How do you implement a zero trust security strategy step by step?

To implement zero trust, stop granting access because a request comes from inside your network. Verify identity and device health for each request, give the least access needed, and log decisions. Start with one important application and your identity system, then expand pillar by pillar using a maturity model.

What does zero trust mean?

NIST SP 800-207 defines zero trust as a set of ideas that move defences from network perimeters to users, assets and resources. It states that no implicit trust is granted based on physical or network location. Access decisions are made per session, using policy and what is known about the requester and the resource.

It is an approach, not a product. No single purchase gives you zero trust.

What are the building blocks?

NIST describes a policy decision point that evaluates a request and a policy enforcement point that allows or blocks the connection. In practice that is your identity provider, device management, and a gateway or proxy in front of applications.

CISA's Zero Trust Maturity Model organises the work into five pillars, Identity, Devices, Networks, Applications and Workloads, and Data, with cross-cutting themes of visibility and analytics, automation and orchestration, and governance. It gives maturity stages so you can plan progress instead of aiming at a finished state.

Where should you start?

Start where one change gives the most.

Identity first. Single sign-on with multi-factor authentication for every application that supports it. Prefer phishing-resistant methods for administrators. Remove shared and stale accounts.

Then devices. Know which devices exist and whether they meet a baseline: disk encryption, supported operating system, up-to-date patches. Use that signal in access decisions.

Then one application. Pick an internal application, put it behind an access proxy, require identity and device checks, and remove it from the flat network. Measure what breaks.

Then expand. Repeat for the next application, then work on segmentation, data classification and workload identity.

A constructed example

A 200-person company runs an internal admin tool that is reachable from the office network and a VPN. Anyone on the VPN can open it.

Step 1: put sign-on with multi-factor authentication in front of the tool. Step 2: allow access only from managed, encrypted devices. Step 3: restrict access to the support group, and give a smaller admin group the dangerous functions. Step 4: log every access decision. After a month they find 30 stale accounts and a contractor laptop that fails the baseline. The tool is now safer, and the pattern becomes a template for the next five applications.

What about software and workloads?

Zero trust applies to services too. A service calling another service should prove its identity and be authorised for that call, using short-lived credentials. For the software you run, an inventory and SBOM show what is inside, and policy gates keep known exploited components out. Safeguard supports that layer with dependency scanning, reachability analysis, policy gates and agent identity for connected AI agents. It does not provide network access or identity provider functions.

What goes wrong?

Common mistakes: treating it as a product purchase, enforcing everywhere on day one and breaking workflows, ignoring legacy applications that cannot use modern sign-on, and never turning off the old broad access. Plan exceptions with owners and end dates.

How to check or apply this

1. Inventory users, devices, applications and data flows for one business area.
2. Enforce single sign-on and multi-factor authentication for all supported apps.
3. Define a device baseline and use it in access decisions.
4. Move one application behind an access proxy with per-request checks.
5. Log decisions and review them weekly at first.
6. Assess against the CISA maturity model and set the next stage per pillar.
7. Retire the broad network access the new controls replace.

Quick check

Sources

• NIST SP 800-207, Zero Trust Architecture, NIST
• Zero Trust Maturity Model, CISA
• NIST SP 800-63B, Digital Identity Guidelines, NIST

Last reviewed: 18 October 2026.