IICTI Certified Zero Trust Security Architect

Holders demonstrate that they can apply and evaluate zero trust reference architectures and logical components, zero trust strategy, maturity assessment and roadmapping, identity as the control plane and continuous authentication and device trust, attestation and posture-based access, plus 8 further areas, in realistic professional scenarios, as defined in the AQSCERT scheme for Zero Trust Security Architect.

Who it is for: Professionals working, or preparing to work, in security roles.

1. 01Zero trust reference architectures and logical components5% of the exam

   • Evaluate and adapt zero trust reference architectures to an organization's environment and constraints.
   • Scope: NIST SP 800-207 policy engine, administrator and enforcement points, NIST SP 1800-35 example implementations, CISA Zero Trust Maturity Model v2.0, DoD Zero Trust Reference Architecture pillars and NCSC principles.
2. 02Zero trust strategy, maturity assessment and roadmapping6% of the exam

   • Lead a zero trust maturity assessment and design a prioritized, funded multi-year roadmap.
   • Scope: Protect surfaces and transaction flow mapping, maturity baselining against CISA ZTMM, business case and prioritization, phased migration from perimeter models and outcome metrics.
3. 03Identity as the control plane and continuous authentication15% of the exam

   • Architect identity controls that continuously verify users and sessions and revoke access on changing risk.
   • Scope: NIST SP 800-63-4, phishing-resistant MFA and passkeys, risk-based conditional access, CAEP and the OpenID Shared Signals Framework, ITDR and just-in-time privileged access.
4. 04Device trust, attestation and posture-based access9% of the exam

   • Design device trust models that feed reliable posture signals into access decisions.
   • Scope: Device identity and certificates, TPM-based and platform attestation, UEM/MDM compliance signals, EDR integration, BYOD and unmanaged device strategies.
5. 05ZTNA, SSE and identity-based micro-segmentation11% of the exam

   • Architect network access and segmentation that removes implicit trust while preserving application availability.
   • Scope: ZTNA and CSA Software-Defined Perimeter v2, SASE/SSE architectures, VPN replacement, identity-based micro-segmentation, east-west traffic control and segmentation migration sequencing.
6. 06Workload identity and cloud-native zero trust10% of the exam

   • Design workload-to-workload trust for hybrid and multi-cloud applications without network-location assumptions.
   • Scope: SPIFFE/SPIRE workload identity, mTLS and service mesh, NIST SP 800-207A for multi-cloud and cloud-native applications, API gateway enforcement and machine identity lifecycle.
7. 07Policy decision engines and fine-grained authorization9% of the exam

   • Design dynamic authorization architectures that make consistent, explainable, low-latency access decisions.
   • Scope: ABAC, RBAC and ReBAC models, OPA/Rego, Cedar and OpenFGA, OpenID AuthZEN, trust algorithms and risk scoring, PDP/PEP placement, latency and caching trade-offs.
8. 08Data-centric zero trust and data security posture6% of the exam

   • Architect controls that protect data wherever it resides and tie access to data sensitivity and context.
   • Scope: Data discovery and classification, DSPM, DLP and CASB, rights management, attribute-based encryption and tokenization, and data access governance.
9. 09Visibility, analytics and automated policy feedback9% of the exam

   • Design analytics and automation that convert telemetry into timely, trustworthy access policy changes.
   • Scope: Telemetry pipelines and normalization, UEBA, SIEM and SOAR integration, continuous diagnostics and mitigation, signal quality, and closed-loop policy adaptation.
10. 10Zero trust for OT, IoT and legacy environments5% of the exam

    • Evaluate constrained environments and design zero trust controls that respect safety and availability requirements.
    • Scope: IEC 62443 zones and conduits, legacy protocol and device constraints, agentless enforcement, secure remote access for OT, and compensating controls for non-modernizable systems.
11. 11Resilience, failure modes and validation of zero trust10% of the exam

    • Diagnose failure and bypass modes in zero trust architectures and design resilient, verifiable enforcement.
    • Scope: PDP and identity provider availability, fail-open versus fail-closed decisions, break-glass procedures, policy bypass risks, and validation through adversary emulation and control testing.
12. 12Zero trust governance, compliance and program leadership5% of the exam

    • Lead a cross-functional zero trust program that meets regulatory expectations and sustains organizational adoption.
    • Scope: OMB M-22-09 and EO 14028, NIS2 and DORA mapping, ISO/IEC 27001 alignment, operating model and ownership, vendor and platform evaluation, change and stakeholder management.

Question types

Single choice 100%

Delivery

Online (remote proctored), Test centre, On-site (corporate)

Retakes

Up to three attempts within any 12-month period. A 14-day waiting period applies after a first unsuccessful attempt and 30 days after a second. Each retake requires a new booking and fee. Retakes draw a different randomised form from the question bank.

Provisional cut score — psychometric validation is required before live delivery. Blueprint v1.0.

1. 1

   Register

   Create a free account and start the programme.

2. 2

   Practice

   Online practice test (coming soon).

3. 3

   Training

   Optional

   Online course or classroom — or skip it.

4. 4

   Certification

   Independent exam and certification decision.

Training is optional and does not by itself confer certification. Find a training partner