Aquia Completes Deployment Supporting HHS Rollout of Zero Trust Maturity Framework Scoring Tool

WASHINGTON, Oct. 26, 2026 -- Aquia Inc., a digital services firm helping the government modernize systems and processes, has completed the department-wide rollout of a custom-built Zero Trust Maturity Framework (ZTMF) scoring tool across the U.S. Department of Health and Human Services (HHS). The application, originally developed through Aquia’s work supporting the Centers for Medicare & Medicaid Services (CMS), has been expanded to support zero trust maturity reporting across HHS operating divisions (OpDivs).

The rollout took three months from contract award to go-live and replaces the manually maintained spreadsheets HHS agencies had used to answer federal zero trust data calls required under the Office of Management and Budget (OMB) Memoranda M-22-09, M-24-14, and Executive Order 14028. For the first time, HHS can compare zero trust maturity across OpDivs using a single scoring method and track it over time.

“Spreadsheet-driven security data calls are often riddled with inaccuracies, become stale essentially instantly, and are limited in their ability to drive real, meaningful insights into zero trust security posture,” said Allison DiPietro, senior vice president of delivery at Aquia. “The ZTMF tool centralizes data capture and creates a real-time platform for accurate, standardized, targeted maturity assessments that help ISSOs know exactly where their systems stand today, and where they need to grow in their zero trust journeys.”

Originally developed through work supporting CMS and launched in 2023, the tool is now used by 1,200 users to report on roughly 1,300 Federal Information Security Modernization Act (FISMA) systems. Its 40-question assessment is a tailored interpretation of the Cybersecurity and Infrastructure Security Agency’s Zero Trust Maturity Model v2. Questions are reframed around the environments, platforms, and tools each agency’s teams operate in, with distinct versions for cloud, hybrid, and Software as a Service (SaaS). Instead of interpreting general framework language, Information System Security Officers (ISSOs) answer questions about their own environment and arrive at accurate data faster.

As part of Aquia’s work supporting CMS, the tool was designed to help connect relevant compliance information with zero trust maturity assessments and support more evidence-informed reporting. A full case study from Aquia describing its work on the ZTMF scoring tool is available at: www.aquia.us/case-study-cms-ztmf.

Aquia provided support to CMS to design, build, and deploy the ZTMF Scoring Tool under the Program and Project Management Support and CMS Cybersecurity Integration Center contracts and subsequently supported deployment across HHS.

Disclaimer: The descriptions and views in this release are Aquia’s and should not be construed as statements or endorsements by HHS, CMS, or any other federal agency.

About Aquia Inc.

Aquia is a digital services firm helping the government modernize systems and processes to improve outcomes for millions of Americans. Since 2021, we’ve helped our country’s Veterans access earned benefits in days instead of weeks, generated millions in cost savings through cloud services and licensing optimization, enabled civil servants to double health care fraud investigations through streamlined cloud-based systems, and reduced authorization timelines by 74% through modernized security processes. 

As a team of strategic advisors and engineers, we help our customers develop and deploy innovative solutions, adopt and implement digital transformation initiatives, and navigate complex regulatory landscapes. 

Named the “2024 Service-Disabled, Veteran-Owned Small Business (SDVOSB) of the Year” by the Department of Health and Human Services (HHS), we are passionate about making our country digitally capable and secure.

Aquia has been named to the 2026 Inc. 5000 list of America's fastest-growing private companies, honored as a 2026 Inc. Best Workplace, and ranked the #1 Best Remote Startup to Work For in 2025 by Built In. Learn more at aquia.us.

Press contact for Aquia:

Ashling Knight

comms@aquia.io

###