Zero Trust for Small Business: Plain English and First Steps

Zero trust is a way of designing security so that nothing is trusted just because of where it is. Being on the office Wi-Fi, or signing in from a company laptop, is not treated as proof of anything. Every request to reach email, files, or an application is checked: who is asking, from what device, and whether that person needs this resource. It is not a product you can buy. For a small office it comes down to a short list of concrete steps: multi-factor authentication everywhere, managed and healthy devices, least-privilege access, a segmented network, and logs that someone reviews.

What Does Zero Trust Actually Mean?

The older model was a castle and moat. A firewall protected the office network, and anything inside was assumed safe. That assumption stopped matching reality when business data moved to cloud services and people began working from home, from phones, and from client sites.

NIST’s Special Publication 800-207, Zero Trust Architecture, published in August 2020, describes zero trust as moving defenses “from static, network-based perimeters to focus on users, assets, and resources.” It sets out seven tenets. In plain English:

1. Everything that holds or processes data counts as a resource, including cloud apps and personal devices that touch company data.
2. All communication is secured, wherever it happens. Being on the office network does not imply trust.
3. Access is granted one resource and one session at a time, with the least privilege needed.
4. Access decisions use policy that weighs who the user is, the state of the device, and other signals such as location or unusual behavior.
5. The organization monitors the security condition of every device it owns or allows. No device is trusted by default.
6. Authentication and authorization are enforced before access, and rechecked over time.
7. The organization collects information about devices, network traffic, and access requests, and uses it to improve.

Two ideas sit underneath all seven: assume an attacker may already be inside, and limit how far any single stolen password or infected laptop can reach.

CISA’s Five Pillars, Translated for a Small Office

CISA’s Zero Trust Maturity Model, version 2.0 (April 2023), was written as a roadmap for federal agencies. Its structure still works as a checklist for a ten-person office. It has five pillars (Identity, Devices, Networks, Applications and Workloads, and Data), three capabilities that cut across them (Visibility and Analytics, Automation and Orchestration, and Governance), and four maturity stages: Traditional, Initial, Advanced, and Optimal.

Pillar	What it asks	What that looks like in a small office
Identity	Is this really the person?	One named account per person, multi-factor authentication on everything, no shared logins, separate admin accounts, a password manager
Devices	Is this device known and healthy?	An inventory, device management, disk encryption, current patches, endpoint protection, and a compliance check before access
Networks	Can a problem spread?	Guest Wi-Fi, cameras, and printers separated from business computers with network segmentation, plus DNS filtering
Applications and Workloads	Does each app check access itself?	Single sign-on where available, app-level permissions, and no reliance on “you are in the office, so you are allowed”
Data	Who can reach what?	Know where sensitive data lives, restrict sharing, review folder permissions, and keep tested backups

The cross-cutting capabilities translate simply. Visibility means sign-in logs and device alerts that someone looks at. Automation means policies that block a risky sign-in without a person having to notice it. Governance means written rules for who approves access and a schedule for reviewing it.

An office that has not yet worked on a pillar is at the Traditional stage for it. The goal is steady progress, not reaching Optimal.

Where Should a Small Business Start?

Work in this order. Each step is useful on its own, so you can stop at any point and still be better off.

1. Turn on multi-factor authentication for every account

Start with email, then banking, payroll, accounting, and remote access. In Microsoft 365, security defaults are free on every plan and require all users to register for MFA, require it for administrators, and block older sign-in methods that cannot use MFA. To check, sign in to the Microsoft Entra admin center, go to Entra ID, then Overview, then Properties, and select Manage security defaults. Microsoft’s security defaults documentation lists exactly what they enforce.

2. Clean up accounts and admin rights

List every account. Remove former staff, vendors who no longer need access, and shared mailboxes with passwords. Give administrators a separate account for admin work and an ordinary one for daily email. A solid onboarding and offboarding process keeps this from drifting.

3. Know and manage your devices

Build the inventory, then enroll company computers and phones in device management so you can require encryption, a screen lock, and current updates. Keep them current with a patching routine. Decide how personal phones fit in before you need to.

