The procurement trap vs. the mandate reality Organizations often spend large capital budgets on redundant tools. Under Executive Order 14028 and OMB M-22-09, and through CISA’s Continuous Diagnostics and Mitigation (CDM) program, federal civilian programs have already been directed to field the foundational capabilities: Endpoint Detection and Response (EDR) that meets CISA technical requirements, centralized identity with phishing-resistant MFA, and complete asset inventories. Enterprise logging is the other half of that investment. OMB M-26-14 (which rescinds M-21-31) and CISA’s Logging Reference Architecture (LRA) (August 2026) treat visibility as an operational discipline: logging must enable Continuous Event Monitoring (CEM) and Threat Hunting, Investigation, Response, and Forensics (THIRF) as one capability—not a tool-enablement exercise. A standalone commercial suite sold to “achieve Zero Trust” often means paying a second time to collect telemetry that EDR, IAM, flow logs, and the SIEM already produce. The gap is not an absence of tools. It is the absence of unified, verifiable proof that existing controls satisfy mission requirements across execution phases and operational boundaries. Stakeholder Need Outcome CEO / CFO Capital efficiency Maximize return on mandated tools; stop redundant six-figure spend. CISO / ISSO Risk and assurance Automate continuous Proof of Delivery (PoD) against NIST SP 800-207 control-plane and data-plane outcomes. SME / Engineering Operations Automate via REST/JSON and SOAR; replace tool sprawl and manual paperwork. Figure 1. AWS-DFD-Visualizer operational swimlanes (cover). NIST SP 800-207 defines two logical planes — control (Policy Engine and Policy Administrator as the Policy Decision Point) and data (Policy Enforcement Point, subjects, resources). Identity and posture feeds are Policy Engine inputs, not a third NIST plane. Non-compliant SSH/22 paths are highlighted for audit. Digital Enterprise Nexus Navigating real-world topologies: one size fits none A monolithic platform cannot secure diverse infrastructure tiers with one blanket policy. A defensible implementation has to address at least three operating realities. Legacy virtual machines, AMIs, and on-premises networks. Static subnets and monolithic workloads still depend on host-level EDR, Port Protocols and Services Management (PPSM), and VPC or firewall flow logs. Zero Trust here means verifying host-to-host lateral movement and proving segmentation boundaries. The LRA’s network-activity baseline is exactly this: source, destination, protocol, port, and session attributes enough to reconstruct paths—not coarse summaries that fail during incident response. Kubernetes, containers, and ephemeral pods. Pods and microservices disappear when a node recycles. Runtime telemetry and non-human workload identities vanish with them. The LRA requires that logging capture important runtime details and non-human identities before ephemeral infrastructure expires or is recycled, so forensic reconstruction remains possible. In Kubernetes, that operationalizes as timely collection of cluster and pod events, runtime metrics, and workload-identity context—before the evidence is gone. SaaS and multi-cloud control planes. Traditional network perimeters do not exist in cloud fabrics. Visibility depends on provider-native audit feeds and APIs. The LRA designates cloud and SaaS administrative activity as a mandatory baseline logging category (LRA §6.2.7): actor, control-plane action, target resource, timestamp, outcome, and request or session context. Ingest those administrative actions and federated identity events into the same pipeline used for CEM and THIRF so privilege escalation and cross-tenant drift can be investigated in cyber-relevant time. Surgical procurement: automate response, do not buy hype Rejecting the procurement trap does not mean refusing to invest where technology is actually required. Manual correlation across REST APIs and JSON objects does not scale during an incident. Capital expenditure is best aimed at orchestration—Security Orchestration, Automation, and Response (SOAR)—when the telemetry pipeline is already trustworthy. NIST SP 800-207 splits the Policy Decision Point into a Policy Engine (the trust algorithm that grants, denies, or revokes) and a Policy Administrator (the component that opens or tears down the path by commanding PEPs). SOAR is not a substitute for the Policy Engine. Used well, it operationalizes Policy Administrator actions: containment, PEP configuration, and an auditable trail of what was enforced. That only works if playbooks are tightly scoped and validated against operational risk tolerances. The LRA is explicit: when SOAR is integrated with a SIEM, workflows depend on accurate normalization, reliable transport, and consistent event fidelity; immature or noisy SIEM pipelines can significantly degrade SOAR performance. NIST similarly warns that automated enforcement fails on false positives and false negatives unless the decision process is retuned. Logical Control Telemetry & Visualization Pipeline_Rev3.jpg Figure 2. Logical