Zero Trust for SMBs: A Practical Guide (Without the Enterprise Budget)

Zero trust gets marketed as an enterprise transformation program with seven-figure budgets. For a 40-person operator, that's not actionable, but the core idea is: don't trust access just because someone is on your network or behind your firewall.

That's increasingly relevant when staff work from home, vendors have standing VPN access, and cloud apps sit outside your perimeter entirely.

What zero trust means in plain language

Traditional security assumed: inside the office = safe, outside = risky. Zero trust assumes: every access request must be verified, who you are, whether your device is healthy, and whether you're allowed to reach that specific app or file.

For SMBs, zero trust usually boils down to:

1. Strong identity, MFA everywhere, no shared accounts
2. Least privilege, access only to what's needed for the role
3. Device health, managed laptops, compliance policies via Intune or equivalent
4. Segmentation, clinical, admin, guest, and IoT traffic separated
5. Continuous verification, not one login at 8am that lasts all day unchecked

You don't need a zero trust "platform" on day one. You need progressive tightening with a plan.

Phase 1: Identity (weeks 1–4)

This is where ROI is highest:

• Enforce MFA on all M365/Google accounts
• Conditional access: block legacy auth, require compliant devices for sensitive apps
• Remove orphaned accounts and shared credentials
• Admin roles assigned with least privilege, break-glass accounts documented offline

Most breaches start with compromised credentials. Phase 1 closes the widest door.

Phase 2: Device trust (weeks 4–8)

• Enroll all company laptops in MDM (Intune, etc.)
• Require disk encryption, screen lock, OS patch compliance
• Block personal devices from PHI systems unless explicitly approved with containerization

"Bring your own laptop" and PHI rarely mix without controls.

Phase 3: Application access (weeks 8–16)

• Move from network-level VPN to app-level access where possible (ZTNA, conditional access to SaaS)
• Retire "full network tunnel" VPN for roles that only need email and one cloud app
• Inventory every app that stores sensitive data, assign owners

VPN that grants access to the entire LAN is the opposite of zero trust.

Phase 4: Network segmentation (ongoing)

• VLANs for guest Wi-Fi, cameras, clinical workstations, admin staff
• Firewall rules that deny east-west traffic by default
• Document what's allowed and why

Segmentation limits blast radius when something is compromised.

What to skip at SMB scale

• Custom micro-segmentation at datacenter scale
• Buying a zero trust suite before MFA is enforced
• Replacing working VPN overnight without pilot groups

Measuring progress

Track quarterly:

• MFA coverage (% of active accounts)
• Unmanaged device sign-ins blocked
• Admin account count and last review date
• Segmentation test results (can guest Wi-Fi reach file shares?)

Your MSP should report these in QBRs, not just ticket volume.

Contact us for a zero trust gap assessment against your current M365 and network setup.