The National Cybersecurity Standardisation Technical Committee opened a consultation on a national standard for zero trust capability maturity on 17 June 2026. The consultation closes on 16 August 2026. If you implement zero trust architecture, or sell technology billed as zero trust, the comment window shuts in five days. I read the scope with some care because the model and its evaluation method are the two parts that usually make or break a security standard.
Zero trust capability maturity is a way of rating how far an organization has moved from perimeter security to a model that assumes breach. The standard defines stages. Most maturity models in security follow the CMM structure: initial, repeatable, defined, managed, optimized. Each stage has criteria an organization has to meet before it can claim that level. The innovation in this standard is tying the maturity model to an evaluation method. That combination is what separates a scorecard from a measurement system.
The evaluation method is the part I care about. A maturity score means nothing if the evidence gathering is loose. The method has to specify what artifacts count: policy documents, configuration baselines, logs, incident response records. It also has to say who evaluates and how they verify. If an organization can self-assess and submit a spreadsheet, the score is a marketing number. The standard's credibility rests on this section.
My worry with maturity models is that they reward process maturity over security outcomes. A team can have mature change management and still put every service on the same flat network. Zero trust is about reducing implicit trust. Those two goals pull in different directions. The evaluation weight matters. If the standard weights process artifacts at 70 percent, most organizations will optimize for paperwork. If it weights evidence of actual trust reduction, the score tracks something real. I have not seen the final weights, but the consultation documents likely include the draft criteria. That is what you want to review.
The scope statement says the standard applies to organizations implementing zero trust cybersecurity technologies. That is broad. It will touch procurement, audits, and possibly certification schemes. Vendors in the Chinese market should expect customers to ask for a maturity score against this model. That changes how products get sold. A product can no longer claim zero trust by name; it has to demonstrate a maturity level under the evaluation method. For procurement teams, this standard gives a common language. Instead of comparing marketing claims, they compare maturity levels and the evidence behind them.
There are real costs. Maturity assessments take staff time. The evaluation method will require documentation that many security teams do not keep today. Small organizations without a dedicated security function will find the defined level expensive to reach. That does not mean the model is wrong; it means the standard creates an economic incentive to hire or purchase upward. I expect a market for zero trust assessment services to grow out of this.
What should you do before the consultation closes?
Comment if you have evidence that the evaluation method disincentivizes real security. The committee is taking input until 16 August 2026. Even a short comment citing a control base you have observed matters more than a general statement. Two questions worth testing: does the method accept automated evidence, and does it distinguish between inherited controls and direct implementation?
Audit your current controls against the draft levels. You likely have strong identity verification and some microsegmentation. Find the gaps between where you are and the defined level. That gap analysis is your implementation backlog. The model is not a compliance checkbox; it is a roadmap. Treat the levels as a sequence of investments, not a single deadline.
Build an evidence trail now. Logs, configs, policy review records. The evaluation method will reward organizations that can produce these quickly. Start collecting them before the standard is final. Automation helps here. If your configuration management system already emits baseline reports, you are ahead of most teams. If you rely on manual spreadsheets, start converting that process.
I am not convinced the model will change security posture on its own. Standards like this have a way of producing scores that everyone hits. The defense-in-depth history is full of checklists that organizations satisfied without improving actual outcomes. But the evaluation method can change that if it demands outcome evidence. Whether it does depends on the final text. The consultation closes on 16 August 2026. Check the committee's page before Sunday and make your case. Reading the draft takes an afternoon. Commenting takes another. That is a small cost for shaping a standard that will define zero trust for years.