Author: [Gerardus Blokdyk](https://www.linkedin.com/in/gerardblokdijk/)
Retrieved from [LinkedIn](https://www.linkedin.com/pulse/define-zero-trust-approach-cybersecurity-gerardus-blokdyk/) on January 8, 2022

Relevant ISO 27001 clauses/controls:
- [[ISO 27001 C 9.2 Internal audit]]
- [ISO 27001 A 18 Compliance](../../Standards/ISO27x/legacy/ISO%2027001%202013/ISO%2027001%20A%2018%20Compliance.md)

Related:
- [Zero Trust](../Zero%20Trust.md)

1.  Does your organization have a hybrid cloud/colocation design, and does a Zero Trust software defined perimeter security option secure your organizations new expanded perimeter?
2.  As more of your organization moves to a hybrid cloud model, how does the Zero Trust model and identity and access management technologies ensure that data is protected?
3.  Can access rights be modified in near real time to reflect the current trust level of users and devices?
4.  Do you have your business aligned Zero Trust strategy supported by an architecture and set of processes that enables users to seamlessly access both on premise and cloud applications?
5.  What does your organization need to do to transform to a Zero Trust Remote Access platform for DevOps?
6.  What security measurement practices and data does your organization use to assist product planning?
7.  Were does the rise of cloud acceptance in your organization mean trust based perimeter centric security models are falling short?
8.  CISOs need a way to communicate cyber risk to your organizations management team: does the current security posture align with common security standards?
9.  When you look at your organization and you are evaluating the technical solution, do you see a moat there, or does there even need to be a technological moat?
10.  Have you fully considered how cloud services and mobile working affects your risk and threat management models?
11.  Are you creating a Zero Trust model, embedding security and streamlining compliance everywhere, including mobile, applications, and cloud platforms?
12.  Which measures has your organization implemented or does it plan to implement within the next six to 12 months to help address concerns with data security?
13.  Do you have IAM in place for not only internal and external data repositories for Big Data, cloud, and DevOps?
14.  Do you have a program in place to assess the impacts of an attack by an aggrieved employee with access to your business and customer critcal data or your network?
15.  Will you have an explicit trust model, where all participants are known and authenticated business models, or do you need something closer to the Zero Trust Bitcoin model?
16.  What devices do you have and how are they communicating so you can easily implement better segmentation and Zero Trust policies?
17.  What are your organizations biggest cybersecurity concerns, and what cyberdefenses does your organization have for protecting its assets?
18.  Do you really trust the entire workforce to comply with security protocols now that they are not physically in the office?
19.  To what extent do you and your organization plan to move Zero Trust access capabilities to SaaS?
20.  How can having persistent data security controls help your organization to adhere to data protection responsibilities?
21.  If your organizations devices are not seen as secure, if data is not protected or devices are hacked and used maliciously, how does your organization recover from scenarios and stay in business?
22.  How does the solution or technology work in order to secure the humans that are using the network and business infrastructure?
23.  How can departments create multi cloud security governance, centralization, and orchestration with human centric security policies to enable your Zero Trust environment?
24.  How do applying a Zero Trust strategy through the implementation of Zero Trust principles mitigate each wave of potential attacks?
25.  What is your level of confidence in the ability to provide Zero Trust with your current security technology?
26.  How can Zero Trust improve your identity and access management practices when moving to a hybrid cloud model?
27.  Are network access control and Zero Trust (software defined perimeter) solutions acceptable as either equivalent or mitigating controls for your organization?
28.  Which identity access/Zero Trust controls will you prioritize for investment in your organization within the next 12 months?
29.  Has COVID-19 and the remote working economy accelerated Zero Trust Security as a priority at your organization?
30.  Approximately how many data and/or security incidents has your organization experienced over the past 12 months?
31.  How does Zero Trust secure your cloud environment, especially in multi-cloud environments?
32.  Does your organization use managed security services in its cybersecurity and privacy programs?
33.  What is the role for MPC based authentication in the IoT security landscape for your organization?
34.  How many different security technologies do you use to protect your endpoint, network and cloud environments?
35.  How does your organization take up Zero Trust with a granular and phased approach, without having to redesign the entire internal IT and network security?
36.  What are key drivers for your organization initiating/augmenting an identity access/Zero Trust management program?
37.  Where does the corporate perimeter really end if personal devices are storing corporate data and accessing organization resources?
38.  To what extent are PKI and digital certificates essential to your organizations Zero Trust security architecture?
39.  What authentication mechanisms are required to provide a sufficient level of trust to allow an individual to access information?
40.  Is it possible to augment your secure access architecture to achieve a Zero Trust model without the extreme of throwing out your existing investments?
41.  Where does SaaS provision of business application introduce any new security considerations for your organization?
42.  How far have your security practitioners come in their effort to bring better security controls to your cloud workloads?
43.  How do your organizations security training programs need to change to reflect the new realities of cyber risk?
44.  Do you employ a Zero Trust policy so that devices that connect to the network are not trusted by default?
45.  As your organization consolidates, how does Zero Trust help reduce risk when integrating infrastructures?
46.  How are your security leaders trying to change the privacy and data security message to one of opportunity and business enablement?
47.  Which cloud delivered security service provides instant access to community based threat data?
48.  Do you apply robust access security policies across all your users cloud and web destinations?
