In this guide · 8 sections
- 01What zero trust means, in plain words
- 02Why zero trust matters for a small business
- 03Zero trust set-up on Microsoft 365 or Google Workspace
- 04Do you still need a VPN or firewall?
- 05Zero trust marketing: what to ignore
- 06How far a 10-person company should go
- 07Do it yourself or get help?
- 08Frequently asked questions
Short answer
Zero trust is a security approach, not a product: verify every sign-in, give each person only the access they need, and assume an attacker may already be inside. For a small team that means MFA, managed devices, sign-in rules and tidy sharing in Microsoft 365 or Google Workspace.
What zero trust means, in plain words
The old model was a castle with a moat. Anyone inside the office network, or connected through the VPN, was trusted. That stopped making sense once email, files and accounting moved to the cloud and staff started working from home, cafes and their phones.
Zero trust drops the idea of a trusted inside. The US standards body NIST describes it in SP 800-207, Zero Trust Architecture (published August 2020). One of its basic tenets is that network location alone does not imply trust: a request from the office Wi-Fi must meet the same checks as one from a hotel.
Microsoft's Zero Trust overview boils it down to three principles that are easy to remember:
| Principle | What it means | What it looks like in a 10-person firm |
|---|---|---|
| Verify explicitly | Every access request is checked using all available signals | MFA on every account; sign-in blocked from unmanaged or risky devices |
| Use least privilege | People and apps get only the access they need, for as long as they need it | Two admin accounts, not ten; shared drives per team; leavers removed on day one |
| Assume breach | Design as if an attacker is already inside, and limit the damage | Device encryption, endpoint protection, backups, alerts and sign-in logs you actually read |
Why zero trust matters for a small business
Small firms rarely get hit by clever network intrusions. They get hit by a stolen password on a mailbox, a fake invoice sent from that mailbox, or a laptop left in a taxi. Each of these is an identity or device problem, which is exactly what zero trust focuses on.
Microsoft's security defaults page says more than 99.9% of common identity-related attacks are stopped by using multifactor authentication and blocking legacy authentication. That is the first and cheapest zero trust step, and it is free.
The second reason is customers and tenders. Larger clients, insurers and the CSA Cyber Essentials mark ask about access control, secure configuration and device protection. A zero trust set-up answers most of those questions.
Zero trust set-up on Microsoft 365 or Google Workspace
You do not need a new platform. These steps use features that come with the business plans most Singapore SMEs already pay for. Do them in this order, because each one builds on the last.
Turn on MFA for every account
On Microsoft 365, switch on security defaults (free) or Conditional Access policies. On Google Workspace, enforce 2-Step Verification for all users. Our MFA set-up guide has the clicks.
Block old sign-in methods
Legacy protocols such as basic-auth POP and IMAP skip MFA. Security defaults block them on Microsoft 365. On Google Workspace, review app passwords and third-party app access in the Admin console.
Cut admin rights down
Keep two named admin accounts with strong MFA, plus one break-glass account stored safely. Everyone else works as a normal user. See admin account best practice.
Enrol and encrypt devices
Use Microsoft Intune or Google endpoint management to require encryption, a screen lock and updates. Company data on personal phones goes into a work profile you can wipe.
Add sign-in rules based on device and risk
With Conditional Access you can require a compliant device to open email or SharePoint. Our Conditional Access guide lists the starter policies.
Tidy sharing and remove leavers
Review 'anyone with the link' shares, move team files to shared drives, and run a leaver checklist the day someone goes.
Watch the logs
Send sign-in and security alerts to a mailbox someone reads. Assume breach means you expect to spot something, not hope you never will.
Do you still need a VPN or firewall?
Zero trust does not mean throwing away the office firewall. It means the firewall is no longer the thing that decides whether someone gets into your files. If all your data lives in Microsoft 365 or Google Workspace, most staff do not need a VPN to reach it, because the sign-in checks do the job.
A VPN or a zero trust network access (ZTNA) tool still makes sense when you have something on the office network that cannot sit behind a cloud sign-in, such as an old accounting server or a NAS. Our guide on whether a business needs a VPN covers that decision.
Zero trust marketing: what to ignore
Because zero trust is a popular term, it now appears on almost every security product page. NIST itself notes that its tenets are an ideal goal and not every tenet will be fully implemented for a given strategy. Use that as your filter.
Real zero trust work
- MFA or passkeys enforced for every user, including the director
- Access decided by user, device health and app, not by office IP
- Least-privilege admin roles and regular access reviews
- Managed, encrypted devices with remote wipe
- Logs and alerts that someone reviews
Marketing to question
- A single appliance sold as 'zero trust in a box'
- A VPN rebranded as zero trust with no device or identity checks
- A product that needs you to drop MFA or share admin passwords
- Promises of 'complete protection' or 'no breaches'
- Annual contracts priced for 500 users when you have 10
If a vendor pitches zero trust, ask three questions: which identity provider does it check against, does it look at device health, and what happens when a check fails. Clear answers suggest a real control. Vague answers suggest a label.
How far a 10-person company should go
Think in levels. Level one is free and covers most real attacks: MFA, blocked legacy sign-ins, two admins and a leaver checklist. Level two adds device management and encryption, which matters as soon as client data sits on laptops and phones. Level three adds Conditional Access rules on device compliance and location, plus regular access reviews.
Most firms in professional services, healthcare or finance should aim for level three. A small retail or F&B business with one shared laptop can usually stop at level one plus encryption. Our Microsoft 365 security checklist works as a level check for Microsoft tenants.
Do it yourself or get help?
A confident admin can do level one in an afternoon using the vendor guides linked above. The risky part is Conditional Access: a badly scoped policy can lock every user, including you, out of email. Test with one user, keep a break-glass account excluded, and change one policy at a time.
Zero trust basics for a small team
If you prefer it done for you, our Microsoft 365 / Google Security Lockdown (S$590) covers MFA, admin roles, sign-in rules and sharing, and Device Encryption & Management (S$490) enrols and encrypts up to 10 devices on your own licences.
Frequently asked questions
No. The principles scale down well. For a small company zero trust mostly means MFA on every account, managed and encrypted devices, few admin accounts and access based on who and what device is signing in. Much of this is already included in Microsoft 365 and Google Workspace business plans, so the main cost is set-up time rather than new software.
Not really. NIST describes zero trust as a set of principles and an architecture, not a single product. Vendors sell parts of it, such as identity, device management or zero trust network access tools. If a product claims to deliver zero trust on its own, ask how it checks user identity and device health before you buy.
No. Endpoint protection is part of the assume-breach principle. Zero trust decides who and what may access company data, while antivirus or endpoint detection looks for malware on the device itself. A healthy device signal from your endpoint tool can feed into sign-in rules, so the two work together rather than compete.
Not for the basics. Security defaults, which enforce MFA and block legacy sign-ins, are free in every tenant. Business Premium adds Conditional Access and Intune device management, which let you require a compliant device before staff open email or files. Firms holding sensitive client data usually find the upgrade worth it.
ZTNA stands for zero trust network access. It replaces a traditional VPN by giving users access to one specific internal app after checking identity and device, rather than to the whole office network. A small business only needs it if it still runs internal servers or apps that staff must reach from outside the office.