Zero Trust
Last updated
Definition
Zero Trust is a security model in which no user, device, or network location is trusted by default: every access request is authenticated, checked against policy, and limited to the least privilege needed, whether it comes from inside the office or a coffee shop. It is an architecture described in NIST SP 800-207 and CISA's Zero Trust Maturity Model, not a product – anything sold as "Zero Trust in a box" is one component of it.
Why it matters to an MSP
For an SMB, Zero Trust reduces to three things you can actually deploy. Identity: MFA on every account, SSO so applications inherit it, and conditional access that blocks sign-ins from unmanaged devices or impossible locations. Device posture: only enrolled, patched machines running EDR get to company data. Least privilege: no standing admin, access granted per role and per task, and application control instead of "trust the internal network." Most of that is configuration inside licenses the client already pays for, which makes it a high-margin security tier – a conditional-access and device-compliance baseline takes a few hours per tenant to deploy from a template. The model applies to you as much as to clients: partner access to customer tenants through GDAP, just-in-time elevation, and technician devices held to the same posture rules are Zero Trust turned on the MSP itself, which is what cyber insurance questionnaires now probe. Commercially, Zero Trust is the answer to "we already have a firewall" – the perimeter stopped being where the data lives once the data moved to SaaS. The failure mode is partial adoption: MFA without device checks, or device checks with standing local admin everywhere. Sell the controls, not the label, and sequence them as in identity and access for SMB.