Why “Best Zero Trust Platform for Federal Agencies” Is the Wrong Starting Question

The phrase “best zero trust platform for federal agencies” returns thousands of vendor comparison pages. Most of them answer the wrong question. They ask which platform has the most features, the widest cloud presence, or the strongest marketing. None of that determines whether the platform actually meets the requirements of a federal agency.

Federal agencies in the United States, Canada, the United Kingdom, Germany, France, and across Western Europe operate under specific cybersecurity mandates that most commercial Zero Trust platforms were not designed to satisfy. They authenticate personnel with smartcards – PIV in the US, CAC for DoD, myGOV in Canada, government-issued eID across Europe. They process classified information that cannot traverse commercial cloud infrastructure. They connect operational technology controlling physical assets – water utilities, power grids, border security, transportation networks – alongside traditional IT. And they answer to Authorizing Officials and Inspectors General who require architectural evidence, not marketing claims.

The correct question is not which platform is “best” in the abstract. The correct question is: which platform’s architecture satisfies the mandate framework that applies to your specific agency, in your specific jurisdiction, for your specific workloads?

This guide answers that question across the three major mandate frameworks governing federal Zero Trust in 2026:

• United States – EO 14028, OMB M-22-09, CISA ZTMM, DoD Zero Trust Strategy, FedRAMP
• Canada – ITSG-33, CCCS ITSM.10.008 (Zero Trust), Protected B / PBMM profile
• Western Europe – NIS2 Directive, national transpositions (BSI Germany, ANSSI France, NCSC UK/Ireland), DORA

The evaluation framework covers architectural requirements, smartcard/eID integration, data sovereignty, OT/SCADA coverage, and audit completeness – the dimensions that actually determine whether a Zero Trust platform serves federal agencies or merely claims to.

The Three Mandate Frameworks Federal Agencies Operate Under

Zero Trust is not a single standard. It is a set of principles that different mandate frameworks translate into different specific requirements. A Zero Trust platform that satisfies one framework may not satisfy another. Federal agencies selecting a platform must first map their mandate environment.

United States: FCEB, DoD, and the Cascade Into State/Local

The US Zero Trust mandate environment has three layers:

Federal Civilian Executive Branch (FCEB). Executive Order 14028 (May 2021) required FCEB agencies to develop Zero Trust Architecture plans. OMB Memorandum M-22-09 (January 2022) set specific goals by end of FY2024 – phishing-resistant MFA, encrypted DNS, network segmentation, application-level access. The CISA Zero Trust Maturity Model (ZTMM) V2.0 provides the measurement framework across five pillars (Identity, Devices, Networks, Applications & Workloads, Data) and three cross-cutting themes. CISA’s latest Binding Operational Directive cadence has pushed ZTMM maturity deadlines throughout 2025–2026 for all FCEB agencies.

Department of Defense. DoD DTM 25-003 is effective now. The DoD Zero Trust Strategy defines 91 capability outcomes for target-level IT ZT and 61 for advanced-level. The November 2025 OT-specific guidance adds 84 target-level and 21 advanced-level outcomes for OT environments. DoD Impact Levels (IL4, IL5, IL6) govern where cloud workloads can reside.

State, local, and tribal. While not bound by FCEB mandates, states are adopting ZTMM voluntarily. California Department of Technology Letter 23-01 directed state entities toward ZTA aligned to NIST 800-207 and CISA ZTMM V2.0. Other states are following similar patterns, and federal grant conditions increasingly require ZTMM alignment for recipient agencies.

Agencies selecting a Zero Trust platform under US mandates need Zero Trust Access that maps directly to the five CISA ZTMM pillars with documented evidence per pillar – not generic “Zero Trust” claims.

Canada: ITSG-33 and the Protected B Requirement

The Canadian federal framework is structured differently. ITSG-33 (IT Security Risk Management: A Lifecycle Approach) is the Canadian Centre for Cyber Security’s foundational guidance that defines how federal departments assess risk, select controls, and earn Authority to Operate. ITSM.10.008 (A Zero Trust Approach to Security Architecture) provides the Zero Trust layer on top of ITSG-33 and explicitly references both CISA ZTMM and UK NCSC Zero Trust design principles.

