Zero Trust starts like many other strategic initiatives do: An executive (likely the CISO) sets a bold vision to implement a new model, framework, or technology across the enterprise. Typically, the leader gets buy-in, the security team develops a plan, and architects get to sketching out and designing the architecture. As months or years go by, however, progress slows. Meetings turn into debates. Ownership remains unclear. In the case of Zero Trust, segmentation initiatives are stalled because no one knew who was accountable. Data classification is delayed because business units were not consulted. Thus, the Zero Trust journey, with all of its promise, is stymied by misalignment between teams.
This is an all-too-common scenario that organizations contend with today. Despite the urgency to implement Zero Trust, organizations often underestimate the complexity of coordinating across all of its domains — and, more importantly, across people.
Address The Alignment Gap In Zero Trust
As we’ve stated many times previously, Zero Trust is not a product — it’s a strategy that spans multiple domains. As such, each domain requires collaboration across technical and nontechnical stakeholders. Yet many organizations have been treating Zero Trust as a purely IT- or security-only initiative. This results in a siloed approach that leads to delays, duplicated efforts, and governance breakdowns. The root cause? A lack of clarity on who does what.
Enter The Zero Trust RASCI Chart
Forrester’s latest report introduces our Zero Trust RASCI Chart — a tool for defining roles and responsibilities as they relate to essential activities across the core domains of Zero Trust. The RASCI chart assigns the following roles for Zero Trust implementation: responsible, accountable, supportive, consulted, and informed. These roles are assigned based on the nature of the initiative tied to a project and at the stage of the lifecycle that the project is in.
By applying RASCI to each Zero Trust-aligned initiative across various domains, organizations can clarify ownership, reduce friction, and accelerate execution. Make the RASCI chart actionable by mapping roles across the project lifecycle for each domain. For example:
Discover. Identify current state, gaps, and dependencies. This also includes engaging business units early to understand data flows and user access needs.
** RASCI tip: Make business stakeholders consulted and informed to ensure alignment.
Plan. Define scope, success metrics, and governance. Align with enterprise architecture and compliance teams as well as industry and regional requirements.
** RASCI tip: Assign accountable roles to domain leads and supportive roles to the PMO.
Design. Architect solutions for desirable outcomes such as segmentation, identity, and workload protection. Ensure that cross-domain integrations (e.g., network + identity) are well defined to achieve outcomes.
** RASCI tip: Include architects and security engineers as responsible and consulted.
Implement. Deploy controls, configure tools, and onboard users (or BYO). Coordinate with change management and training teams.
** RASCI tip: Make IT operations responsible, with business units informed.
Monitor and evaluate. Track KPIs, audit controls, and adapt to threats. Review governance and update policies.
** RASCI tip: Assign accountable roles to governance leads and consulted roles to risk teams.
Forrester clients can access the full report and RASCI chart tool here.
Include Stakeholders Beyond IT And Security
Understand that Zero Trust impacts how people access data, how applications are built, and how decisions are made. That’s why it’s critical to include stakeholders from across the organization outside of IT and security. These can include HR (for identity lifecycle), legal and compliance (for data governance), finance (for budget and risk tolerance), and business units (for operational alignment). This broader inclusion ensures that Zero Trust supports business objectives to focus the intent behind its strategic adoption to be not solely technical change.
Adapt The RASCI Chart To Fit Your Organizational Structure
Technology, threats, and business priorities are constantly evolving — which means your governance model must evolve with them. A static RASCI chart can quickly become outdated, leading to misalignment and inefficiencies. Stay resilient and responsive. This means organizations should regularly revisit and refine their RASCI assignments to reflect:
Adoption of new tools or platforms.
Shifts in organizational structure or roles.
Emerging threats and evolving compliance requirements.
By embracing an adaptive approach, you ensure that your Zero Trust strategy remains aligned with both operational realities and strategic objectives.
Use The RASCI Chart As A Strategic Enabler
Zero Trust is a journey — and like any journey, it needs a map. The RASCI chart helps clarify roles, align stakeholders, and enable execution in a manner that gets the ball rolling for creating a map to govern your Zero Trust implementation. When applied thoughtfully across domains and lifecycle stages, the RASCI chart helps transform Zero Trust from a vision into a reality.
Connect With Me
Forrester clients can reach out to schedule an inquiry or guidance session to discuss more about how to effectively adopt the Zero Trust RASCI Chart and discuss the activities highlighted within the template.
I will also be in Austin, Texas, on November 5–7 with a host of colleagues for the Forrester Security & Risk Summit. I’m leading a session on establishing a governance framework for Zero Trust. The event agenda includes tracks not only focused on Zero Trust but also a variety of keynotes, breakouts, workshops, roundtables, and special programs curated to help you master whatever new challenges your teams are facing today. We hope to see you there!
