Zero Trust Security: Where Should an SME Start?

Zero trust is not a product you install — it's a change in what your security systems assume by default. Traditional IT security drew a line around the office network: inside that line, a device or user was mostly trusted; outside it, they weren't. Zero trust drops that assumption entirely. Every request for access, from inside the building or from a laptop at a client's office, gets verified on its own merits, every time, based on who is asking, from what device, and under what conditions.

For a Dutch SME, this matters more than it used to. Staff work from home, from client sites, and from personal phones checking email between meetings. The "inside the office equals trusted" model stopped matching how anyone actually works years ago, but a lot of SME security setups still quietly assume it.

This guide explains what zero trust actually means in practice, the three principles it's built on, what a small business can realistically do about it without replacing its entire infrastructure, and where to start.

From perimeter security to zero trust

The traditional model restricts access to a corporate network connection: get inside, by cable, by office Wi-Fi, by VPN, and you're mostly trusted from there on. That approach assumes a clear line between "inside" and "outside," and that anything inside the line is safe. Cloud services, remote work and personal devices checking company email have made that line meaningless: most of what an SME actually uses, such as Microsoft 365, cloud accounting software or a CRM, lives outside any network perimeter you could draw around an office.

Zero trust replaces that single line with continuous verification: every access request is authenticated and authorized on its own, treating every connection as if it originated from an uncontrolled network, regardless of whether it's coming from inside the building or not.

The three principles zero trust is built on

Zero trust isn't a checklist of products; it's organized around three principles that apply to identity, devices and data equally:

• Verify explicitly. Every access request is authenticated and authorized using everything you can actually check: who the user is, what device they're on, where they're connecting from, and whether anything about the request looks abnormal. Not just a correct password once at login.
• Use least privilege access. People and systems get the minimum access they need for the task in front of them, not standing access to everything "in case it's needed later." A marketing employee's account should not be able to reach the finance system's database, even if nobody has ever misused that access.
• Assume breach. Design as though an attacker is already inside somewhere, and limit how far they can move if they are. That means segmenting access so that compromising one account or device doesn't hand over everything else, encrypting data so a stolen laptop isn't a stolen client list, and keeping backups separate enough that an attacker who gets in can't simply delete them too.

None of these is a single setting you turn on. They're a direction you move your existing systems in, a bit at a time.

What this looks like with the tools you probably already have

Most Dutch SMEs already run Microsoft 365, which means most of the groundwork for zero trust is sitting in a license you're already paying for, not a new platform to buy.

Microsoft Entra Conditional Access is the part that does the actual enforcing. It works as a set of if-then rules: if someone tries to sign in to a company resource, then specific conditions have to be met before access is granted, such as a managed and compliant device, a successful multi-factor authentication check, or a sign-in from an expected location rather than one flagged as risky. It brings together signals about the user, the device, the application and the sign-in itself, and decides in real time whether to grant access, demand another verification step, or block it outright. That is a direct, practical expression of "verify explicitly": nobody gets in on a password alone, and the bar for access adjusts automatically based on how risky a particular request looks, not on whether the connection happens to come from inside the office.

Conditional Access policies are available from Microsoft Entra ID P1, which is also included in Microsoft 365 Business Premium, a license many Dutch SMEs already hold for other reasons. If that's you, the policy engine for most of "verify explicitly" may already be sitting unused in your tenant.

Least privilege is less about a specific product and more about discipline: reviewing who actually has admin rights (usually far more people than need them), separating a day-to-day account from a privileged admin account, and granting elevated access only for as long as a specific task takes rather than permanently. Our guide on setting up MFA in Microsoft 365 covers the identity side of this in more operational detail.

Assume breach shows up as network segmentation, so one compromised laptop can't see the whole file server, encrypted data at rest and in transit, and backups kept genuinely separate from the systems they protect, so an attacker who gets into your main environment can't also reach and delete the thing that would let you recover. If you haven't checked recently whether your backups would actually survive that scenario, that's a more urgent gap than most zero trust theory.

Device compliance, whether a laptop or phone meets your security baseline before it's allowed to touch company data, is the signal that connects zero trust to device management. Our guide to mobile device management covers how that enrollment and policy layer actually works for a mixed fleet of company and personal devices.

Where a small business should actually start

Rolling all three principles out everywhere at once is how a zero trust project stalls. A more realistic order:

• 1. Start with identity, not network. Turn on MFA everywhere it isn't already, and move toward Conditional Access policies instead of relying on MFA alone. Identity is the control plane that most other zero trust work builds on.
• 2. Clean up standing access before adding new controls. Find accounts with admin rights they don't use day to day, and separate privileged actions from everyday work. This single step closes more real risk than most of what follows it.
• 3. Bring devices into the picture. Require devices to be enrolled and meet a baseline, encrypted, patched, running endpoint protection, before they can reach company email or files: the Conditional Access signal that checks device compliance.
• 4. Segment what you can, where it actually matters. You don't need to redesign your entire network on day one. Start with the systems that would do the most damage if a compromised account could reach them unchecked, such as finance, client data and admin consoles, and isolate those first.
• 5. Revisit backups with an attacker's assumptions in mind. Backups that live on the same network as everything else, reachable by the same compromised credentials, don't actually protect you from the scenario zero trust assumes is coming.

Each of these is useful on its own, even if you stop after step one. Zero trust is a direction, not a single destination you either reach or don't.

What zero trust is not

It's not a product with that name on the box; any vendor selling you "a zero trust solution" as a single purchase is selling a piece of the picture, usually the one they happen to make. It's not a replacement for a firewall or a VPN either; both can still have a role, just not as the single gate that decides who's trusted. And it's not something you finish: policies need revisiting as staff, devices and applications change, in the same way any access control does.

FAQ

What is zero trust security, in plain terms? A security approach that verifies every access request on its own merits, who's asking, from what device, under what conditions, rather than trusting anyone or anything by default just because they're inside the office network or already logged in once.

Is zero trust a product we need to buy? No single product delivers it. It's a set of principles, verify explicitly, use least privilege, assume breach, that you apply to tools you likely already have, most commonly through Microsoft Entra Conditional Access if your business runs Microsoft 365.

Do we need Conditional Access if we already use MFA? MFA checks identity at one moment, at login. Conditional Access can require MFA and also react to device compliance, location and sign-in risk continuously, which is the fuller "verify explicitly" principle MFA alone only partly covers.

Where should a small business start with zero trust? Identity first: enforce MFA everywhere, then move to Conditional Access. After that, clean up unnecessary standing admin access, since it is usually the single highest-risk gap and doesn't require any new tooling to fix.

Does zero trust replace our firewall or VPN? No. Both still have a role in a zero trust setup; what changes is that neither is treated as the single boundary that decides who gets trusted once they're inside it.

Get help moving toward zero trust

Already running Microsoft 365 but not using Conditional Access, or unsure how much standing admin access has quietly accumulated in your tenant? Our Cybersecurity & Identity team can audit what you have and build a policy set that fits how your business actually works, not a generic template. Pair it with Managed IT & Support once device compliance and ongoing policy maintenance need an owner, and see how this fits a broader security baseline in our guide to NIS2 for SMBs.