Secure Network Infrastructure & Cyber Defense

The older model granted trust on the basis of network location, so anything already inside the boundary was treated as legitimate. Zero trust replaces that assumption with per-request verification, on the premise that an attacker may already be operating inside the network.

Because authorization moves from the network edge to the individual request, identity, device posture, and segmentation have to carry the access decisions that perimeter controls previously made, which is a substantially larger engineering scope than deploying a gateway.

GAO reviewed eight systems across the Departments of State, Transportation, and Veterans Affairs and the Small Business Administration in 2026, and found that three had fully implemented the cloud security practices it examined, with the remaining five implemented only partially.

The specific gaps were consistent across the agencies reviewed: monitoring plans existed but the deliverables that providers supplied under them were not always reviewed, most agencies had not documented procedures for coordinating incident response and recovery with their providers, and for three systems the service agreements did not define how performance would be measured or what would follow if it was not met.

GAO has made more than 4,400 cybersecurity recommendations to federal agencies since 2010, of which over 730 remained open as of February 2026, including 48 it designated as priority recommendations for department and agency heads.

Authorization decisions belong at the identity layer, evaluated per request against a verified identity, using phishing-resistant authentication where the environment supports it and managed service identities in place of shared secrets stored in configuration files.

Segmentation policy has to remain maintainable by the team that operates it, because a model that operations staff cannot reason about will be widened by exception until it no longer constrains anything.

Detection depends on network, host, identity, and application telemetry being normalized into a single place, so that an analyst is not correlating across four consoles while an incident is in progress.

We begin with an inventory of what is actually deployed, because asset and identity inventories are usually incomplete and a design built on an incomplete inventory will leave gaps that were never accounted for.

We design segmentation together with the staff who will operate it, so that policy changes can be made through normal operations rather than requiring a project each time.

We review monitoring deliverables from cloud providers on a defined schedule and assign that review to a named individual rather than to the team in general, which is the gap GAO found across the agencies it examined.

We write incident response procedures with the provider included in scope, and exercise them before an incident rather than assembling them during one.