Leadership brief · one page

Zero Trust Implementation

Two things show up over and over in published breach write-ups: a stolen credential, and a device nobody manages. This training teaches teams to close both, in an order that works, and to prove it closed.

Self-paced · 6 modules, 21 lessons · about 6 hours

Chapter 2 in the Meridian sequence · 9 live so far — the sequence follows one fictional utility through the same modernization, so the examples build on each other, and this one picks up the story from Cloud Modernization Patterns. Each training stands on its own; the order is the recommended path, not a prerequisite. The story continues in Modern DevSecOps Foundations.

What this training covers

Zero Trust — the model in which no user, device, or network is trusted by default and every request is checked — built up in the order the work depends on itself: the architecture and the federal map, then identity, then devices and networks, then applications and data, then the visibility and evidence that make the whole thing provable, and finally the habits that keep it in place. The program runs as four quarters, each ending in a scorecard.

Why it matters

Two separate problems sit behind most security programs. The architecture problem is that a stolen credential still opens doors. The evidence problem is that when an auditor, insurer, or customer asks a program to prove what it claims, the proving turns out to be the hard part. Zero Trust addresses the first; the evidence discipline this training pairs with it addresses the second. Order matters more than budget here — tools bought before identity is fixed become shelfware.

What changes in practice

Tags name what each shift affects most: cost, contract risk, or an audit finding avoided.

1. 1

   Identity comes first, before any other Zero Trust work

   Contract risk

   Why it matters: for every enrolled admin, a stolen password stops being enough to reach the account, and standing admin rights expire on their own instead of accumulating · Module 2

2. 2

   Access decisions read live signals, not network position

   Contract risk

   Why it matters: access follows what the device, the user, and the data being requested actually look like at that moment, so being inside the network stops being a credential of its own · Modules 3–4

3. 3

   One log platform: recent activity in fast storage, older activity in cheap storage

   Cost

   Why it matters: an incident gets reconstructed from one place instead of five consoles, and retention follows one policy instead of per-team accidents · Module 5

4. 4

   Alerts are proven to reach a person

   Audit finding avoided

   Why it matters: every alert rule has been watched reaching a human once, before an auditor or a customer outage is the thing that tests it · Module 5

5. 5

   Every exception has an owner, an expiry, and a signature

   Audit finding avoided

   Why it matters: no waiver becomes permanent by default, and the record of what was accepted survives staff turnover — routed to the authorizing official (the federal official who signs go-live) where a federal authorization applies · Module 6

6. 6

   Progress is shown on a scorecard each quarter

   Cost

   Why it matters: maturity is reported as evidence rather than asserted, so the program can show movement between quarters instead of restating intent · Module 6

Where the effort goes

Identity work carries the first quarter and the largest share of the effort. After that it is consolidation rather than acquisition: one log platform instead of five, a quarterly scorecard that someone actually maintains, and steady remediation of whatever the exception register surfaces. Network and data tooling waits until the identity work is enforced and measured, or it sits unused.

How you'll know it worked

• Each pillar moving up a documented maturity stage by its target quarter until it reaches its target stage, with the evidence to defend the claim at audit
• Exception debt — the backlog of accepted risks — trending to zero by expiry date; zero unowned exceptions found at audit
• The same scorecard holds quarter after quarter, even when the security chief changes — no program-restart cost with new leadership