Almost every security team has a zero trust slide by now. Far fewer have zero trust running across the business. In a Gartner survey of 303 security leaders, 63% said they had fully or partially implemented a zero trust strategy. The same research found that a typical strategy covers half of the environment or less and mitigates a quarter or less of enterprise risk.
So starting is easy. Getting zero trust to cover the parts of the business that matter is the hard part. This zero trust implementation guide is about that part: where to begin, what order to work in, how to tell whether it is working and what usually goes wrong.
What Zero Trust Means in Practice
The old model trusted anything inside the network. Once someone was on the VPN or in the office, they could reach far more than they needed. Zero trust drops that assumption. Every request is checked, wherever it comes from.
In practice that comes down to three rules:
- Verify every time. Access depends on who the user is, what device they use and how risky the request looks right now, not on network location.
- Give the least access that works. People and services get access to specific applications and data, not to whole network segments, and only for as long as they need it.
- Plan for a breach. Assume an attacker is already inside. Segment systems so one stolen password or one exploited vulnerability does not open everything else.
Zero trust is not a product. Vendors sell parts of it: identity platforms, ZTNA, microsegmentation, endpoint tools. None of them is zero trust on its own, and you can build a lot of it with tools you already own. Gartner found that about 30% of organizations used only existing technology for their rollout.
Frameworks for Zero Trust Architecture Implementation
You do not need to design a program from scratch. Four public references cover most of what a team needs:
- NIST SP 800-207 defines zero trust architecture and its core components. It is the vocabulary most vendors and auditors use.
- NIST SP 1800-35, finalized in June 2025, shows 19 working implementations built with 24 vendors. It is the closest thing to a set of reference builds, mapped to the NIST Cybersecurity Framework and SP 800-53.
- The CISA Zero Trust Maturity Model 2.0 splits the work into five pillars and four maturity stages. It is the most practical yardstick for progress, and we use it below.
- The NSA’s Zero Trust Implementation Guidelines break the work into a discovery phase and two implementation phases across seven pillars. They were written for national security systems, but the sequence works for any large organization.
For companies in the EU there is one more reason to take this seriously. Recital 89 of the NIS2 Directive lists zero-trust principles among basic cyber hygiene practices. NIS2 does not require a full zero trust architecture, but a zero trust program makes it much easier to show that access controls and network security are in place.
How to Implement Zero Trust in 6 Steps
The order matters more than the tools. Each step below builds on the one before it.
Step 1: Define what you are protecting
Start small. Pick the data, applications and services that would hurt most if they were stolen or went down: customer data, payment systems, source code, the ERP. This is your protect surface. It is far smaller than the whole network and much easier to secure.
For each item, write down who needs access, from where and through which systems. That map becomes the basis for every access policy later.
Step 2: Inventory identities and devices
You cannot verify what you do not know about. List every user account, service account, API key and device that touches the protect surface. Non-human identities are the usual blind spot. Service accounts and automation tokens often hold broad rights and never expire.
The NSA guidelines put this discovery work in a phase of its own, before any controls change. It is slow, and it is also the step teams most often skip.
Step 3: Lock down identity first
Identity is where most zero trust programs get their first real results. Roll out phishing-resistant MFA, bring applications behind single sign-on and add conditional access rules that check user, device and location. Move administrators to separate privileged accounts with just-in-time access instead of standing rights.
These controls cost relatively little, because most companies already own an identity platform that can do them. They also close the most common way in: stolen credentials.
Step 4: Check device health before granting access
A valid password on an infected laptop is still a risk. Connect your endpoint management and security tools to access decisions: is the device managed, encrypted, patched, running endpoint protection? Unmanaged devices get limited access, for example browser-only access to a few applications.
Step 5: Segment the network and replace broad VPN access
A classic VPN puts a user on the network and lets them reach far more than they need. Zero trust network access (ZTNA) connects users to specific applications instead. Inside the data center and the cloud, microsegmentation does the same for servers: workloads can only talk to the systems they actually depend on.
This step takes the longest, because it requires knowing how applications talk to each other. Do it application by application, starting with the protect surface.
Step 6: Protect the data and watch continuously
Classify sensitive data so policies can follow it: who can open it, download it or share it outside the company. The same classification work also makes data easier to govern and is a first step to AI-ready data.
