ISC2 Zero Trust Strategy Certificate

Zero trust fails when users and teams experience it as obstruction. You identify stakeholders, shape messages for each, secure executive sponsorship, handle resistance, and plan the training and feedback that make adoption last.

• Mapping stakeholders and what each one fears
• Messaging for executives, IT and end users
• Executive sponsorship and governance
• Handling resistance and friction
• Training and ongoing feedback loops
• Measuring adoption, not just deployment

You build A stakeholder communication plan for a zero trust rollout, with messages and measures per audience.

Zero trust is justified by what it changes in the attack path. You show how it shrinks attack surface and blast radius, map it to existing controls and programs, and set measures that show posture improving over time.

• Reducing attack surface and blast radius
• Mapping zero trust to existing controls and frameworks
• Integrating with current security programs
• Visibility and telemetry as foundations
• Measuring posture improvement
• Avoiding gaps between old and new controls

You build A posture improvement case that maps zero trust capabilities to specific attack paths they close.

Cloud workloads change faster than any perimeter can follow. You apply identity-centered access, workload identity, segmentation and posture management to cloud estates, and secure service-to-service traffic.

• Identity as the control plane in cloud
• Workload and service identity
• Service-to-service authentication with mutual TLS
• Cloud microsegmentation and policy
• Posture management and drift detection
• Zero trust across more than one provider

You build A zero trust design for a cloud workload with workload identity, segmentation and posture checks.

Trust is granted for a moment, not for a session. You design least privilege access, conditional and risk-based authentication, device posture checks and just-in-time elevation, then keep verifying as signals change.

• Least privilege design for users and services
• Conditional access and risk-based authentication
• Device health and posture as an input
• Just-in-time and just-enough access
• Continuous evaluation and session revocation
• Balancing security with usability

You build An access policy set with conditions, posture checks and step-up rules for three user groups.

Segmentation turns a breach into an incident of limited size. You identify the resources that matter most, design segmentation from network zones to microsegments, and apply the approach to government and commercial resources alike.

• Identifying what must be protected first
• Macro and micro-segmentation designs
• Data-centric controls and classification
• Segmentation for legacy and operational systems
• Testing that segmentation holds
• Operating segmentation over time

You build A segmentation plan for a set of critical resources, with policy rules and a validation test.

Zero trust changes what risk looks like and how response works. You adapt risk assessment methods to the model, and rewrite incident response plans to use identity, session and segment controls as containment tools.

• Risk assessment methods for zero trust environments
• Telemetry that supports detection and response
• Containment by revoking sessions and isolating segments
• Adapting response playbooks and roles
• Exercising response in a zero trust design
• Learning from incidents to adjust policy

You build A revised incident response playbook that uses zero trust controls for containment.

Bring architecture, communication, cloud, access and response into one plan. You assess a sample organization, choose the first protect surfaces, sequence the work and define the measures a program sponsor will track.

• Assessing the current state
• Choosing the first resources to protect
• Sequencing technology and communication work
• Defining measures and review points
• Presenting the roadmap to sponsors

You build A phased zero trust roadmap with scope, sequence, owners and measures.