Many London SMEs still rely on a perimeter model, where staff on the office network are trusted and remote access is granted through a virtual private network (VPN). That model assumes the main threat sits outside the business. Hybrid working, cloud applications and personal devices have weakened that assumption. Zero trust security removes implicit trust from the network and verifies every access request. This article explains zero trust security for London SMEs, which controls are realistic to adopt first, and how to sequence the work without disrupting daily operations.
Table of Contents
- Quick Takeaways
- What Zero Trust Means
- Why Perimeter Security Falls Short
- The Core Principles in Practice
- Where to Start: A Sequenced Approach
- Zero Trust Network Access Compared
- Working With a Managed IT Partner
- Frequently Asked Questions
- References
Quick Takeaways
| Key Insight | Explanation |
|---|---|
| Start with identity | Multi-factor authentication on email, cloud storage and administrator accounts addresses one of the most common routes into business systems. |
| Inventory before restricting | Access rules cannot be applied to applications, devices or accounts that the business has not listed. |
| Treat devices as part of access | A request should be assessed on whether the device is managed, encrypted and patched, not only on who signed in. |
| Remove standing administrator rights | Privileged access should be granted for a defined task and withdrawn afterwards. |
| Disable legacy sign-in methods | Older protocols that bypass multi-factor authentication undermine every other identity control. |
| Phase the rollout | Pilot policies with one team, review sign-in logs, and then extend coverage to the wider business. |
| Review access quarterly | Access rights accumulate as staff join, change roles and leave, so periodic reviews are required to keep them accurate. |
What Zero Trust Means
Microsoft describes zero trust as a security approach based on the principle of never trust, always verify. Under this model, access is granted only after the request has been checked against who is asking, the condition of the device they are using, and the sensitivity of the resource requested. Nothing is accepted simply because it originates inside the office network.
For a London SME, the practical meaning is straightforward. Each sign-in, device connection and application request is evaluated on its own merits. Zero trust is therefore a set of decisions about access, supported by tools, rather than a single product that can be purchased and switched on.
Why Perimeter Security Falls Short
The perimeter model treats the office network as a protected zone. Staff inside the network are trusted, and remote workers reconnect through a VPN. This arrangement suited businesses whose applications ran on premises. It is less effective when email, file storage and line-of-business systems sit in cloud services that staff reach from homes, cafés and client sites.
A common pattern in small business environments is that a compromised password on a cloud email account gives an attacker access without touching the office network at all. The perimeter offers no protection in that scenario. Shared administrator accounts and legacy access rights that were never removed add to the exposure.
Zero trust does not require a business to discard its existing tools immediately. It changes the default from implicit trust to explicit verification, which can be applied to new and existing systems in stages.
The Core Principles in Practice
Zero trust is usually explained through three principles: verify explicitly, grant least privilege and assume breach. For an SME, each principle translates into a small number of concrete controls that can be documented and reviewed.
Verify identity on every request
Identity is the control point that matters most for a small business. Multi-factor authentication, which requires a second proof of identity such as an approved app prompt, should cover email, cloud storage, finance systems and every administrator account. Conditional access policies can then require stronger checks for sign-ins from unfamiliar locations or unmanaged devices.
Grant least privilege
Users should receive only the access their role requires. Administrator rights should be separated from day-to-day accounts, and privileged access should be granted for a defined task and then removed. Quarterly access reviews prevent rights from building up as staff change roles.
Check the health of devices
A verified user on an unpatched or unencrypted laptop still presents a risk. Device compliance checks confirm that a device is managed, encrypted and running supported software before it reaches business data. Personal devices can be allowed with limited access, such as web-based email without local downloads.
Zero trust is less a product than a set of decisions about who and what may reach each business resource, and under which conditions.
Where to Start: A Sequenced Approach
The most effective starting point is to reduce the number of ways an account can be accessed before adding more complex network controls. The sequence below reflects the order in which we would normally recommend work for a London SME with a mix of cloud and on-premises systems.
