential abuse the leading initial-access vector, with roughly 88% of basic web-application attacks involving stolen credentials. A perimeter cannot tell a legitimate login from a stolen one, which is why NIST SP 800-207 makes per-request authentication the first control.
The CISA identity pillar explicitly covers non-person entities and NIST SP 800-207A requires authorization on the calling service’s identity. In practice, give every workload and AI agent a short-lived cryptographic identity (SPIFFE/SPIRE SVIDs per the CNCF whitepaper) and enforce least privilege on every call, never a static over-privileged token.
Partly. ZTNA, built on the CSA Software-Defined Perimeter, replaces broad VPN access with per-application, authenticate-before-connect access. But that covers north-south user access only; Gartner notes many attacks target areas outside typical Zero Trust scope, so east-west traffic, APIs, and data still need identity-tier controls.
Use the CISA ZTMM v2.0: five pillars and three cross-cutting capabilities across four stages (Traditional, Initial, Advanced, Optimal; the Initial stage was added in v2.0). Assess each pillar per environment, find the weakest links (usually east-west networks and workload identity), and sequence investment toward Advanced and Optimal.
Build a Zero Trust Roadmap for Hybrid Cloud
Hybrid cloud security cannot rely on network location, VPN access or isolated cloud controls. Organizations need identity-led access, distributed enforcement, workload identity, microsegmentation, continuous monitoring and audit-ready governance evidence.
ServQual helps organizations assess Zero Trust readiness, strengthen cloud and identity controls, improve SOC visibility and build a prioritized security roadmap across on-premises, AWS, Azure and Google Cloud environments. Explore SUSAN or contact ServQual to connect Zero Trust risks, control maturity, evidence status and remediation ownership into one continuous assurance view.
Disclaimer:This article is for general informational purposes only and does not constitute legal, compliance, or security advice. NIST, CISA, CSA, CNCF, AWS, Microsoft Azure, Google Cloud, and other names are trademarks of their respective owners; references reflect framework and platform alignment, not endorsement. Validate all controls against your own environment and the current official guidance.
