Which standards require a zero trust architecture standard?

ISO/IEC 27001:2022: 8.27, 8.22.

What must a zero trust architecture standard contain under ISO 27001?

8.27: Establish and apply secure engineering principles to system development. 8.22: Segregate groups of services, users and systems in the network. The ISO 27002 guidance beside 8.27: Requires principles for engineering secure systems to be established, documented and maintained, then applied across all information system development work.

Who should own the zero trust architecture standard?

The clauses imply the head of engineering or the CTO. The register names the role so the line on your list can carry a name.

How often should a zero trust architecture standard be reviewed?

Annual (the register's default: the clauses say planned intervals and on significant change, and do not fix a period).

Is there a template for a zero trust architecture standard?

Yes: https://compliance.theartofservice.com/policy-templates/zero-trust-security-policy

Every policy type · Operations and technology

Zero trust architecture standard

The architectural principles for verifying every request explicitly, granting least privilege and assuming breach, and where they are applied.

How the register reads it

Also called	ZTA standard
Family	Operations and technology
Document type	Standard. The regimes ask for the content, not the label; a line pasted as a standard, procedure, plan or schedule is placed here with the label noted.
Folds into	The regimes accept it folded into the network security policy; when neither is listed, the gap is counted once, under the parent.
Expected owner	The head of engineering or the CTO.
Review cadence	Annual (the register's default: the clauses say planned intervals and on significant change, and do not fix a period).
On the gap list when	never on its own: the register recognises it and names the clauses, but no ticked regime lists it as a separate document (its parent, network security policy, is).
Template	Zero trust security policy.

Which standards require it, and what each expects it to contain

2 requiring clauses, 1 regimes

Shown on a register for the regimes you tick; with none ticked, ISO 27001 is applied. Requirement text drawn from a human-verified compliance corpus under licence: the corpus statement of each clause, not the instrument verbatim.

ISO/IEC 27001:2022

ISO 27001 8.27 Secure system architecture and engineering principles

Establish and apply secure engineering principles to system development.

What the ISO 27002 guidance expects the document to say: Requires principles for engineering secure systems to be established, documented and maintained, then applied across all information system development work.

Evidence an auditor accepts: The documented secure engineering principles, such as defence in depth, least privilege, secure defaults, fail secure and minimising trust; evidence of maintenance, showing the principles are reviewed against current technology and threat; design documentation for systems delivered in the period showing the principles were applied
Common gap: Design reviews not documented
Source: ISO/IEC 27001:2022; guidance ISO/IEC 27002:2022

ISO 27001 8.22 Segregation of networks

Segregate groups of services, users and systems in the network.

What the ISO 27002 guidance expects the document to say: Requires segregation within the organisation's networks, keeping groups of information services, of users and of systems apart from one another.

Evidence an auditor accepts: The segregation design, showing the defined zones and the criteria placing systems, services and users into each; enforcement evidence at each boundary, such as firewall rules, access control lists or micro segmentation policy; evidence of segregation for wireless, guest, third party, management and operational technology networks
Common gap: Informal or outdated network maps used instead of documented diagrams
Source: ISO/IEC 27001:2022; guidance ISO/IEC 27002:2022

Do this for every document on your list

Paste the list and get this reading for every document at once, with the owner and cadence against each, the clauses quoted, and the documents the regimes expect that the list does not carry. Eight documents free, no account.

Build a register

Wireless network standard · Cloud vendor management policy