Start zero trust with knowledge, not purchases. NIST SP 800-207 says an organization should reach a baseline of competence first, with assets, subjects, business processes, traffic flows and dependencies identified. After that, move one business process at a time. A small team can make real progress in a quarter.
Step 1: Inventory assets and subjects
NIST says there should be a survey of assets, subjects, data flows and workflows before any deployment. Do it in a spreadsheet if you must.
- Subjects: every human and every service account or automated identity that touches resources.
- Assets: laptops, phones, servers, containers, SaaS tenants, certificates. NIST also asks you to catalog nonenterprise devices and shadow IT as well as you can.
- Flows: which applications talk to which, and which users reach which applications.
Privileged accounts need extra attention. NIST notes that in many legacy designs these accounts have blanket access to everything.
Step 2: Pick one workflow
Choose a single business process, for example engineers reaching the production admin console. NIST says migration may go one process at a time and that hybrid operation with perimeter based workflows can last an indefinite period. A small scope gives you a finished result to learn from.
Step 3: Strengthen identity for that workflow
- Require multifactor authentication. The document expects it for some or all resources.
- Prefer phishing resistant methods. See which MFA to require.
- Remove shared accounts and standing broad privileges.
- Give each service its own identity, not a shared key.
Step 4: Add device conditions
A zero trust decision considers the requesting asset's state, such as software versions. Start simple: only managed, patched, disk encrypted laptops reach the admin console. See laptop encryption checklist.
Step 5: Put an enforcement point in the path
Place an access proxy or identity aware gateway in front of the application, so every session is evaluated and logged. Learn the roles in policy engine, administrator and enforcement point.
Step 6: Log and improve
Tenet 7 asks you to collect information about asset posture, traffic and access requests and use it to refine policy. Review denied requests weekly. A spike of denials often means a missing inventory item, not an attack.
Step 7: Repeat
Pick the next workflow. Record what you learned. Update the inventory on a schedule, since NIST describes a regular cycle of maintenance.
Where Safeguard fits
Safeguard's asset discovery can help with the inventory step, and its policies, gates and guardrails can enforce rules on software changes. It does not replace an identity provider or an access proxy. You can try a free scan at gold.safeguard.sh/scan.
Quick check
Do we need a new product to begin?
No. Begin with inventory and the identity and device controls you already own, then fill gaps.
How do we know a first project is done?
When every access to the chosen workflow is authenticated, evaluated against device state and logged, and you have reviewed those logs at least once.
Sources
Last reviewed: 19 October 2026.