The control profile that matters for most workloads is Protected B / Medium Integrity / Medium Availability (PBMM). This profile defines the baseline security controls for information that, if compromised, could cause serious injury to individuals, organizations, or government. The PBMM profile aligns closely with NIST SP 800-53 – the same foundation as FedRAMP – which means platforms with strong FedRAMP evidence often have a head start for Canadian federal deployment.

Critical distinction: ITSG-33 and CCCS Medium Cloud Profile typically require data localization in Canada. Cloud services must be assessed by CCCS against the PBMM profile before processing Protected B workloads. Commercial cloud providers with US data paths may not qualify without specific Canadian residency configuration.

Beyond federal core departments, ITSG-33 extends to Crown corporations, GC agencies, and third-party service providers handling GC information. This expands the effective scope beyond the 24 main federal departments to hundreds of affiliated entities.

Western Europe: NIS2 Directive and National Transpositions

European federal agencies operate under the NIS2 Directive (EU 2022/2555), which came into force in January 2023 with a transposition deadline of 17 October 2024. NIS2 covers 18 critical sectors and explicitly includes public administration at central and regional level. Member states may extend to local level.

The NIS2 transposition status as of January 2026 varies dramatically across the EU:

• Maturity Level 4 (approved bill + finalized cybersecurity framework): Belgium, Germany, Italy, Hungary, Greece, Czech Republic, Slovakia, Slovenia, Latvia, Lithuania, Croatia
• Maturity Level 3 (approved bill, framework pending): Sweden, Denmark, Austria, Portugal, Malta, Finland, Estonia, Romania, Cyprus
• Maturity Level 2 (draft law under legislative review): United Kingdom, Luxembourg, France, Spain, Netherlands, Poland, Bulgaria
• Maturity Level 1 (first transposition efforts): Ireland, Norway

Key national frameworks federal agencies must address:

Germany – BSI (Bundesamt für Sicherheit in der Informationstechnik). The NIS2 Implementation and Cybersecurity Strengthening Act (NIS2UmsuCG) has been delayed multiple times but BSI has prepared information packages and is building a central incident reporting platform. German federal agencies and Länder (state) administrations are in scope.

France – ANSSI (Agence nationale de la sécurité des systèmes d’information). ANSSI is developing a cybersecurity measurement framework that translates NIS2 Articles 20 and 21 into technical, operational, and organizational measures. Notably, France extends scope beyond EU minimums to include all departments, municipalities with over 30,000 inhabitants, overseas territories, and research institutions. The French government is pursuing a holistic approach integrating NIS2, DORA, and the Critical Infrastructure Resilience Directive.

United Kingdom – NCSC (National Cyber Security Centre). Post-Brexit, the UK operates its own NIS Regulations (updated 2024) and the NCSC’s Zero Trust Architecture Design Principles. The UK’s approach tracks NIS2 philosophically but implements independently. The Cyber Security and Resilience Bill was introduced in 2025.

Ireland – NCSC Ireland. The National Cyber Security Bill transposing NIS2 is progressing. Ireland’s NCSC is designated as competent authority for most entities.

Netherlands – NCSC-NL and the CBw NIS2 Control Framework. The Dutch National Cyber Security Center has published a specific control framework for NIS2-scoped entities, with entry into force expected Q2 2026.

NIS2 explicitly mandates cybersecurity risk management measures including “policies on risk analysis and information system security, those regarding incident handling, access control policies and the use of multi-factor authentication or continuous authentication.” This is Zero Trust in substance, even where the directive does not use the term.

The Architectural Requirements Federal Agencies Actually Need

The mandate frameworks above differ in specifics but converge on seven architectural requirements. A Zero Trust platform that lacks any of these is insufficient for federal deployment – regardless of marketing claims.

1. On-Premises Data Path Option

Classified workloads, Protected B data, and national security information cannot traverse commercial cloud infrastructure owned by foreign vendors. The platform must support on-premises deployment where all traffic stays within agency-controlled infrastructure. Cloud-native platforms that route all traffic through vendor PoPs fail this requirement for classified and regulated data – regardless of FedRAMP authorization.

