Zero trust architecture for a mid-size company: where to start and in what order

Zero trust architecture and where a mid-size company starts

Zero trust architecture is a security design that gives no user or device implicit trust because of its network location or because the company owns it: every request to an application or data source is authenticated and authorised for that session, under a policy that checks the identity, the device and its state. For a company of 200 to 2,000 staff we recommend this order: identity with phishing-resistant multi-factor authentication, device inventory and posture, privileged access, separate networks for management and backup, per-application access in place of a flat VPN, and central logging that grows with each step.

The reference definition is NIST Special Publication 800-207, Zero Trust Architecture, of August 2020, which describes zero trust as moving defences from static, network-based boundaries to users, assets and resources. The UK National Cyber Security Centre (NCSC), in guidance of October 2025, lists “a product” among the things zero trust is not. A co-author of NIST’s implementation guide, quoted in NIST’s announcement of June 2025, said that “every ZTA is a custom build”.

NIST SP 800-207: the seven tenets in plain terms

The table sets the seven tenets of SP 800-207 next to what each changes in a mid-size estate.

NIST SP 800-207, Zero Trust Architecture (August 2020), section 2.1; the right-hand column is our summary.

Three core logical components carry this out. The policy engine makes “the ultimate decision to grant access to a resource for a given subject”, the policy administrator establishes or shuts down the communication path, and the policy enforcement point enables, monitors and terminates the connection. In a company of 200 to 2,000 staff the access policies of the identity provider can act as the engine, and application proxies, firewalls, VPN gateways and endpoint agents as enforcement points. NIST expects most enterprises to run a hybrid of zero trust and their existing network-based design while they modernise.

CISA zero trust maturity model: five pillars and a self-assessment

CISA’s Zero Trust Maturity Model was written for US federal agencies. The US Office of Management and Budget organised its agencies’ zero trust goals by this model in memorandum M-22-09 of 26 January 2022, which describes five pillars: identity, devices, networks, applications and workloads, and data. Visibility and analytics, automation and orchestration, and governance run across all five. For each pillar, CISA’s own page on the model lists examples of traditional, initial, advanced and optimal zero trust architectures.

Under identity, for example, the OMB strategy says agencies “must require their users to use a phishing-resistant method to access agency-hosted accounts”. A mid-size company can use the pillars as a self-assessment without adopting the federal targets:

1. Rate each pillar from evidence, such as the share of accounts with MFA, of devices enrolled in MDM and of applications reached through a policy check.
2. List the systems that cannot reach the target, such as applications without modern authentication, and the control that compensates for each.
3. Set one target per pillar for the next budget period, and expect the pillars to move at different speeds.
4. Repeat the rating after each step of the roadmap below.

Our Cyber Resilience assessment covers infrastructure, access and backups and ends with a risk map and a prioritised action plan. Send us your rating per pillar and the systems you expect to remain exceptions.

NIST SP 1800-35: the 19 example implementations and their order

NIST finalised its practice guide SP 1800-35, Implementing a Zero Trust Architecture, in June 2025. It documents 19 example implementations built with 24 collaborators from commercially available technology. The web edition maps the reference design and the capabilities used in the builds to CSF 2.0 subcategories and SP 800-53 controls, among other references. The project began with enhanced identity governance (EIG); in NIST’s words, “Our first implementations with minimum viable solutions were EIG deployments because the identity-based controls provided by EIG are foundational components of ZTA.” That phase ran first without cloud capabilities and then with them, and microsegmentation, SDP and secure access service edge (SASE) builds came afterwards.

For that phase the guide treats authentication and periodic reauthentication of users and endpoints as fundamental, and endpoint health checks as highly desirable. Its takeaways begin with an inventory of all assets, ask for critical resources to be isolated in their own trust zones, and note that implementation may begin with tools that continuously monitor the environment. The project also found that zero trust products from different vendors need more integration, so check how device signals reach the access policy before buying more tools.

A zero trust roadmap in six steps for 200 to 2,000 staff

Start with the inventory that NIST and the NCSC both put first; the NCSC’s first principle is “Know your architecture including users, devices, services and data”. List accounts of every kind, devices, applications with the networks they are reached from, and the administration interfaces of hypervisors, backup servers, firewalls and BMCs.

The order and the controls are our recommendation, drawing on NIST SP 800-207 (2020) and SP 1800-35 (2025), OMB memorandum M-22-09 (2022) and the NCSC’s zero trust guidance (reviewed 16 January 2026).

Identity comes first because each later decision needs a verified user, and contractors and service accounts need managed identities as much as staff do. Our guide to phishing-resistant MFA compares the methods and where to enforce them first.

