Zero Trust for Small Organisations: A Practical Starting Point Using Tools You Already Pay For

Small organisations are told zero trust is an enterprise programme with an enterprise price, so many never start, even though most of the controls are already sitting unused in the productivity suite they pay for each month. A business with 10 to 300 people rarely has a data centre to segment or a SOC to staff, but it does have cloud email, a handful of SaaS apps, laptops and phones, and a few admin accounts that an attacker would love to have. Those are exactly the things zero trust protects. This guide shows how to apply zero trust principles on a small budget using bundled identity, device management and access features, what to do in what order, and when a separate product such as zero trust network access (ZTNA) is worth paying for. It is written for owners, office or IT managers and the managed service providers who look after small organisations.

Key takeaways

• Zero trust for a small organisation is mostly identity and device policy. If every sign-in needs strong MFA and only healthy, managed devices reach company data, most of the model is in place without new network hardware.
• Use what the suite already includes. Business-tier productivity suites bundle MFA enforcement, device management and some conditional access, so check your licence before buying anything.
• Start with admins and email. Phishing-resistant MFA on administrator accounts and mailbox access closes the routes most small business compromises use.
• Replace the VPN only when there is something behind it. If all your apps are SaaS, there may be nothing for a VPN or ZTNA product to protect; if you still run on-premises servers, ZTNA is the step that removes the open remote access door.
• Write down who owns it. A one-page access policy, a named person who checks MFA coverage monthly and two emergency accounts are the governance a small organisation needs.

What zero trust means at small scale

The NCSC zero trust architecture design principles include knowing your architecture, knowing your user, service and device identities, assessing device and service health, using policies to authorise requests, authenticating and authorising everywhere, focusing monitoring on users, devices and services, and not trusting any network, including your own. The NCSC writes them for enterprise environments, but each one maps to something a small organisation can do with a modest budget. The Zero Trust Identity Guide explains why identity is the control plane; this guide is about doing it with small-business tooling.

The bundled-feature approach: what each suite gives you

Most small organisations run on one of two productivity suites. Platforms are listed alphabetically; the order is not a ranking. The controls below are customer-side settings: the suite provides them, and the organisation decides whether to switch them on. For deeper configuration see Google Workspace for Small Business and Microsoft 365 Business Premium.

Google Workspace

• Enforce 2-Step Verification: in the Admin console under Security, Authentication, 2-step verification, set enforcement to On or to a start date, and choose a new user enrolment period between 1 day and 6 months. The allowed methods setting can block text and phone codes, or require security keys only, an option Google's documentation says now also accepts passkeys.
• Manage devices: basic mobile management is on by default and lets administrators set password requirements on mobile devices, wipe a user's account from a lost device, review the device list and receive device activity alerts. Advanced management adds app management and device audits.
• Context-Aware Access: access policies for apps based on user identity, IP range, country, operating system and device policy such as encryption or company-owned status.
• Availability: Google lists basic mobile management for Business Starter, Standard and Plus. Context-Aware Access is documented for Frontline Standard and Plus, Enterprise Standard and Plus, Education Standard and Plus, Enterprise Essentials Plus and Cloud Identity Premium. Check the current edition comparison before planning.

Microsoft 365

• Security defaults or Conditional Access: security defaults require every user to register for MFA, require MFA at every sign-in for key admin roles, block legacy authentication such as IMAP, POP3 and SMTP basic authentication, and block device code flow. Conditional Access replaces security defaults with custom policies using user, IP location, device platform and compliance, and application. See Conditional Access vs Security Defaults.
• Manage devices: Microsoft Intune covers managed company devices and app protection for personally owned phones, with device compliance feeding Conditional Access. See the Microsoft Intune Guide.
• Endpoint and email protection: Microsoft Defender for Business and Defender for Office 365 are part of the Business Premium documentation set.
• Availability: Microsoft describes Business Premium for organisations of up to 300 users. Conditional Access requires Microsoft Entra ID P1, and Business Premium customers can use Conditional Access features. Risk-based sign-in and user risk policies require Entra ID Protection, a P2 feature. Microsoft recommends security defaults for organisations on the free Entra ID tier.

If your suite tier does not include device-based access policies, you can still get most of the value: enforce MFA for everyone, enrol devices for encryption and remote wipe, and restrict admin roles. Upgrading a few admin or high-risk users to a higher tier is often cheaper than a separate product.

Where ZTNA fits and when to pay for it

ZTNA gives a user access to one application after checking identity and device, rather than placing them on the network as a VPN does. The ZTNA Guide covers the architectures. For a small organisation the decision is simple:

Some ZTNA services offer free or low-cost tiers for small teams. Check the user limit, whether single sign-on and device posture are in the tier you pick, and log retention, before relying on one. Conditional Access vs ZTNA explains where each enforcement point sits. CISA's small business guidance also names moving on-premises services to the cloud as part of reaching the highest security posture.

