Zero › Module 9 › Lesson 3
Phased Rollout
ZT program KPIs literacy — MFA coverage, ZTNA adoption, segment coverage, DLP incidents — KPI dashboard stub on YOUR $ZT_LAB.
Visual · t40_kpis_metrics
ZT KPIs. $ZT_LAB. Original Cyberlium.
Opening
Executives ask numbers — define KPIs that prove progress without vanity metrics on LAB-ZT-001 dashboard stub.
Sample KPIs: MFA coverage % privileged, legacy auth blocked %, device compliance rate, apps on ZTNA vs VPN, microseg rules enforced, DLP incidents triaged, mean time to revoke access literacy. Dashboard stub: KPI | baseline | target | measurement source — fictional numbers labeled FICTional. Next: Roadmap Lab.
1. KPI categories (named)
Identity: MFA, CA policy coverage, orphan accounts. Device: compliance %, patch SLA. Network: ZTNA app count, east-west deny logs.
Data: labeled assets %, DLP tune rate. Program: milestone on-time %.
Command guide
Try these commands — KPI categories (named)
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
CISA ZTMM — https://www.cisa.gov/zero-trust-maturity-model NIST SP 800-207 — https://csrc.nist.gov/publications/detail/sp/800-207/final
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install python3
macOS:
Command — copy this
brew install python3
Windows: Download https://python.org/downloads/
═══ LINUX / macOS ═══
Command — copy this
export ZT_LAB=${ZT_LAB:-$HOME/cyberlium-lab/t40-zt}
export ZT_ROADMAP=${ZT_ROADMAP:-$ZT_LAB/LAB-ZT-001/roadmap}
cat > "$ZT_ROADMAP/kpi-dashboard-stub.csv" <<'EOF'
kpi_id,name,baseline_pct,target_pct,source_fictional,milestone_link
K-001,MFA coverage all users,72,100,IdP report,M-02
K-002,Legacy auth blocked,40,100,IdP sign-in logs,M-01
K-003,Device compliance rate,65,95,MDM dashboard,M-03
K-004,Apps on ZTNA vs VPN count,3,12,ZTNA broker,M-04
K-005,Microseg deny rules enforced,partial,full,NGFW logs,M-06
K-006,Data assets labeled,30,90,classification scan,M-05
K-007,DLP Restricted enforce rules,0,3,DLP console,M-07
K-008,Privileged vault coverage,50,100,PAM report,PAM checklist
All values FICTional — NOT production metrics
EOFCommand — copy this
grep -E 'kpi_id|K-00|FICTional' "$ZT_ROADMAP/kpi-dashboard-stub.csv"
python3 -c "print('KPIs: outcome metrics linked to roadmap milestones')"Primary tools to practice this lesson: grep, python3. Reference sites: CISA ZTMM (https://www.cisa.gov/zero-trust-maturity-model); NIST SP 800-207 (https://csrc.nist.gov/publications/detail/sp/800-207/final). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Anti-vanity
Bad: total firewall rules count. Good: % sensitive apps behind ZTNA with posture check.
Each KPI links to roadmap milestone or pillar pack evidence.
3. Dashboard stub
Ten KPI rows with baseline, target, fictional measurement source.
Ship: KPI dashboard stub. Next: Roadmap Lab.
4. What you ship: KPI dashboard stub
Ten KPIs with baseline/target and FICTional label. $ZT_LAB. chmod 600.
5. What you record before the next lesson
Date. KPI stub. $ZT_LAB named. File t40-m09-l03-kpis-metrics.txt chmod 600.
6. Wrong vs right: bypass cookbooks vs YOUR ZT design
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
KPI: number of security tools purchased. Use real employer metrics without scope.
Right
Write KPI dashboard with MFA coverage and ZTNA adoption rows. Next: Roadmap Lab.
Mission: KPI dashboard stub
1) Define ten ZT KPIs. 2) Baseline and target per KPI. 3) Link two KPIs to roadmap milestones. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
% apps on ZTNA beats raw VPN user count — outcome over activity.
Knowledge Check
APPLY: Good ZT KPIs measure:
Multiple choice
Knowledge Check
APPLY: True or False: KPIs should link to roadmap milestones.
True or False
Knowledge Check
APPLY: Employer live metrics in lab without scope:
Multiple choice