control telemetry pipeline. Existing IAM, EDR, flow, and cloud logs ingest into Splunk; Zero Trust Compliance maps DoD execution-roadmap activities and Proof of Delivery; AWS-DFD-Visualizer projects assets for continuous audit. Enterprise compliance hub: Zero Trust Compliance For organizations that already operate an enterprise SIEM, the open-source Zero Trust Compliance app is meant to close the gap between raw machine telemetry and audit-ready evidence. It turns DoD Zero Trust capability execution roadmap activities into structured lookup tables (via the Splunk Lookup Editor) and maps navigation to the seven DoD pillars: User; Device; Application and Workload; Data; Network and Environment; Automation and Orchestration; and Visibility and Analytics. The Splunkbase listing tracks the 152 DoD roadmap activities plus eight foundational telemetry enablers. DoD-oriented extras such as CAC stage-gates are optional for those environments. Any Splunk shop can use the evidence, milestone, and lookup model. Telemetry-driven Proof of Delivery. As engineering teams attach log-based evidence in the app, it compiles a PoD package for ISSO and CISO review. The package is an evidence binder, not a legal determination. Integrated Master Schedule. Detected capability gaps generate Zero Trust milestones so the SIEM you already run becomes a live compliance tracker against the execution roadmap (DoD Target Level remains the end of FY2027). Lightweight path via Microsoft Planner. Teams without a customizable SIEM can load the same JSON outcome definitions into Planner and use native labels for predecessors, successors, and stage (Discovery, Phase 1, Phase 2). Splunk is the automated, telemetry-backed path; Planner is the manual tracking alternative. Real-time architecture visualization: AWS-DFD-Visualizer The companion open-source project, AWS-DFD-Visualizer (v2.8.5), is already published. It renders cloud inventory into audit-oriented topology views designed for NIST SP 800-207 programs and DoD Impact Level 5 (IL5) design targets. An IL5 mention is a design constraint, not an authorization. NIST defines two logical planes, not three: Control plane — Policy Engine, Policy Administrator, and PDP communications used to judge access and set up paths. Identity outcomes, conditional access, credential federation, CDM/EDR posture, and threat intel are inputs to the Policy Engine, not a separate NIST plane. Data plane — Subjects, PEPs, and enterprise resources. Application and service traffic flows here after the control plane establishes the path. The visualizer inspects web tiers, workloads, pods, and storage, and flags non-compliant paths such as unshielded SSH/22 ingress. PEPs must send and receive on both planes: they enforce on the data path and take direction from the Policy Administrator on the control plane. The product’s three operational swimlanes are a visualization overlay for operators. They do not add a third plane to NIST SP 800-207. Staying current: knowledge updates and CNAPP-oriented evolution Hybrid inventories rot. The visualization pipeline uses regular Technology Knowledge Updates (TKUs) to refresh live inventory tags, non-compliant port heuristics, and AWS/Azure/GCP stencil libraries. TKUs are a maintenance mechanism for the visualizer, not a federal control catalog. A later release cycle extends the same evidence model toward Cloud-Native Application Protection Platform (CNAPP) questions—workload posture, container supply chain, and flow integrity—still scored against NIST SP 800-207 and the logging outcomes in the LRA. That is roadmap, not a claim that the current app is a CNAPP. Community-driven build strategy Open source only helps the broader security community if we build what operators actually need: Demand validation. Comments on this post plus download metrics from Zero Trust Compliance and AWS-DFD-Visualizer set priority for new modules. Telemetry-informed roadmap. Feedback decides whether the next increment is SIEM/SOAR analytics or the Planner-style lightweight track. Continuous feedback. Testing across legacy, Kubernetes, and multi-cloud topologies is how parsers, schemas, and DoD/NIST mappings get better for everyone—not only one agency’s stack. Zero Trust is a discipline of continuous evidence, not a procurement race. Buying EDR, IAM, and logging platforms is the preliminary step. Maturity is the ability to map, automate, and prove that those controls satisfy every operational boundary in real time. A shared, telemetry-driven repository for proof of delivery turns tools you already funded into a defensible posture—and it is something the community can build in the open. Sources Executive Order 14028, Improving the Nation’s Cybersecurity OMB M-22-09, Moving the U.S. Government Toward Zero Trust Cybersecurity Principles OMB M-26-14, Ensuring Effective and Efficient Agency Logging and Network Visibility CISA Logging Reference Architecture NIST SP 800-207, Zero Trust Architecture DoD Zero Trust Strategy DoD Zero Trust Capabilities and Activities Zero Trust Compliance (Splunkbase 9582) AWS-DFD-Visualizer (Splunkbase 8628)
... View more