2. Zero Inbound Firewall Ports

Every inbound port exposed to the internet is an attack surface. The CitrixBleed pattern (CVE-2023-4966, CVE-2025-5777), Ivanti Pulse Secure vulnerabilities, and Fortinet VPN exploits demonstrated that internet-facing remote access appliances are the preferred initial access vector for nation-state actors and ransomware affiliates. A federal-grade Zero Trust platform eliminates inbound ports architecturally – through reverse-access connections initiated from inside the protected network outward to a gateway, not inbound connections accepted from the internet.

3. Smartcard and eID Native Integration

• US federal: PIV (Personal Identity Verification) for civilian agencies, CAC (Common Access Card) for DoD and intelligence community
• Canadian federal: myGOV credential, myKey, PIV-I
• German federal: nPA (neuer Personalausweis) / eID
• French federal: France Identité, RGS-compliant certificates
• UK public sector: GOV.UK One Login, with PIV-I equivalence for sensitive systems
• Pan-European: eIDAS-compliant national eID schemes

The platform must integrate natively with these authentication mechanisms – not through third-party brokers that add attack surface and reduce performance.

4. OT/SCADA Coverage

Federal agencies increasingly operate OT alongside IT: water utilities (EPA + state water agencies), power grids (DOE, TVA, provincial Crown corporations), transportation (DOT, FRA, DVSA, Bundesamt für Verkehr), border surveillance (CBP, CBSA, Frontex systems), and critical facility management across defense and civilian buildings.

OT environments add requirements that IT-focused platforms often do not address: RDP/SSH to SCADA workstations with per-session MFA and recording, bidirectional file sharing with CDR scanning for firmware updates, zero inbound ports on OT network firewalls, and vendor access with named accounts and time-bounded sessions.

Platforms that cover IT only force agencies to procure separate OT security products – increasing vendor count, integration complexity, and attack surface. The TerraZone solutions portfolio for state and federal government systems provides integrated IT/OT coverage in a single architecture designed specifically for federal operational realities.

5. Audit Trail Completeness with SIEM Integration

Authorizing Officials and Inspectors General require evidence that security controls actually work. Fragmented logs from multiple products do not satisfy audit requirements. The platform must produce a unified audit trail covering every access decision, every file operation, every session – with identity attribution, device attribution, and policy decision records – exported in standard formats (Syslog, CEF, STIX) to the agency SIEM.

6. Session Recording for Privileged and Vendor Access

Government agencies face specific requirements for privileged session oversight – OMB circulars, GAO audit guidance, CCCS privileged access requirements, BSI Mindeststandards. Video recording of privileged sessions, keystroke logging, and file transfer attribution are increasingly required. Platforms that rely on separate PAM products for session recording add vendor count and integration complexity.

7. Compliance Mapping Per Mandate Framework

Pre-built compliance documentation mapping platform capabilities to specific framework controls – CISA ZTMM V2.0, DoD DTM 25-003, ITSG-33 Annex 3A, NIS2 Articles 20 and 21, BSI C5, ANSSI SecNumCloud – accelerates ATO processes and audit responses. Generic security claims do not.

The Evaluation Matrix: Capability Coverage Across Vendor Categories

The following matrix evaluates the dominant vendor categories against federal agency requirements. It is not a feature count – it is an architectural match assessment.

Capability	Cloud-Native ZTNA (Zscaler, Netskope, Cloudflare)	Hybrid SASE (Palo Alto, Cisco, Fortinet)	Identity Platform (Okta, Microsoft Entra)	On-Premises Reverse Access (truePass, AppGate)
FedRAMP High authorization	Multiple vendors hold it	Varies by vendor	Microsoft Entra: yes	Varies by deployment model
DoD IL5/IL6 deployment	Limited – gov cloud only	Limited	Microsoft: yes (IL5)	Yes (on-premises)
On-premises data path (zero vendor cloud)	No	Configurable, rarely default	No (cloud service)	Yes
Zero inbound firewall ports	At cloud edge only	Depends on configuration	N/A	Yes (architectural)
PIV/CAC native integration	Vendor-dependent	Vendor-dependent	Microsoft Entra: yes	truePass: yes; AppGate: yes
Canadian PBMM / CCCS Medium alignment	Some vendors have Canadian Protected B region	Limited	Microsoft: yes	Yes (on-premises)
NIS2 control framework mapping	Available from major vendors	Available	Available	Available with detailed mapping
BSI C5 / ANSSI SecNumCloud	Limited – few vendors	Limited	Microsoft: partial	Yes (on-premises deployments)
OT/SCADA workstation access	Limited (IT-optimized)	Limited	No	Yes (primary use case for truePass)
Bidirectional file sharing with CDR	No (separate product)	No (separate product)	No	truePass: yes (integrated); AppGate: no
Session recording (video + keystroke)	Limited/add-on	Limited/add-on	No	truePass: yes (built-in); AppGate: limited
Unified audit trail across all connectivity	For ZTNA only	Partial	Identity events only	truePass: all connectivity types

