"Zero trust" is usually sold as a major project with a six-figure price tag. For a five-person accounting firm or a twelve-person design studio, the useful version is smaller and far more boring. It comes down to three habits: check who is asking, check what device they are asking from, and hand over only the access they actually need to do the job. You can start that this week, with no IT team and very little spending.

What zero trust really means

The old way of thinking was a castle with a moat. If you were inside the office network, you were trusted. Once a stolen password got someone through the front door, they could wander from the shared drive to the invoicing system to the client database without anyone asking questions.

Zero trust removes the free pass. Being on the office Wi-Fi, or having logged in yesterday, no longer counts as proof that you should see a file today. Every request gets checked, every time.

In practice, for a business your size, that means asking three questions whenever someone reaches for a system:

• Who is this? Identity, ideally with a second factor beyond a password.
• What are they using? A managed, updated, encrypted device — or an unknown one?
• Should they have this? Does their role require it, and only it?

The damage in small-business incidents almost always comes through the same handful of openings: a reused password, a laptop left unlocked at a café, an ex-employee's account nobody remembered to disable. Zero trust is mostly about closing those.

Start with MFA, starting with your money

Multi-factor authentication is the highest-value step you can take, and most of it costs nothing. Turn it on first everywhere that touches cash, client data, or your identity:

• Email — business email is the master key to almost everything else.
• Online banking and payment platforms.
• Your accounting software and payroll provider.
• Cloud storage where client files live.
• Your domain registrar. If someone takes over your domain, they can quietly intercept your email and reset passwords elsewhere.

Prefer an authenticator app or a hardware key over text messages, since phone numbers can be hijacked. And think about the single point of failure: if the only MFA device belongs to the office manager who is hiking in Patagonia for three weeks, you have a problem. Register a backup device for at least two people on every critical account.

Check for the quiet bypasses

Many platforms still allow "app passwords" or legacy connections that skip the second factor entirely. Look through the security settings of your main tools and switch off anything you do not recognise or need. This is dull work, and it is where a surprising number of gaps hide.

Check the device, not just the password

A correct password typed into a compromised laptop is still a problem. You do not need a mobile device management suite to improve this. You need a short checklist applied to every work device — company-owned and personal:

1. Turn on full-disk encryption. BitLocker on Windows, FileVault on Mac.
2. Require a screen lock with a short timeout. Five minutes is reasonable in an office, one minute if the laptop travels.
3. Keep automatic updates on, including the operating system and the browser.
4. Enable remote wipe through Microsoft, Apple, or Google business accounts so a lost laptop is an inconvenience, not a breach.
5. Write the details into a simple spreadsheet: device, owner, serial number, encrypted yes or no, last update check.

If staff use personal phones for email, decide the terms. Most tools let you require a passcode on the phone in exchange for access. Make that choice deliberately rather than by default.

Give people only the access they need

Least privilege sounds technical. It usually just means untangling habits. Most small businesses have everyone sharing one folder, one login, or admin rights nobody remembers granting.

Fix the worst of it first. Ask: who can move money out of the bank? Who can delete client files permanently? Who can add or remove users? That short list is where the real risk sits.

Then make a few changes:

• Separate admin accounts. Nobody browses the web or reads email from the account that can change system settings.
• Retire shared logins. Where a shared mailbox genuinely makes sense, keep it; where people share one password to a tool, move them to individual accounts with a password manager.
• Adopt an offboarding list. Disable accounts the same day someone leaves, forward their mail for a set period, collect devices, and change any shared passwords they knew.
• Review access twice a year. Put it in the calendar. Old accounts are the risk that never announces itself.

Write it down, and test your backups

You do not need a forty-page policy. One page that people actually read beats a binder nobody opens. Cover who approves new software, what to do about a lost device, how to report a suspicious email, and who holds admin rights. Add a friendly internal test message occasionally to see whether the reporting habit is real.

Backups deserve their own mention because they are the safety net when prevention fails. Keep three copies, on two kinds of storage, with one held offline or off-site. Then restore a file — properly, from the backup, into a test folder — at least twice a year. An untested backup is a hope, not a plan. If you carry cyber insurance, ask your broker which controls your policy expects; the answer often shapes where to spend first.

Your first thirty days

Week one: switch on MFA for email, banking, accounting, and your domain registrar. Add a backup device for each.

Week two: set up a business password manager with shared vaults, create separate admin accounts, and build the offboarding checklist.

Week three: encryption, screen locks, automatic updates, and remote wipe on every device. Fill in the inventory spreadsheet.

Week four: restore a backup to prove it works, publish the one-page rules, and book the twice-yearly access review.

Zero trust is not a product you buy once and finish. It is a set of small, repeatable habits. Do these four weeks and you have removed most of the easy ways in — without hiring anyone.

Photo: meetthephil / Pixabay