The reference point
NIST announced guidance covering 19 example zero trust implementations in June 2025. The work provides concrete implementation patterns alongside the architectural principles of SP 800-207. It is useful foundational guidance for teams planning a phased migration. NIST implementation guidance ↗
Start with the application that has an owner
Our integration approach starts with a named resource and a representative identity cohort. Keep the existing identity source, map application dependencies, and introduce an enforcement boundary that can be tested. This makes each rollout an owned change with a measurable effect.
A migration becomes difficult when application discovery, user provisioning, endpoint posture, and routing changes are hidden inside one cutover. Separate their acceptance gates. A successful federation test is not proof of connector reachability; a healthy connector is not proof of least privilege.
A practical first increment
- 01Inventory
Name the application, owner, and dependencies.
- 02Federate
Map the existing identity and group lifecycle.
- 03Publish
Connect only the approved origin.
- 04Evaluate
Test access, denial, and recovery.
Use the resulting evidence to expand by application group. Keep exceptions visible and retire the old route only after the application owner accepts the new one.