Starting point and immediate trigger

• Tell me briefly which event started this project, a VPN outage, a red team finding, an insurer requirement, or something else? Options: VPN outage, Red team / penetration finding, Cyber insurance requirement, Executive directive, Other
• Walk me through the last time that remote access failed for your users, what happened and how long before normal work resumed?
• When you picture a successful outcome from replacing VPN access for this user group, what does that look like in concrete terms?
• How many people would be in the initial pilot user population, and which job functions do they represent? Options: Fewer than 50, 50–199, 200–499, 500–999, 1000 or more
• Which application types must the pilot support for you to consider it credible, for example web apps, thick clients, RDP, databases, or custom protocols? Options: Web applications, Thick client (installed apps), RDP / VDI, Database clients, API connectors / services, Other
• Who on your team will be responsible day to day for running the pilot and reporting outcomes?

Where your current remote access breaks and why it matters

• If an attacker had one compromised VPN session tomorrow, how much lateral movement could they achieve before detection and containment? Options: Limited to one host, Across a single subnet, Across multiple subnets and domains, Unrestricted until manual intervention, Unknown
• Describe the most recent production outage related to remote access, its operational impact, and any measurable cost or lost hours.
• How often do you see high-severity VPN incidents such as full concentrator failure, credential compromise, or unexpected hairpin bottlenecks? Options: Monthly, Quarterly, Yearly, Rarely, Never tracked
• Estimate what a full-day remote access outage costs you in lost productivity or revenue for a typical affected team. Options: Under $10k, $10k–$50k, $50k–$200k, Over $200k, Unknown
• Which legacy dependencies are most likely to fail during migration, for example undocumented apps, bespoke VPN ACLs, or split-tunneling rules? Options: Undocumented applications, Custom firewall/ACL rules, Split tunneling configurations, Homegrown scripts or integrations, None of the above / unsure
• Which single failure related to current VPN behavior would make you stop the migration effort immediately?

People, politics, and decision power

• If the security sponsor wants to move forward and the VPN operations team wants more proof, whose approval resolves the impasse? Options: CISO/security leadership, VP of Infrastructure/Operations, IT operations manager, Cross-functional steering committee, Procurement/legal
• List the roles that must be engaged for a pilot to run, including approval, technical, and business stakeholders.
• Who is enabled to pause the pilot or require a rollback if customer-impacting issues appear? Options: Security leadership, Infrastructure operations, Application owners, Helpdesk manager, Executive sponsor
• Are there internal teams that have publicly recommended building a replacement in-house instead of using an external vendor? Options: Yes, architecture/team believes internal build, No, not proposed internally, Discussed but not formal proposal, Unsure
• Which stakeholder, if not fully bought in, would most likely delay or kill the project? Options: CISO/security, VPN operations, Application owners, Procurement, Legal/compliance
• How quickly can the group that must sign contracts and funding decisions move if the pilot proves successful? Options: Within 1 week, 1–2 weeks, 2–6 weeks, Longer than 6 weeks, Unsure

Designing a pilot that proves you can replace VPN

• If you could only test one capability during the pilot to prove VPN can be retired, which would convince you most—connection reliability, thick client compatibility, fine policy control, or helpdesk ticket reduction? Options: Connection reliability, Thick client/RDP compatibility, Policy granularity for replacements, Helpdesk ticket trend reduction, Other
• Walk me through the user journey you want covered in the pilot, from onboarding to day two support and escalation.
• Which acceptance metrics will you require us to demonstrate during the 60–90 day side by side pilot? Options: >= 99% connection success rate, No increase in helpdesk tickets, Support for RDP/thick clients without session loss, Equivalent or better login latency, Policy rule parity with existing firewall rules
• How many concurrent sessions or peak users should the pilot handle to be representative of production? Options: Under 50, 50–199, 200–499, 500–999, 1000+
• Who will own validating acceptance criteria day to day and who signs off at pilot end?
• If the pilot meets the agreed acceptance criteria, what internal step would most commonly delay a purchase decision? Options: Procurement contract negotiations, Budget approval, Security review and approvals, Operational handover planning, No expected delay

