Zero Trust Readiness Self-Assessment

You and your security team are interested in learning more about what Zero Trust is, the types of security and business benefits that it can bring, and how it may impact your enterprise both architecturally and operationally. You don't have any named Zero Trust projects or programs, although there may be pockets of Zero Trust interest or activity spread across the enterprise, but if so, they are not coordinated or centrally managed. If you're unsure of your readiness, choose this level.

You and your security team understand the core principles of Zero Trust, and as a security leader want to adopt this strategy for your enterprise. However, you don't yet have any concrete plans, and recognize that in order to do so, you need to learn more about Zero Trust, and its potential impacts for your enterprise. There is some awareness of Zero Trust outside the security team.

Your enterprise has decided to embark on a Zero Trust journey, acknowledging that this strategy represents a combination of security best practices. This decision may have been driven by the security team, or top-down. You and your security organization have a reasonably strong grasp of Zero Trust concepts and architectures, and are eager to move forward with an actual initiative.

You and your security team have decided to create a security initiative for Zero Trust (or perhaps has already created one). This is a security-driven and security focused program, rather than one heavily tied to business outcomes. The initiative may be named something other than "Zero Trust", such as "Workplace Modernization" or "Digital Transformation" but Zero Trust principles are at its heart.

Your enterprise has chosen Zero Trust as a security strategy specifically to support business goals. That is, the business has committed to a strategic initiative, and Zero Trust is the means by which IT systems will securely enable achievement of this business goal.

Your organization has a mandate to adopt Zero Trust. This may be externally imposed, such as by government or compliance regulations. Or, it may be internally imposed by C-level or Board leadership.

Your initiative's management and reporting structure is under your control, without predefined requirements imposed upon it. You may have lighter reporting and measurement requirements. The initiative may be evaluated and monitored more heavily for its security benefits than for its business benefits.

Your initiative is organized based on a defined structure imposed on it by your enterprise, with some adaptations. The structure imposes some overhead, often in the form of reporting requirements and metrics. There may or may not be a requirement for an ROI analysis, or for ongoing measurement of business value.

Your initiative follows a defined structure imposed on it by your enterprise. The structure imposes significant overhead, often in the form of reporting requirements, metrics, and ROI analysis, with a clear expectation of delivering and measuring business value. This degree of formality is often required for programs with higher investments and larger organizational impacts, or within larger or more formally managed enterprises.

You don't know what degree of formality is right for your initiative, or which will be imposed upon it.