Zero trust is a way of designing security so that no user or device is trusted automatically, however it connects. This article explains what the idea means according to the US standards body NIST and the US cybersecurity agency CISA, and how a small team can apply it without buying a new product category.
What does zero trust actually mean?
The term is often used as a marketing label, which makes it sound like a product. It is better understood as a set of principles. The National Institute of Standards and Technology (NIST), in its Special Publication 800-207, describes zero trust as an evolving set of cybersecurity paradigms that move defenses away from static, network-based perimeters and toward users, assets and resources. The document was first published in August 2020, and NIST’s page lists an update dated March 23, 2021.
The same publication defines a zero trust architecture as one that applies those principles when planning an organization’s infrastructure and workflows. In other words, zero trust is not something you switch on. It is a way of deciding who and what can reach each system, and under what conditions.
The name can mislead. It does not mean an organization trusts nobody. People still need access to do their jobs. It means that trust is never granted by default and must be earned again for each request.
Why the old perimeter model stopped working
For decades, most organizations protected themselves the way a castle is protected. There was a wall, usually a firewall, and a gate. Anything inside the network was treated as friendly, and anything outside was treated with suspicion. This approach is sometimes called perimeter security.
That model assumed that staff worked in one office, on company-owned computers, using software that ran on servers the company owned. Few teams work that way now. Staff log in from home, cafés and airports. Files live in cloud services, and personal phones read work email. If you want a refresher on how that shift happened, see what cloud computing means for everyday businesses.
NIST’s publication presents zero trust as a response to exactly these trends: remote work, bring-your-own-device (staff using personal equipment) and assets that sit in the cloud rather than inside a single network. When the “inside” of the network stretches across homes and data centers you do not control, the idea of a trusted interior stops being reliable. An attacker who steals one password, or gets one infected laptop onto the network, can wander freely in a castle-style design.
The core ideas behind the standard
NIST’s abstract highlights a few tenets that capture the spirit of zero trust:
- No implicit trust. Trust is not granted to an asset or a user account based only on its physical or network location, or on who owns the asset. Being on the office Wi-Fi proves little. Owning the laptop proves little.
- Authentication and authorization are separate, discrete functions. Authentication asks “who or what is this?” Authorization asks “is it allowed to do this particular thing?” Both the person (the subject) and the device are checked, and both checks happen before a session to a resource begins.
- Protect resources, not network segments. Because network location is no longer the main factor in how secure something is, the focus shifts to defending the individual application, file store or database.
Notice what these three ideas have in common. Each replaces a blanket assumption (“you are inside, so you are fine”) with a specific, repeated question (“should this person, on this device, reach this thing, right now?”).
How does zero trust differ from what most teams do today?
Many small teams already use some zero trust habits without calling them that. Multi-factor authentication, individual accounts and per-app permissions all fit the philosophy. The gap is usually consistency. The table below compares the two mindsets in everyday terms.
| Question | Perimeter mindset | Zero trust mindset |
|---|---|---|
| Where is trust decided? | Once, at the network edge | Every time someone requests a resource |
| What does being on the network prove? | A great deal | Very little |
| What is protected? | The network as a whole | Each application and data store |
| What happens after login? | Broad access to most systems | Access limited to what the role needs |
| Who checks the device? | Rarely anyone | The device’s state is part of the decision |
None of this requires abandoning the firewall. A perimeter can still be one useful layer. The change is that it stops being the only layer, and that nothing is allowed to rely on it alone.
What CISA adds: a maturity model
The US Cybersecurity and Infrastructure Security Agency (CISA) publishes a Zero Trust Maturity Model to help organizations plan a gradual journey rather than a single leap. According to CISA’s page, the model is at Version 2.0, with a revision date of April 11, 2023, and it includes five pillars and three cross-cutting capabilities.
CISA describes four stages that organizations can aim for within each pillar: traditional, initial, advanced and optimal. The point of a maturity model is that few organizations jump from the first stage to the last. They improve one area at a time, and the model offers examples of what each stage looks like so that teams can see where they stand.
For a small team, the useful lesson is the framing. Zero trust is a direction of travel. Moving from “traditional” to “initial” in a few places, such as identity and devices, is real progress even if the rest of the environment still looks conventional. The detailed pillar descriptions are written with large organizations in mind, so a small team should treat them as a menu of ideas and not as a checklist.
A practical path for a team of ten
A small team does not need a dedicated security department to move toward zero trust. The following order tends to deliver the most benefit for the least effort. It builds on the habits described in cybersecurity basics for small teams.
- Know what you have. List the applications, data stores and devices the team uses. You cannot protect resources you have not identified.
- Strengthen identity first. Give each person an individual account, require multi-factor authentication everywhere it is offered, and use a single sign-in system if your tools support it, so access can be removed in one place when someone leaves.
- Apply least privilege. Review who can open what. Finance records, customer data and admin panels should be visible only to the people whose roles need them.
- Consider the device. Require updates and screen locks on any laptop or phone that reaches company data. Some tools can refuse access from devices that are out of date.
- Limit what a compromise can reach. Separate sensitive systems from everyday ones so one stolen login does not open every door.
- Watch and review. Turn on sign-in alerts and check the access list on a regular schedule.
Each step is a small decision, not a software purchase. Many are settings in tools the team already pays for.
A worked example
Consider an illustrative design studio of eight people. Under its old setup, anyone who connected to the office network could open the shared drive, the accounting system and the client contact list. One designer’s personal laptop picks up malware at home, and the next day it joins the office Wi-Fi.
In the perimeter model, the malware now sits inside the trusted zone and can read everything the designer’s laptop can reach, and because the designer has broad access, that is nearly everything.
Now picture the same studio after a few zero trust changes. The designer can open design files and client briefs but not accounting. Access to each system requires a sign-in with a second factor, and the accounting tool only accepts logins from devices that are up to date and managed by the studio. The infected personal laptop fails that check and is blocked from the sensitive systems. The malware may still cause trouble on that one machine, but the damage stays contained. The studio did not need a new network; it changed the rules about who gets in and what they can reach.
Is zero trust right for every organization?
Zero trust is a principle, so some form of it applies to nearly everyone, but the depth will vary. A freelancer using three cloud tools can get most of the benefit from strong sign-in, a password manager and careful sharing settings. A company with dozens of staff, contractors and customer data will want more formal controls over identity, devices and access.
There are also costs to watch. Frequent verification can irritate staff if it is clumsy, so choose methods that are quick, such as an authenticator app or a hardware key. Tools can also create a false sense of completeness: no product delivers zero trust on its own, because the standard is about how decisions are made across the whole environment.
Connections between systems deserve attention too. When software talks to other software through APIs, those connections need the same scrutiny as human logins, a topic covered in how APIs connect the software you use. The same applies to AI assistants that read company files, which is part of using AI responsibly in your business.
Where to start this quarter
Zero trust works best as a series of modest, steady changes rather than a grand project. Start with identity, because stolen or guessed credentials are the doorway most attackers prefer, and continue by trimming access and checking devices. Use the NIST principles as a test for each new tool or setting: does this grant trust because of where someone is, or because of who they are, what they are using and what they need? If it is the former, there is room to improve.
This article provides general information and is not professional security or legal advice. Consult a qualified security professional about your own environment.
Sources: National Institute of Standards and Technology; Cybersecurity and Infrastructure Security Agency