The other paths you are actively weighing

• Why would you keep the incumbent remote access approach instead of moving to a zero trust access model? Options: Perceived lower short term cost, Operational familiarity and scripts, Dependency on network topology, Regulatory comfort with current controls, Other
• Which alternative solutions or vendors are you evaluating in parallel, including internal build options? Options: Incumbent VPN/firewall vendor, Other zero trust vendor, SASE supplier offering full stack, Internal engineering build, No other evaluations
• What would have to be true about your current approach for you to decide to stay with it rather than switching? Options: No new security findings, Cost to replace exceeds benefit, Operational risk too high, All undocumented dependencies reconciled, Other
• Has any internal team proposed a timeline or plan to replicate the same functionality without an outside partner? If yes, who and what is the proposed timeline? Options: Yes, less than 3 months, Yes, 3–6 months, Yes, more than 6 months, No internal proposal, Unsure
• Which acceptance criteria would the incumbent vendor need to match for you to cancel the pilot? Options: Identical connectivity reliability, Same thick client support, Policy management parity, Lower total cost of ownership, Other
• Who internally would advocate strongest for staying with the current approach? Options: VPN operations, Network architecture, Procurement, Application owners, Security leadership

Operational readiness and constraints that could gate the work

• Which integration, access, or approval would block the pilot from starting on your target date? Options: SSO/IdP integration, Active Directory/LDAP access, Network connector access to datacenter, Change window approvals, Security signoff
• Which specific on-prem systems must the pilot connector reach, and do those systems already permit outbound TLS connections?
• Do you have APIs or automation for the systems we must integrate with, and who owns those APIs? Options: Yes, APIs available and owned internally, APIs exist but access limited, No APIs, manual integration required, Unsure
• How many dedicated engineering hours per week can your team commit to the pilot for onboarding and troubleshooting? Options: Under 10 hrs/week, 10–20 hrs/week, 21–40 hrs/week, More than 40 hrs/week
• Are there regulatory, data residency, or compliance approvals that must clear before testing can touch production data? Options: Yes, strict approvals required, Some approvals but manageable, No special approvals, Unsure
• If you could not obtain one of these prerequisites in time, which would be the single deal breaker for starting the pilot?

Handling failure, rollback expectations, and operational ownership

• If the pilot increases helpdesk tickets by 30 percent, who owns the customer communications and remediation steps? Options: Helpdesk/IT operations, Application owners, Security operations, Shared responsibility, Other
• Which rollback condition would force you to stop the pilot and return users to VPN access, for example X minutes of outage, percent of users affected, or security incident?
• Describe the communication plan you would expect during an incident in pilot, who gets alerted and in what order.
• What SLAs or verification checkpoints will you require during each planned cutover or test window? Options: Connection success rate, Authentication latency, Application response time, Ticket volume threshold, Other
• Which team will be responsible for rollback execution and how quickly can they execute? Options: Network operations, Infrastructure, SecOps, Dedicated migration team, Unsure
• Where would you prefer to run cutovers, during business hours, after hours, or in defined maintenance windows? Options: Business hours, After hours, Weekend maintenance window, Flexible by app owner

Metrics, governance, and decision triggers for moving to production

• If the pilot meets the acceptance criteria, what stands between you and executing a production rollout within two weeks? Options: Procurement and contracting, Operational handover readiness, Security final approval, Budget release, Nothing, ready to go
• Which quantitative metrics will you require from the pilot to greenlight full rollout, for example % decrease in blast radius, connection success rate, or ticket delta? Options: Connection success rate target, Percent reduction in blast radius, Helpdesk ticket reduction target, Policy parity achieved, Other
• Who has final budget authority for the rollout and who has final technical signoff?
• Are there calendar constraints or business events in the next 6 months that would prevent a full rollout even if the pilot succeeds? Options: Major product launch, Audit or compliance window, Hiring freeze/budget period, No major constraints, Unsure
• Assuming the pilot proves the numbers you need, what is the single fastest path to a signed agreement and production schedule?
• Would you like us to prepare a pilot plan that includes named owners, test windows, rollback triggers, and a clear signoff checklist? Options: Yes, please prepare, Maybe, need more info, No, we will draft our own

