Think about the last person who left your business. How long did it take before their email, their access to the shared drive and the invoicing tool stopped working? If the honest answer is "weeks" or "we never got round to it," you already understand the problem zero trust was invented to solve.
Zero trust sounds like something you buy. It isn't. It's a way of deciding who gets in, and it starts by dropping the assumption most small offices still run on: that anyone who made it past the router is safe.
The Assumption Worth Dropping
Most small networks are built like a house with one front door. If you're inside, you can wander. The Wi-Fi password sits on a sticky note by the till. The shared drive has no per-folder permissions, because everyone at work is "us." The finance login lives in a spreadsheet because three people need it.
That model works right up until it doesn't. Working from home means the inside is now somewhere else. Contractors and accountants come and go. A laptop gets left on a train. A free PDF converter someone installed quietly sends data to a server nobody has heard of. And once an intruder is inside a flat network, everything else is easy: one password opens the next door and the one after that.
Zero trust replaces one big door with a series of smaller, checked ones.
What Zero Trust Actually Means
Strip away the marketing and it comes down to four habits:
- Verify every time. Access is granted to a person and a device for a specific job — not because the request came from the office network.
- Give the minimum. Someone who needs to read invoices does not also need to delete them.
- Assume something will go wrong. Design so that one stolen password doesn't hand over the whole business.
- Keep the record. If you can't see who signed in and when, you can't tell normal from strange.
That's the whole idea. The tools exist to serve these habits, not the other way around.
Four Questions Behind Every Access Decision
Before you grant anything — a folder, an app, a server — ask:
- Who is asking? A named person with their own account, or "whoever is on the front desk today"?
- What do they need to reach? One folder, one system, one function.
- From which device, and where? The company laptop in the office, or a personal phone on hotel Wi-Fi?
- For how long? Forever, or for the eight weeks of a project?
Now apply it to the situations that come up in almost every small business:
- The bookkeeper needs to read purchase invoices, not delete the whole company drive.
- A new sales hire needs email, the CRM and the proposals folder — not the HR files.
- Your external accountant needs one folder during tax season, with a start and an end date, not a permanent login.
- The office printer doesn't need an account that can sign in to anything else.
A Realistic Starting Point
You don't need a platform, a consultant and a budget line to begin. You need an afternoon and a spreadsheet.
- Make a list. Every login the business depends on: email, banking, accounting, CRM, cloud storage, the router, the Wi-Fi. Note who has access and whether it's a named account or a shared one.
- Give everyone their own account. Shared logins mean you can never tell who did what, and you can't remove one person without changing the password for everyone.
- Turn on multi-factor authentication, email first. Your inbox is the reset button for almost everything else.
- Cut admin rights. Most people don't need to install software on a work laptop. Keep one or two admin accounts and use them only when required.
- Group by role, not by person. "Sales" and "Accounts" permissions are easier to keep clean than twenty individual setups — and far easier when someone changes jobs.
- Write down the leaver process. One page, done the same day: disable the account, change shared passwords, collect the laptop, remove the phone from the Wi-Fi.
- Review quarterly. Open the list, compare it with reality, delete what's no longer needed. Thirty minutes, four times a year.
The Step That Pays Off Fastest
If you only do one thing, put multi-factor authentication on email and on any tool that can reset other passwords. Most account takeovers start with a password that leaked somewhere else or was simply guessed. A second factor — an app code or a hardware key — means a stolen password alone isn't enough.
What This Looks Like in a Ten-Person Office
Picture a small design studio. The owner has full access for billing. Two designers share a projects folder with edit rights. A freelance illustrator gets access to a single project folder that closes in three weeks. The accountant gets read-only access to invoices and nothing else. Nobody shares a login, and everyone confirms sign-ins with an app on their phone.
That arrangement took an afternoon and cost nothing but the time. It also means a lost laptop is an inconvenience rather than a crisis.
Where People Get Stuck
- Buying tools before writing rules. Software that enforces permissions you haven't defined just moves the mess somewhere else.
- Making access painful. If requesting a folder takes three days, someone will email the file instead — or share a password.
- Forgetting the boring accounts. The router, the guest Wi-Fi code, the domain registrar, the card paying for subscriptions.
- Forgetting personal devices. If people read work email on their phones, those phones are part of your access picture.
- No owner. This isn't a project with an end date. Someone has to hold the list and review it.
Start Smaller Than You Think
Pick one account — email is the best candidate — and do three things this week: confirm everyone has their own login, switch on multi-factor authentication, and write down who has access. Then repeat for the next system on your list. Small offices rarely struggle with this because the technology is hard. They struggle because the plan was too big to start.
If your business handles payment data, health information or client data under a contract, check the requirements you've agreed to before deciding what's "good enough," and take professional advice where the obligations are unclear. For everyone else, a spreadsheet and an afternoon are a genuinely good place to begin. You will never be able to trust every device and every person. You can stop pretending you have to.
Photo: Thirdman / Pexels
