SECURITY
How to choose a Zero Trust implementation partner
5 min read
The question that most reliably separates Zero Trust partners is whether their first month measures the existing environment or deploys controls, because a partner who enforces before measuring is transferring the risk of discovery onto your users.
Zero Trust proposals converge. They cite the same reference architecture, name the same products and arrive at a similar number. The differences that matter are in method and handover, and neither is usually in the document.
These are the questions worth asking, and what the answers tell you.
“What does the first month produce?”
The answer you want describes measurement: an identity and device inventory, policies deployed in report-only mode, a report showing exactly who would have been affected.
The answer that should concern you describes deployment in week one. Enforcing before measuring means the discovery of who is in scope happens through your service desk, and the first rollback is usually followed by a loss of sponsor confidence that the project does not recover from.
“What are the break-glass arrangements?”
A partner who has done this before will answer immediately and in detail: two accounts, excluded from all policies, credentials held by the client, alerting on use, tested before enforcement begins.
Hesitation here is a strong signal. It is the most basic safety measure in identity work and its absence predicts how the rest of the engagement will handle reversibility.
“What do we have when you leave?”
Zero Trust is an ongoing posture, not a delivered project, so the handover determines whether you can run it. The useful answer covers documentation you can read without the partner, administrative access you hold yourself, and a review process you can run.
Be specific: who holds global administrator at the end, whose tenant the policies live in, and whether the documentation is a written runbook or a slide deck.
- Named engineers, and who covers them
- Report-only measurement before any enforcement
- Break-glass accounts, client-held, tested
- Written handover: policy intent, exclusions, review process
- What is explicitly out of scope
“What would you tell us not to do?”
This is the most revealing question in the list. Everyone can describe what to buy. A partner with real experience will have a list of things organisations commonly want that they would push back on — data classification before access control, a thirty-policy Conditional Access estate, universal hardware keys before the enrolment backlog is cleared.
A partner with no objections to anything you have proposed is either unusually lucky in their client or is selling rather than advising.
“How do we know it is working six months in?”
Zero Trust has no completion date, so it needs measures that persist: sign-ins completing without a second factor, devices in scope versus devices compliant, exemptions granted versus exemptions removed, time to revoke access for a leaver.
A partner who proposes these at the start is thinking about the state you will be in after they have gone. One who proposes a maturity score is proposing a slide.
Questions we get asked
Does the size of the partner matter?
Less than the identity of the engineer assigned to you. A large partner brings breadth and a deeper bench for cover; a smaller one usually brings the person who wrote the proposal. Ask who will be in your tenant either way, because that is the variable that actually changes the outcome.
Should a Zero Trust engagement be fixed price?
The assessment phase can reasonably be fixed, because its scope is known. The remediation that follows depends on what the assessment finds — particularly the device enrolment gap — so a fixed price for the whole programme before measuring usually contains either a large contingency or a narrow scope.
Can we do this in-house instead?
Frequently, yes, if someone has the time to own it continuously. The common failure is treating it as a project alongside a full workload, which stalls at the device enrolment stage. An outside partner mostly buys sequencing experience and dedicated attention, not secret knowledge.