Strategic Management of Zero-Trust Network Architecture Implementation in Large Organizations

Mohammad Ali  Haghighi

Authors

Mohammad Ali Haghighi MA, Department of Computer Engineering, Faculty of Computer Engineering, University of Science and Technology, Tehran, Iran Corresponding author https://orcid.org/0000-0003-1876-3658

Keywords:

Zero-trust architecture; strategic management; cybersecurity governance; technological readiness; change management; structural equation modeling.

Abstract

This study aimed to develop and test a structural model explaining the direct and indirect effects of strategic alignment and executive commitment, governance and policy development, technological and infrastructural readiness, human resources and change management, and cybersecurity risk and compliance management on the effectiveness of zero-trust network architecture implementation in large organizations. This applied, quantitative, cross-sectional, descriptive-correlational study was conducted among 384 senior managers, information technology managers, cybersecurity specialists, network administrators, enterprise architects, and risk and governance professionals employed in large public and private organizations in Tehran, Iran. Participants were selected using proportional stratified and purposive sampling. Data were collected using a demographic form and the 48-item Strategic Management of Zero-Trust Architecture Implementation Questionnaire. The instrument measured six dimensions and demonstrated acceptable content validity, construct validity, internal consistency, convergent validity, and discriminant validity. Data were analyzed using descriptive statistics, Pearson correlation coefficients, confirmatory factor analysis, and partial least squares structural equation modeling in SPSS 27 and SmartPLS 4. All proposed direct and indirect paths were positive and statistically significant. Strategic alignment and executive commitment significantly predicted governance and policy development (β = 0.58, p < 0.001), technological and infrastructural readiness (β = 0.37, p < 0.001), and human resources and change management (β = 0.44, p < 0.001). Governance significantly predicted cybersecurity risk and compliance management (β = 0.49, p < 0.001). Technological readiness had the strongest direct effect on implementation effectiveness (β = 0.30, p < 0.001), followed by governance (β = 0.22, p < 0.001), cybersecurity risk management (β = 0.21, p < 0.001), human resources and change management (β = 0.19, p < 0.001), and strategic alignment (β = 0.14, p = 0.003). The model explained 68.3% of the variance in implementation effectiveness. Effective zero-trust implementation depends on the coordinated development of executive leadership, formal governance, technological readiness, workforce adaptation, and risk-management capability rather than on isolated security technologies.

References

[1] A. Wylde, "Zero Trust: Never Trust, Always Verify," pp. 1-4, 2021, doi: 10.1109/cybersa52016.2021.9478244.

[2] C. Sample, C. Shelton, S. M. Loo, C. Justice, L. Hornung, and I. Poynter, "ZTA: Never Trust, Always Verify," European Conference on Cyber Warfare and Security, vol. 21, no. 1, pp. 256-262, 2022, doi: 10.34190/eccws.21.1.309.

[3] R. Chandramouli, "Guide to Secure Enterprise Network Access Landscape," 2022, doi: 10.6028/nist.sp.800-215.ipd.

[4] R. Chandramouli, "Guide to a Secure Enterprise Network Landscape," 2022, doi: 10.6028/nist.sp.800-215.

[5] S. Rose, "Planning for a Zero Trust Architecture," 2022, doi: 10.6028/nist.cswp.20.

[6] Y. He, D. Huang, L. Chen, Y. Ni, and X. Ma, "A Survey on Zero Trust Architecture: Challenges and Future Trends," Wireless Communications and Mobile Computing, vol. 2022, no. 1, 2022, doi: 10.1155/2022/6476274.

[7] H. Kang, G. Liu, Q. Wang, L. Meng, and J. Liu, "Theory and Application of Zero Trust Security: A Brief Survey," Entropy, vol. 25, no. 12, p. 1595, 2023, doi: 10.3390/e25121595.

[8] P. Dhiman et al., "A Review and Comparative Analysis of Relevant Approaches of Zero Trust Network Model," Sensors, vol. 24, no. 4, p. 1328, 2024, doi: 10.3390/s24041328.

[9] S. K. Nanda and R. Priyadarshini, "A Comprehensive Review and Comparative Analysis of Zero Trust Architecture: Evolution, Implementation Strategies, and Key Challenges," Journal of Computer Security, vol. 34, no. 2, pp. 85-110, 2025, doi: 10.1177/0926227x251409922.

[10] S. Mushtaq, M. Mohsin, and M. Mushtaq, "A Systematic Literature Review on the Implementation and Challenges of Zero Trust Architecture Across Domains," Sensors, vol. 25, no. 19, p. 6118, 2025, doi: 10.3390/s25196118.

[11] H. Salminen, "Zero Trust: The Magic Bullet or Devil’s Advocate?," European Conference on Cyber Warfare and Security, vol. 22, no. 1, pp. 678-686, 2023, doi: 10.34190/eccws.22.1.1263.

[12] K. M. Adamson and A. Qureshi, "Zero Trust 2.0: Advances, Challenges, and Future Directions in ZTA," 2025, doi: 10.21203/rs.3.rs-6602547/v1.

[13] I. Ogbaga, C. Ogbonnaya, and A. Chukwuemeka, "Deployment of Zero Trust Access (ZTA) Policy as a Veritable Tool for Protecting Network Infrastructures and Users," 2023, doi: 10.20944/preprints202307.0006.v1.

[14] R. Chandramouli and Z. Butcher, "A Zero Trust Architecture Model for Access Control in Cloud-Native Applications in Multi-Location Environments," 2023, doi: 10.6028/nist.sp.800-207a.

