Zero Trust Roadmap: 12-Month Plan by Pillar With Owners and Metrics
8 min read ยท 2026-10-25
A zero trust roadmap is a phased plan that moves your organization from trusting anything inside the network to checking every access request based on who the user is, the state of their device and what they are trying to reach. It sets which pillars you improve first, which applications and users move in which order, who owns each workstream and how you measure progress.
Zero trust is not one product. It is an approach described in NIST SP 800-207, and many teams use the CISA Zero Trust Maturity Model to plan it. That model groups the work into five pillars (identity, devices, networks, applications and workloads, and data) and tracks maturity from traditional to optimal.
The roadmap below covers 12 months in six phases, starting with an assessment and the identity work most programs need first. You will also find who owns what, an example, the metrics to report, the risks to plan for and how to present it to leadership. Use the official NIST and CISA documents to confirm definitions and maturity criteria.
The roadmap at a glance
Goal: Within 12 months, require strong authentication for all users, check device health before access to priority applications, replace broad network access for those applications, and report maturity per pillar. Duration: 12 months
Assess and plan (Weeks 1-6)
Know your starting point and pick where to begin.
- Inventory users, devices, applications and the data each application holds, starting from your identity provider and asset tools.
- Score current maturity per pillar using the CISA model or a similar framework.
- Identify the most sensitive assets and the access paths to them, sometimes called protect surfaces.
- Choose a first group of applications and users based on risk and how easy they are to move.
Milestone: A maturity baseline per pillar and a prioritized list of applications and user groups, approved by the CISO and CIO.
Identity foundations (Weeks 4-16)
Make identity the main control point for access.
- Consolidate on one identity provider for single sign-on where possible, and connect priority applications to it.
- Roll out multifactor authentication for all users, starting with admins and remote access, and prefer phishing-resistant methods where you can.
- Set up privileged access management for admin accounts with just-in-time access where possible.
- Automate joiner, mover and leaver processes so access follows HR changes.
Milestone: MFA enforced for all users, priority applications behind single sign-on, and admin accounts under privileged access controls.
Device trust (Weeks 12-24)
Only let healthy, known devices reach sensitive resources.
- Bring company devices under endpoint management and endpoint detection and response.
- Define a device health baseline: supported OS, patches, disk encryption, security agent running.
- Feed device health into access decisions through conditional access policies for priority applications.
- Decide how unmanaged and personal devices get limited access, such as browser-only with no downloads.
Milestone: Conditional access policies live for priority applications, blocking or limiting devices that fail the health baseline.
Application access (Weeks 20-36)
Give users access to specific applications instead of the whole network.
- Move priority private applications from VPN access to zero trust network access or an identity-aware proxy.
- Apply per-application policies based on user, group, device health and location.
- Run old and new access in parallel for a pilot group, then switch the rest in waves.
- Retire VPN access for applications that have moved.
Milestone: Priority applications reachable only through per-application access, and VPN use reduced for the migrated groups.
Network segmentation and workloads (Weeks 30-44)
Limit how far an attacker can move if one system is compromised.
- Map traffic flows between servers and workloads for the most sensitive environments.
- Apply segmentation or microsegmentation so workloads only talk to what they need.
- Review service accounts and machine identities, and remove standing broad permissions.
- Test that segmentation holds with planned exercises.
Milestone: Sensitive environments segmented with documented allowed flows, and a test confirming blocked paths.
Data, visibility and next phase (Weeks 40-52)
Protect the most sensitive data and see what is happening across pillars.
- Classify sensitive data and apply labels or controls in the main storage and collaboration tools.
- Send identity, device, network and application logs to your SIEM, and build detections for access anomalies.
- Automate common responses, such as forcing reauthentication or isolating a device.
- Re-score maturity per pillar and draft next year's roadmap.
Milestone: Maturity re-scored per pillar against the baseline and next year's roadmap approved by the CISO and CIO.
Who owns what
Zero trust cuts across identity, endpoint, network, application and data teams. When it sits only with security, the teams that run those systems see it as extra work. Give each pillar a named owner from the team that runs it, with the security architect setting the target and the policies.
Keep one program lead who owns the roadmap, the maturity score and the steering meeting. A monthly steering group with the pillar owners and a business representative keeps decisions moving.
- Executive sponsor (CISO with the CIO): goals, funding and decisions when teams disagree.
- Zero trust program lead or security architect: the roadmap, target architecture, policies and maturity scoring.
- Identity and access management lead: identity provider, MFA, single sign-on and privileged access.
- Endpoint lead: device management, EDR and the device health baseline.
- Network lead: zero trust network access, segmentation and VPN retirement.
- Application owners: testing and moving their applications, and per-application access rules.
- Data owner or privacy lead: data classification and protection rules.
Example: a 3,000-person manufacturer
Picture a manufacturer with offices, plants and many remote staff who use a VPN to reach everything. A phishing incident showed that one stolen password gave wide network access. Here is how the roadmap could look by quarter.
