For years, small business security looked like a medieval castle. The firewall was the wall, the VPN was the drawbridge, and once you were inside, you could wander anywhere. The reception PC could reach the accounting server, and the summer student's account saw the same shared folders as the CEO's.
That model assumed the enemy stays outside. But your data now lives in the cloud, your staff work from home and your IT provider connects remotely. More importantly, an attacker who phishes a password doesn't need to climb the wall anymore. They walk through the front gate wearing a valid badge.
Zero trust starts from the opposite assumption: no connection is trusted by default. Here's what that means, in practical terms, for a small or mid-sized business.
TL;DR
- Zero trust isn't a product. It's a way of deciding who gets access to what, with every request checked, every time.
- Being "inside" the network no longer earns any special privileges.
- For a small business, the first steps are well known: MFA everywhere, managed devices, least privilege and separate admin accounts.
- Many of the tools you need are probably already in your licences. They just need to be configured.
Zero trust in one sentence
The reference document is NIST SP 800-207, published by the U.S. National Institute of Standards and Technology in August 2020. Its core idea: no implicit trust is granted to an account or a device based solely on where it sits on the network, or on the fact that the company owns the device.
The Canadian Centre for Cyber Security sums up the same philosophy with a familiar motto: "Never trust, always verify." It adds two useful points. First, trust must be re-assessed every time someone requests access to a new resource. Second, you should plan as if a breach has already happened.
In practice, every access request goes through a decision point that asks three questions: who is this person, what device are they using, and do they actually need this resource right now?
Why the castle model no longer holds
Picture a 22-person accounting firm in Mississauga. A bookkeeper clicks a fake delivery notice and types in her password. Without MFA, the attacker signs in remotely. Because the network is "flat," they reach the file server, then the backup server. It's the classic sequence described in our breakdown of a ransomware attack on a small business: stolen credentials, then lateral movement.
Under a zero trust model, each step would have hit a wall. A sign-in from an unknown device would have required a second factor. The bookkeeper's account wouldn't have had access to the backup server. And the unusual activity would have triggered an alert.
The principles, translated for a small business
NIST lists seven tenets, and the Cyber Centre sets out its own priorities. Here's what they look like on the ground.
| Principle | What it means | Small business example |
|---|---|---|
| No trust based on network location | Being at the office or on the VPN isn't enough | Office Wi-Fi doesn't give direct access to the accounting server |
| Verify identity on every request | MFA, ideally phishing-resistant | A security key or passkey for admin accounts |
| Verify the device | Only managed, encrypted, up-to-date devices reach company data | Conditional access blocks an unregistered personal laptop |
| Least privilege, just enough and just in time | People get only the rights their task requires, for as long as it requires | Admin rights are granted for a specific job, then removed |
| Assume breach | Segment to contain the damage | Backups are isolated from the rest of the network |
| Monitor and measure | Accounts and devices are watched continuously | An alert fires on a sign-in from an unusual country |
Where to start: a five-step roadmap
The Cyber Centre recommends starting with strong authentication, access decisions based on user and device information, least privilege and dedicated admin workstations. For a small business, that translates into this sequence.
- Identities. Turn on MFA for every account, no exceptions, and retire weak methods where you can. Our guide to choosing the right MFA compares the options.
- Devices. Enrol laptops and phones in a management tool (Intune, for example), require encryption and updates, then set up conditional access to block non-compliant devices. Microsoft 365 Business Premium includes Microsoft Entra ID P1, which brings conditional access.
- Privileges. Separate admin accounts from everyday accounts. An admin account doesn't read email or browse the web.
- Application access. Gradually replace full network access with per-application access. To see whether a VPN still makes sense for you, read our comparison of VPN vs ZTNA for remote work.
- Visibility. Keep sign-in logs and make sure someone monitors them, whether that's you or your provider.
Starter checklist:
- MFA enabled on 100% of accounts, including your vendors' accounts.
- An inventory of every device that accesses company data.
- Conditional access requires a compliant device for sensitive data.
- Admin accounts are separate, few in number and protected by a phishing-resistant method.
- Shared-folder permissions reviewed against people's actual roles.
- Backups isolated from the domain and from everyday accounts.
- Alerts configured for unusual sign-ins.
What zero trust is not
It's not all or nothing. The Cyber Centre notes that the approach takes sustained commitment over several years. A business that completes the first three steps has already removed most of its implicit trust.
It's not a box you plug in. A product labelled "zero trust" can help, but without an inventory of who accesses what and a clear policy, it just moves the problem around.
It's not a reason to drop the basics. Patching, backups and staff awareness still matter. The Cyber Centre's baseline controls for small and medium organizations remain the foundation.
It's not just for big companies. A 40-person manufacturer in the Eastern Townships that requires managed workstations, limits its IT provider's access to scheduled maintenance windows and separates its production network is already applying NIST's principles.
Measuring your progress
To find out where you stand, ask your team or your IT provider three simple questions:
- What happens if an employee signs in from a personal computer we've never seen?
- How many accounts have admin rights, and who uses them day to day?
- Could a compromised account at the front desk reach the backups?
If any answer starts with "I think...", there's work to do. Our team can configure conditional access, device management and privilege separation through our remediation and hardening service, starting from what your licences already include.
Frequently asked questions
Is zero trust a product I can buy?+
No. The Canadian Centre for Cyber Security describes it as a security framework, not a single product or technology. Vendors sell useful building blocks such as conditional access, ZTNA and device management, but nobody delivers zero trust out of the box. Be wary of any quote that promises otherwise.
Do we have to get rid of our VPN to adopt zero trust?+
Not necessarily, and not right away. A VPN protected by multi-factor authentication and limited to the resources people actually need is still acceptable. Zero trust pushes you to replace broad network access with per-application access, which is what ZTNA tools do. You can make that shift gradually, as equipment comes up for renewal.
Can a 20-person business realistically do zero trust?+
Yes, at its own scale. Many of the tools are already paid for: Microsoft 365 Business Premium, for example, includes Microsoft Entra ID P1 and therefore conditional access. The work is mostly configuration, removing unnecessary privileges and requiring managed devices. The goal isn't perfection; it's removing implicit trust.
Does zero trust mean we don't trust our employees?+
No. You distrust connections, not people. From the network's point of view, a stolen password or an infected laptop looks exactly like a legitimate employee. Verifying every access request protects your staff from having their identity hijacked.
Sources
- 1.NIST SP 800-207: Zero Trust Architecture (August 2020)
- 2.Canadian Centre for Cyber Security: Zero Trust security model (ITSAP.10.008)
- 3.Canadian Centre for Cyber Security: A zero trust approach to security architecture (ITSM.10.008)
- 4.Canadian Centre for Cyber Security: Baseline cyber security controls for small and medium organizations
- 5.Microsoft Learn: Microsoft Entra licensing