I read the federal government’s Zero-Trust Memo so you don’t have to

The real crux of the issue is the long-tail of applications which were never conceived with anything but network-based trust. I'm certain the DoD is absolutely packed with these, probably for nearly every workflow.

The reason this was so "easy" for Google (and some other companies, like GitLab[1]) to realize most of these goals is that they are a web-based technology company - fundamentally the tooling and scalable systems needed to get started were web so the transition were "free". Meaning, most of the internal apps were HTTP apps, built on internal systems, and the initial investment was just to make an existing proxied internal service, external and behind a context aware proxy [1].

The hard part for most other companies (and the DoD) is figuring out what to do with protocols and workflows that aren't http or otherwise proxyable.

[1] https://cloud.google.com/iap/docs/cloud-iap-context-aware-ac...

[2] https://about.gitlab.com/blog/2019/10/02/zero-trust-at-gitla...

As if Gov't does their own IT infrastrucutre...

This is a windfall for Gov't contractors.

Hey, at least they're 'our kind' of Gov't contractors. No $640 toilet seats here ;)