Zero Trust Without the Slogans: How to Sequence It

Zero trust is one of the few security ideas that survived its own marketing. The concept in NIST SP 800-207 is narrow and testable: no request is trusted because of the network it arrives from, and every request is evaluated against identity, device and context before it is allowed. The problem is that a principle this simple is easy to sell as a product and hard to implement as an architecture, which is why so many programmes consist of a procurement, a slide deck and a VPN replacement that nobody uses.

The Honest Record

The United States federal government set the clearest test. OMB memorandum M-22-09 required agencies to meet specific zero-trust goals by the end of fiscal year 2024, with identity as the centrepiece: enterprise-wide phishing-resistant authentication, device inventories, encrypted DNS and traffic, and a model that treats every network as untrusted. The deadline passed with most agencies at partial implementation, and subsequent GAO reporting has been consistently unimpressed. That is not an argument against the model. It is an argument about sequencing, because the agencies that made progress generally did the identity work first and the network work later.

Five Pillars, One Order

CISA's maturity model describes five pillars — identity, devices, networks, applications and workloads, and data — across four stages. It is a good map and a poor project plan, because it does not say where to start. The order that works in practice is driven by dependencies, not by ambition.

Identity first. Single sign-on across the estate, phishing-resistant authentication for everyone, and conditional access that can express a policy like allow this user, on this device, to this application, from this location. Without a reliable identity signal, every later control is guessing. Administrators go first, and they go without SMS fallback.

Devices second. You cannot make an access decision about a device you cannot describe. Inventory, ownership, encryption state, patch level and management enrolment are the minimum, and the policy consequence is that an unmanaged device gets less access rather than no access at all. Browser-only, session-limited access from personal devices is usually the compromise that keeps the business working.

Applications third. Put applications behind an access proxy that authenticates per application rather than per network, and retire the flat VPN that grants a subnet once a session is established. This is where most organisations see the visible change, and it is also where the legacy application that cannot do SAML becomes a budget conversation.

Networks fourth. Microsegmentation is where zero trust gets confused with network security. It is valuable, and it is much easier once identity and application access are in place, because you know what should be talking to what. Starting here produces a segmentation project with no policy engine behind it.

Data last, and continuously. Classification is the input to every other decision: which data is sensitive, where it lives, who should reach it. It is also the pillar most organisations never finish, which is why data loss prevention remains a product looking for a policy.

Operational Technology Is Not the Same Problem

For anyone responsible for industrial or building systems, CISA's OT-specific zero-trust guidance, published in April 2026, is the more relevant document. The constraints are different: devices that cannot run an agent, protocols with no authentication, and change windows measured in months. The approach that works starts with visibility and segmentation around safety-critical processes, not with identity providers, and it accepts that some assets will be protected by their neighbours rather than by their own controls.

Why Programmes Stall

• It was bought, not sequenced. A ZTNA appliance and a microsegmentation licence do not make an architecture.
• No data classification. Without it, every policy is a guess about what matters.
• Legacy applications. The ones that cannot federate become permanent exceptions, and exceptions become the architecture.
• Ownership gaps. Identity sits with one team, network with another, and nobody owns the policy that spans both.
• User experience ignored. A control that adds three prompts to every login will be worked around, and the workaround will be less secure than what it replaced.
• No break-glass plan. When the identity provider is unavailable, the organisation needs a way to operate that does not depend on it.

Measure Decisions, Not Maturity

Maturity scores are useful for reporting and easy to game. The numbers that indicate real progress are operational: the percentage of applications reachable only through the access proxy, the percentage of administrators using phishing-resistant authentication, the percentage of devices with a current compliance signal, the median time to revoke access for a leaver, and the number of standing network paths that exist only because nobody turned them off. Those can be measured this quarter, and they move when the architecture moves. Zero trust is not a state an organisation reaches. It is a set of decisions it keeps making, and the useful question is which decision is next.