NIST SP 800-207
NIST Special Publication 800-207, Zero Trust Architecture
S3M supports six of the seven zero trust tenets in NIST SP 800-207 and its micro-segmentation model. ConnGuard NAC treats every device as a resource, EndGuard and CityGate decide access per session from identity, device and context, APNZone extends that to SIMs, and SAMI turns telemetry into answers that improve policy.
How S3M supports NIST SP 800-207
Applies to: Organizations planning a zero trust architecture; written for US federal agencies. Read the official text
| Article / control | What it asks | How S3M supports it | Products |
|---|---|---|---|
| Tenet 1 (§2.1) | Treat every data source and computing service, including IoT and personal devices, as a resource. | ConnGuard NAC sees every device on the network, managed, IoT or BYOD, and applies policy to each one. | |
| Tenet 3 (§2.1) | Grant access to resources per session, with least privilege. | EndGuard and CityGate decide access for each session and keep verifying while it lasts. | |
| Tenet 4 (§2.1) | Decide access by dynamic policy that uses identity, device state and environment. | CityGate changes policy with context, and APNZone adds location and SIM-to-device binding to the decision. | |
| Tenet 5 (§2.1) | Monitor the security posture of every asset and trust none by default. | EndGuard checks device posture during each session, and ConnGuard NAC isolates devices that fail. | |
| Tenet 6 (§2.1) | Authenticate and authorize dynamically and strictly before every access, and re-evaluate continuously. | EndGuard and CityGate verify identity, device and session continuously. S3M does not provide multi-factor authentication. | |
| Tenet 7 (§2.1) | Collect information about assets, network and access, and use it to improve policy. | SAMI answers questions about access and devices from telemetry, with the source shown, to inform policy changes. | |
| §3.1.2 ZTA using micro-segmentation | Place resources in their own segments behind gateways that enforce access. | CityGate segments without VLANs, and APNZone isolates mobile devices on private APN. |
S3M supports these requirements with technical controls. This is not legal advice or a certification; confirm legal questions with your counsel.
Checked against the official text on .
Frequently asked questions
Which zero trust tenet does S3M not cover?
Tenet 2 asks that all communication be secured whatever the network location, which includes encryption. S3M controls access but does not encrypt traffic.
Is NIST SP 800-207 a requirement?
For US federal agencies it shapes zero trust plans. For others it is guidance; many use it as a reference model.
Where does APNZone fit in a zero trust architecture?
APNZone brings cellular devices into the same model: each SIM is bound to its device and checked against policy for every session.
Last updated