# NIST SP 800-207

Source: https://s3msecurity.com/compliance/nist-sp-800-207/
Last updated: 2026-11-12

S3M supports six of the seven zero trust tenets in NIST SP 800-207 and its micro-segmentation model. ConnGuard NAC treats every device as a resource, EndGuard and CityGate decide access per session from identity, device and context, APNZone extends that to SIMs, and SAMI turns telemetry into answers that improve policy.

**NIST Special Publication 800-207, Zero Trust Architecture.** Applies to: Organizations planning a zero trust architecture; written for US federal agencies. Official text: https://doi.org/10.6028/NIST.SP.800-207

## How S3M supports it

| Article / control | What it asks | How S3M supports it | Products |
| --- | --- | --- | --- |
| Tenet 1 (§2.1) | Treat every data source and computing service, including IoT and personal devices, as a resource. | ConnGuard NAC sees every device on the network, managed, IoT or BYOD, and applies policy to each one. | ConnGuard NAC |
| Tenet 3 (§2.1) | Grant access to resources per session, with least privilege. | EndGuard and CityGate decide access for each session and keep verifying while it lasts. | EndGuard, CityGate |
| Tenet 4 (§2.1) | Decide access by dynamic policy that uses identity, device state and environment. | CityGate changes policy with context, and APNZone adds location and SIM-to-device binding to the decision. | CityGate, APNZone |
| Tenet 5 (§2.1) | Monitor the security posture of every asset and trust none by default. | EndGuard checks device posture during each session, and ConnGuard NAC isolates devices that fail. | EndGuard, ConnGuard NAC |
| Tenet 6 (§2.1) | Authenticate and authorize dynamically and strictly before every access, and re-evaluate continuously. | EndGuard and CityGate verify identity, device and session continuously. S3M does not provide multi-factor authentication. | EndGuard, CityGate |
| Tenet 7 (§2.1) | Collect information about assets, network and access, and use it to improve policy. | SAMI answers questions about access and devices from telemetry, with the source shown, to inform policy changes. | SAMI |
| §3.1.2 ZTA using micro-segmentation | Place resources in their own segments behind gateways that enforce access. | CityGate segments without VLANs, and APNZone isolates mobile devices on private APN. | CityGate, APNZone |

S3M supports these requirements with technical controls. This is not legal advice or a certification; confirm legal questions with your counsel.

Checked against the official text on 2026-11-12.

## Frequently asked questions

### Which zero trust tenet does S3M not cover?

Tenet 2 asks that all communication be secured whatever the network location, which includes encryption. S3M controls access but does not encrypt traffic.

### Is NIST SP 800-207 a requirement?

For US federal agencies it shapes zero trust plans. For others it is guidance; many use it as a reference model.

### Where does APNZone fit in a zero trust architecture?

APNZone brings cellular devices into the same model: each SIM is bound to its device and checked against policy for every session.