What This Matrix Reveals for Federal Agencies

The pattern is consistent: no single vendor category covers every federal requirement. The platform selection depends on the specific agency profile.

For US federal civilian agencies with primarily cloud/SaaS workloads: Zscaler and Palo Alto Prisma Access provide the most comprehensive SSE/SASE coverage. FedRAMP High authorization and IL4 deployment options cover most FCEB use cases. Limitations appear at DoD IL5/IL6 boundaries and for classified workloads.

For US DoD and intelligence community: Microsoft Entra combined with on-premises Zero Trust platforms addresses the IL5/IL6 requirement that pure commercial cloud cannot satisfy. Agencies running OT/SCADA alongside IT require platforms that consolidate both – truePass provides this through TerraZone solutions for State, Federal, and Defense Agencies, combining ZTNA, SMB Proxy with CDR, and session recording in a single architecture.

For Canadian federal departments: Platforms meeting PBMM profile with Canadian data residency are mandatory for Protected B workloads. Microsoft Canada offers CCCS Medium alignment. On-premises platforms with ITSG-33 control mapping provide the broadest coverage without cloud dependency.

For European federal agencies: NIS2 compliance varies by member state transposition status. Platforms with documented NIS2 control framework mapping, BSI C5 (Germany), ANSSI SecNumCloud (France), or national equivalents simplify compliance. Agencies in NIS2 Maturity Level 4 countries have the most detailed requirements – Germany’s BSI requirements and Italy’s AgID framework are among the most specific.

For any federal agency with OT/SCADA: Platforms that address only IT force a second procurement for OT security. Consolidated platforms reduce vendor count, unify audit, and eliminate the gaps between IT-focused and OT-focused security products where attackers consistently enter.

Cross-Jurisdiction Compliance Mapping

Federal agencies operating across multiple jurisdictions – or selecting a platform for future multi-jurisdiction deployment – benefit from cross-framework mapping. The following table maps core Zero Trust architectural principles to specific framework requirements.

Architectural Principle	US (CISA ZTMM + DoD ZTS)	Canada (ITSG-33 + ITSM.10.008)	EU (NIS2 + National Frameworks)
Identity verification per access	ZTMM Identity Pillar – Advanced/Optimal	ITSG-33 AC-2, IA-2, IA-8	NIS2 Art. 21(2)(i) – access control policies, MFA, continuous authentication
Phishing-resistant MFA	OMB M-22-09 goal (FY2024)	ITSG-33 IA-2(1), IA-2(11)	NIS2 Art. 21(2)(j) – MFA or continuous authentication solutions
Device posture verification	ZTMM Devices Pillar	ITSG-33 CM-2, CM-7	BSI IT-Grundschutz SYS.2.1; ANSSI guide on endpoint security
Network micro-segmentation	ZTMM Networks Pillar; DoD ZTS pillar 3	ITSG-33 SC-7(13), AC-4	NIS2 Art. 21(2)(a) – risk analysis + information system security policies
Application-level access (not network)	ZTMM Applications & Workloads Pillar	ITSG-33 AC-3(9), AC-6	NIS2 Art. 21(2)(e) – security in network and information systems acquisition
Data protection in transit and at rest	ZTMM Data Pillar	ITSG-33 SC-8, SC-13, SC-28	NIS2 Art. 21(2)(h) – cryptography and encryption policies
Continuous monitoring and logging	ZTMM Visibility & Analytics (cross-cutting)	ITSG-33 AU-2, AU-6, SI-4	NIS2 Art. 21(2)(b) – incident handling
Session recording for privileged access	DoD ZTS pillar 7 (Visibility & Analytics)	ITSG-33 AU-14 (session audit); Treasury Board privileged access	NIS2 Art. 21(2)(c) – business continuity; national frameworks (BSI ORP.4)
Supply chain / vendor access control	ZTMM Data + Identity Pillars	ITSG-33 SA-9, PS-7 (personnel security)	NIS2 Art. 21(2)(d) – supply chain security (explicit requirement)
Data sovereignty	FedRAMP / DoD IL boundaries	CCCS Medium Cloud Profile (data in Canada)	GDPR + national transpositions; ANSSI SecNumCloud; BSI C5