• desired_state
• current_state
• stakeholders
• gaps
• success_criteria
• decision_readiness
• desired_state
• decision_readiness
• current_state
• success_criteria
• gaps
• stakeholders
• stakeholders
• gaps
• decision_readiness
• success_criteria
• current_state
• desired_state
• decision_readiness
• success_criteria
• decision_readiness
• decision_readiness
• decision_readiness

• Deploy Endpoint Client Agent
• Enable Side-by-Side Pilot Mode
• Onboard User Group to ZTNA Pilot
• Install Connectors for Thick-Client and RDP
• Onboard Legacy Applications to Connectors
• Configure Per-Application Micro-Tunnels
• Integrate Identity Provider for Authentication
• Configure Device Posture Policies
• Translate VPN Firewall Rules into Access Policies
• Define Admin Roles and Policy Granularity
• Enable Real-Time Diagnostic and Support Tools
• Forward Audit and Session Logs to SIEM/Syslog
• Optimize Connector Routing to Remove Hairpinning

Deploy Endpoint Client Agent

• List the endpoint operating systems the agent must support (e.g., Windows 10, macOS, Linux distro). Options: Windows 10/11, Windows Server (RDS hosts), macOS, Linux (specify distro), Other
• Estimate the number of endpoints to receive the agent during the pilot. Options: <50, 50-200, 201-500, 501-2,000, 2,000+
• Name the approver or change control ticket where agent installation approval will be recorded.
• Confirm the preferred deployment mechanism for the agent (MDM, endpoint manager, software distribution, or manual). Options: Mobile device management (MDM), Endpoint manager / software distribution, Manual installer, Other
• Specify any installation windows or maintenance windows that the rollout must respect (e.g., nightly 10pm-6am, weekends). Options: Business hours, Nightly window, Weekend window, Specific approved window
• Describe any corporate imaging, disk-encryption, application allowlist, or EDR policies that could block the installer.

Enable Side-by-Side Pilot Mode

• Confirm whether you require side-by-side pilot mode that leaves the existing VPN active for rollback. Options: Yes, No
• Identify which user tags or groups should be routed to the pilot environment versus staying on the legacy VPN.
• Choose the pilot duration within the 60-90 day evaluation window. Options: 60 days, 75 days, 90 days
• Indicate the monitoring dashboards or metrics you will compare during the side-by-side pilot (e.g., connection success rate, RDP session failures, helpdesk ticket counts).
• Assign the single point of contact for rollback decisions and record the change control ID to authorize a rollback.
• Specify the support escalation path to use during side-by-side operation (helpdesk queue name, on-call rotation).

Onboard User Group to ZTNA Pilot

• Identify the user population to include in the pilot (team name, approximate headcount, primary locations, e.g., 250 remote engineers in EMEA).
• List the primary thick-client or RDP workflows this group uses, including application names, server hostnames, or host pools.
• Define the acceptance thresholds that will determine pilot success for this group (connection reliability %, RDP success %, acceptable change in helpdesk tickets).
• How will you measure end-user perceived latency for application launches (tool or test script name and measurement points)?
• Are there VIP users who need exemption or special rollback handling; if yes, list roles and required protections. Options: Yes - list below, No
• Outline the onboarding and offboarding provisioning workflow for pilot accounts (ticketing process name or runbook reference).

Install Connectors for Thick-Client and RDP

• Indicate the server platforms intended to host connectors for RDP and thick-client traffic (e.g., Windows Server, Linux VM, virtual appliance). Options: Windows Server, Linux VM, Virtual appliance, Cloud-hosted instance
• Estimate the number of connector instances per site or VPC required for redundancy and target concurrent RDP sessions.
• Provide the firewall or network ACL changes required to allow connector egress, listing ports and destination ranges if available.
• State whether connectors will be deployed in a DMZ, private subnet, or VLAN and list the network segment identifiers. Options: DMZ, Private subnet, On-prem VLAN, Cloud VPC subnet
• Enumerate the legacy RDP hosts or thick-client servers (FQDN or IP) the connectors must reach during the pilot.
• Describe any reverse-proxy, NAT, or certificate dependencies that will require changes to connector reachability.

