It's official. Agencies must have zero trust in their networks. Now what?