4. Tie access to identity and device health

This is the step that makes it zero trust and not just good hygiene. With Conditional Access, a sign-in to Microsoft 365 can be allowed only with MFA and only from a device that meets your compliance rules, with older sign-in methods blocked. Conditional Access requires at least Microsoft Entra ID P1, which is included in Microsoft 365 Business Premium. Security defaults and Conditional Access are alternatives, so you move from one to the other and do not run both.

5. Segment the network

Put guests, cameras, printers, payment terminals, and smart devices on separate networks from business computers. If one of them is compromised, it should have no route to your files. CISA’s #StopRansomware Guide recommends segmentation and a zero trust approach to limit how far an intruder can move.

6. Tighten access to data

Review who can open each shared folder, SharePoint site, and line-of-business application. Remove “everyone” permissions. Limit external sharing links and set them to expire.

7. Watch and review

Make sure sign-in alerts and device alerts go to a person. Once a quarter, review admin accounts, device compliance, and sharing. Without this step, the other six slowly come undone.

What Does Zero Trust Cost?

The first two steps are free on any Microsoft 365 or Google Workspace plan and cost only time. Device management and Conditional Access need licensing: Microsoft lists Business Premium at $22.00 per user per month, paid yearly, as of September 2026, which bundles Intune, Entra ID P1, and Defender for Business. Network segmentation needs a firewall and switches that support separate networks (VLANs). Many business-grade models do, while consumer routers often offer only a basic guest network.

The larger cost is attention. Policies need tuning when they block legitimate work, and someone has to own the reviews.

Common Mistakes

• Buying a product labeled “zero trust” and considering the job done. Tools help, but the model is about how access decisions are made.
• Enforcing strict device rules on day one. Microsoft’s Conditional Access supports a report-only mode. Use it first to see who would be blocked.
• Forgetting an emergency account. Microsoft recommends keeping emergency access admin accounts so a misconfigured policy cannot lock everyone out.
• Treating the VPN as the finish line. A VPN that drops a remote laptop onto the full office network recreates the castle and moat. See our guide to secure remote access.
• Skipping the account cleanup because it is dull. Old accounts are an easy way in.

When the Full Model Is More Than You Need

A three-person office with everything in cloud apps, no shared network resources, and no regulated data does not need a formal zero trust program. MFA on every account, automatic updates, separate admin accounts, and a guest Wi-Fi network cover most of the benefit. The remaining steps start to pay off as you add staff, shared files, remote work, or compliance obligations such as HIPAA or the FTC Safeguards Rule.

Common Questions

Is zero trust a product we can buy?

No. NIST describes zero trust as a set of guiding principles, not a single architecture or technology. Vendors sell tools that support it, such as identity providers, device management, and network access services. A small office usually gets most of the way with features already included in its Microsoft 365 or Google Workspace subscription.

Does zero trust mean we do not trust our employees?

No. The name refers to systems, not people. It means the network does not grant access automatically based on location or on a password alone. For staff, the visible effects are an MFA prompt, a managed device, and access to the things their role needs.

Do we still need a firewall?

Yes. Zero trust reduces how much you rely on the network perimeter, but a firewall still blocks unwanted inbound traffic and is what makes network segmentation possible. NIST’s publication expects most organizations to operate in a hybrid of perimeter and zero trust approaches while they make the transition.

How long does it take to implement?

Turning on MFA and cleaning up accounts can be done in days. Plan for a few weeks for device management and Conditional Access, because policies should run in report-only mode before enforcement. Segmentation depends on your network hardware. It is an ongoing practice with a review cycle, not a project with an end date.

How We Can Help

Coastal Growth Co. can assess where your office stands on each pillar, turn on MFA and Conditional Access, enroll devices, segment the network, and set up a simple quarterly review. You can take it one step at a time as a defined project or as part of ongoing managed IT support, and our Microsoft 365 services cover the identity and device pieces. Scope and price are agreed before paid work begins. Contact us to start the conversation.