ChaptersCircleEventsBlog
Join us for the in-person CCSK Azure course at Black Hat from August 4–5! Register now for a hands-on deep dive and secure your spot now!

Download Publication

Map the Transaction Flows for Zero Trust
Map the Transaction Flows for Zero Trust
Who it's for:
  • Zero Trust implementation teams
  • Security managers, architects, and analysts
  • Business system owners
  • CISOs
  • Compliance officers

Map the Transaction Flows for Zero Trust

Release Date: 11/18/2024

The NSTAC Report to the President on Zero Trust defines five steps to implementing a Zero Trust security strategy. This publication provides guidance on executing the second step: mapping transaction flows for the protect surface. CSA is developing separate research documents to elaborate detailed guidance for each of the five steps. Explore Step 1, defining the protect surface, in our first publication.

The Zero Trust protect surface consists of Devices, Assets, Applications, and Services (DAAS). Mapping the transaction flows establishes granular visibility into communication between these elements, with other protect surfaces, and with users and external services. This helps you understand how the business system works before defining security policies in subsequent steps. 

The mapping methods explored in this document include comprehensive system analysis and leveraging scanning tools. The document also delves into how these methods can help refine protect surfaces and design Zero Trust architectures. Additionally, it outlines the benefits of mapping transaction flows and provides a maturity model for evaluating the effectiveness of transaction flow mapping practices. 

Navigate the complex task of understanding system architecture, transaction flows, and security maturity within the Zero Trust security model. Enhance your cybersecurity resilience and establish a foundation for enforcing an adaptive and robust security posture in your organization.

Key Takeaways:
  • A review of Zero Trust strategy and the five-step Zero Trust implementation process
  • How to validate the protect surface’s DAAS elements and refine their metadata 
  • How to identify and document users of the protect surface and the types of endpoint devices they use 
  • How to identify dependencies and transactions among DAAS elements, users, other business systems, and external services
  • How to map data flows
  • How to validate and refine the understanding of the relative sensitivity and security maturity of the system 
  • Specific considerations for cloud, OT, and IoT devices
  • Challenges of mapping transaction flows
  • Benefits of mapping transaction flows


Download this Resource

Bookmark
Share
Related resources
Zero Trust Automation & Orchestration and Visibility & Analytics Overview
Zero Trust Automation & Orchestration and Visib...
Dynamic Process Landscape: A Strategic Guide to Successful AI Implementation
Dynamic Process Landscape: A Strategic Guide to...
Agentic AI Red Teaming Guide
Agentic AI Red Teaming Guide
Navigating the Cybersecurity Imperative in India’s Manufacturing Ascent
Navigating the Cybersecurity Imperative in India’s Manufacturing As...
Published: 06/27/2025
What Kind of Identity Should Your AI Agent Have?
What Kind of Identity Should Your AI Agent Have?
Published: 06/25/2025
ESXi Ransomware: The Growing Threat to Virtualized Environments
ESXi Ransomware: The Growing Threat to Virtualized Environments
Published: 06/25/2025
CIEM and Secure Cloud Access Best Practices
CIEM and Secure Cloud Access Best Practices
Published: 06/24/2025

Acknowledgements

Michael Roza
Michael Roza
Risk, Audit, Control and Compliance Professional at EVC

Michael Roza

Risk, Audit, Control and Compliance Professional at EVC

Michael Roza is a seasoned risk, audit, control and compliance, and cybersecurity professional with over 20 years of experience across multinational enterprises and startups. As a Cloud Security Alliance (CSA) Research member for over 10 years, he has led and contributed to more than 140 CSA projects spanning Zero Trust, AI, IoT, Top Threats, DecSecOps, Cloud Key Management, Cloud Control Matrix, and many others.

He has co-chaired...

Read more

Vinotth Ramalingam
Vinotth Ramalingam
Cybersecurity Product Leader at Dell Technologies

Vinotth Ramalingam

Cybersecurity Product Leader at Dell Technologies

Erik Johnson
Erik Johnson
Cloud Security Specialist & Senior Research Analyst, CSA

Erik Johnson

Cloud Security Specialist & Senior Research Analyst, CSA

Worked for the Federal Reserve for many years and volunteered with the CSA with a focus on CCM/CAIQ V4, specifically the STA domain, and developing a comprehensive framework and guidance for defining and managing the cloud shared security responsibility model (SSRM).

I recently retired from the Federal Reserve and am now consulting with the CSA as a Senior Research Analyst with a focus on Zero Trust and Financial Services.

Linke...

Read more

Are you a research volunteer? Request to have your profile displayed on the website here.

Interested in helping develop research with CSA?

Related Certificates & Training