The convergence across frameworks is deliberate. NIS2 explicitly references CISA ZTMM. Canadian ITSM.10.008 explicitly cites both CISA ZTMM and UK NCSC design principles. The three major frameworks are not competing standards – they are parallel implementations of the same Zero Trust principles, with jurisdiction-specific additions.

A Zero Trust platform with strong documentation for any one framework typically covers the others with modest additional evidence. The exceptions are jurisdiction-specific data residency requirements (Canada PBMM, ANSSI SecNumCloud, BSI C5), which require explicit architectural support.

The Five Common Federal Procurement Pitfalls

Federal agencies evaluating Zero Trust platforms consistently encounter the same procurement failures. Recognizing these patterns shortens the evaluation cycle.

Pitfall 1: Equating FedRAMP with Zero Trust

FedRAMP authorization confirms that a cloud service meets baseline security controls. It does not confirm that the architecture is Zero Trust. A FedRAMP High platform that grants network-level access after VPN authentication is FedRAMP compliant – and architecturally opposed to Zero Trust. Agencies selecting platforms based on FedRAMP status alone frequently discover post-procurement that the architecture does not map to ZTMM pillars.

Pitfall 2: Accepting Cloud-Only Architectures for Classified Workloads

Vendor marketing often implies that FedRAMP High enables classified deployment. It does not. Classified workloads – Secret, Top Secret, DoD IL6 – require deployment architectures that most commercial cloud-native platforms cannot provide. The procurement team must verify the actual deployment model for classified systems, not rely on FedRAMP general authorization.

Pitfall 3: Ignoring OT/SCADA Until It’s Too Late

Agencies with OT environments – water utilities, power systems, transportation infrastructure, border security – often procure Zero Trust for IT, then discover that OT requires separate products. The second procurement cycle extends timelines, increases budget, and creates integration gaps. Platforms evaluated with OT requirements from the start – with RDP to SCADA, SMB Proxy with CDR, and session recording – deliver consolidated coverage in a single procurement.

Pitfall 4: Underestimating Data Residency Constraints

Canadian PBMM requires data localization in Canada. German BSI C5 requires specific operational controls in Germany. French ANSSI SecNumCloud has data residency requirements. Agencies that select cloud platforms without explicit regional deployment confirmation discover during ATO review that the architecture does not satisfy data residency – requiring platform change or re-architecture.

Pitfall 5: Selecting Based on Incumbent Vendor Relationship

Agencies standardized on a specific vendor often default to that vendor’s Zero Trust offering. This works when the vendor’s platform genuinely covers federal requirements. It fails when the vendor’s strength is in one dimension (identity, firewall, SaaS access) but federal requirements span multiple dimensions. Evaluation should start with requirements – then match to vendors.

Frequently Asked Questions

What is the best Zero Trust platform for US federal civilian agencies in 2026?

For FCEB agencies with primarily cloud and SaaS workloads, Zscaler and Palo Alto Prisma Access provide comprehensive SSE/SASE coverage with FedRAMP High authorization. For agencies with on-premises applications, classified data, or OT/SCADA environments, truePass provides integrated ZTNA + file sharing with CDR + session recording in a single on-premises architecture. Microsoft Entra is the foundation for any federal identity deployment. No single platform serves every FCEB agency – the selection depends on workload profile and classification level.

What is the best Zero Trust platform for Canadian federal departments?

For Canadian federal departments handling Protected B data, platforms assessed against CCCS Medium Cloud Profile are mandatory. Microsoft Canada and select Canadian-resident cloud providers offer this alignment. For classified workloads or OT environments, on-premises platforms with ITSG-33 control mapping – including truePass for integrated IT/OT Zero Trust – provide the broadest coverage without cloud dependency. Data localization in Canada is the default requirement for Protected B.

