I85PREP
⌘ K
CSA CCZT study materials
CSA CCZT study resources

CSA CCZT: Zero Trust Strategy

CSA CCZT · Work through your exam, one topic at a time.

All guide sections

Zero Trust Strategy

Zero Trust Strategy is the 'why and what' domain: aligning zero trust to business outcomes, securing executive sponsorship, and choosing a defensible sequence of changes. The exam distinguishes strategy from planning and tests the artifacts a strategy must produce-principles, scope, maturity baseline, roadmap themes, governance, and measures.

Core rules

  • Start from business risk and crown-jewel assets, not from a product catalogue. Strategy states outcomes such as reducing lateral movement, protecting regulated data, or enabling remote work.
  • Zero trust is an evolution, not a rip-and-replace. A strategy sets principles and a multi-year direction while preserving critical operations.
  • Secure an executive sponsor and a cross-functional steering group spanning security, identity, network, applications, legal, and business units.
  • Baseline maturity against a model such as the CISA Zero Trust Maturity Model. Use the baseline to choose themes, not to score vendors.
  • Define governance: policy ownership, exception handling, funding model, and decision rights.
  • Define measurable outcomes before pilots: MFA coverage, percentage of access decisions policy-driven, mean time to revoke access, and reduction in implicit trust zones.

Worked example

A retailer's board wants 'zero trust' after a ransomware incident. The strategy team identifies payment data and inventory systems as crown jewels, and the business outcome as containing lateral movement from a compromised user device. Baseline: identity is Initial, networks Traditional, data Initial. The strategy selects three themes over 24 months: phishing-resistant MFA and SSO; device posture for administrators; microsegmentation of payment zones. Each theme has an executive owner and a metric. The reasoning: the strategy does not list products; it sequences outcomes and assigns accountability.

Traps that cost marks

  • Presenting a vendor product list as a strategy.
  • Trying to transform every pillar at once, which dilutes funding and attention.
  • Ignoring culture and user experience; adoption fails without change management.
  • Setting no baseline or metrics, making progress unprovable.