Zero Trust Architecture: What UK CISOs Must Build in 2026

UK CISOs must now treat zero trust architecture as a baseline delivery obligation — not a future aspiration — with NCSC guidance, DORA, and the UK Cyber Security and Resilience Bill all pointing in the same direction.

Zero trust is an architectural approach that removes inherent trust from the network, assumes the network is hostile, and requires every access request to be verified based on explicit policy — regardless of whether it originates inside or outside the corporate perimeter. The NCSC has published specific design principles for zero trust network architecture; DORA requires financial services firms to implement ICT security controls consistent with zero trust principles by its enforcement deadlines; and the UK Cyber Security and Resilience Bill, expected to receive Royal Assent in 2026, will extend mandatory security standards to a significantly wider range of organisations. According to Gartner, only 10% of large enterprises will have a fully mature zero trust programme by end of 2026 — up from less than 1% in 2023. UK CISOs who are not yet in active implementation are already behind the curve.

Why Is Zero Trust Architecture Now a Regulatory Expectation for UK CISOs?

Three regulatory frameworks are converging on zero trust as the standard of care for UK enterprise cybersecurity in 2026. First, the NCSC’s Zero Trust Architecture design principles — updated and reinforced through 2025 — set out eight principles that the NCSC recommends all UK organisations implement, regardless of size or sector. These include: knowing your architecture; knowing your users, services, and devices; assessing behaviour and trust; using policies to authorise requests; and monitoring everything. Second, the Digital Operational Resilience Act (DORA), which applies to financial services firms in scope from 17 January 2025, requires ICT security frameworks that align with zero trust concepts including strict access controls, network segmentation, and continuous monitoring of ICT systems and third-party providers. Third, the UK Cyber Security and Resilience Bill extends mandatory incident reporting and security requirements to a wider set of digital service providers and critical infrastructure operators — raising the baseline across the economy.

According to research by Just Cyber Security, 2026 is “the year to make the shift” to zero trust, with the convergence of regulatory pressure, increasing threat sophistication, and the maturation of ZTNA (zero trust network access) technology making implementation more achievable than at any previous point. Organisations successfully deploying ZTNA reduce security breaches by 68%, reduce lateral movement by 80%, and cut incident response times by 60%, according to analysis from multiple implementation studies. Use INFORMD’s cybersecurity readiness assessments to benchmark your current architecture against zero trust maturity.

• Executive Action: Commission an immediate zero trust maturity assessment against the NCSC’s eight design principles — establish your baseline before setting a programme delivery timeline.
• Map your DORA ICT security framework requirements against zero trust implementation — identify where DORA compliance obligations accelerate your ZTA delivery timeline.
• Present a zero trust architecture roadmap to the board by Q3 2026 — include the regulatory drivers, current maturity position, implementation timeline, and investment requirement.

What Are the NCSC’s Eight Zero Trust Design Principles for UK Enterprises?

The NCSC’s zero trust design framework provides UK CISOs with a structured set of principles for implementing zero trust network architecture at enterprise scale. The eight principles are: know your architecture (including users, devices, services, and data); know your user, service, and device identities; assess the behaviour and trust of users, devices, and services continuously; use policies to authorise every access request; authenticate and authorise everywhere, not just at the network perimeter; focus monitoring on users, devices, and services; don’t trust any network, including your own internal network; and choose services designed for zero trust.

The NCSC’s guidance emphasises that zero trust is not a single product or technology — it is an architectural philosophy that must be embedded across identity management, device management, application access, network segmentation, and monitoring. UK CISOs who approach zero trust as a technology procurement exercise — buying a ZTNA vendor solution without addressing the underlying architecture — will achieve partial protection at best. Full zero trust implementation typically takes eighteen to thirty-six months for a large enterprise, requiring phased delivery across identity, device, application, and network domains. Access INFORMD’s cybersecurity framework templates to structure your zero trust implementation programme.

