Zero Trust Data Access Maturity Assessment

1. Which identity platform do you currently use? * Your identity platform is the foundation of Zero Trust — it controls who is authenticated and what policies govern their access.

2. Is MFA enforced for all employees? * MFA prevents the majority of credential-based attacks — even if a password is stolen, MFA blocks unauthorized access.

3. Do you use centralized IAM? * Centralized Identity and Access Management ensures access policies are applied consistently across all applications and systems.

4. Do you use Conditional Access policies? * Conditional Access evaluates context — user risk, device compliance, location, sensitivity — before granting access.

5. How do remote users access internal applications? * VPNs grant broad network-level access; ZTNA grants access only to specific applications with continuous verification.

6. Which ZTNA solution do you currently use? * Understanding your ZTNA platform helps us assess current capability and how it can integrate with data-layer controls.

7. Can users access applications without network-level access? * In a true Zero Trust model, users reach specific applications without access to the underlying network, preventing lateral movement.

8. Do access decisions rely on identity verification? * Zero Trust requires access decisions that continuously verify identity posture and device compliance — not just at login.

9. How are sensitive documents typically shared externally? (select all that apply) * A controlled access platform keeps data inside your environment; external parties access it without receiving a copy.

10. Can access to shared files be revoked after sharing? * If a vendor relationship ends or a breach is suspected, can you immediately cut off access to files you have already shared?

11. Can permissions be modified after sharing? * Dynamic permission control lets you adapt as trust relationships evolve — for example, moving a vendor from full access to read-only.

12. Can external parties collaborate without receiving copies of files? * Zero Trust data access means collaboration happens inside your controlled environment, with no copies distributed.

13. Can access be controlled at the file and folder level? * Granular file and folder-level control ensures users and external parties see only what they specifically need.

14. Can external auditors access information without receiving copies? * A governed access portal lets auditors review information without taking custody of it, simplifying evidence management.

15. Can board members securely access sensitive documents remotely? * Secure remote access without local copies is a governance and cybersecurity best practice for board materials.

16. Can mortgage applicants securely access and submit documents without email attachments? * A secure portal reduces fraud risk, meets regulatory expectations, and improves the client experience.

17. Can you identify who currently has access to sensitive information? * Real-time access visibility is foundational — without it you cannot scope a breach or demonstrate least-privilege compliance.

18. Can you identify every external party with access to a document? * Most compliance frameworks require you to know exactly which third parties hold access to sensitive information at any time.

19. Do you maintain complete audit trails for document access? * Complete audit trails capture every access event and are essential for compliance and post-incident forensics.

20. Do you monitor file access activity? * Continuous monitoring detects anomalous access patterns before they escalate to a breach.

21. Can third-party access be revoked immediately? * Immediate revocation capability is a Zero Trust requirement for managing supply chain risk.

Primary collaboration methods

Primary use cases

Where do you currently store your data? (select all that apply)