Zero trust is far from easy to define, let alone implement. NIST (the US National Institute of Standards and Technology) refers to accurate, per-request access decisions, based on the idea that your network has been compromised. The main concept is 'never trust, always verify'. Every request to connect is verified, taking into account attributes such as identity, location and device, following the principle of least privilege access and only to explicitly authorised resources.