Fee
Register to see indicative feesConfirmed in writing after discovery01 / Build & Advisory · Supporting
Security Architecture & Zero Trust
The architecture has grown by accretion, and zero trust has been named as the destination without anyone defining what it means here.
Strategy & ArchitectureBuild and advisory
Typical duration
10 to 16 weeksScoped after a discovery phasePrimary artefact
Target-state architecturePlus one moreWho leads it
Steve SharmaFounder & Principal04 / What this is
What Security Architecture & Zero Trust is
A design engagement producing a target-state security architecture and a migration sequence that survives contact with the estate you actually have.
And what this service produces
Zero trust is a set of principles, not a product. This engagement decides which of those principles apply to you, in what order, and what they cost.
05 / Who it is for
Built for a real assurance trigger, not a badge project.
01
This fits when
- The architecture has accreted over time and there is no reference design.
- Your team has been told to do zero trust without a definition.
- A major migration or consolidation is being planned.
02
The usual trigger
- A board or vendor has named zero trust as the target.
- A migration or consolidation is being planned.
- An audit found architectural weaknesses.
06 / The obligation
What zero trust means once you remove the marketing
Zero trust is not a product and cannot be purchased. It is a small set of principles (verify explicitly, use least privilege, assume breach) applied to identity, devices, networks, applications and data.
The hard part is not agreeing with the principles. It is deciding which parts of your estate to apply them to first, given that full application is a multi-year programme and most organisations cannot pause operations to do it.
The sequence is the deliverable
The deliverable that matters is the migration sequence, not the target-state diagram. Everyone can draw the target state.
Where programmes quietly stop
The first domain, usually identity, delivers visible benefit and gets funded. The second and third touch systems that are older, more coupled and owned by people who did not ask for this, and the business case for them is harder to make in isolation.
Each phase states what it buys
A sequence that does not state what each phase buys on its own gets abandoned after phase one, with the estate half-migrated and running two models at once, which is worse than either.
Everyone can draw the destination. The engagement earns its fee in the sequence that gets you there without stopping the business.
07 / What you receive
Two artefacts. Each one yours to keep.
- 01
Target-state architecture
The design, with control points named and each principle mapped to where it actually applies.
Architecture document + diagramsArchitecture owner - 02
Migration sequence
What moves when, what depends on what, and what can be deferred without breaking the rest.
Sequenced planProgramme planning
08 / Scope
The whole system is visible before work begins.
Current state
- Architecture and data flows mapped
- Identity, device and network posture
- Existing controls and their coverage
Target state
- Principles mapped to domains
- Control points defined
- What stays out of scope, and why
Migration
- Sequence by risk and dependency
- Coexistence during transition
- Deferral options stated
Handover
- Architecture board briefing
- Reference patterns
- Named internal owner
09 / Included / not included
A useful boundary is part of the deliverable.
Included
- Current-state architecture mapping
- Target-state design
- Migration sequencing
- Handover to a named owner
Not included
- Implementation: We design and sequence. Building it is your team or a partner.
- Product selection: Vendor-neutral, no product margin.
- Ongoing architecture governance: Handed to a named owner.
10 / How we do it
A traceable path from scope to evidence.
Discovery
Current architecture, identity posture and data flows mapped.
Target-state design
Principles mapped to your domains, control points defined.
Migration sequencing
Sequence, dependencies and deferral options.
Handover
Architecture board briefing and named owner.
Mapped againstNIST SP 800-207NIST Cybersecurity FrameworkSABSAISO/IEC 27001
11 / Timeline
10 to 16 weeks of work.
Elapsed time and customer effort are separated because they are not the same number.
Weeks 1 to 4
Discovery and current-state mapping
Map the current architecture, identity posture and data flows. The fee is confirmed at the end of this phase.
Customer effort
5-8 interviews, plus architecture and identity system access.
Weeks 5 to 9
Target-state design
Map the principles to your domains and define the control points.
Customer effort
Two review cycles with architecture.
Weeks 10 to 14
Migration sequencing
Set the sequence, the dependencies and the deferral options.
Customer effort
One half-day workshop with operations.
Weeks 15 to 16
Handover and board briefing
Brief the architecture board and hand over to a named owner.
Customer effort
One architecture board session.
Our work: 10 to 16 weeks
12 / Scope check
Test whether Security Architecture & Zero Trust
is the right next move.
We will cover likely scope, cost and fit.
Book a confidential strategy sessionWith Steve Sharma, who would lead.13 / Who leads the engagement
Named lead. Direct assessment.
Your engagement lead
Steve Sharma
Founder & Principal
Authors the target-state design and the migration sequence.
ASD-endorsed IRAP AssessorCISSPCREST
Every engagement has a named lead. Where a second executive or specialist is needed, they are named in the proposal and subject to client approval.
Review leadership record14 / Why Cybersecurity Link
Three decisions.
Accountability.
The sequence is the deliverable.
Everyone can draw the target state. The value is in getting there without stopping the business.
Vendor-neutral by construction.
No product margin, so the design states requirements rather than a stack.
Deferral options stated explicitly.
Every phase says what happens if it is delayed, because something always is.
15 / The boundary
What this engagement does not claim.
Delivery
We design and sequence. We do not implement.
Building the architecture sits with your team or an implementation partner.
Independence
We are vendor-neutral and take no product margin.
The design is requirement-led, not built around a stack.
Operations
We are not a managed security service.
Ongoing architecture governance is handed to a named internal owner.
Frameworks
One design, mapped across four references.
The work maps to NIST SP 800-207, the NIST Cybersecurity Framework, SABSA and ISO/IEC 27001.
What moves the fee
Estate size and complexity, the primary driver, confirmed at discovery.
Where a modern identity platform is already in place.
Discovery as a bounded fixed feeThe engagement quoted in writing after discoveryTarget-state architecture and migration sequenceImplementation and product selection excluded
18 / How this fits
Where this sits in the wider programme.
19 / When this is not right
Sometimes the best recommendation is a smaller service, or a later date.
01
No wider security strategy exists yet.
The roadmap should come first, or this has nothing to sequence against.
02
You need one domain fixed rather than the whole architecture.
Identity or cloud work is more direct.
03
You want the design implemented too.
We do not implement, and we would rather say so. Talk to us about the right route.
20 / FAQ
The questions that change the decision.
No, and anyone selling it as one is selling something else. It is a set of principles applied across identity, devices, networks, applications and data, and the work is deciding where to apply them first.
No. We design and sequence, then hand over to your team or a partner. We do not take product margin either, so the design is requirement-led.
Multi-year for most organisations, which is exactly why the sequence matters more than the diagram. We build it so phases can be deferred without collapsing the rest.
21 / Next move
If Security Architecture & Zero Trust is what you need, the next step is a conversation about scope.
A 45-minute conversation with Steve Sharma, who would lead the engagement: what your scope looks like, what it involves, and whether this is the right service for you at all.