Zero Trust for Mid-Market Organizations: A Phased Roadmap

What zero trust means

NIST SP 800-207 describes zero trust as moving defenses from static network perimeters to users, assets and resources. In practice that means:

• Every access request is authenticated and authorized, wherever it comes from.
• Access is limited to what is needed, for as long as it is needed.
• Decisions consider identity, device health and context, such as location and behavior.
• Networks are assumed to be hostile, so traffic is protected and monitored.

Why it matters for mid-sized organizations

Staff work from home and client sites, applications live in SaaS and cloud platforms, and vendors connect remotely. A firewall around the office no longer describes where users and data are. Meanwhile, ransomware groups and fraudsters target organizations of every size, usually through stolen credentials.

Use a maturity model to structure the work

CISA's Zero Trust Maturity Model organizes zero trust into five pillars (identity, devices, networks, applications and workloads, and data) supported by visibility and analytics, automation and orchestration, and governance. Each pillar moves from traditional to initial, advanced and optimal maturity. Mid-sized organizations do not need to reach optimal everywhere; they need to raise the pillars that protect their most important systems.

Phase 0: Baseline and priorities

• Inventory identities, devices, applications, data stores and every way people reach them.
• Identify the most sensitive systems and data: finance, customer records, HR and production systems.
• Record current controls and known gaps.
• Agree sponsorship, scope and how exceptions will be approved.

Phase 1: Identity

• Consolidate sign-in on one identity provider where possible, with single sign-on for SaaS applications.
• Enforce MFA for everyone; use phishing-resistant methods such as security keys or passkeys for administrators.
• Block legacy authentication protocols that cannot use MFA.
• Separate administrator accounts from daily accounts, and grant privileged roles only when needed.
• Connect account changes to HR processes so leavers lose access the same day.
• Review access to sensitive applications regularly.

Phase 2: Devices

• Enroll company devices in central management.
• Define compliance requirements: encryption, supported operating system, current updates and endpoint protection.
• Require compliant devices for access to sensitive applications.
• For personal devices, use app protection policies that separate company data.

Phase 3: Applications and access

• Put applications behind single sign-on and conditional access.
• Replace broad VPN access with per-application access, starting with web applications.
• Route vendor and administrator access through privileged access tools with approval and recording.
• Remove management interfaces from the internet.

Phase 4: Networks

• Break flat networks into zones with filtered traffic between them.
• Isolate guests, cameras and building devices.
• Apply microsegmentation to critical server environments.
• Encrypt traffic between sites and to cloud services.

Phase 5: Data

• Classify data so the most sensitive information is known.
• Apply sharing restrictions, encryption and data loss prevention where they matter most.
• Protect backups separately from production credentials.

Throughout: visibility and governance

Collect identity, device, network and application logs centrally, and make sure someone reviews alerts. Keep an exceptions register with an owner, a reason and an expiry date for every policy exception.

Measuring progress

Common pitfalls

• Buying a "zero trust product" before defining the strategy.
• Trying to change everything at once.
• Ignoring user experience until MFA fatigue leads to careless approvals.
• Allowing exceptions with no owner or expiry.