transition-state-zero-trust-toolkit README

The project's README from github.com/theycallmehassan1/transition-state-zero-trust-toolkit. As one markdown file: README.md.

Transition-State Zero Trust Adoption Toolkit

Open, vendor-neutral operational templates for governing the transition state between legacy infrastructure and zero trust, aligned with NIST SP 1800-35.

Version 0.1 (community review draft), August 2026.

The problem this addresses

NIST SP 1800-35 establishes that zero trust adoption is incremental rather than a single deployment. What it does not cover in depth is the period in between: the months or years when legacy identity paths, temporary firewall exceptions, hybrid dependencies, partial telemetry and new enforcement points all operate at the same time.

That period is where temporary conditions quietly become permanent ones. A rule opened "just for the migration" outlives the migration. An exception granted to one team is never reviewed because nobody owns it. The organization reaches its target architecture with a layer of undocumented risk underneath it.

The toolkit exists to make that middle state explicit: which dependency is blocking segmentation, which exception is temporary, who owns it, when it expires, what has to be true before it can be retired, and whether the internal team can operate the result once the implementers leave.

What is in here

Artifact Format Use
Environment intake XLSX Baseline the actual environment before scoring anything, including a workload register and an applicability map
Readiness scorecard XLSX Baseline twelve capability domains, 0-5, with evidence
Transition-state risk register XLSX Ownership, compensating control, expiry, retirement condition
Data sensitivity and migration sequencing XLSX Order workloads using approved sensitivity and readiness
Integration readiness checklist CSV Validate multi-vendor policy chains before you depend on them
Transition test cases CSV Ten reusable validation scenarios
Handover and operating model checklist Markdown Confirm the internal team can actually run it
Four-week pilot plan Markdown Bounded way to try the toolkit
Environment intake call guide Markdown One page to run the week 1 intake conversation
Pilot feedback form Markdown Structured input for the next version
SP 1800-35 alignment notes Markdown Traceability and scope boundaries

Each spreadsheet opens on a Read Me sheet explaining what it is for, followed by a working sheet with shaded cells to complete and a worked sample.

Where to start

Start with the environment intake, regardless of where you are in a migration. It establishes what actually exists before anything gets scored, and it decides which scorecard domains and test cases apply to your organization at all. Running the scorecard before the intake usually produces a score for something that does not describe the environment in front of you.

Once the intake is done, move to the readiness scorecard. It takes an afternoon with the right people in the room and it will tell you which domains are going to cause you trouble.

If you are already mid-migration and know you have accumulated temporary exceptions, start with the risk register instead. Getting them into one place with names and dates against them is usually the single highest-value hour available to you.

If you are choosing products, start with the integration readiness checklist, before procurement rather than after.

Who this is for

Organizations with real constraints: small teams, legacy systems that cannot simply be switched off, uneven documentation, and obligations they have to meet anyway. State and local government, community colleges, healthcare and financial SMEs, credit unions, nonprofits handling sensitive data, and the service providers supporting them.

It assumes no specialist tooling and no consultant to interpret it.

Scope and honest limits

This is independent practitioner work. It is informed by NIST SP 1800-35, NIST SP 800-207, NIST CSF 2.0 and NIST SP 800-53 Rev. 5, and it uses the language "aligned with" and "complements" deliberately.

It is not endorsed, approved, certified or validated by NIST, the NCCoE, CISA or any other government entity. It is not a compliance determination, an audit opinion, a FedRAMP authorization package, or a guarantee against breach. It does not replace formal data classification, privacy review, legal review or enterprise risk management.

Sample values throughout are constructed for illustration. They are not results from a real organization, and should not be presented as such.

Contributing

Feedback from practitioners who have actually run a migration is the most useful thing this project can receive, particularly on whether the fields are sufficient, which are missing and which are noise. See CONTRIBUTING.md.

License

Released under CC BY 4.0. Use it, adapt it, publish your changes. Attribution is appreciated and required.

transition-state-zero-trust-toolkit (theycallmehassan1/transition-state-zero-trust-toolkit)

Searching Database…

114 ·GitHub
Transition-state-zero-trust-toolkit
这是什么？一套开放、厂商中立的工作表、检查清单、测试记录和试点材料，用于治理零信任迁移中混乱的中间阶段，设计上与 NIST SP 1800-35 互补。
这是软件，还是只是我填写的文档？它是一组文档，不是软件：电子表格、CSV 和 Markdown 文件。每个电子表格都有一个 Read Me 工作表、一个带待填写阴影单元格的工作表，以及一份填写好的示例。
从哪里开始使用它？无论迁移进行到哪一步，都先从环境信息收集文档开始；在给其他任何东西打分之前，它先弄清实际存在什么，并决定哪些计分卡域和测试用例适用于你。
打开和使用这些文件需要什么？只需要能打开 XLSX 表格、CSV 文件和 Markdown 文本的软件——不假设你会编程、调用 API 或使用专业工具。
这是官方的 NIST 认证或审计吗？不是。它是参考 NIST SP 1800-35、800-207、CSF 2.0 和 800-53 Rev. 5 编写的独立从业者成果，但未经 NIST、NCCoE 或 CISA 的认可、认证或验证，也不是合规判定、审计意见或 FedRAMP 材料。
这套工具包是为谁打造的？面向有现实约束、又没有专门工具或顾问的组织：小团队、州和地方政府、社区学院、医疗和金融领域的中小企业、信用合作社，以及处理敏感数据的非营利组织。
工具包实际包含哪些材料？共 11 份：环境信息收集表、12 域就绪度计分卡、过渡期风险登记册、数据敏感度/迁移排序表、集成就绪检查清单、十个过渡测试用例、交接/运营模式检查清单、为期四周的试点计划、信息收集通话指南、试点反馈表，以及 SP 1800-35 对齐说明。
为什么不直接用 NIST SP 1800-35？SP 1800-35 说明了零信任落地是渐进式的，但对遗留路径、临时例外和新的强制措施并存的过渡期没有深入覆盖。这套工具包正是为了让这一过渡状态显性化、可追踪。
试点计划要运行多久？附带的试点计划设计为四周，是在进一步投入之前有限度试用这套工具包的一种方式。
如果我在迁移中途已经积累了一些临时例外，应该从哪里入手？先从风险登记册入手，而不是信息收集表——把现有例外集中到一处并指定负责人和到期日期，被称为价值最高的一个小时。
What are similar projects?legal-templates, the-practical-linux-hardening-guide, architecture-decision-record, chinese-buy-us-stock-guide, HowToLiveBetter, rfcs, How-To-Secure-A-Linux-Server, mastg
Which topics is it in?risk-management, checklist, healthcare, governance, xlsx, compliance, templates, csv, template, finance, cybersecurity, guide
Creator
theycallmehassan1
Size
0.8 MB
Stars
114
Updated
CommitSep 28
Age
1mo
Commits · 90 Days