The UW–Madison Zero Trust Framework shows every capability the Smart Access program will work to put in place at the university to advance our zero trust maturity to the “Advanced” level of the CISA Zero Trust Maturity Model. Each pillar identifies what we have today, which capabilities we are developing now, and which we plan to develop in the future.

View and download the above Framework image. View an accessible document-based version of the Framework.

Supporting glossary with more information.

Some projects advance multiple capabilities, and some capabilities require multiple projects. The ultimate goal of the Smart Access program is to get all of these capabilities in place and widely used in the right context, and then to operationalize continued zero trust maturity, so that the university keeps developing its security after the program officially ends.

How we got here

Since the decision to defer the Microsoft licensing, we have been working to understand what we can do for zero trust with what we already have. A big part of that was evaluating where we are now according to the CISA maturity model and where we want to go next. The program and its strategy are now centered on advancing zero trust for the university based on the CISA ZTMM, and the framework is the result of that work.

What is a capability?

Each line item in the UW–Madison Zero Trust Framework is a capability. A capability is a specific, named ability of the university to reduce a particular cybersecurity risk, achieved consistently across the environments where that risk exists.

A capability is not a tool, a service, or a project. It is the result those things produce when they are adopted widely enough to change the university’s risk. A single capability may be delivered by several tools, by the processes and people that operate them, and by the standards, policies, or shared norms that lead units to use them. For example, multi-factor authentication is a capability; Duo is one of the tools that deliver it, alongside the enrollment process, the policy that requires it, and the support that keeps it running.

Because a capability is defined by the risk it reduces, it comes before any tool decision. A capability’s status on the framework (existing, in progress, future) describes how far the university has come toward having it broadly in place, not whether a product has been purchased or a project has started.

How capabilities are prioritized?

Capabilities will be prioritized based on several factors:

• Strategic alignment: advances broader institutional or DoIT strategic priorities.

• Risk reduction: mitigates areas of elevated cyber risk, or responds to emerging threats and new compliance requirements.
• Recommendation: prioritized based on the operational insight and readiness of the people closest to the work.
• Maturity roadmap: required to advance another capability, or the next logical step according to the CISA ZTMM.
• Policy and standards enforcement: strengthens our ability to enforce existing university policies, standards, and audit requirements.

An ever-evolving framework

This framework will continue to evolve over time as our understanding of each capability, and how it applies to our university, deepens. The glossary provides a more detailed overview of each capability and the risks it helps mitigate. It also links to service pages for existing capabilities and to project pages for those that are in progress.

What’s next

Priorities already in progress in the device compliance and log management space continue as planned, including the start of WiscVPN device compliance notifications on November 11.

Over time, we will share more about the other capabilities in progress and what each one means for the university . We will also continue to announce ways to get involved, from framework review rounds to pilots and communities of practice, as those opportunities come up.