Then collect logs from identity, devices, network and applications in one place, and automate responses to clear signals. A login from a new country on an unmanaged device should trigger a step-up check or a block without anyone opening a ticket.
The Zero Trust Maturity Model: How to Know Where You Stand
The CISA model rates five pillars on four stages. Most organizations sit at different stages in different pillars, and that is normal. Identity usually moves first, data usually last.
| Pillar | Traditional | Initial | Advanced | Optimal |
|---|---|---|---|---|
| Identity | Passwords, some MFA | MFA for most users | Phishing-resistant MFA, risk-based access | Continuous verification for every session |
| Devices | Little visibility | Inventory of managed devices | Device health checked at login | Real-time device risk in every access decision |
| Networks | Flat network, broad VPN | First segments | ZTNA for key apps, microsegmentation started | Application-level access everywhere |
| Applications and workloads | Access through the network perimeter | Some apps behind SSO | Most apps behind SSO and conditional access | Per-request authorization for all apps |
| Data | No classification | Sensitive data identified | Policies follow data classification | Automated data protection and monitoring |
CISA adds three capabilities that cut across all pillars: visibility and analytics, automation and orchestration, and governance. Score yourself pillar by pillar once a quarter. A move from Traditional to Initial in two pillars within a year is real progress.
Your First 90 Days
A zero trust implementation takes years, but the first three months set the pace. A realistic start:
| Period | Focus | Result |
|---|---|---|
| Days 1–30 | Pick the protect surface, inventory identities and devices for it, enforce MFA for all admins | A map of what you protect and who reaches it |
| Days 31–60 | Pilot ZTNA or conditional access on one high-risk application with one user group | A working policy and real feedback from users |
| Days 61–90 | Measure the pilot, fix friction, score the maturity model, plan the next three applications | A baseline and a funded next phase |
Pick a pilot application that matters but will not stop the business if something goes wrong. An internal finance tool works better than the customer-facing site.
Common Mistakes
- Buying tools before the inventory. Without a map of identities, devices and data flows, a new platform protects whatever is easiest to connect, not what matters most.
- A big-bang rollout. Switching every user to new access rules at once creates a flood of tickets and a quick rollback. Go application by application.
- Forgetting legacy systems. Old applications often cannot do modern authentication. Put them behind a ZTNA gateway or an identity-aware proxy, and add them to your modernization plan. They are usually the technical debt that attackers find first.
- Ignoring user experience. If the new path is slower than the old VPN, people find workarounds. Single sign-on and fewer password prompts help adoption more than any policy memo.
- No metrics. Without numbers, zero trust turns into a never-ending project that is hard to fund. Gartner found that 3 in 5 organizations expect costs to rise after implementation, so leadership will ask what the money buys.
How to Measure Progress
Track a few numbers every quarter and report them in business terms:
- Share of users and admins on phishing-resistant MFA
- Share of critical applications behind SSO and conditional access
- Share of remote access running through ZTNA rather than full VPN
- Number of privileged accounts with standing access versus just-in-time access
- Maturity stage per CISA pillar
- Time to detect and contain identity-based incidents
The first four show coverage. The last two show whether coverage actually lowers risk.
FAQ
How long does zero trust implementation take?
The first results, such as MFA everywhere and a ZTNA pilot, come within months. Reaching an advanced stage across all pillars usually takes several years. Most teams treat zero trust as a permanent program, not a project with an end date.
What is the first step in implementing zero trust?
Define the protect surface: the critical data, applications and services you need to protect first. Then inventory the identities and devices that reach them. Everything else builds on this map.
Do you need to replace your existing infrastructure?
No. Most organizations build on the identity provider, firewalls and endpoint tools they already have, then add specific pieces such as ZTNA where gaps remain.
What are the 5 pillars of zero trust?
In the CISA model they are identity, devices, networks, applications and workloads, and data. The NSA guidelines use seven, adding automation and orchestration and visibility and analytics as pillars of their own.
Is zero trust required by NIS2?
Not as a named architecture. NIS2 recital 89 lists zero-trust principles among basic cyber hygiene practices, and the directive requires risk-based security measures, including access control. A zero trust program is a practical way to meet those requirements.
When does it make sense to get support with zero trust implementation?
Outside help makes sense for the discovery work, for segmenting complex networks and for the first pilot, when internal teams lack time or experience. Keep ownership of the roadmap and the access policies in-house, because they change as the business changes.