49.  Do you have a clear mobile device and application strategy that provides your employees clear guidelines on using personal (and organization owned) devices?
50.  Are you currently taking a piecemeal, reactive, tactical approach to security, or do you have an orderly, structured, strategic plan for achieving your security objectives?
51.  Do users really understand Zero Trust technologies and where they fit?
52.  Does the technology or solution provide useful analytics and data points and eliminate dark corners of systems and infrastructure?
53.  Which types of security breaches or attacks pose the greatest threat to your organization on a daily or weekly basis?
54.  Zero Trust is about trust no one, about individual nodes within your data center being able to be compromised, how do you keep it from spreading?
55.  How concerned are you with the security of the applications and data in your public cloud environment?
56.  What are your organizations plans to adopt network security and security operations technologies?
57.  What will the future ubiquity of orchestration bring, how will less than Zero Trust evolve, and what do you learn from the past to help you prepare?
58.  With traditional perimeter security lacking, how does your organization protect applications, data, and workforce from ever increasing, high profile cybersecurity threats?
59.  What is the risk and is it worth the expense associated with the Zero Trust Network approach?
60.  Do you look for traffic patterns that might represent an attack and dynamically re-configure the network to repel or at least counter a security threat in a mobile centric world?
61.  What are the key business benefits your organization achieves through adopting network virtualization?
62.  How does your organization maximize security and enable effective real time response without slowing down employees and disrupting the business?
63.  How well are your organizations security experts understood, or do the IT and security teams speak a different language than the business people?
64.  How does your an enterprise security team determine whether a given cyber insurance policy is a good deal?
65.  What impact does the rapid growth of technological innovations have on happiness at your work?
66.  How does your organization manage all of the different capabilities in concert in order to achieve a Zero Trust Architecture?
67.  Do you establish granular policies that create a Zero Trust safe zone for how workloads behave, limiting privileges, access to resources, and behaviors?
68.  Which tools are most important to integrate with an IAM solution to support Zero Trust security?
69.  Do your users have the required level of accreditation to access your applications?
70.  What were, or are, your organizations top concerns around implementing network virtualization or the barriers your organization had/has to overcome in adopting network virtualization?
71.  What kinds of attacks is trust negotiation vulnerable to, and to what degree can they be mitigated?
72.  Can security analysts ensure workers are using trusted applications on a secure mobile device?
73.  Where does your cloud infrastructure complicate data protection by making visibility tougher to obtain?
74.  Where should Zero Trust be in the network model?
75.  Are representatives from the security team included in every business planning meeting that is being held?
76.  How so you remain compliant and prevent security breaches with automated access rights recertification campaigns?
77.  Is proper security being implemented across your organization, not just in the data center or the SOC?
78.  Where are you making an investment in using data, and what part of your organizations mission does it drive?
79.  Do you get the right key to the right place at the right time while also meeting your security and compliance requirements?
80.  If someone is connecting from a mobile device, does your organization do anything to try to protect that mobile device?
81.  How does senior business management prioritize cybersecurity against general business objectives?
82.  Which security profile will provide the best protection against ICMP floods, based on individual combinations of a packets source and destination IP address?
83.  Does a solution offer a single interface for performing security tasks, or will analysts be forced to divide the attention among multiple interfaces?
84.  Does your enterprise currently trust on premise users more, less or the same as off premise users?
85.  How does your organization rightsize security solutions to dynamically fit changing work from home requirements?
86.  Are there any common business roadblocks that prevent security practices from being implemented?
87.  In a hybrid cloud environment, how do your security leaders protect sensitive data, especially as it moves from on-premises to your service providers infrastructures?
88.  What would happen to your organization if one of your privileged users had its identity compromised?
89.  How has COVID-19 and the remote working economy accelerated Zero Trust as a priority at your organization?
90.  How do you protect your Zero Trust control plane systems, and what happens if one is compromised?
91.  How do you know if the CISOs security program has accounted for all the components to be effective?
92.  What reasonable controls do you have in place to detect unusual and unusually high data movement?
93.  How does your organization deal with identity and access management for a geographically dispersed workforce using a myriad different devices?
94.  Do you have disparate processes for different privileged systems (for example, Windows versus UNIX/Linux or data center versus cloud)?
95.  Do you have the visibility and monitoring capabilities you need to comply with internal and external regulations as your business is changing?
96.  What top challenges is your organization facing when it comes to securing access to applications and resources?
97.  Are the solutions in place based on the Zero Trust principles of authentication and authorization for all transactions?
98.  Does the current security policy include how remote employees should handle bring your own device (BYOD)?
99.  How do you effectively protect and segment your Building Management Systems, HVAC, physical security and other nontraditional IT systems from your systems infrastructure?
100.  How has the focus on remote work accelerated the priority of Zero Trust projects at your organization?
101.  Which PKI and certificate management capabilities are most important in your organization to a successful Zero Trust strategy?
102.  What is the likelihood that vulnerabilities would be addressed by applying software defined perimeter/hybrid IT Secure access technology?