A vendor says you need zero trust. Another says their product already delivers it. Before buying anything, ask what would actually change for your company. The phrase is most useful when it leads to a clear conversation about who can access a resource, under what conditions, and how that decision is checked.
Zero trust does not mean treating every employee as a suspect. It means not granting access simply because a device is in the office or connected to the company network. Identity, device context, the requested resource, and policy should help determine access. A trusted location by itself is not the whole answer.
Start with one important workflow
NIST’s Zero Trust Architecture guidance focuses protection on resources rather than relying on the network boundary alone. For a smaller company, choose a useful first workflow such as access to company email or a sensitive cloud application. Identify who needs access, which devices are appropriate, and what protection the platform can enforce.
Source: NIST SP 800-207, Zero Trust Architecture
That exercise may reveal an obvious improvement before it reveals a need for another product. A former employee still has an account. A shared administrator login is used for daily work. A business-critical app allows a weak sign-in method. Fixing those gaps can be more valuable than adopting a new label for an unchanged environment.
Use a workable set of building blocks
- Strong authentication for the identities that reach business resources.
- A supported and appropriately managed device baseline.
- Permissions limited to the responsibilities people and services actually have.
- Separation between systems where that reduces unnecessary access.
- Logs and monitoring that help show when access is being misused.
- A process for employee changes, recovery, exceptions, and incident response.
The pieces should fit together. Asking someone to approve a prompt on every action is not automatically better security. A poorly designed rule can drive people toward unmanaged accounts and workarounds. Test the workflow with employees and understand which signals and controls actually improve the decision.
Match the design to your applications
Cloud applications, older line-of-business software, contractors, and shared workstations can present different constraints. Document what is supported and what needs another arrangement. Some identity and device controls require additional licensing. Review that before assuming a setting can be enabled in every account.
RIKR brings a baseline and practical guidance, with flexibility for the company using the technology. Managed IT support, identity protection, endpoint security, and network management can contribute to a zero trust approach. No single product in that group makes the whole organization “zero trust” by itself.
Look for evidence of progress
You should be able to explain what access was reduced, which systems gained stronger checks, and how exceptions are managed. Test whether a lost or compromised device can still reach a sensitive resource. Confirm that employee changes reach the applications people actually use. Keep the explanation grounded in outcomes a business owner can understand.
The objective is functional protection with useful visibility. People still need to work, and the business still needs choices. A good design makes those choices deliberate instead of assuming everything inside the office is safe.
Related: putting least privilege into employee access
Explore RIKR managed cybersecurity
Written by Joshua Price
Back to the blog