FY2027 Is Here: What the DoD Target-Level Zero Trust Deadline Requires and Where Programs Must Act

What the October 2022 Strategy Set in Motion

The DoD Zero Trust Strategy, dated October 21, 2022, and its companion Capability Execution Roadmap established two tiers: Target Level (91 activities, due by the end of FY2027) and Advanced Level (all 152 activities, which DoD officials have set for FY2032). Those activities span seven pillars — User, Device, Applications and Workloads, Data, Network and Environment, Automation and Orchestration, and Visibility and Analytics — across 45 capabilities.

The two-tier structure was deliberate. Target Level sets a minimum cybersecurity floor that closes the most exploited attack surfaces: lateral movement enabled by implicit trust in flat networks, unvalidated device access, and inconsistent identity enforcement. Advanced Level builds toward continuous verification at every layer. The gap between the tiers — 61 additional activities — covers advanced behavioral analytics, automated response, and persistent telemetry collection that makes an enterprise architecture genuinely self-defending rather than gatekeeping at the perimeter.

By the DoD CIO's activity table, Data carries the most Target activities (17 of 91), while Network and Environment carries the fewest (10). Count is not effort, though: the network activities include SDN and macro- and micro-segmentation, which require architectural change rather than configuration alone.

DTM 25-003: What the July 2025 Directive Added

Directive-type Memorandum 25-003, "Implementing the DoD Zero Trust Strategy," signed July 17, 2025 (incorporating Change 1, September 2, 2025), converted the strategy's aspirational language into mandatory requirements with specific governance structures. Its key operational additions:

ZT Portfolio Management Office (ZT PfMO): Formalized by the DTM as the DoD lead for ZT execution. Components submit implementation plans (I-Plans) annually to the DoD CIO through the ZT PfMO, and the Chief ZT Officer reviews and approves them.
Chief Zero Trust Officer: A designated role at the DoD CIO level, no lower than Senior Executive Service, responsible for orchestrating DoD-wide ZT execution.
DoD Cybersecurity Hardening Scorecard: The DoD CIO uses this scorecard (on SIPRNet) to track ZT implementation and outcomes; Components provide data for it on request.
I-Plan annual review cycle: Every Component submits an I-Plan annually, and requests for deviations, exceptions or delays go in that plan with a plan of action and milestones.
Cyber assessment teams: The DTM directs that Cyber Assessment Teams (red and blue) evaluate ZT environments and report the level achieved — the same validation mechanism that makes an I-Plan defensible beyond documentation.

The DTM carried an expiration date of July 17, 2026 — which has passed — and was written to either expire or convert to a permanent DoD Instruction. As of publication, no replacement DoDI or extension notice had been published on the DoD Issuances site, though the status should be verified by program counsel before treating specific DTM provisions as currently binding. The underlying authorities from the DoD CIO and the NDAA directing the strategy are not affected by the DTM's expiration. Component I-Plans submitted under DTM 25-003 guidance remain the documented record and the basis for ZT PfMO review.

Target Level Across Seven Pillars: The Three Structural Challenges

The seven-pillar framework is well understood. Where programs consistently encounter difficulty is not in understanding the pillars but in resolving three cross-pillar dependencies that multiple activities depend on simultaneously.

ICAM (Identity, Credential and Access Management). In April 2024, then-DoD CIO John Sherman said the department was still evaluating options for a federated enterprise ICAM solution. By November 2024 it had chosen federation: the DoD CIO's ICAM Federation Framework requires an enterprise ICAM Federation Hub, and a companion memo set end-FY2025 for non-financial systems to onboard to a DoD-approved identity provider and end-FY2027 for automated account provisioning and a master user record to meet Target Level, with financial-reporting (ICOFR) systems required to onboard to an approved ICAM solution by end-FY2026. ICAM is the foundation the User and Device pillars are built on. For programs that have not yet completed onboarding to an approved identity provider, that onboarding is the upstream dependency that must be documented in the I-Plan — it is a dependency on a DoD-directed timeline, not a gap the Component closes independently.

Micro-segmentation at the application layer. The Network and Environment pillar's Target Level activities require micro-segmentation at the application and workload level, not just perimeter or VLAN-level isolation. Implementing software-defined perimeters and enforcing least-privilege access to individual services requires both network architecture redesign and application inventory work. The challenge is operational, not conceptual: running micro-segmentation implementation in parallel with active operations while managing exception processes that keep production systems running throughout the transition.

Data tagging and classification. The Data pillar's Target Level activities require that data be tagged for access control policy enforcement. For programs with large legacy document stores and databases that have never been classified at the object level, this represents a data governance exercise that must precede the technical ZT controls. Organizations that have not begun data inventory and tagging work are likely to find Data pillar activities the slowest to close in FY2027.