Build an inventory of identities, devices and applications
Begin with a list of every user account, administrator account, device and cloud application in use. Many businesses find unapproved file-sharing tools that individual teams adopted without central oversight. The inventory defines the scope of every access policy that follows.
Enforce multi-factor authentication first
For most London SMEs, multi-factor authentication across email and cloud accounts is the first control to deploy. It requires limited change to daily work and addresses a frequent route into business accounts. Legacy sign-in protocols that bypass multi-factor authentication should be disabled once modern sign-in is in place.
Segment access to business-critical systems
Finance, payroll and client records should be the first systems to receive explicit access rules. Restricting them to managed devices and named roles limits the impact of a single compromised account. Pilot the policies with one team, review the sign-in logs, and then extend them.
Pro tip: Before enforcing conditional access, document two or three emergency administrator accounts, store their credentials securely offline, and test them. This prevents a policy error from locking the business out of its own systems.
Zero Trust Network Access Compared
Zero trust network access (ZTNA) refers to the part of the model that replaces broad VPN access with connections to specific applications. Instead of placing a remote user on the corporate network, ZTNA grants access to named applications after verification. The right approach depends on the application estate and the number of remote users.
| Approach | Typical Fit for London SMEs | Main Consideration |
|---|---|---|
| Traditional VPN | Small offices with few cloud applications and a stable set of on-premises systems | Grants broad network access once connected, which conflicts with least privilege |
| Zero trust network access (ZTNA) | Firms with cloud applications, hybrid staff and contractors who need access to specific systems | Requires an identity provider and a complete application inventory before deployment |
| Identity-led conditional access (Microsoft 365 environments) | Businesses already using Microsoft 365 that want to enforce sign-in conditions across cloud services | Covers cloud applications well, but older on-premises systems may need a separate connector |
In practice, many SMEs combine identity-led controls with ZTNA for selected applications rather than replacing a VPN in one step. Existing VPN access can remain in place for a limited period while users move to application-specific access.
Working With a Managed IT Partner
Zero trust touches identity, devices, networking and monitoring, so ownership of the work matters. Many London SMEs do not employ an internal security specialist, and the work is easily deferred. An outsourced IT department can take responsibility for the inventory, policy design, monitoring and periodic reviews against documented service levels.
iTO.London delivers this work as part of its managed IT services for London businesses, which include rapid response helpdesk support, proactive monitoring and quarterly technology reviews. Access policies are documented, changes are logged, and the business receives a clear view of where its controls stand.
Pro tip: Ask any prospective provider to show the current list of administrator accounts, the multi-factor authentication coverage across user accounts, and the process for removing access when a member of staff leaves. These three answers reveal more about security maturity than a product list.
Frequently Asked Questions
Is zero trust security suitable for a business with fewer than 50 staff?
Yes. The core controls, namely strong identity verification, least privilege access and device checks, scale down well. A small business can start with multi-factor authentication and an access review, then add application-specific controls as its environment grows.
Does zero trust mean replacing our existing firewall and VPN?
Not immediately. Most businesses keep their existing perimeter tools while they introduce identity controls and device checks. Over time, VPN access can be narrowed to specific applications or retired once alternatives are in use.
How long does a zero trust rollout take?
The timescale depends on the number of systems and the quality of the existing inventory. For this reason, we recommend phasing the work and agreeing milestones for each stage rather than setting a single completion date.
Which guidance should a London SME review first?
Microsoft publishes zero trust guidance for its cloud platform, and the National Cyber Security Centre (NCSC) provides guidance for businesses on cyber security basics. Reviewing both helps a business align its controls with recognised practice.
What should a business do if it suspects a compromised account?
Disable the affected account, reset its credentials from a trusted device, and review recent sign-in activity and mail forwarding rules. Contain the account first, then investigate. If personal data may have been affected, the business should assess whether a report to the Information Commissioner’s Office is required.
We would welcome feedback from London business leaders on which zero trust control has been easiest to adopt in their organisations, and where progress has been slowest.
We would love your feedback and any insights you would share with others. What perspective would you add?