Zero-Trust and NIST consulting: a baseline, not a product purchase

Zero-Trust defines a target model for access decisions. ANOMAL assesses the current state against a maturity model. We check how identity, device and context are verified for every access request. We identify flat network segments with implicit trust and users accessing applications directly without controlled paths. This baseline produces a roadmap with measurable milestones. Zero-Trust and SOC explains the connection to ongoing SOC operations, particularly how Zero-Trust signals feed into detection.

• Maturity scoring across identity, devices, network, applications and data.
• Segmentation and access-path design: which flows are possible today and which should be, per target state.
• Device trust and conditional access strategy, aligned to the existing identity platform without requiring a new purchase.
• Application access via controlled paths without flat network access, including handling of legacy applications without modern authentication.
• Phased plan with measurable milestones (e.g. share of segmented zones, share of enforced conditional access rules).

The NIST Cybersecurity Framework structures the assessment across the five functions Identify, Protect, Detect, Respond and Recover. ANOMAL assesses maturity per function through questionnaires, interviews with responsible teams and spot-check configuration reviews. The resulting gap list provides prioritised measures that go beyond a score alone.

We also map the gap list to Swiss regulatory requirements. These include revFADP (revised Federal Act on Data Protection) (nDSG / nLPD) data protection duties and the ISG reporting duty for critical infrastructure. We also cover FINMA requirements for regulated institutes and NIS2 for Swiss subsidiaries of EU groups. Details are on revFADP and SOC, ISG reporting duty, FINMA requirements and NIS2 for Swiss subsidiaries.

• Assessment report with maturity per area or function and the underlying evidence base.
• Prioritised action plan with effort classes, without fixed deadlines or costs.
• Architecture decision records for key decisions (e.g. segmentation boundaries, conditional access policy structure).
• Board-ready summary that presents risk, progress and next steps without technical jargon.

Effort and depth depend on the number of systems, sites and regulatory requirements and are quoted as a dedicated offer per customer. General SOC cost drivers are described on What does a SOC cost in Switzerland.

• ANOMAL does not resell products. Recommendations remain vendor-neutral and reflect what is already in use.
• ANOMAL does not issue a compliance certificate. A NIST assessment is not a certification and does not replace one.
• The accredited auditor conducts certification audits (e.g. ISO 27001). ANOMAL prepares clients for the audit and does not conduct it. See ISO 27001 and SOC.

Zero-Trust and NIST consulting is one of several consulting services at ANOMAL, see Security consulting Switzerland. Results often feed directly into running SOC detection: segmentation and conditional access rules influence which signals the SOC can even see. The full operating model is described on SOC as a Service Switzerland.