--- title: "Zero Trust for SMEs: 4 steps and 90 days with managed IT" description: "Zero Trust for SMEs in 90 days: MFA, controlled devices, a segmented network and least-privilege access, with managed cybersecurity. No-obligation proposal." language: en url: https://www.dataroad-it.com/en/zero-trust-sme-90-day-plan/ source: https://www.dataroad-it.com/en/zero-trust-sme-90-day-plan/ publisher: DataRoad IT (DataRoad - IT Services and Consulting), Portugal --- > Zero Trust for SMEs in 90 days: MFA, controlled devices, a segmented network and least-privilege access, with managed cybersecurity. No-obligation proposal. # Zero Trust for SMEs: 4 steps and 90 days with managed IT At a glance For decision-makers short on time. - 01 Zero Trust for SMEs: no access is granted just for being on the network; every request is verified. - 02 Four steps in order: identity, devices, segmented network and least privilege. - 03 For 10 to 200 workstations, the essentials take about 90 days with Microsoft 365 and firewall. - 04 Verizon 2026: in SMEs, 55% of breaches involved third parties and 45% a human factor. ### In this article A single password captured by phishing is enough for an attacker to roam the entire network of a company that trusts whoever is "inside". **Zero Trust for SMEs** ends that automatic trust: every access is validated by the person, the device and the resource requested. In an organisation of 10 to 200 workstations, the core is implemented in around 90 days. Almost always with what is already paid for: Microsoft 365, firewall and managed workstations. You do not buy a box called Zero Trust. It is a method for organising access, and that is what this guide shows. ## What does it cost the company to keep trusting whoever is already in? Verizon's 2026 Data Breach Investigations Report is clear about SMEs. In 55% of the breaches studied a third party was involved: supplier, partner or service provider. In 45% there was a human factor, such as a wrong click or a password reused on another service. None of these doors is closed by a perimeter firewall. The attacker does not force entry; they use valid credentials. From there, in a traditional model, the whole company is open to them. With Zero Trust, the damage from a compromised account is confined to that person and a fraction of the systems. For the board, that means less downtime, less exposed data and a very different conversation with clients and the insurer. ### Does NIS2 come into the equation? It does. Among its risk management measures, the NIS2 directive calls for access control, an asset inventory and multi-factor authentication. The term Zero Trust does not appear, but the four steps below cover much of that technical work. To find out whether you are in scope, read our [NIS2 guide for SMEs](https://www.dataroad-it.com/en/nis2-smes-managed-cybersecurity-guide/). ## Castle wall or boarding control: which protects better? The old model was a fortress. A strong firewall around the outside and total freedom inside. It worked when everyone was in the office and the data lived on a local server. Today there is remote working, Microsoft 365 in the cloud, smartphones and providers connecting remotely. The wall is full of holes. Zero Trust works like an airport. Getting through the terminal door puts nobody on a plane. The boarding pass is checked at security, again at the gate, and is valid for one flight and one seat only. Your systems adopt the same discipline. ## The four Zero Trust steps for SMEs, in order of return ### Step 1. Identity: make the password insufficient - **Mandatory MFA** First for administrators and Microsoft 365, then for every service. - **Leavers closed the same day** Whoever leaves the company loses access that day, not weeks later. - **Administrators counted** Two or three named people, with a separate account used only for administration. - **An end to generic accounts** "info@" or "shop1" can no longer be used to log in to systems. No other step gives so much for so little. With MFA, a password captured by phishing is no longer enough. Most Microsoft 365 licences carry no extra cost for it: the work is organisational. Go deeper in [MFA in the company](https://www.dataroad-it.com/en/mfa-business-14-day-plan/) and [password managers for teams](https://www.dataroad-it.com/en/business-password-manager/). ### Step 2. Devices: only compliant ones get in - **A complete inventory** Every laptop, desktop and phone that touches company data. - **Protection and patching** Switched on and verified across the whole estate. - **Conditional access** Microsoft 365 only opens data to devices that meet the rules. The first fix is unsupported systems. Windows 10 has been on that list since 14 October 2025. Find out [how to handle Windows 10 end of support](https://www.dataroad-it.com/en/windows-10-end-of-support-migration-plan/). ### Step 3. Network: an infected workstation cannot reach the servers The flat network