Zero-trust maturity assessment