Security
Zero Trust without buying a Zero Trust platform
Zero Trust is a set of design choices, most of which agencies can make with tools they already own.
Vendors sell Zero Trust as a product. It is not. It is a principle: do not trust a connection because of where it comes from, and verify identity, device, and context on every access. Most agencies can make substantial progress with what they already license.
Identity first
Strong identity is the foundation. Multi-factor authentication everywhere, conditional access based on device and location, and prompt deprovisioning. Most agencies already have these capabilities in their identity platform and simply have not turned them on.
Device posture
Access should depend on the device being managed, encrypted, and patched. Device management platforms report this, and identity platforms can require it. A personal laptop should not reach the finance system.
Application access instead of network access
Replacing broad VPN access with per-application access, whether through an identity-aware proxy or the private access features in existing platforms, shrinks what an attacker can reach with stolen credentials.
Segmentation
Public safety, utility control, business, and guest networks should not be one flat network. Segmentation is done with the switches and firewalls an agency already owns. It is design work, not a purchase.
Logging
Every access decision should be logged and the logs kept somewhere an attacker cannot erase. Again, mostly configuration.
Where products help
Some capabilities, such as fine-grained micro-segmentation or advanced analytics, do benefit from dedicated tools. Buy those when the basics are done and you can articulate what the tool adds.
Sequencing
Do identity first, then devices, then application access, then segmentation. Each phase reduces risk on its own. Measure progress against a maturity model so leadership can see it.