--- title: "Your organization cannot meet the new NSA Zero Trust Implementation Guidelines. Here's how to do it." url: https://daily.dev/posts/your-organization-cannot-meet-the-new-nsa-zero-trust-implementation-guidelines-here-s-how-to-do-it--n7swcrljn source_url: https://smallstep.com/blog/nsa-zero-trust-device-identity-gap type: article source: "Smallstep" published: 2026-03-05T18:11:28.746Z updated: 2026-03-05T18:11:54.002Z reading_time: 7 upvotes: 0 comments: 0 language: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Your organization cannot meet the new NSA Zero Trust Implementation Guidelines. Here's how to do it. **[Smallstep](https://daily.dev/sources/smallstep)** · 7 min read · 0 upvotes · 0 comments ## Summary The NSA's 2026 Zero Trust Implementation Guidelines assume devices can prove cryptographic identity, but most enterprises still rely on spoofable identifiers like MAC addresses, MDM enrollment, and SCEP-issued certificates. These portable credentials can be copied or replayed, making true device verification impossible. Hardware security modules (TPM, Secure Enclave, Android hardware-backed keystores) solve this by generating non-exportable private keys. ACME Device Attestation (ACME-DA), an emerging IETF standard co-developed by Smallstep and Google, extends the ACME protocol with hardware attestation challenges, replacing SCEP's shared-password model with cryptographic proof that a certificate key is bound to a specific physical device. This enables continuous, hardware-rooted device authentication across Wi-Fi, VPN, SaaS, SSH, and internal services. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [Device Identity and NCSC Zero Trust Guidance \| Smallstep](https://daily.dev/posts/device-identity-and-ncsc-zero-trust-guidance-smallstep-6qv5zbkwt) · Smallstep · 0 upvotes · 0 comments - [After Mythos: Identity Has to Anchor in Hardware](https://daily.dev/posts/after-mythos-identity-has-to-anchor-in-hardware-cc1hwkqsf) · Smallstep · 0 upvotes · 0 comments - [Reimagining Device Security for the Enterprise](https://daily.dev/posts/reimagining-device-security-for-the-enterprise-egvejadzy) · Smallstep · 0 upvotes · 0 comments --- [View this post on daily.dev](https://daily.dev/posts/your-organization-cannot-meet-the-new-nsa-zero-trust-implementation-guidelines-here-s-how-to-do-it--n7swcrljn)