Zero trust implementation roadmap

Two to four years to reach CISA Optimal-tier maturity across all five pillars. Phase 1 (Foundation, identity and device) takes 3-9 months. Phase 2 (Expansion, network and basic workload) takes 6-18 months and typically overlaps with the tail of Phase 1. Phase 3 (Optimisation, data, advanced workload, telemetry) takes 12-24 months. SMBs running a Microsoft-first stack often complete Phases 1 and 2 in under 12 months because so much functionality is bundled into M365. Federal contractors operating under OMB M-22-09 deadlines often compress the entire programme into 18 months at significant cost premium.

Five quick wins can be deployed in 30 days for $0-$10K beyond labour: (1) enable MFA on all admin accounts using existing M365 / Google identity, (2) document the top 10 most-used apps and confirm SSO is configured, (3) revoke stale privileged accounts via Active Directory cleanup, (4) enable conditional access on admin portals (block legacy auth, geo-block where appropriate), (5) deploy DNS filtering as a no-cost zero trust control via Cloudflare Gateway free tier or Cisco Umbrella. These quick wins materially reduce risk while the larger programme spins up.

Skipping is the wrong word, deferring is correct. The most common deferrals are: PAM (Phase 1 component, deferred to Phase 2 for SMBs without privileged-user complexity), microsegmentation (Phase 2 component, deferred to Phase 3 or skipped entirely under 500 users), and full data classification (Phase 3 component, often deferred indefinitely without compliance pressure). Defer with intent and document the residual risk acceptance, the security architect should sign off on each deferral.

Three high-leverage choices for budget-constrained programmes: (1) Microsoft-first stack, M365 E3 + Entra ID P2 add-on covers identity and device pillars at substantially lower cost than best-of-breed equivalents; (2) defer microsegmentation, the highest-cost network-pillar component is rarely needed under 500 users and can be deferred to Phase 3 or beyond; (3) defer full PAM, for organisations with fewer than 50 privileged users, Entra PIM (free with P2) covers tier-0 needs adequately during Phase 1 and full PAM can move to Phase 2.

Each phase has explicit exit criteria (see the phase tables above). For an external view, run an annual independent zero trust assessment against the CISA Maturity Model, this scores each pillar against four maturity tiers (Traditional, Initial, Advanced, Optimal). A mature programme reaches Advanced across all five pillars by end of Phase 2 and Optimal in identity, network, and device by end of Phase 3. Regulated estates (federal, healthcare, finance) typically need Optimal across all five pillars and use the CISA assessment as compliance evidence.

Trying to deploy all five pillars in parallel. The result is integration chaos, vendor sprawl, no single deployment that finishes cleanly, and burnt budget. Phase sequencing exists because each pillar depends on the maturity of prior ones, microsegmentation policies need accurate identity context, conditional access policies need reliable device posture, DLP rules need consistent classification labels. Following the phase model takes longer but costs less and produces higher-quality controls. The second most common mistake is starting with microsegmentation rather than identity, almost guaranteed to produce policies that need rebuilding.