Operationalizing Zero Trust in Resource-Constrained Public-Sector and Social-Service Organizations: A Maturity Assessment Model Aligned to NIST SP 800-207, CISA ZTMM 2.0 and NIST CSF 2.0

Zero Trust has become the reference model for public-sector cybersecurity, but its main guidance documents were written for large federal agencies and well-resourced enterprises. Child-welfare agencies, community health providers, Indigenous service organisations, municipalities and school boards hold some of society's most sensitive personal information. Yet they typically operate with a handful of IT staff, outsourced or shared infrastructure, legacy systems and tight budgets. Existing Zero Trust maturity models offer such organisations little help in deciding where to start, what "good enough" looks like, or how to measure progress.This paper develops the Zero Trust Maturity Model for Resource-Constrained Organisations (ZT-RC) using a design-science approach to maturity model construction. It first builds a crosswalk between NIST SP 800-207, the CISA Zero Trust Maturity Model 2.0 and the NIST Cybersecurity Framework 2.0. It then consolidates their requirements into six domains and four maturity levels, adds an explicit recovery capability that the Zero Trust models underemphasise, and defines a sufficiency target rather than an open-ended pursuit of optimal maturity. The model includes twelve low-effort key performance indicators, a weakest-link scoring rule and an impact-relevance-effort prioritisation heuristic that turns assessment results into a phased roadmap. An illustrative application to a composite child and family service agency shows how the model directs scarce resources first to identity, recovery and asset visibility. The paper discusses implications for agencies, shared-service providers and funders, and sets out a validation agenda.