JAJSolutions – IT Consulting & Systems Engineering
Cybersecurity & Zero Trust Engineering Runbook Advanced

Zero-Trust Network Architecture (ZTNA) & CMMC Level 2 Compliance Runbook

A step-by-step engineering runbook for transitioning traditional perimeter LANs to micro-segmented Zero-Trust architectures meeting DoD CMMC 2.0 and NIST SP 800-171 controls.

JAJSolutions Defense Security Practice • Last Verified: 2026-10-18 • 15 min read
Key Architectural Outcomes
  • Elimination of legacy site-to-site VPN tunnels in favor of identity-aware, device-posture-verified tunnels.
  • FIPS 140-3 validated encryption applied across both data-at-rest and data-in-transit.
  • Hardware security keys (FIDO2 / WebAuthn) mandated for all administrative endpoints.
  • Granular VLAN isolation separating Controlled Unclassified Information (CUI) systems from standard IoT and guest networks.

1. Compliance Scope & Regulatory Baselines

The Department of Defense (DoD) Cybersecurity Maturity Model Certification (CMMC) Level 2 mandates strict adherence to NIST SP 800-171 Rev 2 (110 controls). Legacy castle-and-moat perimeter models fail to prevent lateral movement once a single internal device is compromised. Zero-Trust Network Architecture (ZTNA) treats every internal network packet as untrusted, enforcing continuous identity validation and device posture assessment prior to granting access to sensitive assets.

2. Architecture Comparison: Perimeter vs. ZTNA

code
[LEGACY MODEL]
Internet ---> [Firewall/VPN] ===(Full Internal LAN Trust)=======> [Servers / Databases / CUI Assets]

[ZTNA IMPLEMENTATION]
User + Device ---> [Identity Provider + MFA]
                       |
                       v (Continuous Posture Check)
                 [ZTNA Controller]
                       |
                       +---> [Micro-Segment A: Web Tier] (Isolated)
                       +---> [Micro-Segment B: CUI Database] (mTLS Only)
                       +---> [Micro-Segment C: IoT / Facility] (Strict Deny)

3. Network Microsegmentation & Switchport Security

1. VLAN Segmentation Hierarchy: * VLAN 10 (Management / OOB): Restrict access strictly to designated jump boxes using hardware FIDO2 keys. * VLAN 20 (CUI Enclave): No direct internet routing. Access granted exclusively through identity-aware reverse proxies. * VLAN 30 (Corporate Workstations): Posture-checked client endpoints only. Lateral workstation-to-workstation traffic dropped via Private VLAN (PVLAN) port isolation. * VLAN 90 (Facility IoT & Surveillance): Air-gapped IoT network with firewall rules preventing communication with enterprise subnets. 2. Cisco / EdgeSwitch Port Isolation Syntax:
text
interface GigabitEthernet0/12
 description Workstation Port - PVLAN Isolated
 switchport mode private-vlan host
 switchport private-vlan host-association 100 101
 spanning-tree portfast
 spanning-tree bpduguard enable

4. Identity & Access Management (IAM) Controls

  • FIDO2 Hardware Token Requirement: Passwords and SMS/TOTP codes are disallowed for administrative access. YubiKey 5 Series or equivalent cryptographic hardware keys are enforced via WebAuthn.
  • Continuous Conditional Access:
    • * Device compliance status (BitLocker / LUKS encryption verified active). * Antivirus / EDR agent healthy and reporting within last 15 minutes. * IP geolocation restricted to authorized territories (CONUS & Puerto Rico).
    Back to Knowledge Catalog Return to Top ↑