How Government Agencies Can Enforce Zero-Trust Security with Keeper

Zero trust is a cybersecurity framework built on the principle of “never trust, always verify,” meaning every user, device and session must be continuously verified for access to be granted and maintained. In federal environments, zero trust is especially critical because privileged accounts can provide access to sensitive systems, infrastructure and data. Government agencies can enforce zero-trust security by adopting an identity security platform with Privileged Access Management (PAM) that continuously authenticates access requests, enforces least-privilege access and provides real-time visibility into privileged activity.

Continue reading to learn how agencies can secure privileged access with an identity security platform and how Keeper^® applies zero-trust principles to protect access across federal and enterprise environments.

Why zero-trust security is important for government agencies

Zero-trust security is no longer simply a recommendation for government agencies; it’s federally mandated. Executive Order 14028, issued in 2021, directed agencies to modernize their cybersecurity practices, including adopting a zero-trust architecture. In 2022, the Office of Management and Budget (OMB) issued Memorandum M-22-09, ordering federal civilian agencies to meet specific zero-trust security requirements and implement them across their environments. The Department of War (DoW) also released its Zero Trust Strategy in 2022, outlining its plan to fully implement an enterprise-wide, zero-trust cybersecurity framework by September 2027. As the DoW moves towards implementation, there are still gaps around data visibility, identity governance — especially for Non-Human Identities (NHIs) and AI agents — and applying zero-trust to legacy and operational systems. These mandates and strategies demonstrate a shift away from traditional perimeter-based security toward a data-centric model.

Since federal environments are now distributed across on-premises, hybrid and cloud systems, it is essential to continuously verify every user, device and session. Federal systems support public services, national security operations and sensitive data, meaning a single compromised privileged account can lead to lateral movement, operational disruption or unauthorized access to classified information. Zero trust helps agencies reduce risk, enforce granular access controls and meet federal requirements at scale.

The pillars of zero trust in federal environments

The Cybersecurity and Infrastructure Security Agency (CISA) defines zero trust through five pillars in its Zero Trust Maturity Model. Here are the ways PAM plays a role across all five pillars of zero trust:

Pillar of zero trust	What it means for federal agencies	How PAM supports it
Identity	Verify employees, third-party vendors, contractors, machines and AI agents before granting access	Enforces strong authentication and time-limited, role-based access
Devices	Ensure both government-issued and personal endpoints are trusted before granting access	Restricts privileged access on unmanaged or unfamiliar devices
Networks	Secure access beyond traditional perimeter-based models	Works with Zero-Trust Network Access (ZTNA) to secure identity-based connections
Applications and workloads	Protect access across on-premises, hybrid and cloud systems	Secures sessions and enables credential injection
Data	Secure sensitive and classified data	Enforces least privilege and logs all privileged activity

Challenges federal agencies face when adopting zero trust

Implementing zero trust across federal environments is complex due to legacy systems, strict compliance requirements and distributed infrastructure.

Legacy systems limit modern authentication

Many agencies still rely on legacy systems that do not support modern authentication like Multi-Factor Authentication (MFA). Updating these systems can be difficult and risky since changes could disrupt critical operations. For example, systems supporting citizen records or benefits processing often run on older on-prem infrastructure that cannot easily integrate with modern controls, creating exploitable security gaps.

Complex compliance requirements

Federal organizations must comply with frameworks such as the Federal Information Security Modernization Act (FISMA) and meet authentication requirements informed by NIST Special Publication 800-63B. Defense organizations and contractors must also meet the Cybersecurity Maturity Model Certification (CMMC), which applies to those protecting Controlled Unclassified Information (CUI) under DoW contracts. Proving least-privilege access and maintaining audit trails are typically manual and tedious processes that require significant time and resources.

Decentralized, multi-cloud environments

Federal IT environments are very decentralized, spanning on-prem and cloud platforms with remote users and third-party contractors distributed across regions. This perimeterless architecture makes it challenging to enforce consistent access controls and maintain visibility across supply chains, increasing the risk of misconfigurations and unauthorized access.

Unmanaged privileged credentials increase risk

Privileged credentials grant access to critical systems, including public service infrastructure, financial systems and identity platforms. If compromised, they can enable cybercriminals to move laterally and access sensitive data, such as citizens’ records or health information. Without proper controls in place, compromised privileged accounts with broad administrative access can jeopardize the security of critical systems and sensitive data.

