How do you design a Zero Trust migration roadmap for a legacy enterprise network?

A realistic roadmap avoids a single "flip the switch" migration, since that risks breaking business-critical access overnight. Instead it moves protect-surface by protect-surface, following roughly this sequence:

1. Inventory assets and data flows, classifying which systems hold the most sensitive or business-critical data.
2. Define discrete "protect surfaces", small, well-understood groupings of critical data, assets, applications, and services, rather than trying to protect the whole network at once.
3. Map the actual transaction flows into and out of each protect surface, since you cannot write accurate policy for traffic patterns you haven't observed.
4. Design microperimeters and policy around each protect surface following NIST 800-207 tenets, starting with the highest-value surface first.
5. For legacy applications inside a protect surface that can't be modified, front them with an identity-aware proxy or SDP gateway instead of reworking the application.
6. Deploy new policy in audit/monitor-only mode first, observing what would have been blocked before actually enforcing it, to catch unexpected legitimate flows.
7. Move from monitor to enforce once confidence is high, then repeat the cycle for the next protect surface.

This phased approach trades a faster theoretical timeline for one that doesn't break production access along the way, which is usually the deciding factor for enterprise buy-in.