A practical zero trust roadmap for mid-size organisations, based on NIST SP 800-207 and the CISA Zero Trust Maturity Model. Free PDF whitepaper.
Zero trust is one of the most talked-about ideas in security, and one of the most misunderstood. This free Cyber Tech Insights whitepaper sets out a practical zero trust roadmap for mid-size organisations: what the architecture really means, how to measure progress, and which steps to take first with a modest team and the tools you already own. It is grounded in two public, vendor-neutral references — NIST Special Publication 800-207, Zero Trust Architecture (2020), and the CISA Zero Trust Maturity Model, version 2.0 (2023).
Free whitepaper (PDF)Download the full guide instantly — no form required.
Download PDFWhat’s inside
- Zero trust in plain terms — the seven tenets of NIST SP 800-207 explained without jargon.
- The decision engine — how the policy engine, policy administrator and enforcement points map to tools you may already run.
- The five CISA pillars — identity, devices, networks, applications and workloads, and data, with early steps for each.
- Cross-cutting capabilities — why visibility and analytics, automation and orchestration, and governance decide how far you can progress.
- Maturity stages — what Traditional, Initial, Advanced and Optimal look like in practice.
- Buyer questions and a phased roadmap — plus a one-page readiness checklist.
Who it’s for
The guide is written for IT directors, security and infrastructure leads, CIOs and CISOs at mid-size organisations, and for the business leaders who sponsor security investment. It assumes a mixed estate — on-premises systems, cloud services and SaaS, remote and hybrid staff — and a security team that cannot pause day-to-day operations for a large transformation programme.
Seven best practices for your zero trust roadmap
- Start with identity. Consolidate identity providers and enforce phishing-resistant multi-factor authentication for administrators and remote access first.
- Define protect surfaces. Agree a short list of critical applications, data stores and admin systems and secure those before anything else.
- Baseline every pillar. Record a current and target maturity stage for each CISA pillar so progress is measurable.
- Switch on what you already license. Conditional access, device compliance and data labelling are often included in existing subscriptions.
- Pilot in report-only mode. Observe the effect of new policies before enforcing them to avoid outages and rollback.
- Replace broad network access gradually. Move one application group at a time to identity-aware, per-application access and retire old paths.
- Correlate the evidence. Bring identity, device and network logs together so access decisions and investigations rely on the same data.
How the zero trust roadmap maps to NIST and CISA
NIST SP 800-207 describes the architecture: no implicit trust based on network location, per-session access, and decisions made by dynamic policy using identity, device state and other signals. The CISA model complements it by describing how mature each part of that architecture is. The whitepaper uses both: NIST to check that your design is sound, and CISA to plan and report progress pillar by pillar. For most mid-size organisations, a realistic target is to move the pillars protecting the most valuable assets to Initial and then Advanced maturity, rather than pursuing Optimal everywhere.
Common pitfalls
- Treating zero trust as a single product purchase rather than an architecture spanning several tools.
- Enforcing strict policies without a monitoring period first.
- Overlooking service accounts, APIs and other machine identities.
- Leaving legacy VPN and firewall rules in place after new access paths go live.
- Measuring success by tools deployed instead of risk reduced for priority assets.
Frequently asked questions
Is zero trust only for large enterprises?
No. The principles scale down well. Mid-size organisations often move faster because they have fewer legacy systems and a simpler identity estate.
Do we need to replace our firewalls and VPN?
Not immediately. Most roadmaps reduce reliance on broad network access gradually, application by application, while existing controls remain in place.
Is the CISA model relevant outside the US public sector?
Yes. It was written for US federal civilian agencies, but it is public and vendor-neutral, and many private-sector organisations use it as a planning reference.
How long does zero trust take?
It is an ongoing programme rather than a project with an end date. Early identity improvements can be delivered quickly; deeper segmentation and automation take longer.
A 90-day action plan
- Days 1–30: inventory identities, devices, applications and sensitive data; agree protect surfaces and an executive sponsor.
- Days 31–60: enforce phishing-resistant MFA for privileged and remote access; run conditional access policies in report-only mode.
- Days 61–90: enforce the first policies, require compliant devices for one priority application and publish a pillar-by-pillar maturity baseline.
Questions to ask vendors
- Which NIST SP 800-207 components does your product provide?
- Which CISA pillars does it support, and at which maturity stage?
- Which signals can it use in access decisions, and from which third-party sources?
- How are legacy applications that cannot use modern authentication handled?
- Can policies run in audit mode before enforcement?
- How do logs integrate with our existing SIEM?
Key terms explained
- Policy engine — the component that decides whether to grant, deny or revoke access.
- Policy enforcement point — the gateway, agent or proxy that applies that decision to a connection.
- Protect surface — a critical asset or group of assets prioritised for zero trust controls.
- Phishing-resistant MFA — authentication methods, such as FIDO2 security keys, designed to resist credential phishing.
The bottom line
Zero trust is a direction of travel, not a box to tick. Start with identity, protect what matters most, measure progress against the CISA pillars and retire broad network access step by step. Download the whitepaper for the full phased roadmap, vendor questions and readiness checklist.
Further reading on zero trust
For authoritative, vendor-neutral guidance on zero trust architecture, see NIST SP 800-207: Zero Trust Architecture and the CISA Zero Trust Maturity Model. You can also browse our free whitepapers.
