A board mandate says "implement zero trust in twelve months". What do you actually do, in what order?

First, reframe the mandate

Zero trust is not a project with an end date; it is a posture reached incrementally. A twelve-month programme promising completion will produce either a partial implementation described as complete, or a stalled programme.

What can be promised in twelve months is a measurable reduction in blast radius, which is what the board actually wants. So propose the metric: how far can an attacker who compromises one workload get? — which is testable, unlike "are we zero trust?"

The order, by risk reduction per unit of effort

1. Remove long-lived credentials. The highest return available. Workload identity for cloud access, OIDC federation from CI, and dynamic secrets for the highest-value data stores. Most breaches involve a credential; removing the ones that never expire changes the arithmetic more than anything else on this list.

2. Segment the network. Start coarse — tier and environment separation, and egress restriction, which is the control most often missing and the one that limits exfiltration and SSRF. Derive policy from observed traffic rather than guessing.

3. Strong authentication for humans, phishing-resistant for privileged access. Passkeys for administrators and anyone with production access first. Small population, large risk reduction.

4. Remove standing privilege. Just-in-time elevation with approval and expiry, so an ordinary compromised account cannot do administrative damage.

5. Workload identity and mTLS on the highest-value paths — those touching the crown-jewel data stores. Not everywhere at once; a service mesh adopted without the platform capability to run it trades a security risk for an availability risk.

6. Per-request authorisation on those same paths, with end-user context propagated so services are not confused deputies.

7. Expand as platform capability matures.

What to report at twelve months

Not "zero trust implemented". Instead: standing credentials eliminated in N% of workloads, lateral movement demonstrably restricted in a tested scenario, privileged access phishing-resistant, and a measured reduction in blast radius from a red-team exercise.

What a strong answer adds

Saying plainly that zero trust reduces blast radius rather than preventing compromise — and that a programme claiming otherwise is selling something. The honest success measure is how far an attacker gets, and that is worth testing rather than asserting.