Identity, authorization and zero trust: standards that apply

The 2 standards listed for identity, authorization and zero trust in the registry, each with its status, UNI (Unique Nexus Identifier) and the rules stated in its text.

Back to Identity, authorization and zero trust All programme areas

01NS-11

Verification and monitoring (evidence, attestations, zero-trust conformance observation)

Status proposed · trust, authorization and assurance · NXS-STD-ST-000007

Rule	Text
`NS11-R1`	A conformance statement shall rest on an attestation, and an attestation shall name an evaluator, a mandate, evidence references and a digest.
`NS11-R2`	Under zero trust, subject and evaluator shall be distinct, and production evaluations shall run outside the subject's trust boundary.
`NS11-R3`	Missing or unresolvable evidence shall yield INDETERMINATE or REFUSED, never PASS (NS0-P12).
`NS11-R4`	Attestations shall be append-only and superseded rather than changed; monitoring records shall be observations with record UNIs.
`NS11-R5`	Every displayed conformance value shall carry its evaluation instant and its evaluator; projections shall not store verdicts.
`NS11-R6`	Exports to Verifiable Credentials, in-toto or PROV-O are crosswalks; the Nexus attestation shall remain the record of truth.

Read NS-11 in full

02Earth observation

Electrified and connected activity in Southeast Asia

The map frames Southeast Asia as an example geography for identity, authorization and zero trust; the frame gives context and is not a statement of where the standards apply. Shown at first: night-time lights, daily (VIIRS Black Marble, VNP46A2, NASA LAADS DAAC) and population density, 2020 (Gridded Population of the World v4.11, NASA SEDAC, CIESIN, Columbia University). The layer drawer adds true colour (VIIRS NOAA-20 corrected reflectance). NASA products are served through NASA GIBS under NASA's open data policy, with acknowledgement; population density is GPW v4.11 by CIESIN, Columbia University, under CC BY 4.0; coastlines, boundaries and place names come from NASA GIBS reference layers (© OpenStreetMap contributors, ODbL) and Natural Earth (public domain). Each layer shows its own observation date; full credits are given under the map. Other sources of the profile, such as FIDO Metadata Service (MDS3) and CISA Known Exploited Vulnerabilities catalogue, are listed for reference.

The interactive map needs JavaScript; the layer list and sources are below.

Layers 2

Connected activity

Latest available

NASA GIBS / EOSDIS · ASTER GDEM (METI, NASA) · Blue Marble (NASA) · © OpenStreetMap contributors (ODbL) · Natural Earth

Loading the latest NASA imagery.

Drag to move. Ctrl or ⌘ and scroll, pinch or the buttons to zoom; hover for the values under the pointer; reset returns to the region.

Connected activity, framed on Southeast Asia. Layers as NASA publishes them, each with its own date.Satellite and model products as NASA publishes them, each with its own date; indicators, not assessments of any place.

Data: NASA GIBS · ASTER GDEM · Blue Marble · © OpenStreetMap contributors · Natural EarthSources and licences

We acknowledge the use of imagery provided by services from NASA's Global Imagery Browse Services (GIBS), part of NASA's Earth Science Data and Information System (ESDIS). Colours redrawn from the published colour map; values averaged into H3 cells where shown (modified). NASA open data
We acknowledge the use of imagery provided by services from NASA's Global Imagery Browse Services (GIBS), part of NASA's Earth Science Data and Information System (ESDIS). Colours redrawn from the published colour map; values averaged into H3 cells where shown (modified). NASA open data
VIIRS Black Marble night-time lights, NASA Goddard Space Flight Center; distributed by the NASA Level-1 and Atmosphere Archive and Distribution System (LAADS DAAC); imagery via NASA GIBS. Colours redrawn from the published colour map; values averaged into H3 cells where shown (modified). NASA open data
Center for International Earth Science Information Network (CIESIN), Columbia University. 2018. Gridded Population of the World, Version 4 (GPWv4): Population Density, Revision 11. NASA Socioeconomic Data and Applications Center (SEDAC). Licensed under CC BY 4.0. Colours redrawn from the published colour map; values averaged into H3 cells where shown (modified). doi:10.7927/H49C6VHW. CC BY 4.0
VIIRS near-real-time products (flood, land surface temperature, snow cover, corrected reflectance), NASA LANCE; imagery via NASA GIBS. Colours redrawn from the published colour map; values averaged into H3 cells where shown (modified). NASA open data
ASTER GDEM is a product of METI and NASA (ASTER Global Digital Elevation Model V003, NASA LP DAAC); imagery via NASA GIBS. Colours redrawn from the published colour map; values averaged into H3 cells where shown (modified). Cite as: NASA/METI/AIST/Japan Spacesystems and U.S./Japan ASTER Science Team (2019). ASTER Global Digital Elevation Model V003. doi:10.5067/ASTER/ASTGTM.003. NASA open data
Made with Natural Earth. Free vector and raster map data @ naturalearthdata.com. Public domain
© OpenStreetMap contributors (ODbL), via NASA GIBS (coastlines, boundaries, roads and place names). Colours redrawn from the published colour map; values averaged into H3 cells where shown (modified). ODbL
Blue Marble, NASA Earth Observatory; imagery via NASA GIBS. Colours redrawn from the published colour map; values averaged into H3 cells where shown (modified). NASA open data
Context on the globe and flat map: coastlines, boundaries, roads and place names from NASA GIBS reference layers (OpenStreetMap data, ODbL, © OpenStreetMap contributors); Blue Marble imagery as an optional base; 3D terrain and the elevation read-out from the ASTER GDEM elevation colour index (5 m to 200 m classes, exaggerated for legibility). Boundaries are drawn as published and imply no position on any territory.
Globe: MapLibre GL JS 6.9.1, BSD-3-Clause, © MapLibre contributors.
NASA GIBS: We acknowledge the use of imagery provided by services from NASA's Global Imagery Browse Services (GIBS), part of NASA's Earth Science Data and Information System (ESDIS).
Optional layers (3 sources in the layer list: live, forecast, observed and context) print their provider credit on the map and here when switched on; forecasts are model output and derived indices are estimates.

