It is a security model that removes the implicit trust based on network location. Each access is verified continuously according to identity and context, applying the principle "never trust, always verify".

How is Zero Trust applied in practice?

It is implemented by combining multi-factor authentication, identity management with least privilege, network microsegmentation and continuous evaluation of each request's context. It is not a single product but an architecture that reorganises existing access controls.

What does DORA require here?

DORA requires sound access and identity controls and mechanisms to limit and contain ICT incidents. Zero Trust is not a named DORA obligation, but it provides a framework aligned with those protection and containment requirements.

Glossary · Cybersecurity · Security architecture

Zero Trust: security without a trusted perimeter

Zero Trust starts from the principle "never trust, always verify": no user, device or service is trusted simply for being inside the network. The identity and context of each request replace the traditional perimeter, and access is granted explicitly, with least privilege and subject to review.

Principles and components

Continuous verification — each request is authenticated and authorised, without assuming trust from previous sessions or networks.
Least privilege — each identity receives only the permissions strictly required, for only as long as needed.
Microsegmentation — the network is divided into small zones to contain lateral movement in the event of an intrusion.
MFA and context — multi-factor authentication and signals such as device, location or behaviour feed every access decision.

Why it matters in regulated banking

The perimeter model loses effectiveness in the face of distributed work, the cloud and third-party chains. DORA requires financial institutions to have robust access controls and the ability to contain ICT incidents, and NIS2 reinforces identity management in essential sectors. Zero Trust offers a framework consistent with those requirements: it limits the exposed surface, restricts lateral movement and leaves a trace of every access decision, which makes it easier to demonstrate control to the supervisor.

How Vermont Solutions helps

Towards a perimeter-less architecture

We support financial institutions in designing identity and access controls under Zero Trust, aligned with the requirements of DORA and NIS2.

See governance and compliance →

Fuentes

NIST — Zero Trust architecture model (SP 800-207)

Last updated: 2026-06-21. Editorial content by Vermont Solutions, citable with attribution.