• Executive Action: Adopt the NCSC’s eight principles as the governing framework for your zero trust programme — use them as both a design guide and an audit checklist for each implementation phase.
• Begin with identity: implement multi-factor authentication and privileged access management as the foundation of zero trust before addressing network segmentation or application access controls.
• Engage the NCSC’s Cyber Advisor scheme or an NCSC Assured Service Provider to validate your zero trust architecture design before committing to major infrastructure investment.

How Should UK CISOs Structure a Zero Trust Implementation Programme?

Zero trust implementation follows a phased approach structured around five domains: identity, device, application, network, and data. Most large UK enterprises should plan for an eighteen-to-thirty-six month programme, delivered in phases that each deliver measurable security improvement while building towards architectural maturity. The first phase — identity and access management — typically delivers the highest immediate risk reduction: implementing strong multi-factor authentication, privileged access management, and conditional access policies blocks the credential-based attack vectors that account for the majority of enterprise breaches.

The second phase focuses on device trust: ensuring that every device accessing corporate systems is known, managed, and continuously assessed for compliance with security policy before access is granted. This is the area where legacy device estates and bring-your-own-device policies create the greatest complexity. The third phase addresses application access — replacing VPN-based broad network access with application-specific access controls that enforce least-privilege principles. The NCSC’s guidance on zero trust explicitly notes that organisations should “not trust any network, including their own” — meaning that applications should be accessible based on verified identity and device posture, not network location. The fourth and fifth phases — network segmentation and data classification — typically require longer lead times and more significant investment, but deliver the architectural completion of a zero trust programme. Explore INFORMD’s executive briefing library for further guidance on cybersecurity programme delivery.

• Executive Action: Structure your zero trust programme as five sequential phases (identity, device, application, network, data) with defined milestones, investment cases, and measurable security outcomes for each phase.
• Prioritise MFA deployment across all users and privileged access management for all administrative accounts as Phase 1 deliverables — these are the highest-impact, fastest-to-deploy zero trust controls.
• Establish a zero trust programme steering group with CISO leadership and representation from IT, Legal, HR, and Finance — zero trust affects every part of the enterprise and requires cross-functional sponsorship to succeed.

How Does Zero Trust Align with DORA and the UK Cyber Resilience Bill?

For financial services firms, DORA’s ICT security requirements create a clear alignment with zero trust architecture. DORA requires firms to implement ICT access management controls that ensure only authorised users can access ICT systems and data; to monitor ICT systems and third-party ICT providers continuously; to maintain network segmentation that limits the impact of ICT incidents; and to test ICT resilience through regular programmes including penetration testing and red-teaming. These requirements are, in effect, a mandate for zero trust implementation — firms that have mature zero trust architectures will find DORA compliance significantly more achievable than those relying on perimeter-based security models.

The UK Cyber Security and Resilience Bill extends similar obligations to a wider set of organisations beyond financial services, including managed service providers, digital infrastructure operators, and data centre providers. UK CISOs in these sectors should treat the Bill’s expected passage in 2026 as an additional driver for zero trust acceleration, not a separate compliance workstream — the security architecture required to meet the Bill’s obligations is the same architecture zero trust delivers. The most efficient path is to build zero trust as the enterprise security standard and use that architecture to demonstrate compliance with DORA, the UK Cyber Resilience Bill, and the NCSC’s guidance simultaneously. Use INFORMD’s contact page to connect with our advisory team on cybersecurity governance and compliance alignment.

• Executive Action: Map your zero trust implementation phases against DORA’s ICT security requirements — use the mapping to demonstrate dual-purpose compliance progress to regulators and the board.
• Engage legal counsel on the UK Cyber Security and Resilience Bill’s scope — confirm whether your organisation falls within the expanded definition of in-scope entities and what additional obligations will apply.
• Include zero trust maturity as a standing metric in your board cyber risk report — it provides a meaningful, forward-looking measure of security programme progress that complements incident-based reporting.

INFORMD provides intelligence briefings, tools and frameworks for senior business leaders across technology, finance, strategy and compliance. Based in Milton Keynes, UK, we help executives stay informed and act with confidence. Explore our full briefing library or access our free assessment tools.

Stay ahead. Subscribe to INFORMD’s weekly executive briefing at informd.co.uk.