- Zero Trust is a security architecture, not a product. The underlying principle: verify identity and device health on every request, enforce least privilege, and design as if breach has already occurred.
- John Kindervag introduced the model at Forrester Research in 2010. NIST formalised it in Special Publication 800-207 in 2020, which remains the authoritative implementation reference.
- Zero Trust has five pillars: Identity, Devices, Network, Applications, and Data. Starting with Identity gives the biggest risk reduction for the least infrastructure change.
- Conditional Access policies in Microsoft Entra ID enforce the identity and device pillars. Microsoft 365 Business Premium includes them at a price most SMEs already pay.
- Zero Trust works with infrastructure you already have. MFA, device management, and network segmentation all map to the framework. You extend them, not replace them.
- Zero Trust satisfies most NIS2 Article 21 access control requirements and ISO 27001 Annex A identity and network controls without needing separate compliance projects.
Why the perimeter is gone
Traditional network security rested on a single assumption: traffic inside the corporate network is trusted, traffic outside is not. A firewall held the line. Remote workers tunnelled in through VPN. That worked when most users sat in the same building, most applications ran on kit you owned, and most data lived on servers you could physically touch.
Today, users work from home, cafes, and client offices. Applications run in Microsoft 365, Salesforce, AWS, and dozens of SaaS platforms you do not operate. Partners and contractors connect from networks you have never seen. All of that happens outside the perimeter, yet the firewall keeps treating internal traffic as inherently trustworthy.
An attacker who compromises one laptop, one phished account, or one VPN credential lands inside the trusted zone. Internal traffic goes largely uninspected. Internal systems grant access to anything that arrived through the right entry point. Lateral movement is a matter of minutes.
Zero Trust removes network location from the trust equation. Access decisions turn on your identity, your device's compliance state, and the specific resource you are trying to reach. The network you connect from is irrelevant.
The five pillars
NIST SP 800-207 organises Zero Trust around five control planes. Most organisations start with Identity, since compromised credentials drive the majority of initial access, and build out from there.
Starting with identity
The identity pillar is the standard starting point. It addresses the most common attack path, works with tools you likely already licence, and requires no network infrastructure changes.
Conditional Access policies
Conditional Access is the enforcement engine. Each sign-in is assessed against a set of signals: user identity, device state, sign-in location, target application, and risk signals from the identity protection engine. The policy then allows, blocks, or demands step-up verification.
A baseline policy set should: require MFA on all cloud applications; block sign-ins from countries where you have no presence; block legacy authentication protocols that cannot complete MFA challenges; require device compliance for sensitive applications; and trigger step-up authentication when the risk engine flags an anomalous sign-in.
Privileged Identity Management
Admin accounts are the highest-value target in any environment. PIM removes persistent privilege: an administrator requests, justifies, and activates a role for a time-limited session. Between sessions the account holds no administrative permissions. A credential stolen outside an active session gives an attacker nothing to work with.
Microsoft 365 Business Premium includes Entra ID Conditional Access, Intune for device management, Defender for Business as the EDR, and Defender for Cloud Apps as a CASB. One licence covers the identity, device, and application pillars for most SMEs. The hard part is configuration, not cost.
Device trust and compliance
Confirming the user's identity is only half the check. A valid MFA login from a laptop running unpatched software or carrying an active infection still represents a real access risk.
Compliance policies in Intune or Jamf define the minimum bar: OS version, encryption, EDR agent, screen lock, and jailbreak detection for mobile. Conditional Access checks compliance at sign-in and blocks access for devices that fall short.
If you allow personal devices, split the access model: managed devices get full resource access; unmanaged devices get browser-only sessions through a reverse proxy, with DLP enforced at the session layer to block downloads.
Network segmentation in practice
Start with your highest-value assets: finance systems, Active Directory domain controllers, backup infrastructure, and any OT if present. Isolate them with deny-by-default inbound rules, permitting only the specific flows each service legitimately needs. You do not need to segment the entire network to get most of the value.
Cloudflare Access, Zscaler Private Access, and similar ZTNA platforms sit in front of internal applications and run identity and device checks before opening a connection. The user's device never joins the corporate network. It reaches one service through an application-level tunnel. A compromised VPN credential no longer opens the whole network.
Zero Trust and regulatory compliance
Zero Trust controls satisfy requirements across the major frameworks European organisations face.
NIS2 (Article 21) requires access control policies, multi-factor authentication, and network security measures for entities in scope. The identity and network pillars address each of those directly. Device compliance policies cover the endpoint security requirement. Logging all access attempts satisfies the audit obligations.
ISO 27001 Annex A controls A.5.15 (access control), A.5.16 (identity management), A.5.17 (authentication information), A.8.20 (network security), and A.8.22 (network segregation) are all addressed by a Zero Trust implementation. The controls required by ISO 27001 and those required by Zero Trust overlap to the point where implementing one builds most of the other.
DORA requires logical network segmentation and multi-factor authentication for financial entities. Zero Trust gives you a single architecture that covers those obligations rather than treating each requirement as a separate project.
Zero Trust is built on a single premise: you will be breached. The question it answers is how much an attacker can reach from their first foothold.