---
title: "Zero Trust i følge Microsoft med referanser til ISO"
canonical: "https://forvarelset.tazk.no/space/TO/83689525/Zero%20Trust%20i%20f%C3%B8lge%20Microsoft%20med%20referanser%20til%20ISO"
format: markdown
---
Kilde: [https://learn.microsoft.com/en-us/security/zero-trust/adopt/zero-trust-adoption-overview](https://learn.microsoft.com/en-us/security/zero-trust/adopt/zero-trust-adoption-overview) 


## Starting a Zero Trust journey

If you are embarking on a Zero trust journey that is aligned to a business scenario or looking to embrace Zero Trust as a strategic defense doctrine, success can be difficult to measure. This is because security doesn't pass a simple pass/fail type of evaluation. Rather, security is a commitment and a journey, to which Zero Trust supplies guiding principles.

Using this adoption guidance as a process framework, first establish and document our security strategy, very similar to a Project Initiation Document (PID). Using the principles that apply to strategy, at minimum, you should document:

- What are you doing?
- Why are you doing it?
- How do you agree on and measure success?

Each business scenario encompasses a different set of assets with different tools to take inventory. Methodically, you begin with an inventory and classification of the assets for each business scenario:

1. **Asset Identification:** What assets do you want to protect, such as identities, data, apps, services, and infrastructure? You may use the functional areas called out above as a guide of where to start. Asset identification forms part of your **Define strategy** and **Plan** lifecycle phases. The **Define strategy** phase can articulate a specific scenario, while the **Plan** phase documents the digital estate.
2. **Asset Classification:** How important is each one of the identified assets, such as identities, business critical data, and human resources data? Asset classification is part of the **Ready** phase where you begin to identify the protection strategy for each asset.
3. **Asset Management:** How do you choose to protect (govern) and administer (manage) these assets?
4. **Asset Recovery:** How do you recover from compromise or loss of control of an asset (govern)?

Each business scenario recommends how to take inventory as well as how to protect the assets and report on progress. While there is inevitably some overlap across the business scenarios, this adoption guidance attempts to simplify as much as possible by addressing asset types in predominantly one business scenario.

## Tracking progress

Tracking your progress throughout the Zero Trust adoption process is crucial as it allows your organization to monitor and measure strategic goals and objectives.

Microsoft recommends taking two approaches to tracking your progress:

1. Measure your progress against mitigating risks to your business.
2. Measure your progress towards achieving strategic objectives across the Zero Trust architecture.

Many organizations use International Organization for Standardization (ISO) standards resources and tools to gauge an organization’s risk. Specifically:

- ISO/IEC 27001:2022
  - Information security, cybersecurity and privacy protection
  - Information security management systems
  - Requirements
- ISO 31000
  - Risk management

The requirements and guidelines in these standards are generic and can apply to any organization. They provide a structured and comprehensive way for you to review and gauge the risks that apply to your organization, as well as mitigations.

Identifying and understanding the specific risks that apply to your organization will help you prioritize your most strategic objectives across the Zero Trust architecture.

Once your organization has identified and prioritized your most strategic technical objectives, you can map out a staged roadmap for implementation. You can then track your progress by using various tools:

- A downloadable [PowerPoint slide deck](https://download.microsoft.com/download/a/b/5/ab51ac2a-e9de-4c8f-8323-6bc7c2f78c1f/ZeroTrust-Adoption-Resources.pptx) with progress tracking slides. These are designed to help you track and communicate progress at a high level. Customize these slides for your own use.
- [Secure Score](https://learn.microsoft.com/en-us/microsoft-365/security/defender/microsoft-secure-score) is an aggregated score of technical controls that contribute to your current security posture. Secure Score gives your organization a global view of the controls that have and are still to be implemented.
- [Cloud Security Posture Management (CSPM) tools](https://learn.microsoft.com/en-us/azure/defender-for-cloud/concept-cloud-security-posture-management) provided with Microsoft Defender for Cloud.

Note that the progress percentage provided by Secure Score might not be accurate for organizations that aren't willing to implement all controls due to reasons such as:

- Scope of the business
- Licensing
- Capacity

Additionally, several portals and reports can assist you in creating an overview of risk within your business, including:

- Reports within Microsoft Defender XDR provide information regarding security trends and track the protection status of your identities, data, devices, applications and infrastructure.
- The Cloud Security Explorer allows you to proactively hunt for security risks.

For example, within Microsoft Defender XDR, the device inventory provides a clear view into newly discovered devices in your network that aren't yet protected. At the top of each **Device inventory** tab, you can see the total number of devices that aren't onboarded. Here's an example.

![Example of the Inventory tab in the Microsoft Defender portal]()

For more information on using Microsoft Defender XDR to track your progress, see [Strengthen your security posture with Microsoft Defender XDR](https://learn.microsoft.com/en-us/microsoft-365/security/security-posture-solution-overview).

For more information about how to use Secure Score, see [Secure Score documentation](https://learn.microsoft.com/en-us/microsoft-365/security/defender/microsoft-secure-score).

## Next Steps

- [Rapidly modernize your security posture](https://learn.microsoft.com/en-us/security/zero-trust/adopt/rapidly-modernize-security-posture)
- [Secure remote and hybrid work with Zero Trust](https://learn.microsoft.com/en-us/security/zero-trust/adopt/secure-remote-hybrid-work)
- [Identify and protect sensitive business data with Zero Trust](https://learn.microsoft.com/en-us/security/zero-trust/adopt/identify-protect-sensitive-business-data)
- [Meet regulatory and compliance requirements](https://learn.microsoft.com/en-us/security/zero-trust/adopt/meet-regulatory-compliance-requirements)