The National Archives and Records Administration (NARA) will be rolling out a zero trust network access (ZTNA) solution as part of the next step of the agency’s zero trust implementation journey, an agency official said on Feb. 6.
Nicole Willis, Deputy Chief Information Officer (CIO) at NARA, discussed how the agency has been working to advance zero trust efforts while simultaneously dealing with limited funding and resources during an event organized by NextGov/FCW.
“We are rolling out a zero-trust network access solution. We’re looking at replacing our private access or VPN access and then rolling out internet access,” said Willis. “As I said, we have constrained financial resources, so we’re looking at building this out in phases.”
“We’ve started with a small group of people and we’re testing it out and then looking at seeking funding to expand the use,” Willis said. “We are also building our monitoring [and] logging capabilities, and really improving our observability, and really being able to have more insight across all of our assets,” she said.
As the Federal government’s primary agency for storing and maintaining government documents, NARA is looking to take a “balanced” approach in implementing zero trust measures across the organization.
“We’re really looking to utilize our existing resources and look at where we can improve access to information while ensuring that we are protecting all of the information,” said Willis.
“We have a bit of technical debt, so we are modernizing the set of legacy applications on low code and cloud platforms, and we’re really looking at kind of balancing, building our zero trust capabilities and modernizing our applications and our cloud platforms while building zero trust into those solutions and really kind of making sure we’re maximizing the use of our resources and all of our solutions,” she added.
Willis said the agency is also looking at maturing its identity management capabilities, and learn more about how users are accessing the agency’s information including what types of devices they are using.
“We’re really building [the technology] within our zero trust journey in mind to … being really able to tailor access and use contextual risk-based methods to really streamline access to information,” said Willis.
