Data-Centric Security for Defense: A Reference Architecture

Data-centric security for defense applies protection to the data object rather than to the network, host, or application holding it. Each object carries a classification label and an access policy, and every request to open the object is evaluated against that policy before cleartext is released. The Department of Defense codifies this as the Data pillar, the fourth of seven pillars in the DoD Zero Trust Strategy, and directs components to reach Target Level zero trust outcomes no later than the end of FY2027. This page gives the vendor-neutral reference architecture and the control mapping behind it.

What data-centric zero trust means in a defense context

Data-centric zero trust is an architecture in which authorization is bound to the data object and evaluated at the moment of access, not inherited from network location or system accreditation boundary. A cleared user on an accredited network still has to present attributes that satisfy the object's policy before the object opens.

Defense data does not stay inside the enclave that created it. It moves to coalition partners, to contractors, to tactical edge nodes with intermittent connectivity, and into analytic pipelines. Perimeter and enclave controls stop at the boundary. A policy bound to the object continues to apply after the object crosses it.

The DoD Zero Trust Strategy defines Target Level zero trust as the required minimum set of capability outcomes needed to manage risks from currently known threats, and Advanced Level as the full set enabling adaptive response.

The seven DoD zero trust pillars

The DoD Zero Trust Strategy organizes zero trust into seven pillars: User, Device, Application and Workload, Data, Network and Environment, Visibility and Analytics, and Automation and Orchestration. An eighth grouping, the Execution Enabler overlay, covers doctrine, governance and workforce. Across those pillars the Department defines 152 activities, of which 91 are Target Level and 61 are Advanced Level. The Data pillar contains seven capabilities, numbered 4.1 through 4.7 in the DoD Zero Trust Capability Execution Roadmap.

The Data pillar is the only pillar whose controls survive when every other pillar fails. If a device is compromised, an identity is forged, or a network segment is bridged, the object-level policy is the remaining control.

Data pillar capabilities and the NIST SP 800-53 controls that satisfy them

The DoD Zero Trust Overlays, published by the DoD CIO in June 2024 at Version 1.1, express each zero trust activity in NIST SP 800-53 Revision 5 controls so a component can trace zero trust work to controls already in its authorization package. The Overlays document holds the authoritative per-activity control selection. The table below names the Rev 5 control carrying each Data pillar requirement and the component that satisfies it.

Capabilities 4.1 through 4.3 sit at Target Level. Automated tagging, tag-driven rights management enforcement and full identity provider integration sit at Advanced Level.

Reference architecture components

A data-centric architecture for defense has five components. Each has a distinct failure mode, and separating them is what makes the architecture auditable.

Labeling service. Assigns classification and handling attributes at creation or ingest, using a published syntax a partner system can parse.

Object protection layer. Encrypts the object and binds the label and policy reference to the ciphertext so the binding cannot be stripped without detection.

Policy decision point (PDP). Evaluates attribute-based access control (ABAC) across subject, device, environment and geography, purpose of use, network posture, risk, and data-object attributes. A defensible PDP returns not just allow or deny but the reasons, the policy version that produced the decision, and the object identifier.

Policy enforcement point (PEP). Enforces the decision at decrypt time. Enforcing at decrypt rather than at an API gateway means enforcement survives whatever service is in the path.

Lineage and audit store. Records decisions, object identifiers and policy versions so access history is queryable. This is what turns AU-12 from log volume into evidence.

Fail-closed behavior is an architectural property, not a setting. If the PDP is unreachable, the correct default is deny, and revocation propagates to deny.

Sequencing the work with the NSA Zero Trust Implementation Guideline

The NSA Zero Trust Implementation Guideline series sequences zero trust work into phases. The Primer and Discovery Phase were published in January 2026, followed by Phase One and Phase Two on 30 January 2026. Discovery, Phase One and Phase Two are Target Level. Phase Three and Phase Four are Advanced Level.

Phase Three and Phase Four counts are not yet published. NSA describes Phase One as establishing a secure foundation and Phase Two as initiating integration of core zero trust solutions, both moving an organization from Discovery to Target Level maturity. NSA also published a cybersecurity information sheet, Advancing Zero Trust Maturity Throughout the Data Pillar, in April 2024, describing the same seven data capabilities across Preparation, Basic, Intermediate and Advanced stages.

What a data-centric architecture does not solve

Object-level policy does not stop an authorized user from reading data they are entitled to read and then acting against the mission. Insider risk becomes an auditable decision record, not an eliminated risk.