Layers and dates

Night-time lights, daily: VIIRS Black Marble (VNP46A2), NASA LAADS DAAC · 12 Oct 2026
Population density, 2020: Population: CIESIN, Columbia University, Gridded Population of the World v4.11 (2018), NASA SEDAC, CC BY 4.0 · static
True colour: VIIRS NOAA-20 corrected reflectance, NASA LANCE · 13 Oct 2026

03NS-10

Policies and clauses (machine-readable obligations: definition, binding, evaluation and enforcement)

Status proposed · trust, authorization and assurance; integrated posture and executive synthesis · NXS-STD-ST-000006

Rule	Text
`NS10-R1`	Every obligation that an implementation enforces shall be a clause with a UNI; code may implement a rule, but no rule shall be enforced without a clause record that names it.
`NS10-R2`	Subjects shall be contextual UNIs; names, labels or free text shall not bind.
`NS10-R3`	The predicate shall be data in a declared language; evaluators shall record the engine and its version; two conformant evaluators shall reach the same result for the same clause and the same inputs.
`NS10-R4`	External obligations shall be cited, not copied.
`NS10-R5`	Failure effects shall be typed; `refuse` is the default for `blocking` clauses in production contexts.
`NS10-R6`	A clause or policy whose `legalState` is other than `APPROVED` may be evaluated, but its results shall be displayed as claims under review.
`NS10-R7`	Policies and clauses shall be append-only artifacts: withdrawal and supersession keep the record.

Read NS-10 in full

04Questions

Questions and answers.

Are these all the rules for identity, authorization and zero trust?

They are the rules stated by the listed standards. The principles of NS-0 bind every standard; clauses specific to the area, where needed, are written under NS-10 and evaluated under NS-11.

What does a rule identifier such as NS1-R5 denote?

The number of the standard and the number of the rule within it. Rule identifiers are stable so that clauses, attestations and publications can cite them.

NRNexus Reports gateway · GW-STD

Contribute to Nexus Reports from this page.

Nexus Reports is the Consortium's quarterly publication. What you know about this subject can become evidence, a case or a correction in the next edition, credited to you and published under CC BY 4.0 where it is your own work.

Nexus Standards

Never send personal data, sensitive infrastructure detail or anything you have no right to share. A contribution is reviewed before use; sending it confers no authorship or editorial rights, and sponsorship never buys a finding.

Across the Consortium

The same subject across the Consortium.

Around Identity, authorization and zero trust.

Nexus Standards

Shape the standards for identity, authorization and zero trust.

Governments, regulators, standards bodies, industry, academia and communities are invited to shape the catalogue ahead of its first official release, targeted for 2030: comment on a draft, propose a change, join a working group or host a field exercise.

Propose a change Roadmap to 2030 Adopt and implement

Status and use. The Nexus Standards are proposed standards developed through an open process under NS-13 and published for voluntary use; they do not constitute certification, accreditation or regulatory approval, and adoption remains a decision of the Global Standards Council and, in each country, of its National Standards Council. A UNI (Unique Nexus Identifier) identifies an artifact; it does not certify it. Names of standards bodies and their standards belong to their stewards and are used only to identify the documents; no text of an external standard is reproduced here. Nexus Standards is not affiliated with, endorsed by or certified by any standards body named here.

Licences: CC BY 4.0 for standards text, registries, schemas and data; Apache-2.0 for reference code. External standards are cited by name, number and link under their own licences. Third-party data, libraries and fonts keep their own licences: see Third-party notices.