For devices, OMB’s strategy requires agencies to consider “at least one device-level signal” alongside identity; in this roadmap, an unenrolled, unencrypted or unpatched laptop is refused. Personal and suppliers’ devices get a narrower path, such as browser access to selected applications.

Administrator accounts should be used only from administrator workstations, never for email or web browsing. Vaults, just-in-time access and break-glass accounts are covered in the guide to privileged access management.

The fourth step moves hypervisor management, BMCs, backup servers and firewall management onto their own segments, reached only from administrator workstations, with backup credentials kept out of the production directory. Implementing Regulation (EU) 2024/2690 asks the digital providers it covers to “separate the dedicated network for administration of network and information systems” from the operational network (point 6.8.2(f)). Zones and their flows are set out in the guide to network segmentation and microsegmentation.

Logging sits last in the table because it gains value with each step, but collection starts with step one. Which tool collects what is explained in our comparison of EDR, XDR, SIEM and MDR.

Our Cyber Resilience service builds such an architecture following NIST CSF 2.0, with network segmentation, multi-factor authentication, privileged access management, MDM and DLP. Tell us which of the six steps are in place and which systems still accept a password alone.

Application access without a flat VPN

A remote-access VPN that places users on the internal network gives each connected device whatever reach the routing and firewall rules allow, often entire server subnets. SP 800-207 lists among its network requirements that remote enterprise assets “should be able to access enterprise resources without needing to traverse enterprise network infrastructure first”; its example is email hosted by a public cloud provider, reached without a VPN. OMB’s strategy says MFA should be “integrated at the application layer” rather than through network authentication such as a VPN. In a zero trust design an enforcement point, such as an identity-aware proxy, an application gateway or an agent, sits in front of each application.

The NCSC cautions against making this the aim: “Finding a replacement for your VPN should not be the goal of adopting ZT”. It advises keeping existing controls until the zero trust architecture provides equivalent or stronger protection, and not inherently trusting traffic that arrives through a VPN that stays. A mid-size company can start with web applications and supplier access, giving a supplier one application for a limited time, and narrow the VPN rules per role for what remains.

Zero trust in NIST CSF 2.0 and NIS2

The NIST CSF 2.0 document of 26 February 2024 does not use the term zero trust. The outcomes a zero trust programme delivers sit mainly in its Protect function. Identity Management, Authentication, and Access Control (PR.AA) covers managed identities and credentials (PR.AA-01), authentication of “Users, services, and hardware” (PR.AA-03) and access that incorporates “the principles of least privilege and separation of duties” (PR.AA-05). PR.IR-01 asks that networks and environments be protected from unauthorised logical access and usage. Inventories sit under ID.AM, log records under PR.PS-04 and monitoring under DE.CM.

NIS2 mentions zero trust in Recital 89 of Directive (EU) 2022/2555, which lists “zero-trust principles” among the basic cyber hygiene practices essential and important entities should adopt. Article 21(2) asks for “access control policies and asset management” in point (i) and, where appropriate, for “multi-factor authentication or continuous authentication solutions” in point (j). Our guide to NIS2 Article 21 covers all ten measures; whether NIS2 applies to a company is a legal assessment for its legal department.

Zero trust for SMB and mid-size companies: what can wait

The NCSC writes that zero trust “can be costly, disruptive and resource-intensive” and that full migration may require rearchitecting many systems over several years. Its guidance starts from the organisation’s specific security challenges. For 200 to 2,000 staff we would start with the first four steps, which remove standing trust from the accounts and networks that control everything else and can often build on the directory, MDM, EDR and firewalls already in place.

Microsegmentation of every server-to-server flow, data classification with DLP across all repositories, automated responses to behavioural signals and the optimal stage in any pillar can follow later. Exceptions need an owner from the start, among them applications without modern authentication, production machines that cannot run an agent, shared accounts and break-glass accounts. Give each a compensating control, such as a dedicated segment or a gateway, and a review date, and raise an alert on every use of a break-glass account.

What we do

Under Cyber Resilience, our engineering partner Vixen.UNO builds zero-trust architectures following NIST CSF 2.0, with network segmentation, multi-factor authentication, privileged access management, mobile device management (MDM) and data loss prevention (DLP). The same service covers firewalls, EDR/XDR on workstations and servers and event centralisation in a SIEM, on Trend Micro, Cisco and other vendors’ solutions. The technical assessment that follows the first call ends with a risk map and a prioritised action plan, and changes roll out step by step in agreed maintenance windows with a rollback plan. During the project Vixen.UNO works in your environment under your access controls, as our security and compliance page describes. Eurokommerz holds the contract; the first call is free of charge, and the price of the technical assessment is fixed before work begins.

FAQ