Operational Technology and Weapon Systems: Provisional Clocks

The 2022 Strategy set no separate OT timeline, and the November 2025 DoW CIO guidance on ZT for OT sets no deadline either. In December 2025, the ZT PfMO's senior advisor publicly cited FY2030 for OT Target Level and FY2033 for OT Advanced Level, while cautioning that those dates could change in the forthcoming Zero Trust Strategy 2.0. He said weapon-system and defense-critical-infrastructure deadlines were still being developed. That date is not yet in an issuance: the DoW CIO's OT guidance itself reads DTM 25-003 as directing Target Level across control systems and OT, so programs should not treat FY2030 as relief until the ZT PfMO or Strategy 2.0 confirms it in writing.

The DoW CIO's Zero Trust for OT Activities and Outcomes, cleared for release in November 2025, adapts the seven-pillar framework to OT with 105 activities (84 Target, 21 Advanced), including air-gapped and process-control environments. On October 8, 2026, NSA followed with Hardening DoW Critical OT Environments with Zero Trust Principles, identifying 26 high-impact Target activities as a practical starting point for programs beginning ZT on legacy OT.

For weapon systems program managers, scope delineation belongs in the I-Plan. I-Plans should distinguish enterprise IT on the DoDIN (FY2027 Target Level under DTM 25-003), OT and control systems governed by the OT activity set, and weapon-system internals — for which DoD has said separate guidance and deadlines are still in development. DTM 25-003 already requires I-Plans to cover weapon systems and defense-critical infrastructure, so the starting point is scoping and tracking rather than a decision to defer.

What the NSA Zero Trust Implementation Guidelines Mean for Programs

The NSA released two foundational documents from its Zero Trust Implementation Guidelines (ZIGs) series on January 14, 2026: a Primer and a Discovery phase guide. Phase One and Phase Two guidelines followed on January 30, 2026, completing the Target-level ZIG set. Discovery is the structured precursor to implementation: establishing foundational visibility of data, assets, applications, and services (DAAS) and their access and authorization activity, covering 14 activities across 13 capabilities. It is the prerequisite that makes activity tracking in an I-Plan defensible under review.

For programs that have not yet completed Discovery, this is the right starting point. Without a documented understanding of the current trust surface, activity completion claims in an I-Plan cannot be validated against an independent baseline. A program reporting Target Level activities as "in progress" without completed Discovery work is tracking on a basis that the ZT PfMO's annual review is designed to examine closely.

The 11-Month Decision Window

For program managers and CIOs running FY2027 acquisition and sustainment cycles, September 30, 2027 is not a future planning horizon — it is the fiscal year end of this year. Decisions with 18-month or longer implementation cycles have already missed the FY2027 deadline unless contract vehicles or task orders are already in execution. The decisions that can still close the gap fall into three categories:

Configuration and policy actions executable with existing tools. PKI certificate enforcement, MFA expansion to remaining user populations, EDR coverage expansion to remaining endpoints, log centralization to existing SIEM infrastructure. These can close in FY2027 with directed resource allocation and clear ownership. The constraint is usually organizational, not technical.

Acquisition actions still executable in time. Micro-segmentation platform implementation, Privileged Access Management (PAM) tooling, User and Entity Behavior Analytics (UEBA) deployments. If a program is not yet at contract execution on these, the realistic path is documented partial completion with a ZT PfMO-visible gap closure timeline — not a last-minute acquisition that produces unvalidated configuration by September 30.

Directed-timeline dependencies that require documentation. Onboarding to an approved ICAM provider and federation through the enterprise Hub, which DISA was tasked to stand up by end-FY2025. DTM 25-003's I-Plan guidance requires Components to document deviations, exceptions, and delays with a plan of action and milestones. A program whose Component ICAM onboarding is behind the memo's FY2025 identity-provider milestone should document that in the annual I-Plan with a remediation path — an I-Plan that overstates completion and fails ZT PfMO review is a worse outcome than one that accurately identifies a constraint and demonstrates a defensible response.

The activities in the third category are not planning failures — they are the honest accounting the ZT PfMO review process exists to surface. The error is treating them as closeable through creative activity interpretation rather than through the dependency resolution they actually require.

DTM 25-003 directs that Cyber Assessment Teams evaluate ZT environments and report the level achieved. For program offices and CIOs navigating Target Level validation and ZT PfMO review, that assessment is both a requirement and a readiness tool: it tests whether micro-segmentation rules actually contain lateral movement, confirms that behavioral analytics detect the threats they're configured to detect, and generates the operational evidence that distinguishes a completed Zero Trust activity from a configured one. Spartan X's Colosseum cyber and space range is built to support exactly this kind of red/blue assessment against ZT architectures.

What the October 2022 Strategy Set in Motion

DTM 25-003: What the July 2025 Directive Added

Target Level Across Seven Pillars: The Three Structural Challenges

Operational Technology and Weapon Systems: Provisional Clocks

What the NSA Zero Trust Implementation Guidelines Mean for Programs

The 11-Month Decision Window

Sources and further reading

More from Signal

CMMC Phase 2 Is Suspended — What the Reform Task Force Means for Program Offices and the Defense Industrial Base

Deploying AI Securely in Defense Programs: Applying the NSA–CISA–FBI Joint Guidance

OT Zero Trust: What Defense Suppliers Should Build Into Their Next Delivery

Ready to Solve Hard Problems?