The security program roadmap schedules a zero trust access initiative to begin before the project that consolidates the organization's several identity directories into one authoritative source. What should the information security manager do?
Select an answer to reveal the explanation.
Short Explanation
You don't hang the doors before the walls are up. Zero trust leans on knowing exactly who's who, so the identity consolidation has to come first, however exciting the zero trust banner looks on the roadmap.
Full Explanation
Program roadmaps must reflect dependencies between initiatives. Zero trust access decisions evaluate identity and context for each request, so they depend on reliable, consistent identity information; with several unconsolidated directories, policies would be built on fragmented and possibly conflicting identities. Sequencing identity consolidation first provides the foundation, reduces rework and makes the later initiative more likely to succeed. Running both in parallel looks faster but forces the zero trust work to integrate with directories that are about to change, producing duplicated effort and policies that must be rebuilt after consolidation. Cancelling consolidation misunderstands zero trust, which increases rather than removes reliance on strong, authoritative identity. Keeping the sequence because zero trust is the higher priority confuses importance with order; a high-priority outcome can be reached sooner by completing its prerequisites first, and ignoring the dependency jeopardizes the priority itself. Exam caveat: limited preparatory zero trust activities such as design work may overlap, but implementation should follow the foundation it requires. Operational check: confirm the roadmap records dependencies between initiatives and that each initiative's start criteria include completion of its prerequisites.