← Back to Blog
ZTDFDefenseZero TrustData Security

NSA Phase Two Cites ZTDF and IC-TDF as DRM Examples. Procurement Catches Up Next.

By Updated
Lattix branded cover for NSA Phase Two Cites ZTDF and IC-TDF as DRM Examples. Procurement Catches Up Next. /13 section number, ZIG Phase Two metadata, Data Rights Management schema callout, IBM Plex Mono on dark grid background, surgical yellow accent.

The National Security Agency released Phase Two of the Zero Trust Implementation Guidelines on January 30, 2026, covering forty-one activities that support thirty-four capabilities under the Department of War target-level zero trust definition. The phase begins the integration of distinct zero trust solutions across pillars, and it does something Phase One did not. It points components at a data rights management schema.

The sentence sits in the Considerations for Activity 4.5.3, Data Rights Management Enforcement via Data Tags and Analytics Part 1, under Capability 4.5 in the Data Pillar. It states that to achieve interoperability, each participating Component should standardize a Data Rights Management schema, such as Intelligence Community-Trusted Data Format (IC-TDF) or Zero Trust Data Format (ZTDF), to ensure the end products for all Components can decrypt shared files.

Read it precisely, because the precision is the point. This is a recommendation with two worked examples, not a designation, and the guideline says so itself: the implementation recommendations are described as not prescriptive or mandatory, with applicability varying by environment and architecture. That is still the first authoritative federal reference the data-centric conversation has had, and it is enough to write a requirement against. It is not a mandate, and a program office that reads it as one will be corrected by the document.

What the recommendation actually does

The NSA guideline does not invent a standard. ZTDF and IC-TDF predate Phase Two. Virtru open-sourced TDF in 2022, and the Intelligence Community variant has been in operational use across cross-domain workflows since well before that. The guideline's contribution is not a new technical artifact. It is a procurement and architectural reference that program offices, integrators, and vendors can cite without producing the standard themselves.

Three downstream effects follow, and none of them require the language to have been a mandate.

First, FY27 acquisition language for systems that handle data across components now has a schema to reference. The previous default for cross-component interoperability was a custom integration written against a vendor proprietary protocol. The Phase Two language gives the contracting officer a defensible alternative. Solicitations that read "DRM schema shall be IC-TDF or ZTDF" pass written-evaluation criteria without further justification.

Second, vendor capability claims now have a verifiable test. A product that claims to enforce zero trust at the data layer either implements ZTDF or IC-TDF or it does not. Implementation is testable against the published specifications, not against marketing characterizations. The previous default for vendor zero trust claims was a self-attested capability mapping. Phase Two replaces that with a schema check.

Third, agency programs that already deployed alternative DRM patterns now face a decision about migration cost. The migration question is not whether the alternative pattern enforces policy. The question is whether the alternative pattern interoperates with another component that adopts the named schema. Phase Two's interoperability framing makes the schema choice a network effect, not a vendor preference.

Where this aligns with the broader 2026 federal architecture

Phase Two ships into a federal landscape where the data pillar has been undermarked for years. The CISA Zero Trust Maturity Model 2.0 names data as one of five pillars, but most agency programs have hit target maturity on identity, devices, networks, and applications well before data. CISA's April 2026 binding directive locks Q3 and Q4 milestones on the first four pillars while leaving the data pillar implicit. NSA's Phase Two narrows the gap by pointing at the schemas that close it.

The DoD Zero Trust Strategy 2.0, published in early 2026, extends the same target-level maturity expectations to operational technology, IoT, defense critical infrastructure, and weapon systems. The data pillar across these new surfaces is harder than across enterprise IT because the data crosses vendor maintenance access, regulator submissions, and joint-operations boundaries. Cross-component DRM enforcement is the architectural primitive that makes the strategy achievable. The Phase Two schema recommendation is what makes that primitive procurable.

NSA's framing on interoperability is direct. The end products for all components must decrypt shared files. The implication is that the schema is the contract between components, not the property of any single component. That framing matches how the Trusted Data Format was originally designed and how Lattix Technologies builds against it.

What Lattix does with the schema

Lattix Technologies binds policy to the data object through attribute-based access control at the policy enforcement point, post-quantum key encapsulation using ML-KEM-768 and ML-KEM-1024, and Merkle-tree lineage in content-addressed storage. The wrapped object format is ZTDF. The policy enforcement model is ABAC against an attribute set evaluated at access time. The cryptographic envelope binds the wrapping key release to the satisfied policy.

This is the architecture the Phase Two guideline implicitly requires for cross-component data sharing. The architecture handles the interoperability question by construction. A ZTDF object produced by one Lattix-protected component decrypts in another ZTDF-aware component when the requesting attribute set satisfies the policy bound to the object. The decryption check is not a coordination protocol between the components. It is a property of the schema.

The architecture also handles the failure mode that procurement language tends to leave out. If the receiving component is not ZTDF-aware, the object remains ciphertext. The failure is fail-closed, not fail-open. Federal data does not leak through schema mismatch.

There is a second requirement in the same passage that gets less attention and constrains the design more than the schema choice does. The guideline says DRM solutions should use an unencrypted wrapper so that data cataloging services can scan and categorize files appropriately. That rules out a design where the entire object is opaque until a key is released, because a catalog that cannot read anything cannot index anything. ZTDF satisfies it by construction: the manifest carrying labels, assertions and key access information sits outside the encrypted payload, so a cataloging service reads the metadata and never touches the content. A vendor whose format encrypts the wrapper as well can satisfy the schema sentence and still fail the sentence after it.

Where this lands in the next twelve months

NSA has signaled additional phases of the implementation guidelines on a rolling cadence. The pattern of Phase One in January and Phase Two later in January suggests follow-on phases through 2026 and into 2027. Each phase is expected to deepen the activities mapping under the target-level zero trust definition and to surface additional capability outcomes that procurement language can reference.

The schema recommendation in Phase Two is the central pivot for the data pillar across this cadence. Vendors with a schema-aligned product line are positioned for the FY27 solicitation cycle. Vendors without one will be writing migration roadmaps against the acquisition language that the Phase Two reference enables. The schema is now the procurement question, not the architecture question.

References

← Back to Blog