Zero trust is a simple idea with a heavy reputation: no user, device or network is trusted by default, and every request is checked. It is not only for governments. NIST's 2025 guide, SP 1800-35, documents 19 example implementations built with 24 industry collaborators, and most of the building blocks are tools small companies already pay for. This guide explains the model and gives a first-year plan sized for a team of ten to two hundred.
What zero trust actually means
Traditional security drew a line around the office. Anyone inside the network, or connected by VPN, was largely trusted. Zero trust drops that assumption. Each time someone opens an app or file, the system checks who they are, whether their device is healthy and whether the request makes sense, then grants the least access needed for that task.
For a small business this matters because the office line has already gone. Staff work from home, data sits in cloud apps, and contractors log in from their own machines. NIST's National Cybersecurity Center of Excellence describes a zero trust architecture as one that gives secure, authorised access to resources spread across on-premises and multiple cloud environments, for a hybrid workforce and partners.
The frameworks behind it
Three documents shape most zero trust advice. NIST SP 800-207 sets out the core concepts and principles. CISA's Zero Trust Maturity Model, now in version 2.0 released in April 2023, turns those concepts into pillars and stages; version 1.0 had opened for public comment in September 2021. NIST SP 1800-35, published on 10 June 2025, shows how real products were combined into working designs.
SP 1800-35 is the most practical for small firms. It records 19 example builds made with 24 collaborators under research agreements, and it is explicitly meant to give organisations models they can copy. You do not need to replicate a full build. Use it to see which product types fit together and which gaps others hit.
The five pillars in small business terms
CISA's model groups the work into five pillars plus three cross-cutting capabilities: visibility and analytics, automation and orchestration, and governance. The table below translates each pillar into a first step a small company can take with tools it probably already pays for, such as an email suite, an identity provider and a device management service.
| CISA pillar | Plain meaning | First step for a small business |
|---|---|---|
| Identity | Prove who the user is | Single sign-on with two-factor authentication for every core app |
| Devices | Know the device is yours and healthy | Enrol laptops in device management; block unknown devices |
| Networks | Stop treating the network as trusted | Replace broad VPN access with per-app access where possible |
| Applications and workloads | Control access to each app | Remove shared logins; review admin roles quarterly |
| Data | Protect the data itself | Label sensitive folders and restrict sharing links |
Maturity stages: where you probably are
CISA describes four stages for each pillar: Traditional, Initial, Advanced and Optimal. Most small companies sit at Traditional for networks and data, and somewhere near Initial for identity because cloud apps already push two-factor sign-in. That is normal. The aim is not to reach Optimal everywhere but to move each pillar up one stage where the risk is highest.
A useful exercise is to score yourself per pillar on one page. Be honest: if a former employee's account could still log in, identity is Traditional. If you cannot list every laptop that holds customer data, devices are Traditional. The scores tell you where to spend the first budget.
Start with identity
Identity gives the biggest return because almost every attack ends with someone logging in. Yet only 47% of UK businesses use two-factor authentication, according to the Cyber Security Breaches Survey 2025/2026, and only 43% of micro businesses. Verizon's 2025 report names credential abuse as the most common initial access route in breaches.
Pick one identity provider, connect your email, file storage, CRM and finance tools to it, and require two-factor sign-in for everyone. Remove shared accounts. Set up a leaver process that disables one account and cuts access everywhere. This single change moves you from Traditional to Initial on the identity pillar.
Then devices and networks
Zero trust checks the device as well as the person. Verizon found that 46% of systems with corporate logins caught by infostealer malware were unmanaged devices holding both personal and business credentials. Enrolling company laptops and letting your identity provider refuse sign-ins from unenrolled machines closes much of that gap.
On networks, the trend is away from broad VPN access. In Verizon's 2025 data, edge devices and VPNs were 22% of exploitation targets, up from 3% the year before, and the median time to patch them was 32 days. Per-app access through your identity provider, or a zero trust access service, means a stolen login reaches one app rather than the whole network.
Do not forget suppliers and data
Third parties are part of your attack surface. Verizon's 2025 report found third-party involvement in 30% of breaches, double the previous year. Give agencies, freelancers and software vendors their own named accounts with time limits, never shared passwords, and review what each one can reach every quarter.
For the data pillar, start small. Find the three places where sensitive data lives, often the CRM, a shared drive and the accounting tool, restrict who can export from them, and turn off public sharing links by default. In India, the DPDP Rules notified in November 2025 make this more than good practice, since weak safeguards can attract penalties of up to ₹250 crore.
A realistic first-year roadmap
Quarter one: single sign-on and two-factor authentication on all core apps, plus a leaver process. Quarter two: device enrolment and a rule that only enrolled devices can reach sensitive apps. Quarter three: replace broad VPN access with per-app access and remove standing admin rights. Quarter four: tighten data sharing and set up basic sign-in alerting.
Revisit the one-page maturity score at the end of each quarter. Keep the cross-cutting capabilities in mind: you need visibility of sign-ins and devices to make decisions, and a named owner for governance. XDQ Labs designs and verifies zero trust controls for small teams on systems they own, but the roadmap above works with whatever tools you already have.
Frequently asked questions
Is zero trust too expensive for a small business?
No. The first steps use tools many small firms already pay for: single sign-on, two-factor authentication and device management. CISA's model lets you improve one pillar at a time, and NIST's 2025 guide shows 19 example builds you can borrow ideas from rather than buying a single large platform.
What are the five pillars of zero trust?
In CISA's Zero Trust Maturity Model version 2.0, released in April 2023, the pillars are identity, devices, networks, applications and workloads, and data. Three cross-cutting capabilities run across them: visibility and analytics, automation and orchestration, and governance.
Does zero trust replace a VPN?
Often, over time. Zero trust favours giving each user access to specific apps instead of the whole network. Verizon's 2025 report found edge devices and VPNs made up 22% of exploitation targets, which is one reason firms move to per-app access through an identity provider.
Where should a small company start with zero trust?
Start with identity. Connect core apps to one identity provider, require two-factor sign-in for everyone, remove shared accounts and build a leaver process. Only 47% of UK businesses use two-factor authentication, so this step alone closes a common gap.
Sources
- CISA Zero Trust Maturity Model introduction, Microsoft Learn, 2025
- Implementing a Zero Trust Architecture: High-Level Document (NIST SP 1800-35), NIST, 2025
- Verizon's 2025 Data Breach Investigations Report: news release, Verizon, 2025
- Cyber security breaches survey 2025/2026, GOV.UK (Department for Science, Innovation and Technology), 2026
- Zero Trust Maturity Model, CISA, 2023
- Implementing a Zero Trust Architecture: Full Document, NIST National Cybersecurity Center of Excellence, 2025
- 2025 Data Breach Investigations Report: Executive Summary, Verizon, 2025
- Digital Personal Data Protection Rules, 2025: backgrounder, Press Information Bureau, Government of India, 2025