A phased rollout for a small organisation

1. Week 1, inventory and owners: list every app, who administers it and whether it supports single sign-on; list devices from the suite console; name a person responsible for security. CISA's small business guidance calls this role the Security Program Manager and says it does not need to be a security expert.
2. Week 1, emergency access: create two cloud-only emergency administrator accounts with long random passwords stored offline, excluded from the policies you are about to enforce, with an alert on their use. See the Break-Glass Account Guide.
3. Weeks 2 to 3, MFA for admins then everyone: enforce MFA technically, not by asking. Give admins phishing-resistant methods (security keys or passkeys) first. CISA describes FIDO authentication as the only widely available phishing-resistant option.
4. Weeks 2 to 3, remove legacy sign-in: block legacy protocols that cannot do MFA, after checking which printers, scanners or old mail clients still use them.
5. Weeks 3 to 6, enrol devices: company laptops into device management with disk encryption, screen lock, automatic updates and no local admin rights for daily use; personal phones with app-level protection rather than full enrolment.
6. Weeks 6 to 8, device-aware access: where your tier allows, require a compliant or managed device for email and file storage. Run the policy in report-only or monitoring mode for two weeks, fix the devices it would block, then enforce.
7. Month 3, single sign-on and app clean-up: connect SaaS apps to the identity provider, remove shared logins, and turn off accounts for leavers on the same day through the directory.
8. Month 3 onwards, remote access: retire any open remote desktop or VPN access, moving those apps to SaaS or ZTNA.

Rollback: every enforced policy should have a documented way to switch it back to report-only, and the emergency accounts must work before you enforce anything. Make one change at a time, on a weekday morning, so lockouts are found while help is available.

Where identity fits beyond people

Small organisations also have non-human identities: the accounting tool's connection to the bank, the scanner that emails documents, API keys for the website, OAuth apps users have connected to mail and drive, and the MSP's management agent. List them, give each an owner, remove app consents nobody recognises, and avoid using a person's account for an integration, because that account then cannot be protected with MFA or disabled when the person leaves. See Choosing an IT Support Provider or MSP Securely for supplier access.

Decision guidance: small versus very small

The main trade-off is convenience against assurance: device-based policies stop stolen passwords working from an attacker's laptop, but they also block staff using personal computers, so decide the personal device rule before enforcing. See the BYOD Security Programme guide.

Detection and measurement

Suite admin consoles provide sign-in logs, admin audit logs and security alerts. For small Windows-based on-premises estates, CISA offers Logging Made Easy, a free centralised log management toolset for organisations with limited resources. Watch for:

• Sign-ins from new countries or unfamiliar devices, especially for admins.
• Repeated MFA prompts denied, which suggests someone has the password.
• New MFA methods registered, new mailbox forwarding rules and new OAuth app consents.
• Use of the emergency accounts.

Metrics that show it is working:

• MFA coverage: percentage of active accounts with MFA enforced, target 100 percent, checked monthly. See MFA Coverage Measurement.
• Phishing-resistant admins: percentage of admin accounts using security keys or passkeys.
• Managed device share: percentage of devices accessing company data that are enrolled and compliant.
• Leaver time: hours from departure to account disablement.
• Open remote access: number of internet-facing remote desktop or VPN endpoints, target zero.

Common failure patterns

• Buying before configuring: paying for a new product while the MFA and device features in the existing licence stay off.
• Push MFA left as the only factor for admins: in the Uber breach an attacker with a contractor's password sent repeated push prompts until one was accepted. Phishing-resistant methods and alerts on repeated denials address this.
• Exclusions that never expire: the owner, a director or a shared mailbox excluded from MFA "for now". Record exclusions with an end date in an MFA Exception Register Template.
• No emergency access: enforcing a policy that locks out the only admin, then disabling security entirely to recover.
• Office network trusted: allowing sign-ins from the office IP address to skip MFA, which turns a compromised office device into a bypass.
• Integrations on personal accounts: a former employee's account kept active because a key integration runs under it.

Framework mapping

Cyber Essentials is a useful companion: it costs from £320 plus VAT for the self-assessment route, and the NCSC lists a free readiness tool and a free 30-minute consultation with an NCSC-assured Cyber Advisor for small and medium-sized enterprises. See the Free Cyber Security Services and Tools for Small Organisations Guide and the Small Business Cybersecurity Basics Guide.

Practitioner checklist

• Check which identity, device and access features your current suite licence already includes.
• Create two emergency administrator accounts and test them before enforcing any policy.
• Enforce MFA for every account, with security keys or passkeys for administrators.
• Block legacy authentication protocols after finding the devices that still use them.
• Enrol company laptops with encryption, automatic updates and no daily local admin rights.
• Require managed or compliant devices for email and files where your tier supports it, after a report-only period.
• Connect SaaS apps to single sign-on and remove shared logins and unknown OAuth app consents.
• Close internet-facing remote desktop and VPN access, moving apps to SaaS or ZTNA.
• Name an owner who checks MFA coverage, exclusions and sign-in alerts every month.

Standards and references

• NCSC: Zero trust architecture design principles
• CISA: Cyber Guidance for Small Businesses
• NCSC: Cyber Essentials overview
• Google: Deploy 2-Step Verification
• Google: Protect your business with Context-Aware Access
• Microsoft Learn: Security defaults in Microsoft Entra ID
• Microsoft Learn: What is Conditional Access?
• CISA: Logging Made Easy

Related NHI Mgmt Group resources: Zero Trust Identity Guide · Small Business Cybersecurity Basics Guide · ZTNA Guide · Free Cyber Security Services and Tools for Small Organisations Guide · Zero Trust Cross Cutting Capabilities