The plant floor systems were kept out of the first year on purpose. They need a separate plan with operations engineers because uptime and safety come first there.
- Q1, Assess and identity: baseline scored with the CISA model, MFA rolled out to all office staff and admins, ten priority applications connected to single sign-on. Owner: IAM lead. Milestone: MFA enforced for everyone with a company account.
- Q2, Devices: laptops enrolled in endpoint management, health baseline defined, conditional access for email and the HR system. Owner: endpoint lead. Milestone: noncompliant devices blocked from priority apps.
- Q3, Application access: ERP, engineering file shares and the intranet moved from VPN to zero trust access for a pilot group, then all office staff. Owner: network lead with application owners. Milestone: VPN retired for those apps.
- Q4, Segmentation and data: data center segmented around ERP and finance servers, sensitive engineering files labeled, logs in the SIEM. Milestone: maturity re-scored and plant floor plan scoped for next year.
Metrics to track
Report coverage first, because a strong policy on a few applications does little if most access still bypasses it. Pull numbers from your identity provider, device management tool and access logs.
Report the maturity score per pillar every quarter, and the coverage metrics every month. Show the baseline next to each number so progress is visible.
- MFA coverage: users with MFA enforced divided by all active users, from the identity provider.
- Phishing-resistant MFA: share of users, starting with admins, on phishing-resistant methods.
- Single sign-on coverage: priority applications behind the identity provider divided by all priority applications.
- Device compliance: managed devices meeting the health baseline divided by all managed devices.
- Applications off VPN: applications reachable only through per-application access.
- Standing admin accounts: count of admin accounts with permanent privileges, which should go down.
Risks and dependencies
Zero trust changes how people log in and reach their tools, so the biggest risks are disruption and pushback. Plan pilots, communication and a rollback for every wave.
Write each risk down with an owner and a fallback, and review them at the monthly steering meeting.
- Legacy applications that cannot use modern authentication: owner is the application owner. Fallback: put them behind an identity-aware proxy or isolate them until they are replaced.
- User pushback on MFA and device checks: owner is the IAM lead with internal communications. Fallback: pilot with a friendly group, publish clear guides and staff a help desk line during rollout.
- Help desk overload during waves: owner is the service desk manager. Fallback: smaller waves and extra staff on switch days.
- Breaking business-critical flows with segmentation: owner is the network lead. Fallback: run in monitoring mode first, then enforce.
How to present it to leadership
Explain zero trust in one sentence: no user or device is trusted by default, and every access request is checked. Then tie it to a business risk leadership already knows, such as a stolen password giving access to everything, or the cost of downtime from ransomware.
On one slide, show the maturity per pillar today and the target for the year, the six phases with one milestone each, and three coverage numbers. Be clear that it is a multi-year journey and that this year aims for specific, measurable steps. Keep the architecture diagrams and vendor details in an appendix.
How to adapt it
A small company with cloud applications and no data center can move faster. Identity, MFA, device management and conditional access may cover most of the roadmap, and network segmentation shrinks to a smaller task.
A large or regulated organization may need a roadmap per business unit and alignment with a specific framework or mandate. US federal agencies, for example, follow specific government guidance. Confirm what applies to you with your compliance team or the issuing authority.
Common mistakes to avoid
- Buying a product and calling it zero trust leaves most gaps open, so plan by pillar and measure maturity across all of them.
- Starting with network segmentation before identity is in place makes policies hard to enforce, so build strong identity and MFA first.
- Moving every application at once causes outages and angry users, so start with a pilot group and move applications in waves.
- Leaving legacy applications out of the plan creates permanent exceptions, so give each one a decision: proxy, isolate or replace.
- Running the program inside security alone slows every change, so give each pillar an owner from the team that runs it.
- Reporting only projects completed hides real coverage, so track MFA, single sign-on and device compliance coverage every month.
Frequently asked questions
What are the five pillars of zero trust?
In the CISA Zero Trust Maturity Model, the five pillars are identity, devices, networks, applications and workloads, and data. The model also describes cross-cutting capabilities such as visibility and analytics, automation and orchestration, and governance. Check the current version of the CISA model for the full definitions.
Where should I start a zero trust roadmap?
Most organizations start with an assessment and then identity: one identity provider, single sign-on for priority applications and MFA for all users. Identity becomes the main control point that device, application and network policies build on.
How long does a zero trust implementation take?
It is usually a multi-year program. A first year can deliver strong identity, device checks and per-application access for priority systems. Segmentation, data protection and automation tend to continue in later years.
Does zero trust replace a VPN?
For many applications, yes. Zero trust network access gives users access to specific applications based on identity and device health, instead of placing them on the network. Most organizations retire VPN access gradually as applications move.
How do you measure zero trust maturity?
Score each pillar against a maturity model such as CISA's, which runs from traditional to initial, advanced and optimal. Pair that with coverage metrics like MFA coverage, device compliance and applications removed from VPN, measured monthly from your tools.