For government agencies
Where the binding constraint is process, mandate and public trust rather than budget.
The question is rarely whether something works. It is whether it can be procured, assured, and defended afterwards.
What matters, in order
Digital identityhigh relevance
A framework that already exists, and an expectation that follows it
New Zealand has the legislation, the rules and an accreditation authority inside Internal Affairs. That moves the question from whether to participate to when, and what accreditation will require of the services you already run. The harder work is not cryptographic — it is procurement, liability and public confidence, and it is being answered right now in Europe by people who will have made the mistakes first.
Start hereEstablish which of your services currently ask citizens for identity documents, and what each of them would need in order to accept a verifiable credential instead.
Wi-Fimedium relevance
Guests, staff and things, on one estate
Public-facing sites carry visitors, staff and a growing population of devices nobody logs in to — cameras, sensors, displays. They share the same air whether or not they share a network. Separation policy that exists only in configuration, without measurement of what the radios are actually doing, tends not to survive contact with a busy day.
Start hereEstablish what is on the air now, before writing the policy for it.
Where to start
None of this needs to be done at once, and the right first move is usually smaller than people expect. A conversation costs nothing.
Not quite you? Read this as a small business, or as an enterprise.