Zero trust is a design rule, not a product

What a review should ask

Can a stolen password alone reach the important system, or is there a second check? Does a laptop on the office network skip controls that a laptop at home must pass? Are administrative paths quieter, and less logged, than user paths? Those differences are where implied trust still lives. A purchase order does not answer them. A diagram of the request does.

Analysis

Security programs get tired of the phrase because vendors exhausted it. The fatigue is fair and the underlying rule is still the right default for systems that no longer have a perimeter you can draw. Use the NIST publication as the vocabulary in the design review, and make vendors map their product onto that vocabulary. If they cannot, you are buying something else. Name that something else honestly.

What SP 800-207 is not

It is not a control catalog you can tick in an afternoon, and it is not a cloud-provider feature. Later NIST work builds on it. The 2020 document remains the one to read before the product demo, not after the contract.