Zero Trust rollout in financial services: identity and device verification steps

[William.J]

Our mid-sized financial services firm is finally moving forward with a mandated Zero Trust Architecture implementation following a recent security audit, and as the lead security architect, I'm tasked with developing the phased rollout plan. The conceptual principles are clear, but the practical application across our hybrid cloud and legacy on-prem systems feels daunting. For security professionals who have steered a similar transition, what were your first concrete steps in identity and device verification that provided the most immediate risk reduction? How did you manage user experience and pushback during the enforcement of strict access policies, and what tools or frameworks proved indispensable for continuous monitoring and validation in your production environment?