intellimetrics Learning
Zero Trust Implementation Module 1 · The Architecture

The Program Shape

Last reviewed

Intermediate

What you'll learn

~15 min
  • Sequence a Zero Trust program in the consensus order - and say why that order
  • Score the estate against the CISA ZTMM's stages to produce a defensible baseline
  • Name the five failure modes that kill ZT programs, and the guard for each

The question after the diagram

Lesson 1.1 gave you the architecture; 1.2 gave you the rules. Meridian’s CISO now asks the practical one: “In what order, and how long?” Zero Trust programs fail far more often from bad sequencing than from bad technology — so this lesson is the shape of the work.

The consensus sequence, and its logic

0. INVENTORY   - identities, devices, apps, data flows. You cannot write
                 policy about what you cannot enumerate.
1. IDENTITY    - MFA everywhere, legacy auth blocked, standing privilege
                 killed, machine identities federated. (Module 2)
2. DEVICES     - posture signals wired into access decisions. (Module 3)
3. PER-APP     - application access modernized one app at a time; the
   ACCESS        perimeter VPN's scope shrinks as apps leave it. (Module 3)
4. SEGMENTS    - default-deny east-west, after flow mapping. (Module 3)
5. DATA        - classification driving policy. (Module 4)
6. CONTINUOUS  - visibility, automation, and the feedback loop. (Module 5)

Why identity first is genuine consensus, not fashion: every later stage consumes identity as an input. Device compliance gates need somewhere to send their signal (the identity PDP); per-app policies are per-identity policies; segmentation rules reference workload identities. Build the pillar the others plug into, first. And why inventory is stage zero: the single most common program-killing failure — verified against years of postmortems — is enforcement before discovery: turning on a default-deny or a device gate without knowing what will break, causing an outage, and losing the political capital the program runs on. Visibility before enforcement, every stage, no exceptions.

Pilot by protect surface

The counterweight to boiling the ocean: pick one protect surface — a crown-jewel asset and everything that touches it — and take it through all the stages end-to-end while the rest of the estate waits. For Meridian: the dispatch system (the thing that must work during a storm). One app, its users, its devices, its data flows, its segments, fully Zero-Trusted in a quarter — producing real lessons, a demonstrable win, and a template. Then repeat, surface by surface. This is how the 18-36 month program (that’s the honest enterprise range for reaching a defensible target state) ships value in quarter one.

Score it or it didn’t happen

The roadmap’s axes come from the CISA ZTMM: five pillars, four stages — Traditional → Initial → Advanced → Optimal. Your artifact:

Score this estate against the CISA Zero Trust Maturity Model v2.0. For each
of the five pillars (Identity, Devices, Networks, Applications & Workloads,
Data) plus the three cross-cutting capabilities: current stage with one
sentence of evidence, the NEXT stage's bar, and the single highest-leverage
move to reach it. Output as a scorecard table. Be stingy - "Initial" requires
the capability to actually exist, not be planned.


Estate: [paste the Lesson 1.1 flow-mapping output plus your inventory summary]

Meridian’s honest first scorecard lands mostly “Initial” with Networks at “Traditional” — which is typical, fine, and now provable. The program reports quarterly against this scorecard: not “we bought a ZTNA,” but “Networks moved Initial→Advanced; evidence attached.” Per-pillar stage movement is the only progress metric that survives an auditor, a CISO transition, and a budget fight.

⚠The five program-killers
  1. Enforcement before discovery — the outage that ends the program (guard: report-only/audit modes first, always; you’ll meet this pattern in every module).
  2. Tools mistaken for architecture — buying a product and declaring the pillar done (guard: the scorecard scores capabilities-in-use, never purchases).
  3. Big-bang scope — redesigning everything at once (guard: protect-surface pilots).
  4. Identity scope stopping at humans — leaving thousands of service accounts as the soft underbelly (guard: Module 2 gives machines equal billing).
  5. Breaking legacy apps and eating the blame — enforcing device/network policy on apps that can’t satisfy it (guard: fronting patterns in Lesson 3.2, plus exceptions that carry an expiry date and an owner — “temporary” exceptions without expiry dates are how architectures quietly repeal themselves).
KNOWLEDGE CHECK

Meridian's board approves budget and an eager director proposes: 'Deploy default-deny microsegmentation across all sites in Q1 — it's the most visible security win.' Per this lesson, what's wrong?

Key takeaway

Inventory, then identity, then signals, then per-app access, then segments, then data, then the loop — because each stage consumes the last one’s outputs. Pilot by protect surface for early wins, score everything against the ZTMM’s stages quarterly, and guard against the five killers — especially enforcement before discovery. The architecture module is done; now we build, starting where every real program starts: identity.

Search lessons