Benefits of a zero-trust PAM solution for government agencies

While zero trust requires users and devices to be continuously verified, PAM ensures that privileged access is closely monitored, controlled and limited. The main benefits of implementing a zero-trust PAM solution in federal environments include:

• Reduce the attack surface by eliminating standing access: Grant access only when necessary and for a limited time via Zero Standing Privileges (ZSP), minimizing the number of exploitable accounts.
• Prevent credential-based breaches with granular access controls: Enforce least-privilege access, secure privileged credentials and reduce the risk of credential theft and lateral movement.
• Achieve continuous compliance with real-time visibility: Gain centralized session monitoring, audit trails and reporting to FISMA, NIST and CMMC requirements.
• Improve operational efficiency with centralized access management: Streamline policy enforcement and provisioning while reducing manual processes and the risk of human error.
• Secure hybrid and multi-cloud environments: Apply uniform access controls and visibility across on-prem, hybrid and cloud systems.

How Keeper enables zero-trust security for federal agencies

By consolidating enterprise password management, secrets management, privileged session management and endpoint privilege management into a FedRAMP High Authorized, cloud-native platform, Keeper enables agencies to secure critical systems and control privileged access across the entire supply chain.

Enforce zero trust across legacy and modern systems

Many federal organizations rely on a mix of legacy and modern systems, making consistent security enforcement challenging. Keeper addresses this through encrypted session brokering via the Keeper Gateway, enabling secure access without exposing credentials or requiring infrastructure changes. In addition, agencies can enforce MFA across all systems, including legacy environments that don’t natively support it, while keeping credentials hidden from end users. This allows federal organizations to apply zero-trust controls to outdated legacy systems without disrupting operations.

Implement least privilege with Just-in-Time (JIT) access

Keeper supports zero-trust security by enforcing least-privilege access through Just-in-Time (JIT) provisioning. Instead of granting standing access, privileges are assigned based on role and context for a limited time and are automatically revoked when no longer needed. This helps eliminate standing access, reduce the risk of insider threats and minimize opportunities for cybercriminals to exploit privileged accounts.

Simplify compliance with privileged session management

Keeper provides session monitoring and recording across privileged sessions, capturing screen and keyboard activity for full visibility. Organizations should verify that session recording practices align with applicable agency policies and federal workforce monitoring requirements before deployment. All privileged activity is logged and can be integrated with SIEM tools. KeeperDB extends zero-trust controls to database access through credential injection. Users connect to databases directly from the Keeper Vault without the underlying credentials ever being exposed. This helps federal agencies protect sensitive data and support compliance with FISMA, NIST SP 800-53 and CMMC.

Strengthen Zero-Trust Network Access (ZTNA)

Keeper extends secure access by enabling identity-based connections without traditional Virtual Private Networks (VPNs). Keeper replaces traditional Zero-Trust Network Access (ZTNA) solutions, enabling agencies to ensure users are authenticated and authorized before accessing systems from any location. When combined with PAM, ZTNA ensures both secure access and tight control over user actions within systems.

Extend zero trust to endpoints

Zero-trust security must extend beyond infrastructure to include devices. Keeper Endpoint Privilege Manager enforces least privilege at the endpoint level across Windows, macOS and Linux systems. By removing persistent, broad administrator rights and enabling task-based privilege elevation, agencies can minimize the risk of insider threats and prevent unauthorized changes.

Detect threats in real time with KeeperAI

KeeperAI analyzes privileged sessions in real time using advanced behavioral analytics to detect suspicious activity and classify risk levels. Administrators can configure automated responses, including session termination, based on defined risk thresholds, with controls in place to minimize false positives and support human review. When high-risk activity is detected, KeeperAI can automatically terminate a session before potential cyber threats escalate, helping federal organizations respond faster to security incidents and minimize the impact of cyber attacks.

Enhance federal cybersecurity with Keeper

EO 14028 and OMB M-22-09 established zero trust not as a best practice but as a federal requirement. Meeting those mandates across legacy infrastructure, distributed cloud environments and a complex compliance landscape requires a platform purpose-built for federal security. Keeper is FedRAMP High Authorized and designed for today’s federal and enterprise environments, enabling agencies to enforce least privilege and secure access across legacy and cloud infrastructure. To see how Keeper can help your agency enforce zero-trust security and gain real-time visibility into privileged activity, request a demo.