Most zero trust programs don't collapse because the technology was wrong. They stall because the groundwork wasn't there: no reliable identity source, no device inventory, no clear idea where the sensitive data actually lives. Six months in, the pilot is stuck in a steering committee and the license renewal is already on the calendar.

The questions below are the ones worth answering before you buy anything or announce a roadmap. They cover the five areas that decide whether a rollout moves or grinds: identity, devices, data, applications, and the organization behind them. A "no" isn't a failure. It's a work item, and it is far cheaper to find it now than during an incident.

One ground rule: answer with evidence, not impressions. "Everyone uses MFA" is a guess. "I ran the report and here are the eleven accounts that don't" is an answer.

Identity: can you prove who is connecting?

1. Do you have one authoritative directory, or do HR, IT, and the business each keep their own list? When three systems disagree about whether someone still works here, access decisions get made on bad data.
2. Can you list every non-human identity — service accounts, API keys, scheduled jobs, integration accounts — and name an owner for each? These are the classic zero trust blind spot.
3. Is multi-factor authentication enforced on every human login, including admin consoles and legacy protocols, or only on email and the VPN?
4. Can you grant access that expires by itself, like a contractor for two weeks or a support engineer for one afternoon, without editing a permanent group?
5. If an account were compromised right now, how fast could you revoke its active sessions across all your applications? Minutes, hours, or "we'd have to ask each vendor"?

Devices: do you know what is on your network?

1. Can you produce a count of endpoints touching your environment, split by managed, personally owned, contractor-supplied, and unmanaged IoT or operational technology?
2. Which system is the authority on device health, and does it actually check patch level, disk encryption, endpoint protection, and screen lock — or merely that the device enrolled once?
3. Can a non-compliant device be blocked or quarantined automatically, and has the help desk tested that path with real people?
4. What happens with devices you cannot manage, such as a partner's laptop or a personal phone reading email? Are there conditional rules, or just hope?
5. When a laptop goes missing, is there a written process that includes revoking certificates and tokens, not only wiping the disk?

Data: where is the sensitive material, and who can move it?

1. Which source of truth tells you where sensitive data lives — your classification labels, your data-loss tool, or a spreadsheet someone last updated in 2022?
2. Can you distinguish regulated records from ordinary business content? Access, retention, and logging rules differ enormously between the two.
3. Do your retention and deletion rules actually execute automatically, or do they only exist in a policy document? Get legal counsel to sign off on the rules themselves; engineering should own the execution.
4. Who is allowed to export data in bulk, and would you notice? One account downloading forty thousand customer records should be visible long before it becomes a headline.
5. Is data encrypted in transit and at rest, and do you know who holds the keys — you or a vendor?

Applications: what actually needs protecting?

1. Do you have a full application inventory, including the tools people bought on a corporate card? Single sign-on logs, expense reports, and SaaS discovery data will usually surface more than your official list.
2. Which applications support modern federation such as SAML or OIDC, and which are stuck on local usernames and passwords?
3. For the legacy system that cannot do MFA, what is the plan? Put it behind a proxy or segment it, then set a retirement date and tell the business.
4. Are admin consoles protected as strictly as user-facing apps? Where are break-glass credentials stored, and who is authorized to use them?
5. Do you know which applications talk to which, with what credentials, and how those credentials rotate? In most environments, machine-to-machine traffic now outnumbers human traffic.

Organizational readiness: will this survive contact with reality?

1. Who is the executive sponsor, and do they have the authority to overrule a business unit that does not want to change a workflow?
2. Who owns identity, who owns device compliance, and who owns data classification? Named people, not "the security team."
3. Do you have funding and a sequence, or are you attempting all five pillars at once? A phased plan that starts with identity beats a broad one that stalls.
4. Will the help desk be resourced for the extra calls when a new sign-in step appears? Predict the disruption and staff for it.
5. How will you know this is working? Choose a baseline now — time to revoke access, share of apps behind single sign-on, number of unmanaged devices — and re-measure it quarterly.

If you cannot answer a question from a report, the honest answer is no. Write it down and move on.

How to use your answers

Block ninety minutes this week and work through the list a section at a time. Score each question green, amber, or red, and keep the scoring boring. Green means you can show me the report. Amber means you can do it manually with effort. Red means nobody owns it.

Then count. A cluster of reds in identity and data is the signal to slow down: those two areas underpin everything else, and building conditional access on top of an unreliable directory just automates the wrong decision. A cluster of greens in identity but reds in devices usually means a short, well-defined project — compliance policy and an enrollment push — rather than a strategy problem.

Pick two items to fix first, choosing the highest risk with the lowest effort. First wins tend to look similar across organizations: enforce MFA on admin consoles, build a real service-account inventory, move one application behind single sign-on, and test your revocation process while nobody is panicking.

Re-run the checklist every quarter. Readiness is not a certificate you hang on the wall; it is a habit of knowing your own environment well enough to make a decision without guessing. The teams that succeed with zero trust are rarely the ones with the biggest budget. They are the ones that answered these questions first.

Photo: jarmoluk / Pixabay