|
1 | | -Implementing Zero Trust across an organization is a major transformation. It requires a structured approach that goes beyond deploying individual technologies. Microsoft provides two complementary approaches: the Zero Trust adoption framework for strategic planning and the Rapid Modernization Plan (RaMP) for quick wins. |
| 1 | +Implementing Zero Trust across an organization is a major transformation that requires a structured approach beyond deploying individual technologies. The Zero Trust adoption framework provides strategic planning guidance for this transformation. |
2 | 2 |
|
3 | 3 | ## Zero Trust adoption framework |
4 | 4 |
|
5 | | -The Zero Trust adoption framework helps organizations plan and execute a Zero Trust strategy across their entire digital estate. It adapts the lifecycle phases from the Cloud Adoption Framework for Azure, but with a scope suited to Zero Trust. |
| 5 | +The Zero Trust adoption framework helps organizations plan and execute a Zero Trust strategy across their entire digital estate. It adapts the lifecycle phases from the Cloud Adoption Framework for Azure to the unique scope of Zero Trust—introducing new security configurations across an entire digital estate rather than onboarding individual workloads. |
6 | 6 |
|
7 | 7 | Adopting a Zero Trust strategy requires buy-in from across the C-suite. Security isn't the responsibility of one team—it's a shared business responsibility aligned to business outcomes. Each C-level role has a stake in Zero Trust, from the CEO who needs an integrated approach to security, to the CFO who needs measurable accountability for security spend. |
8 | 8 |
|
9 | | -The Zero Trust adoption framework uses these lifecycle phases: |
| 9 | +The framework organizes adoption around a lifecycle with five phases: |
10 | 10 |
|
11 | 11 | | Phase | Description | |
12 | 12 | |---|---| |
13 | 13 | | **Define strategy** | Build a business case focused on the outcomes most closely aligned with your organization's risks and strategic goals. | |
14 | 14 | | **Plan** | Prioritize quick wins and incremental progress. Structure coherent initiatives with clear outcomes, benefits, and ownership. | |
15 | | -| **Ready** | Create a multilayer strategy for your Zero Trust deployment and prioritize early actions based on business needs. | |
| 15 | +| **Ready** | Evaluate, test, and pilot security configurations. Prioritize early actions based on business needs. | |
16 | 16 | | **Adopt** | Incrementally implement the strategy across functional areas. | |
17 | | -| **Govern** | Track and measure the success of your deployment. | |
18 | | -| **Manage** | Use monitoring and detection technologies. Incrementally mature each functional area. | |
| 17 | +| **Govern and manage** | Track and measure the success of your deployment. Use monitoring and detection technologies to incrementally mature each functional area. | |
19 | 18 |
|
20 | | -:::image type="content" source="../media/zero-trust-adoption-framework.png" alt-text="Diagram showing the Zero Trust adoption framework lifecycle phases including Define strategy, Plan, Ready, Adopt, Govern, and Manage."::: |
| 19 | +:::image type="content" source="../media/zero-trust-adoption-framework.png" alt-text="Diagram showing the Zero Trust adoption framework lifecycle phases including Define strategy, Plan, Ready, Adopt, and Govern and manage."::: |
21 | 20 |
|
22 | | -### How it differs from the Cloud Adoption Framework |
| 21 | +### Business scenarios |
23 | 22 |
|
24 | | -The Cloud Adoption Framework focuses on introducing new apps and services into an organization, with a repeatable process for each workload added to the digital estate. Zero Trust adoption requires a different scope: introducing new security configurations across an entire digital estate. |
| 23 | +The framework applies the lifecycle through business scenarios that break work into concrete objectives. Each objective is a technical project that moves through the lifecycle independently, and you can stagger objectives so multiple workstreams progress in parallel. The framework includes these business scenarios: |
25 | 24 |
|
26 | | -The scale motion for Zero Trust is two-dimensional: |
| 25 | +- **Rapidly modernize your security posture** — Build the organizational capacity and basic security hygiene needed for every other scenario. |
| 26 | +- **Secure remote and hybrid work** — Apply Zero Trust protections to identities, devices, and applications for remote access. |
| 27 | +- **Identify and protect sensitive business data** — Discover, classify, and protect sensitive data across your digital estate. |
| 28 | +- **Prevent or reduce business damage from a breach** — Limit blast radius through segmentation, threat detection, and response capabilities. |
| 29 | +- **Meet regulatory and compliance requirements** — Align Zero Trust protections with regulatory frameworks and track compliance status. |
27 | 30 |
|
28 | | -1. Take a piece of the Zero Trust architecture, such as data protection, and scale it across the entire digital estate. |
29 | | -2. Repeat the process with each additional piece of the Zero Trust architecture, starting with strategic quick wins and foundational elements, then advancing to more complex areas. |
30 | | - |
31 | | -:::image type="content" source="../media/zero-trust-architecture.png" alt-text="Diagram showing the Zero Trust architecture with technology pillars scaled across the digital estate."::: |
32 | | - |
33 | | -The Zero Trust adoption framework recommends building a strategy through business scenarios, including: |
34 | | - |
35 | | -- Rapidly modernize your security posture. |
36 | | -- Secure remote and hybrid work. |
37 | | -- Identify and protect sensitive business data. |
38 | | -- Prevent or reduce business damage from a breach. |
39 | | -- Meet regulatory and compliance requirements. |
40 | | - |
41 | | -## Zero Trust Rapid Modernization Plan |
42 | | - |
43 | | -The Zero Trust Rapid Modernization Plan (RaMP) provides a set of deployment paths to quickly implement key layers of protection. RaMP takes a project management and checklist approach. It provides a suggested mapping of key stakeholders, implementers, and their accountabilities, along with checklists of deployment objectives and implementation steps. |
44 | | - |
45 | | -Zero Trust is a major transformation, so it's critical to start with the most impactful items that deliver the most security and productivity gains with the least investment of time and resources. |
46 | | - |
47 | | -The Zero Trust RaMP is included in the Microsoft Cybersecurity Reference Architectures (MCRA) and aligns to these recommended security modernization initiatives: |
48 | | - |
49 | | -- **Secure identities and access:** Focus on using cloud-based security capabilities to rapidly modernize access control and increase both productivity and security assurances. |
50 | | -- **Data security and governance, risk, compliance (GRC):** Focus on ensuring the organization can rapidly recover from a ransomware or extortion attack without paying attackers, and protect the most valuable business-critical data. |
51 | | -- **Modern security operations:** Focus on streamlining responses to common attacks, getting end-to-end visibility across the enterprise, and automating manual tasks that slow down analysts. |
52 | | -- **Infrastructure and development security:** Focus on security hygiene, reducing legacy risk, integrating security into DevOps and development processes, and applying microsegmentation concepts. |
53 | | -- **Operational technology (OT) and Internet of Things (IoT) security:** Focus on quickly discovering, protecting, and monitoring these systems for attacks. |
54 | | - |
55 | | -Together, the adoption framework and RaMP give you both the strategic planning structure and the tactical quick wins needed to make progress on your Zero Trust journey. |
| 31 | +The *Rapidly modernize your security posture* scenario is typically the starting point because it builds the organizational capacity—strategy alignment, risk assessment, security hygiene, and a repeatable adoption process—needed to systematically execute the other business scenarios. In turn, the other scenarios supply the technical objectives that feed through this process and accelerate the overall transformation. |
0 commit comments