Distributed Energy Resources (DERs) have added another layer of cybersecurity issues in today’s world with more devices, more ownership, more remote locations, and increased reliance on digital communication networks. These attributes extend the attack surface of modern power systems and render traditional perimeter-control based security methods useless. In this review, the application of zero-trust security as a cybersecurity framework for DER environments will be explored. Zero trust is based on the tenets of no implicit trust, least-privilege access control, strong identity and access management, encrypted communication and policy-based segmentation. The review considers guidance and recommendations from notable cybersecurity and energy-sector organizations such as the National Institute of Standards and Technology (NIST), the Cybersecurity and Infrastructure Security Agency (CISA), the U.S. Department of Energy, and the IEEE Standards Association. Established implementation practices included discussed were mutually authenticating roles, micro-segmentation, secure remote access, anomaly detection, asset visibility and resilient recovery mechanisms. The use of zero-trust architectures in DER systems, however, is still not a simple solution due to legacy device limitations, large scale device management, device interoperability, reliance on cloud computing, latency, and operational reliability. Overall, this paper has highlighted that zero-trust security offers a promising approach to bolstering DER cybersecurity, but implementation needs customization to the realities of OT in today’s complex distributed energy systems.