A Practical Adoption Roadmap

Zero Trust is not a switch. The organisations doing it well have multi-year programmes, executive sponsorship, and a steering group with representation from security, identity, network, platform engineering, and the business. This lesson is the practical roadmap that ties the previous seven together.

Phase 0 — Assess and Charter (0-3 months)

Score against the CISA maturity model. Every pillar, every capability. Be honest. Identify the worst row in each pillar.
Stand up a Zero Trust steering group. Owners for Identity, Devices, Network, Apps/Workloads, Data. A single executive sponsor (CISO or CIO).
Define outcomes, not outputs. "Reduce mean dwell time of breaches" not "deploy product X."
Inventory. Identities, devices, applications, data stores, network paths. You cannot protect what you cannot see.
Charter the programme. 3-5 year horizon, with 6-month milestones per pillar.

Phase 1 — Identity Foundation (3-9 months)

Almost universally the highest-leverage first move.

Consolidate to one IdP. Migrate every app to SAML / OIDC against the chosen IdP. Decommission shadow directories.
Block legacy authentication. One Conditional Access rule, large risk reduction.
MFA for all users. Phishing-resistant (FIDO2 / passkeys) for admins.
Conditional Access baseline. Sign-in risk, user risk, named locations.
PIM for all standing admin roles. Eligible, not active.
Inventory and tier service accounts. Migrate the top 10 most-privileged to workload identity.

Exit criteria: >95% MFA coverage, zero standing global admin, <5% legacy auth, IdP is the sole authoritative directory.

Phase 2 — Device Trust (months 6-15, overlapping)

MDM/UEM enrolment for 100% of corporate-issued endpoints.
EDR rolled out to every endpoint and every server (cloud and on-prem).
Compliance policies enforced in Conditional Access — "Compliant device required for M365 / Workspace."
App protection policies for BYOD mobile email.
Initial cloud workload protection (CSPM at minimum).

Exit criteria: Every endpoint reporting compliance; EDR coverage above 98%; sensitive apps gated on device compliance.

Phase 3 — Replace the VPN with ZTNA (months 9-18)

Inventory applications and access patterns.
Onboard apps to ZTNA in waves — start with greenfield SaaS-like apps, then internal HTTPS apps, then RDP/SSH.
Run VPN and ZTNA in parallel; cut over per app or per persona.
Decommission the VPN once last app is migrated. Celebrate.

Exit criteria: VPN removed; every internal app reached through ZTNA broker with identity + device policy.

Phase 4 — Microsegmentation (months 12-30)

The longest pillar in most organisations.

Deploy flow visualisation; capture 90 days of east-west traffic.
Tier the estate: crown jewels first (payment, customer DB, code repos).
Implement default-deny per VPC and per Kubernetes namespace.
Service mesh roll-out for Kubernetes workloads — start with mTLS-only, add identity authorisation per app.
For on-prem: agent-based segmentation (Illumio, Guardicore) starting with critical apps.

Exit criteria: All crown-jewel apps in microsegmented zones; default-deny east-west in cloud and Kubernetes; flow visibility ongoing.

Phase 5 — Data and Workload (months 18-36)

Data classification scheme; auto-classification deployed.
DLP policies in audit → warn → block for sensitive classes.
CASB visibility on top SaaS; controls on shadow IT.
Image signing and admission control on all Kubernetes clusters.
Customer-managed keys for sensitive data stores.
Secrets management consolidated; static secrets eliminated.

Phase 6 — Continuous Improvement (ongoing)

Policy as code: every Conditional Access rule, every OPA bundle, every NetworkPolicy in git.
Decision telemetry into SIEM; weekly review of denials and friction.
Tabletop exercises and purple-team activities to validate the design.
Re-score against CISA model annually; aim to move pillars by one stage per year.
Move toward "Optimal" capabilities: just-in-time everything, continuous verification, automated remediation.

Outcome Metrics

The programme needs measurable outcomes, not output checkboxes:

Metric	Definition	Direction
MFA coverage	% of active users with phishing-resistant MFA	↑
Standing global admins	Count of permanently privileged accounts	↓ to 0
Mean time to revoke	From compromise signal to access revocation	↓
Blast radius	Number of resources reachable from a compromised workload	↓
VPN users	Concurrent VPN connections	↓ to 0
Policy denial rate	% of access requests that hit a deny / step-up	Tracked (signal of policy health)
Mean dwell time	Time from intrusion to detection in tabletop / red team	↓
Audit findings related to access	Count from internal audit and external assessors	↓

Anti-Patterns to Avoid

Buying "the Zero Trust product." No such thing. Buy components that fit your stack.
Skipping identity to do network first. The order matters; identity is leverage.
Big-bang VPN replacement. Migrate app by app, persona by persona.
Policy without observability. You will block real users and learn about it from a Slack channel.
Ignoring legacy. The mainframe, the Windows 7 lab machine, the IoT estate — none of them will magically modernise. Plan compensating controls.
Security alone owning the programme. Without platform engineering, networking, and the business, it stalls.

What "Done" Looks Like

You will never finish Zero Trust — it is a posture, not a project. But after a successful 3-5 year programme, the picture is:

Every access decision is identity-centric, dynamic, and logged.
The VPN is gone.
The "trusted internal network" is gone — every workload talks to every other workload over mTLS with identity-based policy.
Standing privilege is rare; just-in-time access is the norm.
A compromised endpoint affects a handful of resources, not the whole estate.
Compliance audits are evidenced by telemetry, not screenshots.
New SaaS, new application, new acquisition slot into the framework rather than each becoming its own project.

That is the destination. The path is unglamorous — inventory, configuration, migrations, policy reviews, retrospective tuning — but every step measurably reduces risk and the cumulative effect transforms the security posture of the organisation.

Final Reading List

NIST SP 800-207
CISA Zero Trust Maturity Model v2
Google BeyondCorp papers
Microsoft Zero Trust Guidance Center
Zero Trust Networks — Evan Gilman & Doug Barth (O'Reilly)
Pair with the CertQnA Cloud Security Fundamentals and IAM & Access Management courses.

If your work this year touches enterprise IT, security, or platform engineering, you will encounter Zero Trust on procurement RFPs, in board reporting, and in compliance audits. Now you have the vocabulary and the architecture to engage with it on substance.