Start from an application and identity inventory
You cannot broker access to applications you have not enumerated. Build an inventory of applications, their protocols, their authentication mechanisms, their data sensitivity, and the populations that legitimately use them. Legacy systems that rely on network reachability rather than authentication need explicit handling.
In parallel, consolidate identity. Zero trust assumes a single authoritative source of identity and group membership; multiple partially synchronized directories reintroduce the ambiguity the model is meant to remove.
Define policy in business terms
Policies should read as role, application, condition, and action — a maintenance technician on a managed device may reach the historian read-only from the plant network, and never reach the finance system. Encoding rules as IP ranges reproduces the perimeter you are replacing.
Device posture belongs in the decision: patch level, disk encryption, endpoint agent health. Set posture requirements per application sensitivity rather than one global bar that either blocks operations or protects nothing.
Handle operational technology carefully
Plant floors and clinical environments contain devices that cannot run agents and tolerate no added latency. Front these with brokered access to a jump layer, keep segmentation enforcement at the network boundary for the devices themselves, and confirm changes with the engineers who own the process.
Never roll a posture policy into an OT segment without a tested bypass. Availability constraints there are safety constraints.
Migrate in monitored stages
Run the broker in monitor mode first to learn real access patterns, then enforce for one low-risk application group, then one site, then broaden. Keep the legacy remote-access path available during each stage and decommission it only after the replacement carries the traffic.
Instrument denials as carefully as approvals. A spike in denials after enforcement is usually a policy gap rather than an attack, and fast triage keeps the program credible with the business.
Key takeaways
- Inventory applications and consolidate identity before brokering anything.
- Write policies as role plus application plus posture, never as IP ranges.
- Give OT and clinical devices brokered access with a tested bypass.
- Run monitor mode first, enforce in stages, and triage denials quickly.
Working through this in your own estate?
TalentOp Systems designs, provisions, and operates hybrid infrastructure for regulated, multi-site enterprises.
Start an infrastructure assessment