feat: add NIST SP 800-207 Zero Trust Architecture skill

[sjackson0109]

NIST SP 800-207 — Zero Trust Architecture

Source: NIST Special Publication 800-207, August 2020
CSRC: https://csrc.nist.gov/publications/detail/sp/800-207/final

---

Files Added

plugins/nist-sp-800-207/
  .claude-plugin/
    plugin.json
  skills/
    nist-sp-800-207/
      SKILL.md
      references/
        zta-components.md
        deployment-approaches.md
        migration-guide.md

---

Framework Coverage

1. Zero trust definition: no implicit trust based on network location, physical location, or asset ownership; all access independently validated
2. Seven ZTA tenets from SP 800-207 Section 2: all resources treated as resources; all communications secured; per-session access grants; dynamic policy based on observable state; continuous device posture monitoring; dynamic authentication and authorisation; telemetry collection and analytics
3. ZTA logical components: Policy Engine (PE), Policy Administrator (PA), Policy Enforcement Point (PEP) with full data flow architecture
4. PE trust algorithm: criteria-based (Boolean policy rules), score/confidence-based, historical behaviour-based (ML) approaches with trust score weighting across 7 input sources
5. PA functions: session establishment, credential distribution, session maintenance, session termination
6. PEP types: inline gateway/proxy, split-component (subject-facing/resource-facing), resource-native (service mesh sidecar)
7. Three deployment approaches: Enhanced Identity Governance (EIG), Microsegmentation, SDN/Software-Defined Perimeter (ZTNA)
8. EIG implementation: IdP centralisation, phishing-resistant MFA, identity-aware proxy, device posture integration, continuous session revocation
9. Microsegmentation: workload flow mapping, policy design, enforcement mechanism selection (host-based agent, hypervisor, cloud-native, service mesh), monitor-only to enforce lifecycle
10. SDN/ZTNA: SDP architecture, ZTNA vs. legacy VPN comparison, agent-based vs. agentless ZTNA, SDN dynamic network segmentation
11. Four deployment scenarios: employee enterprise resource access, remote/BYOD, service-to-service/workload, third-party/contractor
12. ZTA threats: credential compromise, DoS against PE/PA, control plane compromise, visibility gaps, insider threat, supply chain attacks on ZTA components
13. ZTA migration roadmap: four phases (Foundation 0-6mo, First ZTA Controls 6-12mo, Broad Coverage 12-24mo, Optimise 24+mo)
14. CISA Zero Trust Maturity Model v2.0 alignment: five pillars (Identity, Devices, Networks, Applications/Workloads, Data), four maturity stages per pillar (Traditional, Initial, Advanced, Optimal)
15. SP 800-53 Rev 5 control alignment: AC-2, AC-3, AC-4, AC-17, AC-20, AU-2, AU-3, IA-2, IA-3, IA-5, SC-3, SC-7, SC-8, SC-39, SI-4

---

Reference Files

zta-components.md

• Full ZTA logical architecture: data flow from subject through PEP to resource
• PE design requirements: high availability, isolation, fail-open/closed policy
• Trust algorithm input sources: identity provider signals, device health/compliance, network location, resource requested, historical behaviour, threat intelligence, time-of-day factors
• PA session lifecycle: credential issuance, session keepalive, revocation triggers
• PEP types and technology examples (identity-aware proxy, microsegmentation platform, service mesh)
• Supporting components: IdP, CDM system, threat intelligence feeds, SIEM, PKI, UEBA
• ZTA component inventory template and coverage gap assessment template

deployment-approaches.md

• Approach 1 EIG: step-by-step with technology options at each step
• Approach 2 Microsegmentation: enforcement mechanism comparison table; monitor-only to enforced lifecycle
• Approach 3 SDN/ZTNA: ZTNA vs VPN comparison table; agent-based vs. agentless guidance; 7-step ZTNA deployment
• Hybrid approach matrix mapping environment layer to recommended ZTA approach
• Recommended adoption sequence for federal agencies

migration-guide.md

• ZTA current-state assessment checklist across all five ZTMM pillars
• Four-phase migration roadmap with activities, owners, and success criteria per phase
• CISA ZTMM v2.0 full five-pillar four-stage alignment matrix with SP 800-207 alignment notes
• SP 800-53 Rev 5 control alignment table (14 controls across AC, AU, IA, SC, SI families)
• ZTA threat mitigation mapping (8 threat categories to ZTA controls)
• ZTA terms and definitions glossary (15 key terms)

---

Integration Points

• SP 800-63B: authentication assurance levels (AAL1/2/3) determine identity signal quality for the ZTA trust algorithm
• SP 800-53 Rev 5: ZTA implements and contributes to AC, IA, SC, SI, AU control families
• SP 800-37 Rev 2: ZTA architecture decisions are made during the RMF system design phase
• SP 800-137: continuous monitoring telemetry from ZTA components feeds ISCM programme
• CISA ZTMM v2.0: five-pillar maturity model for measuring and advancing ZTA implementation
• EO 14028: federal ZTA mandate; NIST SP 800-207 is the designated primary technical reference

---

Tests

python -m pytest tests/test_plugin_structure.py -v -k "nist-sp-800-207"

test_plugin_json_exists[nist-sp-800-207] PASSED
test_plugin_json_is_valid[nist-sp-800-207] PASSED
test_plugin_json_required_fields[nist-sp-800-207] PASSED
test_plugin_version_semver[nist-sp-800-207] PASSED
test_skills_directory_exists[nist-sp-800-207] PASSED
test_skills_directory_has_one_skill_folder[nist-sp-800-207] PASSED
test_skill_md_exists[nist-sp-800-207] PASSED
test_skill_md_not_empty[nist-sp-800-207] PASSED
test_no_files_outside_skill_folder[nist-sp-800-207] PASSED
test_references_are_markdown[nist-sp-800-207] PASSED

10 passed, 95 deselected