The challenge
The SEC needed a comprehensive Zero Trust assessment of its Identity and Device pillars in line with Executive Order 14028. The environment included more than 300 applications, 7 High-Value Assets (HVAs), and 3 identity management products. The gaps, strategy, and implementation plan all had to be delivered within 7 months.
What Zephon did
- HVA risk assessments: security evaluations, gap analysis, and risk mitigation strategies for each High-Value Asset, using the CISA-recommended HVA assessment framework.
- Maturity assessment: mapped existing identity and device controls against the CISA Zero Trust Maturity Model.
- Multi-year strategy: a prioritized, phased implementation roadmap with clear milestones to guide the SEC toward the Optimal maturity level.
- Executive reporting: detailed HVA reports and a multi-year security strategy for leadership.
Results
- The full assessment was delivered ahead of schedule.
- Comprehensive HVA reports with actionable recommendations.
- A phased, structured path to Optimal Zero Trust maturity.