In this article
Zero Trust is a simple rule: being connected to the company network gives access to nothing by itself. Every request is verified: who the person is, which device they are using and which resource they want to reach. In an SME with 10 to 200 workstations, the essentials can be implemented in about three months, mostly with tools the company already pays for: Microsoft 365, the firewall and managed devices. It is not a product you buy; it is a way of organising access.
In brief
- Principle Always verify, grant only what is needed, log everything.
- Scope Four fronts, in this order: identity, devices, network and least privilege.
- Timeframe Around three months in a company with 10 to 200 workstations.
- Reason According to Verizon (2026), 55% of data breaches at SMEs involved third parties and 45% had a human element.
From castle to airport: a change of model
For years, business security imitated a castle: a strong wall (the firewall) and complete trust in whoever was inside. That model no longer works. Today there is remote working, Microsoft 365 in the cloud, mobile phones and suppliers with remote access. And most attacks do not knock down the wall: they walk in with someone's password.
An airport works differently. Entering the terminal is not enough to board: your pass is checked at security, again at the gate, and only gives access to one aircraft and one seat. Zero Trust applies the same logic to the company's systems.
For the board, the gain is tangible: if a password is stolen or a laptop is infected, the damage is limited to one person and one part of the systems, not the whole company.
Why it can no longer wait
Verizon's 2026 data breach report shows that, at SMEs, 55% of the breaches analysed involved third parties (suppliers, partners, contractors) and 45% had a human element: a click, a mistake, a reused password. No perimeter firewall solves this on its own.
The European NIS2 directive requires, among its risk management measures, access control, asset management and multi-factor authentication. It does not mention Zero Trust, but the four fronts cover much of that technical work. If your company is in scope, see our guide to NIS2 for SMEs.
The four fronts of a realistic Zero Trust
1. Accounts: identity as the first barrier
- MFA everywhere Starting with Microsoft 365 and administrators.
- Leavers handled on the day Former employees' accounts disabled on their last day.
- Few administrators Two or three named people, with separate accounts for administrative tasks.
- No shared accounts No "info@" or "shop1" to sign in to systems.
This is the front with the highest return: a password obtained through phishing is no longer enough. With most Microsoft 365 licences there is no additional cost; the effort is organisational. Details in multi-factor authentication in the business and in password managers for teams.
2. Devices: knowing what exists and what state it is in
- Inventory Every computer and phone with access to company data.
- Protection and updates Active on all of them.
- Conditional access In Microsoft 365, only compliant devices reach the data.
Unsupported devices are the first thing to fix, such as Windows 10 since 14 October 2025. See what to do about the end of Windows 10 support.
3. Network: separate zones and a firewall that decides
The network is no longer a single space. Workstations, servers, guests, printers and cameras sit in separate zones, and the managed firewall decides what flows between them. An infected computer is contained within its zone and cannot go on to encrypt servers and backups. With managed switches and a managed firewall, this is configuration, not a purchase.
4. Least privilege: each person only gets what they need
- Permissions reviewed Shared folders, SharePoint and Teams.
- No local admin rights Users without administrator rights on their own computer.
- Remote access per application Instead of access to the whole network, as we explain in why VPN is no longer enough.
This is the most labour-intensive front, because it changes habits, which is why it comes last. It has become more urgent with Copilot and other AI tools, which show each person everything they are able to open. Read the rules to set before ChatGPT and Copilot.
A 90-day timeline
Timeframes for a company with 10 to 200 workstations, with a dedicated IT partner and an engaged board:
| Period | Work | Responsible | Impact on staff |
|---|---|---|---|
| Month 1 | MFA on all accounts; clean-up of old accounts and administrators; device inventory | Board approves; IT carries out | Confirmation on the phone at sign-in |
| Month 2 | Protection and updates on all devices; conditional access in Microsoft 365; replacement plan for unsupported devices | IT carries out; finance approves replacements | Personal devices can no longer download data |
| Month 3 | Segmented network; isolated guest network; restricted VPN and individual accounts for suppliers | IT carries out in a planned intervention | Almost none; done well, it is invisible |
| Afterwards | Quarterly permissions review; removal of admin rights; gradual move to per-application access | Managers validate; IT applies | Software installation goes through IT |
DataRoad IT Unlimited
Talk to DataRoad. We assess your operation and propose the right plan.
What is deliberately left out of the plan
There are advanced Zero Trust solutions: user behaviour analytics, per-application segmentation, continuous verification of each device's state. For most SMEs, they cost a lot and add little until the four basic fronts are in place.
Order matters. MFA without segmentation protects accounts but not the network; segmentation without MFA protects the network but not the accounts.
In practice: a Windows and Mac estate under the same rules
At the Lisbon office of Reltio by SAP, a US data software company, DataRoad provides ongoing maintenance and network management: 125 structured network points, a firewall, three switches and Cisco Meraki Wi-Fi access points, plus specialist support for 35 Dell machines and 40 MacBook Pros.
It is a picture of the second front: a mixed estate where the rules have to be the same whatever the operating system. With the inventory done and the network managed from a single point, applying Zero Trust is a matter of method.
Frequently asked questions
Is Zero Trust a product?
No. It is a way of designing access. Some products help, but in most SMEs the four fronts can be achieved with Microsoft 365, the firewall and existing devices.
Will work become slower?
Very little, if it is implemented well. MFA asks for a confirmation on the phone and conditional access goes unnoticed when the device complies with the rules. The most visible change is no longer installing programs without going through IT, and that is intentional.
Does a 15-workstation company need this?
MFA and a separate guest network make sense in any company. Device control and least privilege become more important with size and with the sensitivity of the data.
Does NIS2 require Zero Trust?
It does not use the term, but it requires access control, asset management and MFA. The four fronts cover much of that technical work. DataRoad implements the technical measures; legal analysis is a matter for a lawyer.
Next step: a Zero Trust assessment in 10 working days
We assess accounts, devices, network and permissions, tell you where your company stands and deliver the plan for the following three months. Managed cybersecurity (firewalls, endpoint protection, MFA and alerting) is included in IT Unlimited Premium. Request a no-obligation proposal. More than 10 workstations · support contract · remote, on-site and telephone support.
