"Never trust, always verify" is easy to say. Implementing it across people, devices, applications and data takes a plan.
Phase 1: Identity first (0–90 days)
- Consolidate identities into a single provider with phishing-resistant MFA.
- Remove standing admin privileges; use just-in-time elevation.
- Turn on conditional access based on user risk and device health.
Phase 2: Devices and applications (3–6 months)
- Require managed, compliant devices for sensitive applications.
- Replace broad VPN access with identity-aware application access.
- Inventory SaaS applications and connect them to SSO.
Phase 3: Data and workloads (6–12 months)
- Classify sensitive data and apply encryption and DLP policies.
- Segment cloud networks and enforce workload identity.
- Centralise logs and build detections for identity-based attacks.
Measure progress
Track MFA coverage, privileged accounts, unmanaged device access and mean time to detect. Report them to leadership quarterly.
Zero trust is a journey — but with the right sequence, every phase meaningfully reduces risk.
- #Zero Trust
- #Identity
- #Cybersecurity
