Which of the following is the FIRST consideration for a CISO when implementing Zero Trust architecture?

Before implementing any security architecture like Zero Trust, a CISO must first understand and refine the relevant business goals, as security should always be an enabler of the business rather than a standalone technical exercise. Aligning Zero Trust principles with specific business outcomes ensures the architecture supports organizational objectives effectively.

Limiting privileged accounts is a key component of Zero Trust but is a specific implementation step, not the foundational first consideration before strategy alignment.

Selecting a security framework is important but comes after understanding the business context and goals, as the framework choice should support those objectives.

Defining security projects and addressing control gaps are tactical steps that flow from the overall strategy, which itself is driven by business goals.