Zero trust sounds enterprise, but for SaaS-heavy SMEs it means identity, device posture and least privilege per app — not a big-bang network project.
Realistic roadmap
- Identity: MFA everywhere, no shared admin accounts, HR ↔ IAM lifecycle.
- Devices: laptop baseline (patch, encryption, MDM where needed).
- Apps: per SaaS: who has which role, quarterly access review.
- Logging: central source for login and admin actions.
ISO 27001 link
Map zero-trust measures to Annex A. Document in SoA how you enforce least privilege in cloud. More: ISO 27001 for SaaS and ISMS.
For SMEs in 2026 conditional access and MFA on all cloud apps deliver highest return: blocks most account takeover without new hardware. Record policy and show quarterly access reviews in sample period.
Device posture can start with encryption and patch compliance on laptops — full MDM is not always needed on day one. Document in risk assessment which devices access which data classes.
Least privilege per SaaS: export role matrix from IdP and top five apps, remove orphaned accounts after offboarding. Auditors sample one departed employee and one admin account.
Identity-first without big bang
For many SMEs the identity provider is the real network: Microsoft Entra ID, Google Workspace or Okta decide who reaches which SaaS. Invest there first in conditional access, MFA and HR lifecycle before expanding office network segmentation.
Per critical SaaS, maintain a role overview: default role, admin role, external access and review frequency. Quarterly access reviews need not be hour-long projects — an export plus line-manager sampling is enough if you document the process.
Admin action logs in cloud apps belong in the same retention as VPN and firewall logs. Auditors cross-check: if someone gets admin rights in Salesforce, that must appear in IdP and application logs.
Document in the SoA which zero-trust measures you choose as risk treatment and which you deliberately defer — with rationale and planned date. That beats putting zero trust on paper without execution.
Start with your top three SaaS apps by data sensitivity — not the entire landscape at once. Success there convinces leadership faster than a thirty-page zero-trust roadmap. Measure before and after: admin account count, orphaned users, MFA coverage.
Note: this article is educational and does not replace legal, privacy or audit advice for your specific situation.