What CISA’s Optimal Identity Stage Requires

CISA’s Zero Trust Maturity Model asks for identity to be checked continuously at its Optimal stage, not only when access is first granted. Most environments are strong at login and silent afterward.

The model in a paragraph

CISA published version 2.0 of its Zero Trust Maturity Model in April 2023. It organizes Zero Trust across five pillars: identity, devices, networks, applications and workloads, and data. Each pillar moves through four stages, from Traditional to Initial, Advanced, and Optimal. Three cross-cutting capabilities run through all of them: visibility and analytics, automation and orchestration, and governance. It is guidance for federal agencies, and many other organizations use it as a yardstick.

What the identity pillar asks, stage by stage

• Traditional: passwords or basic login checks, with static access.
• Initial: stronger login checks, with several attributes checked.
• Advanced: phishing-resistant login checks and more automated, real-time analysis of identity risk.
• Optimal: identity is checked continuously, not just when access is first granted, and identity policies are automated across the organization.

In short, the first three stages are about getting the login right. The last is about what happens next.

Where most environments stand

Strong login controls are in place in many organizations, from smart cards to federated sign-on. Those controls establish a high degree of trust at the start of a session. That trust is then encoded in a token, and from then on the architecture checks the token, not the person. Whoever holds the token is the user, as far as the system can tell.

This is the structural gap that continuous identity assurance addresses. It is not a failure of existing investments. It is the edge of what login-time controls were designed to do.

The same direction in defense

The Department of Defense’s Zero Trust Capability Execution Roadmap points the same way. It names continuous authentication as a User pillar capability, with the outcome of authenticating and authorizing users continuously within and across sessions, and it asks organizations to use behavioral and contextual signals to improve risk-based access. Mimoto’s September 2026 white paper, Extending Zero Trust Through Continuous Identity Assurance, walks through how continuous identity assurance lines up with NIST SP 800‑207 and the CISA model.

What closing the gap looks like

A capability that matches the Optimal stage needs to:

1. Work during the session, not just at the start.
2. Check the person, not only the credential or the device.
3. Be passive, so the legitimate user feels nothing and mission tempo holds.
4. Respond in proportion, from monitoring to re-verification to ending a session.
5. Fit what is already there, feeding existing SIEM, identity, and policy systems instead of replacing them.

Mimoto Continuous Verification is made for that role. It confirms the specific person is present all session long, using how they interact with their systems, their device and connection, and the context of the session. It never captures what someone types. It augments existing identity investments, including CAC, PIV, and federation services, and does not replace them.

The honest caveat

The Maturity Model is guidance, not a certification, and no single product moves an organization to a stage by itself. Mimoto supports the continuous checking the Optimal stage describes. It does not claim to be a compliance stamp.