Onboard Legacy Applications to Connectors

• Provide an inventory of legacy applications to onboard during the pilot including hostname, port, and protocol (e.g., app-server-prod.corp:3389 RDP).
• Flag applications that rely on broadcast, SMB, or other non-tunnelable protocols and list those apps. Options: Yes - list below, No
• State any client-side modifications or connector drivers required by a legacy app (list app and required change).
• Name the application owners who must approve onboarding and specify how approvals will be recorded (ticket ID or email thread).
• Choose the acceptable maintenance window for onboarding activities that may require app restarts. Options: Immediate/none, Nightly, Weekend, Specific preapproved window
• Explain any licensing or session-broker constraints (concurrent license caps) that limit pilot concurrency for these apps.

Configure Per-Application Micro-Tunnels

• Detail which applications require per-application micro-tunnels rather than network-level access (list by hostname or application ID).
• Select the encryption requirements for tunnels required by your security policy (TLS versions or custom ciphers). Options: TLS 1.2, TLS 1.3, Custom - specify
• Outline how granular policy mappings must be compared to existing VPN firewall rule groups (number of groups or examples).
• Set acceptable connection setup time targets for micro-tunnels serving interactive applications (in milliseconds). Options: <100ms, 100-250ms, >250ms
• Define the acceptance metric that will validate micro-tunnel correctness for RDP and thick-client sessions (example: session success rate).
• Explain any DNS resolution or split-tunnel rules required for these micro-tunnels (domain patterns, resolver IPs).

Integrate Identity Provider for Authentication

• Declare which authentication protocols your IdP supports for integration (SAML 2.0, OpenID Connect, LDAP, SCIM). Options: SAML 2.0, OpenID Connect (OIDC), LDAP/AD, SCIM
• How will user attributes and group claims be mapped from the IdP into access policies; list claim names you will send.
• Do you require multi-factor authentication for pilot users and which second factors are allowed (TOTP, hardware key, SMS)? Options: TOTP (authenticator app), FIDO2 / hardware key, SMS/voice, No MFA for pilot
• Report the service account or API credential storage location that will be used for automated provisioning (secrets manager reference).
• Are SCIM or automated provisioning flows available for group membership changes during the pilot? Options: Yes - SCIM available, No - manual provisioning only, Partial

Configure Device Posture Policies

• List the device posture signals to evaluate before granting access (disk encryption, OS patch level, EDR heartbeat, firewall state). Options: Disk encryption, OS patch level, EDR present/heartbeat, Host firewall enabled, Other
• Specify minimum OS build or patch thresholds per platform that devices must meet (provide platform and threshold).
• Decide how posture remediation should be presented to users (self-remediation steps, block and ticket, or allow with restrictions). Options: Self-remediation guidance, Block access and create ticket, Allow with restricted session
• Supply the MDM, EDR, or telemetry sources that will feed posture decisions (source name or API endpoint).
• Do you require conditional restrictions for unmanaged devices (clipboard disabled, file transfer blocked)? Options: Yes - list restrictions, No

Translate VPN Firewall Rules into Access Policies

• Attach excerpts of the current VPN-era firewall rule set to be translated, including source groups, destination IPs/subnets, and ports.
• Declare which existing rule groups are business-critical and must be migrated without change during the pilot (list group names and owners).
• Reveal any implicit allow rules, undocumented tunnels, or service accounts you suspect exist and should be discovered before cutover. Options: Yes - we suspect undocumented routes, No - rules are documented
• Set the acceptable policy consolidation threshold during migration (percentage of rules that may be consolidated or rewritten). Options: 0% - exact parity, 1-10% consolidation, >10% consolidation allowed
• Designate the change authority who will approve translated policies and note where approvals will be recorded.
• Mark whether you require session-level logging, packet-level telemetry, or both to be forwarded to your SIEM. Options: Session-level only, Packet-level, Both

Define Admin Roles and Policy Granularity

• Enumerate the administrative roles you need with a short responsibility for each (role name and primary permissions).
• Assign which teams should have delegated policy management and specify the application sets for each team.
• What least-privilege constraints should be enforced on console access (just-in-time access, timebound roles, permanent roles with approval)? Options: Just-in-time (JIT), Time-bound roles, Permanent with approval, Other
• Record the required audit trail retention period for admin actions (90 days, 1 year, 3 years, custom). Options: 90 days, 1 year, 3 years, Custom
• Supply details of any automation scripts or API keys admins use today that must be rotated or integrated (script names, API key IDs).

