In which step of the Five-Step Methodology for implementing the Zero Trust model is the Kipling Method relevant?

Question

Options

• AStep 3: Architect a Zero Trust network
• BStep 5: Monitor and maintain the network
• CStep 4: Create the Zero Trust policy
• DStep 2: Map the transaction flows

• A
  8% (2)
• C
  88% (21)
• D
  4% (1)

Explanation

Step 4 (Create the Zero Trust policy) is correct because the Kipling Method - named after Rudyard Kipling's "six honest serving men" - uses the questions Who, What, When, Where, Why, and How to define granular access rules. When crafting Zero Trust policies, security teams systematically answer these questions to determine who can access which resources, under what conditions, and through which methods.

Step 3 (Architect) is wrong because that step focuses on designing network segmentation and identifying the protect surface - structural decisions, not access rule definitions. Step 2 (Map transaction flows) is wrong because it's about documenting how data moves between systems and users, not about interrogating the nature of that access. Step 5 (Monitor and maintain) is wrong because it covers ongoing inspection and logging of traffic after policies are already in place.

Memory tip: Think "Policy needs Probing questions" - both Policy (Step 4) and the Kipling method start with asking questions. Just as Kipling's journalist asks who, what, when, where, why, how, a Zero Trust policy author asks those same questions to write each rule.

No community discussion yet for this question.