[15] S. Sarkar, G. Choudhary, S. K. Shandilya, H. Azath, and H. Kim, "Security of Zero Trust Networks in Cloud Computing: A Comparative Review," Sustainability, vol. 14, no. 18, p. 11213, 2022, doi: 10.3390/su141811213.

[16] S. Ahmadi, "Zero Trust Architecture in Cloud Networks: Application, Challenges and Future Opportunities," 2024, doi: 10.31219/osf.io/dt4km.

[17] V. Dakić, Z. Morić, A. Kapulica, and D. Regvart, "Analysis of Azure Zero Trust Architecture Implementation for Mid-Size Organizations," 2024, doi: 10.20944/preprints202407.1454.v1.

[18] R. Li and X. Cao, "Research on the Design of Network Security System for Natural Resources Big Data Platform Based on Zero-Trust Architecture," p. 81, 2024, doi: 10.1117/12.3038292.

[19] Y. Cao, S. R. Pokhrel, Y. Zhu, R. Doss, and G. Li, "Automation and Orchestration of Zero Trust Architecture:Potential Solutions and Challenges," 2022, doi: 10.36227/techrxiv.21385929.

[20] A. Hassan, A. Rauf, N. Shafqat, R. Latif, and H. Khan, "ZenGuard a Machine Learning Based Zero Trust Framework for Context Aware Threat Mitigation Using SIEM SOAR and UEBA," Scientific Reports, vol. 15, no. 1, 2025, doi: 10.1038/s41598-025-20998-4.

[21] B. Dash, "Zero-Trust Architecture (ZTA): Designing an AI-Powered Cloud Security Framework for LLMs’ Black Box Problems," Current Trends in Eng Sc, vol. 4, no. 2, pp. 1-5, 2024, doi: 10.54026/ctes/1058.

[22] S. Teerakanok, T. Uehara, and A. Inomata, "Migrating to Zero Trust Architecture: Reviews and Challenges," Security and Communication Networks, vol. 2021, pp. 1-10, 2021, doi: 10.1155/2021/9947347.

[23] P. Phiayura and S. Teerakanok, "A Comprehensive Framework for Migrating to Zero Trust Architecture," Ieee Access, vol. 11, pp. 19487-19511, 2023, doi: 10.1109/access.2023.3248622.

[24] A. Akinsanya, "Manufacturing Cybersecurity for SMEs: Implementing Zero Trust in Legacy Industrial Environments," 2026, doi: 10.21203/rs.3.rs-8846670/v1.

[25] C. Perducat, D. C. Mazur, W. Mukai, S. N. Sandler, M. Anthony, and J. Mills, "Evolution and Trends of Cloud on Industrial OT Networks," Ieee Open Journal of Industry Applications, vol. 4, pp. 291-303, 2023, doi: 10.1109/ojia.2023.3309669.

[26] A. M. Abdelmagid and R. Dı́az, "Zero Trust Architecture as a Risk Countermeasure in Small–Medium Enterprises and Advanced Technology Systems," Risk Analysis, vol. 45, no. 8, pp. 2390-2414, 2025, doi: 10.1111/risa.70026.

[27] B. Karabacak and T. N. Whittaker, "Zero Trust and Advanced Persistent Threats: Who Will Win the War?," International Conference on Cyber Warfare and Security, vol. 17, no. 1, pp. 92-101, 2022, doi: 10.34190/iccws.17.1.10.

[28] U. B. Chaudhry and A. K. M. Hydros, "Zero‐trust‐based Security Model Against Data Breaches in the Banking Sector: A Blockchain Consensus Algorithm," Iet Blockchain, vol. 3, no. 2, pp. 98-115, 2023, doi: 10.1049/blc2.12028.

[29] A. Siddiki, "Vault-Based Secret Management and Zero-Trust Security Model for Distributed Financial Applications," 2026, doi: 10.21203/rs.3.rs-9916782/v1.

[30] S. Sun, M. Repeta, V. Nandall, E. Fung, and C. D. Thomas, "Towards 5G Zero Trusted Air Interface Architecture," 2022, doi: 10.48550/arxiv.2211.03776.

[31] N. Ngema, B. Nleya, and R. C. Maswanganyi, "A Review of Zero Trust Architecture: Principles, Applications, and Implementation Challenges in Communication, Navigation, and Surveillance (CNS) Systems," Sensors, vol. 26, no. 12, p. 3813, 2026, doi: 10.3390/s26123813.

[32] S. R. Pokhrel, G. Li, R. Doss, and S. Nepal‬, "Towards Decentralized Operationalization of Zero Trust Architecture," 2022, doi: 10.36227/techrxiv.19127090.

[33] T. Mawla, M. Gupta, and R. Sandhu, "BlueSky: Activity Control: A Vision for "Active" Security Models for Smart Collaborative Systems," pp. 207-216, 2022, doi: 10.1145/3532105.3535017.

[34] A. Alquwayzani and A. Albuali, "A Systematic Literature Review of Zero Trust Architecture for UAV Security Systems in IoBT," 2024, doi: 10.20944/preprints202403.0349.v1.

[35] Z. Bassfar, A. Sayeed, P. H. M. Bala, A. Alshehri, A. M. Alanazi, and S. Zubair, "Toward Secure and Resilient Networks: A Zero-Trust Security Framework With Quantum Fingerprinting for Devices Accessing Network," Mathematics, vol. 11, no. 12, p. 2653, 2023, doi: 10.3390/math11122653.

[36] S. Yevseiev et al., "The Concept of Building Security of the Network With Elements of the Semiotic Approach," Sciencerise, no. 1, pp. 24-34, 2023, doi: 10.21303/2313-8416.2023.002828.