First 30 Minutes: From Enrollment to Enforcement

    Enroll a device, establish identity, generate a policy, simulate impact, enforce safely, and review evidence.

    Quickstart
    Policies
    Events
    10 min
    Last updated: 2026-01-22

    Outcome

    • Verified identity in inventory (device or user).
    • Baseline trust posture captured (integrity + patch signals).
    • Least-privilege policy created and tested in Observe mode.
    • Enforcement enabled for a pilot scope with rollback.
    • Audit-ready evidence showing decisions, actions, outcomes.

    Step 1 — Enroll an identity

    Start in Inventory. Add a pilot device (or user) and assign it to an environment and site/zone.

    Tip
    For OT/ICS, begin with jump hosts and engineering workstations before controllers.

    Step 2 — Verify trust posture

    • Last authenticated time and identity assurance level.
    • Integrity indicators (secure boot, tamper signals where available).
    • Patch posture (missing updates, reboot pending).

    Step 3 — Generate a least-privilege policy

    • Example: allow remote admin only from approved subnet and role.
    • Require step-up verification for privileged actions.
    • Deny-by-default everything else.

    Step 4 — Simulate impact (Observe mode)

    • What would be blocked?
    • Which dependencies need allow rules?
    • Which zones should be segmented first?

    Step 5 — Enforce safely (pilot)

    Move to Enforce for a limited pilot scope (one site / one zone / one group).

    Rollback plan
    Keep a break-glass path with time limits and full audit logging.

    Evidence checklist

    • Policy version and decision trace (signals evaluated).
    • Enforcement action taken (allow/deny/step-up/quarantine).
    • Outcome verification (access granted/blocked, posture improved).
    • Operator identity (who changed policy, who executed response).

    Next steps

    • NIST 800-207 Mapping to align architecture language.
    • AI Policy Generation for guardrailed authoring.