Enable Real-Time Diagnostic and Support Tools

• Detail the real-time diagnostics required for troubleshooting user sessions during pilot (packet captures, live session replay, connection timeline). Options: Packet capture, Live session replay, Connection timeline, Session metrics
• Enter the helpdesk ticketing queue name to capture pilot connectivity issues and the tagging convention to use.
• Will frontline support require remote-assist or session-shadowing capabilities for RDP sessions during the pilot? Options: Yes, No

• Subscription Agreement
• Order Form
• Trial Acceptance & Transition Agreement
• Data Processing Agreement and Security Approval
• Service Level Agreement (SLA)
• Governance & Escalation Protocol
• Change Order Agreement
• Regulatory Compliance Addendum (conditional)

• Go-live Health Check
• First Measurement Review
• Acceptance Gate and Incumbent Wind-down
• Quarterly Operational Review
• Annual Success Retrospective and Lessons Learned

• Provide a quarterly operations pack with metric exports, open tickets, and enhancement backlog status.
• Establish which metrics are on track and which require remediation, with named actions and dates.
• Confirm the acceptance gate date and the criteria to be evaluated at that meeting as recorded in the Solution Evaluation stage.
• Deliver a metric dashboard export with raw data and analysis notes for the period under review.
• Create a remediation plan for each off-target metric with owners and due dates.
• Restate acceptance criteria and numeric targets
• Produce a documented acceptance decision for each criterion recorded in the Solution Evaluation stage, including any conditional remediation items.
• Confirm the incumbent wind-down status and that no active user groups remain on the legacy VPN except as formally retained read-only.
• Publish the acceptance record listing pass/fail per criterion, named signatory, and any remediation commitments.
• Execute the incumbent decommission tasks and provide evidence of contract termination or read-only retention and data archive completion.
• Operational metrics and trend review
• Ensure operational metrics remain within acceptable bounds and that high severity issues are on a documented path to resolution.
• Maintain a prioritized enhancement backlog with next-step commitments and dates.
• Re-confirm success criteria and owners
• Publish a short remediation plan with owners and dates for any items trending off-target.
• Long term outcome metrics vs targets
• Validate that annual outcomes meet the targets recorded in the Solution Evaluation stage or document final remediation paths.
• Capture and distribute a lessons learned summary and finalize disposition of the enhancement backlog.
• Produce an annual outcomes report with metric trends, lessons learned, and backlog disposition.
• Finalize any remaining remediation items or convert them into scheduled work with owners and dates.
• Confirm deployment completed to the agreed configuration checklist and that each acceptance owner is identified.
• Create a prioritized list of early blockers with owners and target resolution dates.
• Publish a deployment validation report listing completed tasks and any deviations from the plan.
• Document each open blocker with owner and resolution date and circulate for async confirmation.
• Present first measured data
• Deployment and migration validation
• Adoption and policy coverage review
• Diagnose root causes for any gaps
• Open issues and ticket burn-down
• Present outcome data against each criterion
• Agree corrective actions and owners
• Document pass/fail and formal acceptance decision
• Lessons learned and process improvements
• Enhancement requests and backlog status
• Early adoption signals and usage patterns
• Agree remediation items for any failed criteria
• Security and compliance exceptions
• Confirm timeline to acceptance gate
• Enhancement backlog closure and next steps
• Blockers and open issues with owners
• Agree operational actions for the next quarter
• Incumbent decommission checklist and fallback closure
• Agree immediate remediation actions
• Close long-tail operational items