Implementing a Zero Trust Architecture
I have previously read most of these docs, and NIST has done some excellent work in what can be tough territory, even if 'zero trust' is now* a misleading term (the question is more like who/what do you trust under which circumstances and how do you implement that in a simple, scalable, extensible way...so I prefer something closer to 'authorize everything').* The term was more applicable when originally coined - the context back then was don't trust an endpoint just because it is on your network.