ends. Workstations, servers, visitors, printers and cameras move onto their own segments. Between them, the managed firewall decides what traffic passes. The result: a laptop with malware stays trapped in its segment and cannot encrypt servers or backups. If you already have manageable switches and a managed firewall, this is configuration work, not a purchase. ### Step 4. Least privilege: each person sees only their own work - **Permissions audited** Shared folders, SharePoint and Teams reviewed. - **Users without administrator rights** On their own computer included. - **Remote access to the application, not the network** We explain why in [VPN is no longer enough](https://www.dataroad-it.com/en/secure-remote-access-vpn-managed-firewall/). This step changes habits, so it comes last. But it has become urgent: Copilot and other AI tools show each user everything they have permission to see. First define [the rules for ChatGPT and Copilot in the company](https://www.dataroad-it.com/en/company-ai-policy-chatgpt-copilot/). ## What happens in each month of the plan? A typical schedule for 10 to 200 workstations, with a dedicated IT partner and management involved: | When | Deliverables | Who decides and who does | What the team notices | | --- | --- | --- | --- | | **Month 1** | MFA active for everyone; old accounts and surplus administrators removed; inventory closed | Management approves, IT implements | A tap on the phone when signing in | | **Month 2** | Protection and patching across the estate; conditional access in Microsoft 365; a plan to replace unsupported equipment | IT implements; finance approves the replacements | Personal devices can no longer download data | | **Month 3** | Network segmentation; visitor Wi-Fi isolated; restricted VPN and named accounts for providers | IT implements in a planned window | Practically nothing, if done well | | **Afterwards** | Quarterly permissions audit; removal of administrator rights; progressive move to per-application access | Managers validate, IT applies | New software only via IT | ## Where is it not worth spending yet? Behavioural analytics, per-application micro-segmentation and continuous device posture assessment exist and have value. For most SMEs, however, they are expensive and return little until the four steps are complete. The sequence matters. MFA alone protects the accounts and leaves the network exposed. Segmentation alone protects the network and leaves the accounts exposed. You need both. ## What does it look like in a real Windows and Mac estate? [Reltio by SAP](https://www.dataroad-it.com/en/reltio-sap-lisbon-cisco-meraki-apple-dell/), a US data software company, has a Lisbon office with ongoing maintenance and network managed by DataRoad. That means 125 structured network points, a firewall, three switches and Cisco Meraki access points, plus specialist support for 35 Dell machines and 40 MacBook Pros. It is step 2 in practice: a mixed estate, with the same policy for every operating system. When the inventory exists and the network is managed from a single point, Zero Trust stops being theory and becomes routine. ## Questions from decision-makers ### Do I need to buy a Zero Trust solution? No. Zero Trust is an access design, not a product. In most SMEs the four steps are done with the Microsoft 365, firewall and estate that already exist. ### Will the team lose productivity? Hardly at all, when implementation is done well. MFA adds a confirmation on the phone and conditional access is invisible to anyone whose device is in order. The noticeable difference is installing software only through IT, and that is intentional. ### With 15 workstations, is it worthwhile? Yes, at least in part. MFA and separate visitor Wi-Fi are justified at any size. Device control and least privilege matter more as the team and the sensitivity of the data grow. ### Does NIS2 require Zero Trust? Not by name, but it requires the substance: access control, asset management and MFA. The four steps cover a large share of the technical measures. DataRoad handles the technical side; the legal framework should be validated by a lawyer. ## Want to know where your company stands? A diagnosis in 10 business days We analyse identities, devices, network and permissions, tell you your current level and deliver the plan for the next 90 days. Firewalls, endpoint protection, MFA and alerting are part of the [managed cybersecurity](https://www.dataroad-it.com/en/managed-cybersecurity-services/) included in the [IT Unlimited Premium plan](https://www.dataroad-it.com/en/it-unlimited-premium-on-site-support/). Request a no-commitment proposal. **More than 10 workstations · support contract · remote, on-site and telephone support.** +351 211 459 950 * · sales@dataroad.pt **Call to a Portuguese landline.