Guiding organizations through security program modernization with reference strategies built on Zero Trust principles