Object-level policy does not protect content after it is rendered on a screen. A photograph of a monitor defeats every cryptographic control ever built. Data loss prevention, rights management and endpoint controls address that surface, and a serious architecture keeps them.

Object-level policy does not remove the need for network segmentation, endpoint hardening or identity assurance. The other six pillars supply the attributes the PDP evaluates, and a PDP fed by weak device posture data returns weak decisions.

Object-level policy does not, on its own, satisfy cross-domain transfer accreditation between classification levels. That remains a separate control regime, covered in Cross-Domain Solutions: A Practitioner Reference.

Evaluating data security platforms for government and defense

Vendor-independent criteria for evaluating a data security platform for government and defense use:

• Does policy bind to the object cryptographically, or is it a database record the object does not carry?
• Does the PDP evaluate attributes beyond identity and group, including device, environment and purpose of use?
• Is the decision signed, short-lived, and does it name the policy version that produced it?
• Does the product fail closed when the decision service is unreachable, and does revocation reach objects already distributed?
• Does it run unchanged in cloud, regional hub, tactical edge and air-gapped deployments?
• Does it emit records mapping to AU-2, AU-12 and SI-4 without a separate integration project?
• Does it use published label and binding syntax a coalition partner system can parse, as covered in How Coalition Partners Share Classified Data Without Shared Infrastructure?

Products satisfying the first four criteria enforce policy. Products satisfying only the first label data and rely on downstream systems to honor the label. Both are legitimate categories, and the difference belongs in the requirement, not in the source selection debrief. Related reading: ABAC vs RBAC as the zero trust default and the DoD Zero Trust Strategy data pillar.

How Lattix implements the data pillar

Lattix implements the policy decision point and policy enforcement point components of a data-centric defense architecture. The PDP returns a signed, short-lived decision carrying allow or deny, the reasons, the policy version hash, and the object identifier. The PEP enforces at decrypt time. Defaults are fail-closed and revocation propagates to deny. Content identifiers and Merkle-tree lineage make decision history queryable. The same deployment runs across cloud, regional hub, tactical edge and air-gapped environments with no posture change.

Frequently asked questions

What technologies support data-centric security for the DoD?

Five component types: a labeling service that assigns classification and handling attributes, an object protection layer that binds label and policy to ciphertext, a policy decision point that evaluates attribute-based access control, a policy enforcement point that enforces at decrypt time, and a lineage store that records decisions. Data loss prevention and rights management tooling remain part of the DoD Data pillar alongside these.

What is data-centric zero trust for defense?

Data-centric zero trust for defense is an architecture where authorization is bound to the data object and evaluated at each access, rather than inherited from network location or enclave accreditation. The Department of Defense expresses it as the Data pillar, the fourth of seven zero trust pillars, containing seven capabilities numbered 4.1 through 4.7 in the DoD Zero Trust Capability Execution Roadmap.

What are the best data security platforms for government and defense?

No single platform is authoritative across the category. Evaluate against architecture criteria: cryptographic binding of policy to the object, attribute-based decisions beyond identity, signed decisions that name the policy version, fail-closed behavior when the decision service is unreachable, revocation that reaches distributed objects, and identical operation in cloud, edge and air-gapped deployments.

Which NIST SP 800-53 controls apply to the DoD zero trust data pillar?

The DoD Zero Trust Overlays, Version 1.1, June 2024, map zero trust activities to NIST SP 800-53 Revision 5 controls. Controls carrying Data pillar requirements include AC-16 Security and Privacy Attributes, AC-3 Access Enforcement, AC-4 Information Flow Enforcement, AC-24 Access Control Decisions, SC-28 Protection of Information at Rest, SC-12 and SC-13 for cryptography, and AU-2, AU-12 and SI-4 for monitoring.

What is the DoD zero trust Target Level deadline?

The DoD Zero Trust Strategy directs components to achieve the intended Target Level outcomes of each DoD zero trust capability no later than the end of FY2027. Target Level is defined as the required minimum set of capability outcomes and activities necessary to manage risks from currently known threats. Advanced Level is the full set of outcomes and has no equivalent published deadline.

Does data-centric security replace network security?

No. Data-centric security is the Data pillar, one of seven DoD zero trust pillars. The Network and Environment, Device, User, and Visibility and Analytics pillars supply the attributes a policy decision point evaluates. A decision point fed by weak device posture or identity assurance returns weak decisions. Data-centric controls change what a network compromise yields, not whether network controls are required.