Zero Trust as a Sequence: Four Steps From Slogan to Architecture

Many organizations say they have "started Zero Trust." Look closer and you often find a new VPN and MFA turned on for a few managers, while the internal network is as flat as before: anything plugged into a wall socket can still reach most servers. Zero Trust is not a product. It is a sequence, and the sequence is what separates a working program from a stalled one.

Why most programs stall

The principle is simple: no request is trusted just because it comes from inside the network, and every access is evaluated on identity, device health and context. Execution usually fails on ordering, not technology. Teams start where a vendor pointed them instead of where the risk is highest, and end up with disconnected tools that never see the whole picture. Gartner predicted that by 2026 only about 10 percent of large enterprises would have a mature, measurable Zero Trust program.

Four steps, in this order

• Know your devices. Run network access control (NAC) in monitor-only mode first and build a full inventory, including printers, cameras and contractor equipment. Then move unknown devices to quarantine, and finally block anything without a healthy posture.
• Prove identity. MFA is not just for the VPN; admin consoles, email and financial systems need it too. SSO keeps identity in one place, and privileged access management adds session recording and just-in-time approval for admin accounts.
• Grant application access, not network access. Users reach only the application they need, after identity and device checks. A single leaked account can no longer scan the whole network.
• Limit lateral movement. Micro-segment by workload role rather than by subnet. Start with the crown jewels: financial systems, domain controllers and backups.

What ties the steps together

Zero Trust without data is blind. NAC logs, sign-in events and firewall alerts belong in one monitoring platform, so a rule such as "successful sign-in from two countries within ten minutes" becomes an automatic action. That visibility also tells you where to tighten policy.

A realistic six-month plan:

• Months 1–2: NAC in monitor mode, device and application inventory with named owners
• Months 3–4: MFA and SSO, removal of shared accounts, privileged access for admins
• Month 5: application-based access for contractors and administrators
• Month 6: micro-segmentation of 3 to 5 critical systems, logs connected to monitoring

You do not need to start everything at once. You need the right order, and a measurable exit criterion for each stage.

The full article, with details for each step and the roadmap, is here: Zero Trust in Practice: Four Steps That Turn a Slogan Into Real Architecture

— Kazem Mortazavi, independent network-security consultant