* ## Sources - [Verizon: 2026 DBIR, executive summary with SME data](https://www.verizon.com/business/resources/executivebriefs/2026-dbir-executive-summary.pdf) - [EUR-Lex: Directive (EU) 2022/2555, NIS2, Article 21](https://eur-lex.europa.eu/legal-content/PT/TXT/?uri=CELEX:32022L2555) - [Microsoft Learn: Windows 10 lifecycle](https://learn.microsoft.com/en-us/lifecycle/products/windows-10-home-and-pro) Chosen by respected and international companies ★★★★★ 5,0 · 52 Google reviews ★★★★★ 5,0 · 52 Google reviews DataRoad ## Related articles [Managed IT and cybersecurityTeams on the move: securing laptops, phones and public Wi-FiThe real travel risk is an unencrypted lost laptop, not hotel Wi-Fi. With disk encryption, central management, MFA and a controlled connecti…12 October 2026 · 7 min read](https://www.dataroad-it.com/en/managed-cybersecurity-travelling-teams/)[Managed IT and cybersecurityExternal attack surface: what the internet sees of your companyAutomated attacks hunt for vulnerable versions, and company size is irrelevant. In 2025, CERT.PT recorded 3,864 incidents, 40% more than in …12 October 2026 · 5 min read](https://www.dataroad-it.com/en/external-attack-surface-managed-cybersecurity/)[Managed IT and cybersecurityNOC and managed cybersecurity: who watches your SME, and whenThe question is not whether you have a SOC: it is who receives the alert at 10 pm on a Saturday and what they do next. At DataRoad, nights, …12 October 2026 · 6 min read](https://www.dataroad-it.com/en/noc-managed-cybersecurity-sme/)[Managed IT and cybersecurityMicrosoft 365 security: the 10 controls that are yoursIn Microsoft 365, the platform is Microsoft's and the keys are yours. According to Microsoft, MFA and blocking legacy authentication stop mo…12 October 2026 · 6 min read](https://www.dataroad-it.com/en/microsoft-365-managed-cybersecurity-shared-responsibility/)[Managed IT and cybersecurityGDPR and managed cybersecurity: 10 technical controls to proveWithout documented technical measures, a data breach turns from an IT incident into a problem with the regulator. Ten controls in three bloc…12 October 2026 · 6 min read](https://www.dataroad-it.com/en/gdpr-managed-cybersecurity-10-technical-measures/)[Managed IT and cybersecurityExposed passwords: audit your domain and close the door in 5 daysThe risk is not the email appearing in a breach: it is the same password opening a work account. Change what is exposed, MFA on every accoun…12 October 2026 · 5 min read](https://www.dataroad-it.com/en/company-credentials-data-breach-check/)[Managed IT and cybersecurityAsset inventory: the basis of IT estate management and NIS2Without an asset inventory there is no planned renewal, no demonstrable security and no answer to CNCS. NIS2 entities must submit the list o…12 October 2026 · 7 min read](https://www.dataroad-it.com/en/it-asset-inventory-management-nis2/)[Managed IT and cybersecurityBreak-glass accounts in Microsoft 365: your company's insuranceA locked-out admin can leave email, Teams and files unmanaged for days. Break-glass accounts are the reserve administrator you only use when…12 October 2026 · 5 min read](https://www.dataroad-it.com/en/microsoft-365-break-glass-accounts/)[Managed IT and cybersecurityWindows 365 for business: when a cloud PC cuts costsA cloud PC pays off for consultants, seasonal staff, teams without an office and mixed Mac and Windows estates. For video, CAD or weak inter…12 October 2026 · 6 min read](https://www.dataroad-it.com/en/windows-365-business-cloud-pc-costs/) Numbers you can verify **11** years in business **232** clients **< 10 min** average response time **15+** IT vendor certifications **10+** Countries with clients supported **5.0 ★** 52 Google reviews Transparency ## What many providers hide, we publish. [See plans and prices →](https://www.dataroad-it.com/it-unlimited/) - **Prices upfront** Essential from €395/month + VAT, Premium from €750 and Premium 365 from €1,200. - **No lock-in** Annual contract, no lock-in and no joining fees. - **Everything in writing** What is included, the scope and the price, before you sign. - **Support without counted hours** Remote and phone in every plan; on-site support from Premium. Partners and certifications DataRoad · Managed IT for business ## One StepAhead of IT. We stop failures before they reach your business. Every network we design, document and manage is treated as if it were our own. - **11** years in business, since 2015 - **PT · EU · US** remote and on-site support - **0** DataRoad security incidents in 11 years We do **IT** right. DataRoad IT Unlimited ## Operational continuity is not luck. It is method and contract. IT Unlimited reduces risk and shows in writing what changed. [Request a proposal, no commitment →](https://www.dataroad-it.com/en/#contact)+351 211 459 950 **Call to a Portuguese landline · More than 10 workstations · support contract · remote, on-site and phone support[Not sure what you need? Talk to the assistant →](https://www.dataroad-it.com/en/#assistente) --- Versão HTML desta página: https://www.dataroad-it.com/en/zero-trust-sme-90-day-plan/