Open Group's Zero Trust Reference Model Targets Spring 2026, Reshaping Vendor RFPs

Reference Model Gives Buyers Architecture Clarity

The Open Group's Zero Trust Architecture working group is developing a reference model and standard for zero trust deployments, with the first iteration expected in spring or summer 2026 and a related certification program to follow. This matters for enterprise buyers because it creates a vendor-neutral framework to evaluate how identity, device, and policy enforcement components integrate — reducing architecture risk and strengthening RFP language.

The move favors vendors that can map their products directly to a recognized reference model. It pressures tool-only offerings that cannot explain how they fit an enterprise architecture. For procurement teams, the reference model provides a clearer way to compare multi-vendor zero trust deployments without relying on vendor claims alone.

NIST Remains the Baseline, But Standardization Is Fragmenting

NIST's SP 800-207 still defines zero trust architecture for most enterprise buyers, providing deployment models and use cases centered on continuous verification, least privilege, and policy-based access. The NIST model has become the de facto yardstick for cutting through vendor ambiguity — procurement teams can use it to tie spending to specific controls rather than broad claims.

But the Open Group's work signals that standardization is fragmenting. Different frameworks will create different evaluation lenses. Buyers with public-sector exposure will face additional pressure: GSA continues to frame zero trust as a procurement and federal security issue, treating all networks and traffic as potential threats. This reinforces compliance-driven demand and increases the value of products that align with government procurement expectations. Zero trust requirements are showing up in contract language and security questionnaires, not just security roadmaps.

Market Size Confirms Multi-Year Budget Commitments

The global zero trust architecture market was estimated at $28.99 billion in 2023 and is projected to reach $85.45 billion by 2030. A second estimate puts the market at $40.2 billion in 2025. The divergence reflects a crowded, fast-expanding market with overlapping categories: SASE, IAM, microsegmentation, and network security platforms all claim zero trust positioning.

For buyers, the size and growth trajectory signal that zero trust remains a budget line item for large enterprises, not a pilot-only initiative. Expect bundling pressure from major platform vendors and price competition from point products. The market's scale also means that procurement teams have leverage — vendors need reference customers and are willing to negotiate on roadmap commitments and integration guarantees.

What This Changes for Procurement

The Open Group's reference model will give procurement teams a structured way to ask vendors how their products fit an enterprise zero trust architecture. It will make it harder for vendors to claim "zero trust" without explaining their role in identity federation, device posture enforcement, or policy-based access control.

For buyers evaluating zero trust deployments in 2025, this means waiting for the reference model before finalizing multi-year architecture commitments carries real risk. The standard is at least a year out, and zero trust budgets are being committed now. The better approach: use NIST SP 800-207 as the baseline evaluation framework and require vendors to explain their roadmap alignment with the Open Group's emerging standard.

What to Watch

The Open Group's reference model release in spring or summer 2026 will clarify which vendors can demonstrate architectural fit and which are selling point products with zero trust marketing. Buyers should track whether the certification program gains traction with major platform vendors — if it does, it will become a procurement requirement. If it does not, it signals that the market remains too fragmented for a single standard to take hold.

In the near term, expect platform vendors to accelerate bundling. The market size and growth rate mean that consolidation pressure is building. Buyers should evaluate whether their current zero trust architecture can absorb acquisitions without rework.