Zero Trust Network Access: An Implementation Checklist That Survives Contact With Reality
Most zero trust programmes stall at procurement. The ones that succeed start with identity, not with a product, and they phase adoption so the network team does not fight the security team.
Zero trust has been a marketing term long enough to accumulate a specific failure pattern: an organisation buys a ZTNA product, assigns it to the network team, and discovers eighteen months later that it secures three applications while the rest of the estate still runs on a VPN that everyone prefers because it works.
The programmes that succeed do something different. They start with identity, not with a product, and they phase adoption so the network team and the security team are pulling in the same direction.
Phase 0 — Identity preparation (before you buy anything)
- Consolidate identity providers. If you have three directories, pick one as authoritative and federate the others. Zero trust is impossible without a single source of truth for who a user is.
- Enforce MFA on all administrative access. Not email. Not sensitive systems. All administrative access, including to the infrastructure that runs the identity provider itself.
- Inventory applications and their access paths. You cannot secure access to what you have not catalogued. This is unglamorous and it is the step most often skipped.
- Map privileged accounts to human owners. Service accounts, shared admin credentials, and orphaned privileged identities are the reason zero trust programmes fail to reduce risk.
Phase 1 — Secure remote access (60-90 days)
| Control | Why it comes first |
|---|---|
| ZTNA for remote admin access | Replaces VPN for the highest-risk access path; quick win the board can see |
| Device posture checks | Managed device required for application access; unmanaged devices get conditional or no access |
| Session recording for privileged access | Evidence trail without the friction of jump servers |
| Decommission exposed RDP | The single most exploited initial access vector; closing it is measurable risk reduction |
Phase 2 — Application-level access (3-9 months)
This is where the programme earns its cost. Move internal applications from network-based access (if you are on the VPN, you can reach it) to identity-based access (you are authenticated, authorised, and your device is compliant, so you can reach this specific application for this session).
Phase 3 — Segment the internal network (6-18 months)
Zero trust at the network layer means micro-segmentation: workloads communicate on a need-to-know basis, enforced by policy rather than by network topology. Start with critical asset isolation — backup infrastructure, identity systems, crown-jewel databases — and expand outward.
The five reasons programmes stall
- Product-first procurement. Buying ZTNA before identity is ready produces a tool that nobody can use correctly.
- Network team ownership without security team input. ZTNA is an access control decision, not a network topology decision.
- No application inventory. You cannot migrate applications to identity-based access if you do not know what they are.
- Ignoring service accounts. Human identity is easy; machine identity is the long pole, and it is the one attackers exploit most.
- Measuring deployment instead of risk reduction. '50% of users on ZTNA' is a vanity metric. 'Zero exposed RDP endpoints' is a risk metric.
Implementing zero trust as a programme, not a purchase
The value of zero trust is not the product. It is the identity discipline, the application inventory, and the segmentation that you build along the way — and those survive vendor changes.
Kinematic Digital designs and operates security programmes for mid-market and enterprise organisations. See our cybersecurity services and preemptive security programme, or book a security review.
Frequently Asked Questions
What is the difference between zero trust and a VPN?
A VPN grants broad network access once authenticated, trusting everything inside the tunnel. Zero trust grants access to specific applications and resources per session, with continuous verification. VPNs extend the network perimeter; zero trust removes it.
Do we need to replace our VPN to do zero trust?
Not necessarily. ZTNA can coexist with VPN during transition. The goal is to shrink VPN usage over time as application access moves to per-session, identity-aware connections, until the VPN is only used for edge cases.
Is zero trust expensive?
The tooling is not the main cost; the design and identity preparation are. Organisations that skip identity hygiene and jump to product procurement spend more and achieve less. Start with identity, then invest in the access layer.
How long does zero trust adoption take?
For a mid-market organisation, expect 12-24 months for meaningful adoption across critical applications. Full estate coverage takes longer. The first milestone — securing remote access to admin tools — is achievable in 60-90 days.
Does zero trust replace the firewall?
No. Firewalls remain for perimeter inspection and network segmentation. Zero trust changes how users and devices access applications, not the underlying network inspection architecture.