How does NIS2 affect Zero Trust platform selection for European federal agencies?

NIS2 explicitly mandates cybersecurity risk management measures that constitute Zero Trust in substance – access control policies, multi-factor authentication, continuous authentication, encryption, incident handling, supply chain security. Federal agencies in member states with Maturity Level 4 transposition (Germany, Italy, Belgium, others) have the most specific requirements. Agencies in member states still at Maturity Level 1–2 (Ireland, UK, France, Spain) should select platforms that satisfy the NIS2 Directive directly, since national transpositions will add specificity but rarely subtract requirements.

Can one Zero Trust platform satisfy US, Canadian, and European federal mandates simultaneously?

Yes, architecturally – but with jurisdiction-specific deployment and documentation. A platform with strong CISA ZTMM mapping, ITSG-33 control documentation, and NIS2 control framework evidence can serve all three. The critical factors are data residency (Canadian data in Canada, EU data in EU), smartcard integration (PIV/CAC/myKey/eID), and on-premises deployment capability for classified workloads. Agencies with operations across jurisdictions benefit from platforms that support deployment in each jurisdiction with local data paths and local compliance evidence.

What about defense agencies specifically – DoD, Canadian Armed Forces, Bundeswehr, French Armed Forces?

Defense agencies require specific compliance layers beyond civilian frameworks – DoD DTM 25-003 with IL5/IL6 deployment in the US, CFINTCOM security frameworks in Canada, BSI “Geheim” protection in Germany, ANSSI “Diffusion Restreinte” or higher in France. These layers typically require on-premises or government-dedicated cloud deployment with specific hardening. Commercial cloud platforms with FedRAMP or equivalent civilian authorization rarely satisfy defense classification levels. Defense-grade deployments typically use on-premises platforms with explicit classification-level certification.

How do state, provincial, and regional governments fit in?

US state governments follow voluntary ZTMM adoption, often conditioned by federal grant requirements. California, Texas, New York, and others have published state-level Zero Trust guidance aligned to CISA ZTMM V2.0. Canadian provinces follow TBS and CCCS guidance with provincial variations – Ontario, British Columbia, and Quebec have specific provincial frameworks. European regional governments (German Länder, French régions, Spanish comunidades autónomas) are explicitly in scope for NIS2 national transpositions, often at the same level as central government agencies. Platform selection at state/provincial/regional level should follow federal patterns – but with local data residency where applicable.

Does platform selection differ for agencies with classified versus unclassified workloads?

Yes, fundamentally. Unclassified workloads can be served by cloud-native platforms with FedRAMP Moderate/High, CCCS Medium, or equivalent authorization. Classified workloads – Secret, Top Secret, DoD IL5/IL6, Canadian Top Secret, EU RESTRICTED/CONFIDENTIAL, NATO SECRET – typically require on-premises deployment with jurisdiction-specific certification. Agencies operating both workload types often deploy dual platforms: a cloud-based platform for unclassified operations and an on-premises platform for classified. Architectural consolidation is possible through platforms that support both deployment modes.

Conclusion

The best Zero Trust platform for federal agencies is not a single vendor or a universal answer. It is the platform whose architecture, deployment model, and compliance documentation match the specific mandate framework governing the specific agency.

For US FCEB agencies with cloud-first workloads, cloud-native platforms with FedRAMP High dominate. For DoD with classified workloads, on-premises architectures are mandatory. For Canadian federal departments handling Protected B data, PBMM-aligned platforms with Canadian data residency are required. For European federal agencies, NIS2 compliance with national framework evidence is the baseline – and for agencies operating in BSI or ANSSI jurisdictions, the specific national frameworks set additional requirements.

The architectural principles that satisfy all three frameworks are consistent: zero inbound ports, identity-based per-session verification, application-level access, smartcard/eID native integration, integrated OT/SCADA coverage where applicable, unified audit with SIEM export, and deployment flexibility that supports on-premises where classification or sovereignty requires it.

Federal agencies that define their mandate framework, workload profile, and classification requirements first – then evaluate vendors against those specific requirements – select the platform that actually serves their mission. Federal agencies that start with vendor lists end up with platforms that pass marketing review but fail architectural review during ATO. The first approach takes longer at the start. The second approach takes longer in total.