Ninety days will not make your organisation zero trust. Anyone who promises otherwise is selling something. But ninety days is enough to prove the model works on one real application, with real users, real devices, and real audit evidence — and that proof is what earns you the budget and the mandate for the rest.

The plan below splits the quarter into three 30-day phases: identity, then devices, then access decisions. It assumes you already have an identity provider, some endpoint management tooling, and at least one person with authority to pause a rollout that is going badly. Adjust the calendar to your change-management rhythm, but keep the sequence. Identity first, devices second, policy third. Enforcing device compliance before you know who your users are produces confusion, not security.

Before Day One: Pick a Slice, Not the Whole Company

Scope is the single decision that determines whether this quarter succeeds. Choose one business application — the finance portal, the code repository, the HR system — or one user population, such as the engineering team or the remote sales group. Then write down three things:

• Who has access today, including shared accounts, service accounts, and the contractor nobody remembers onboarding.
• How they reach it: VPN, direct internet exposure, single sign-on, a browser bookmark with a saved password.
• What success looks like on day 90. Something like: every access to this application requires phishing-resistant authentication and a managed, compliant device, and we can produce a log showing who accessed what and when.

Name one accountable owner. A committee will not push back when a policy breaks a legitimate workflow at 4pm on a Friday; a person will.

Days 1–30: Identity Is the Control Plane

Week 1 — Inventory and clean up

Export your user list and compare it against HR records. Disable dormant accounts, delete duplicates, and replace shared credentials with named ones. This unglamorous work prevents months of painful exceptions later.

Week 2 — Strengthen authentication

Turn on multi-factor authentication for the pilot group, prioritising app-based or hardware keys over SMS. Secure your administrative accounts first, and create two break-glass accounts with long random passwords stored offline. You will need them when a policy locks out your own team.

Week 3 — Tidy groups and roles

Stop assigning permissions to individuals. Grant access through groups that describe a job function, so revocation happens when someone changes teams rather than when someone notices.

Week 4 — Pilot and listen

Run the pilot with ten to twenty tolerant users. Watch the sign-in logs daily. Fix the login experience before you widen it; frustration in week 4 becomes resistance in week 9.

Days 31–60: Make Devices Earn Their Trust

Identity answers "who." Device posture answers "from what." During phase two, you extend the same slice so that only known, reasonably healthy devices reach the application.

• Week 5: Produce a device inventory. Include unmanaged laptops, personal phones checking email, and virtual machines nobody owns.
• Week 6: Enroll pilot devices in your management platform. Confirm disk encryption, screen lock, and automatic patching are actually enforced, not just configured.
• Week 7: Define what "compliant" means in writing — patched within a set window, encryption on, endpoint protection running, no jailbroken phones. Keep the definition short enough that a busy person can meet it.
• Week 8: Start sending device signals to your access policies in report-only mode. Nothing is blocked yet; you are measuring how many legitimate users would be denied.

Personal devices deserve an honest conversation. Some organisations issue hardware; others allow browser-only access from unmanaged devices so no corporate data lands on the disk. Either choice is defensible. Silence is not.

Days 61–90: Write Access Rules That Hold

Now combine identity and device signals into policy. Take this phase slowly, and stage every enforcement change:

1. Week 9: Require strong authentication plus a compliant device for the pilot application.
2. Week 10: Add context — block or limit sessions from unusual locations, and require re-authentication for sensitive actions such as exporting data or changing payment details.
3. Week 11: Apply least privilege. Review who holds administrative rights and remove standing access in favour of time-limited elevation.
4. Week 12: Confirm logging flows into a central system, alert on policy denials, and document your exception process — including who approves exceptions and when they expire.

Keep a written rollback plan for every policy you enforce. Being able to revert in ten minutes is what allows you to move quickly in the first place.

Measure Progress, Not Activity

Dashboards showing "policies created" impress nobody. Track things that indicate the control is real: percentage of pilot users authenticating with a phishing-resistant method, percentage of devices reporting compliant, number of standing admin accounts, time to revoke access after a leaver, and count of active exceptions. If exceptions are climbing, a workflow is broken — investigate rather than adding another exception.

Where 90-Day Rollouts Slip

Three failure patterns show up again and again. The first is skipping user communication: people resist what they were not told about, so send a short note before each enforcement change. The second is treating the project as an IT-only effort; finance, legal, and HR need to sign off on exceptions and data access. The third is enforcing too much at once, which turns one broken integration into a company-wide outage. Stage the changes, and roll back without drama when something breaks.

Day 91 and Beyond

You now have one application, one user group, and a working pattern: identity verified, device checked, access decided, activity logged. The next quarter is repetition — pick the next application, reuse the same policies, and tighten the thresholds you loosened during rollout. Zero trust is not a project you finish. It is a habit of asking "should this request be allowed, right now, from this device?" and being able to answer with evidence.

Photo: Leeloo The First / Pexels