CISA's New Playbook Nudges Agencies Toward Zero Trust — and Everyone Else Can Read Along

Key points

• The Cybersecurity and Infrastructure Security Agency (CISA) published new guidance titled The Journey to Zero Trust, Using Secure Access Service Edge in a Modern TIC 3.0 Solution.
• The document explains how federal agencies can modernise the way staff connect to apps and cloud services.
• CISA says private organisations moving away from old-style network perimeters can use the same playbook.
• The guidance sits inside CISA's broader push for zero trust, a security model that assumes no user or device is safe by default.

CISA has quietly dropped another piece of its zero trust puzzle. The new guidance walks agencies through how to weave Secure Access Service Edge, a cloud-delivered way of protecting users no matter where they log in from, into the government's Trusted Internet Connections programme, now on version 3.0.

That programme, known as TIC, used to funnel federal internet traffic through a small number of heavily guarded gateways. It worked when everyone sat in an office. Staff now log in from home networks and cloud apps their agency doesn't own, and the old model creaks.

What is CISA actually telling agencies to do?

Stop treating the office network as a castle wall.

The old model assumed that once you were inside the network, you were trusted. Zero trust flips that: every login, every device, every request to open a file gets checked, every time. Secure Access Service Edge, usually shortened to SASE (pronounced "sassy"), enforces those checks from the cloud rather than from a box in a server room.

CISA's document lays out how the two ideas fit together. TIC 3.0 sets the policy goals. SASE is one of the tools that can meet them.

Why should anyone outside government care?

Because the problem CISA is solving is the same problem most companies have.

Staff are scattered. Data lives in someone else's cloud. The firewall at head office no longer sees half the traffic that matters. Hospitals, law firms and retailers are all trying to protect people who never touch the corporate network anymore. CISA states plainly that any organisation looking to modernise perimeter-based architectures and improve visibility across distributed environments will benefit from the guidance, which is an unusually broad invitation from a federal agency.

We first covered SASE's role in federal zero trust architecture on 22 June 2026, when Zscaler made its case at Zenith Live for governing AI agents under the same model. That vendor pitch was forward-looking; this CISA document is the policy skeleton those tools have to fit into.

What does this mean for ordinary users?

Probably very little day to day, and that is the point.

Done well, zero trust is invisible: your device is checked in the background and you reach the app you need. Done badly, it means more password prompts, more multi-factor codes and more frustrated calls to the help desk. The CISA guidance is aimed at the architects making those choices, not at end users.

For citizens using federal services, the practical hope is fewer breaches of the kind that have leaked personnel records and tax data in past years. For employees at private companies following the same playbook, expect single sign-on and tighter scrutiny of unusual logins from unfamiliar places.

The wider direction of travel

This is not a standalone announcement. It sits alongside the White House's 2022 zero trust strategy and a steady drumbeat of CISA documents pushing the same direction.

A caveat worth keeping front of mind: none of this stops a determined intruder on its own. Zero trust reduces blast radius. It does not eliminate risk. Agencies still need patching, monitoring and staff who can spot a phishing email, a fake message designed to trick someone into handing over a password.

The full guidance and related zero trust materials are available on CISA's site. Feedback goes through the agency's product survey.