Zero Trust
Zero-trust architecture
TL;DR
Zero Trust (NIST SP 800-207) is a security model in which no component is trusted simply because it sits 'inside' the network. Every request is verified.
What is Zero Trust?
Zero Trust principles:
- Never trust, always verify
- Least privilege
- Micro-segmentation
- Continuous verification
- Identity-first security
Microsoft Entra ID with Conditional Access is one Zero Trust implementation.
Example from practice
SME with 100 employees: Zero Trust via Microsoft 365 E5. Conditional Access: compliant devices only, MFA, geographic block. Cost: included in M365 E5.
Frequently asked questions
Migration effort?
6-18 months for an SME. Start with Conditional Access, MFA and device compliance.
Is it mandatory?
NIS2 does not expressly require Zero Trust as a term. The individual building blocks are, however, part of the statutory minimum measures: access control and least privilege fall under § 30(2) no. 9 BSIG (human resources security, access control and management of ICT systems), while multi-factor or continuous authentication and secured communication fall under § 30(2) no. 10 BSIG. (§ 30(2) no. 8, by contrast, concerns cryptographic methods, not Zero Trust.)
See also
Practitioner note: This article is practice-oriented compliance documentation, not legal advice. We are compliance specialists, not a law firm. For legally binding advice, please consult an admitted lawyer.