What should organisations do first when they want to move from perimeter security to zero trust in a flat network?

The first step is to map high value assets and agree on which systems matter most to the business. That requires input from security, legal, finance, and infrastructure stakeholders. Once the crown jewels are identified, teams can choose controls such as segmentation and identity and access management to limit which devices and processes can reach them.

Why the first move is business-critical asset mapping

Perimeter security fails as a primary strategy in flat networks because once an attacker or misused process reaches the inside, lateral movement is often easy. Zero trust changes the design target from “keep everyone out” to “constrain access to what matters most”, so the first planning step is to identify the systems that would cause the greatest business harm if exposed or misused.

This is less about choosing a toolset than about setting the protection boundary correctly. If teams start with segmentation diagrams or identity controls before agreeing on the crown jewels, they often automate the wrong trust boundaries and overprotect low-value systems while leaving critical ones too open.

That asset-led view also makes the programme defensible across technical and non-technical stakeholders. Security can describe exposure, finance can rank business impact, legal can surface regulatory sensitivity, and infrastructure can validate feasibility before any policy is enforced.

What “crown jewels” means in practice

The term should be read narrowly enough to drive action. The assets that matter most are not every server or application, but the systems whose compromise would stop revenue, expose regulated data, disrupt operations, or undermine trust in a core service.

Good candidates usually include sensitive data stores, transaction systems, authentication services, privileged administration planes, and the control systems that other services depend on. In a flat network, these assets need explicit boundaries because their value comes not only from what they contain, but from the access they can enable if misused.

NHIMG’s Ultimate Guide section on NHI security standards is useful here because the same inventory discipline later supports identity and access decisions around workloads, services, and privileged automation.

How zero trust follows from the inventory, not the other way around

Once high value assets are agreed, the next step is to define who or what should be allowed to reach them, under what conditions, and with what level of privilege. That is where segmentation, identity and access management, and other policy controls become precise rather than generic.

In a flat network, the practical objective is to reduce implicit trust. Instead of assuming that a device or internal subnet is safe, teams should define smaller trust zones, require stronger verification for access to important systems, and separate administrative pathways from ordinary business traffic.

Guide to SPIFFE and SPIRE is a strong companion when the next question becomes how to express trust for workloads and services that need to talk to one another after the asset map is complete.

Risk and Threat Considerations

Flat-network environments increase the blast radius of a compromise because internal reachability is often broader than the business actually needs. If the crown jewels are not identified first, segmentation and access controls can end up protecting the wrong systems, while attackers or misconfigured processes retain a path to the most valuable ones.

Failure mechanism: The organisation treats “inside the network” as a trust signal, so lateral movement, excessive east-west access, and unchecked administrative paths remain available after the first foothold or policy mistake.

Impact: A single compromised endpoint, account, or service can reach more systems than intended, turning one incident into data exposure, operational disruption, or privileged access to core assets.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

NIST Zero Trust (SP 800-207), NIST SP 800-53 Rev 5 and CIS Controls v8 set the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.

Framework	Control / Reference	Relevance
NIST Zero Trust (SP 800-207)	3.2 — Logical Components and Data Flows	Zero trust starts by mapping protected assets and trust boundaries.
Recommendation — Map crown jewels and trust zones before enforcing access policies.
NIST SP 800-53 Rev 5	AC-4 — Information Flow Enforcement	Segmentation and constrained east-west access depend on controlled information flows.
	RA-2 — Security Categorization	Crown-jewel identification is a categorization step that prioritizes safeguards by impact.
Recommendation — Enforce information flow rules around the systems you identify as critical. Categorize systems by business impact before choosing protective controls.
CIS Controls v8	CIS-12 — Network Infrastructure Management	Network segmentation and boundary design are core to reducing flat-network exposure.
Recommendation — Segment network paths to reduce unnecessary lateral movement.
ISO/IEC 27001:2022	A.5.9 — Inventory of information and other associated assets	Asset inventory is the prerequisite for deciding which systems deserve stronger protection.
Recommendation — Maintain an asset inventory that identifies the systems most critical to the business.

Practitioner Guidance

What to prioritise: Start with a short, jointly agreed list of crown jewels and the business outcomes each one protects. If teams cannot explain why an asset is on the list, it is usually too broad for the first phase of zero trust design.

What to verify: Confirm that the inventory includes the systems that enable privileged access, not just the systems that store data. A zero trust programme is weaker when it protects records but leaves administration, orchestration, or identity dependencies treated as ordinary internal traffic.

Practitioner takeaway: The first zero trust decision is not about the control stack, it is about deciding what must be hardest to reach so that later segmentation and access decisions are anchored to business value rather than network convenience.