Glossary term
Zero Trust
Also: Zero-Trust Architecture, ZTA
A security model built on the principle that no user, device or network location is trusted by default. Access is continuously verified against identity, device posture, context and policy, regardless of whether the request comes from inside or outside the corporate network.
Zero Trust is a model, not a product. It is composed of capabilities across IAM, device management, network segmentation, data protection and continuous monitoring. Vendors selling Zero Trust typically cover one or two layers; no single product delivers it end to end.
The practical question in a Zero Trust decision is sequencing. Most programmes start with identity and device, move to network (ZTNA replacing VPN) and finish with data and workload controls. The memo should name the stage, the target state and the criteria for moving on, not treat Zero Trust as a single binary.
In practice
Regulatory context: NIS2 Art. 21 and DORA Art. 9 do not name Zero Trust, but their access-control and least-privilege expectations align closely. A Zero Trust programme maps directly to these articles as the operating model.
Related terms
IAM (Identity and Access Management)
The stack of systems that governs who has access to which systems under which conditions. IAM covers authentication, single sign-on, lifecycle management, access governance (IGA) and privileged access management (PAM), and is the most commonly breached control in enterprise environments.
Sovereign cloud
A cloud deployment model that guarantees operational, legal and technical control of data and workloads within a specific jurisdiction (typically the EU). Sovereign cloud answers the concern that hyperscaler deployments remain exposed to foreign jurisdiction, primarily the US CLOUD Act.
Compliance mapping
The explicit link between a decision (vendor, architecture, control) and the specific regulatory articles, controls or standards it satisfies. Without compliance mapping, a memo cannot be defended under audit against a named clause.
AI Act Conformity Assessment
Procedure to demonstrate that a high-risk AI system complies with the EU AI Act before being placed on the market or put into service. Mandatory for all Annex III high-risk systems from 2 December 2027 (postponed from the original 2 August 2026 by the Digital Omnibus, Regulation (EU) 2026/1744).
AI Act Risk Categories
Four-tier classification under the EU AI Act: prohibited (Art. 5), high-risk (Annex I/III), limited risk (Art. 50 transparency), minimal risk. Classification is the first duty; it must be documented and defensible.
Audit-ready decision
A decision whose record is structured, evidence-backed and stakeholder-signed to a level that a third-party auditor, a supervisor or a board reviewer can reconstruct the reasoning without interviewing the original team.
BAIT
BaFin circular that concretises IT requirements for credit institutions. Specifies MaRisk AT 7.2 for IT strategy, information security, user permissions, project management, application development, and IT outsourcing.
BCM
Discipline for maintaining critical business processes during disruptions. Standards: ISO 22301, BSI Standard 200-4. Mandatory under BAIT/VAIT and DORA Art. 11 in the financial sector.