A former employee’s Microsoft 365 account still active. A shared admin password known by three people. A production laptop connecting from an unmanaged home network. These are the ordinary gaps that a zero trust security review is designed to find before they become an operational problem.

Zero trust is often presented as a major security programme reserved for large enterprises. In practice, its central idea is straightforward: do not grant trust simply because a user, device or application is already inside the network. Check access continuously, give people only what they need, and make decisions using evidence rather than assumption.

For small and mid-sized organisations, this is less about buying another security product and more about gaining clear control of who can access what, from where and under which conditions.

What is a zero trust security review?

A zero trust security review examines whether your current technology estate assumes too much trust. It looks across identities, user permissions, devices, networks, cloud services, data and third-party access to identify where a compromised account or device could cause disproportionate harm.

The review should start with business reality, not a generic checklist. A school needs to protect safeguarding information while allowing staff and pupils to work efficiently. A manufacturer may need to separate office systems from operational technology and supplier connections. A public sector team may rely on external partners, shared documents and hybrid working. The technical controls may differ, but the questions are consistent: who needs access, why do they need it, and how can that access be verified?

Zero trust does not mean treating staff as a threat or making every task harder. Done well, it makes secure working the normal, manageable route. Staff should not have to choose between getting their work done and following the rules.

Why a zero trust security review matters

Traditional security often focused on protecting a network perimeter. That model made more sense when most users worked in one building, applications sat on local servers and company devices rarely left the site. Few organisations now operate that way.

Email, Microsoft 365, cloud storage, collaboration platforms, mobile devices and remote access have moved the perimeter. An attacker who obtains a password may not need to break through a firewall at all. They may sign in through the same page your staff use every day.

The operational consequences can be significant. A compromised account can lead to fraudulent invoices, inaccessible files, unauthorised access to sensitive records or a ransomware incident that stops services. Even where the immediate impact is limited, investigating access and restoring confidence can consume days of management and IT time.

A review helps prioritise improvement. Rather than attempting to secure everything at once, leaders can see which weaknesses create the greatest exposure and which changes will reduce risk with the least disruption.

The areas a useful review should examine

Identity and access controls

Identity is usually the most important place to begin. Every user account, administrator account, shared mailbox, service account and external guest account should have a clear owner and purpose. Accounts without an owner, especially those belonging to former staff or suppliers, are a common and avoidable risk.

The review should assess whether multi-factor authentication is applied consistently, including for privileged accounts and remote access. It should also test the quality of password practices, self-service reset arrangements and joiner, mover and leaver processes. A strong policy is of little value if access remains in place after someone changes role or leaves.

Permissions deserve close attention. Many organisations find that staff have accumulated access over time because it was quicker to add permissions than to remove old ones. Least-privilege access means people can do their jobs without receiving broad permissions simply for convenience.

Devices and endpoint security

A trusted user working from an untrusted device is still a risk. The review should establish which devices can access business systems, whether they are encrypted, patched, protected and centrally managed, and whether lost or compromised devices can be isolated or wiped.

This does not always mean banning personal devices. Bring-your-own-device arrangements can be practical, particularly for smaller teams, but they need clear boundaries. Access to a web application may be acceptable from a personal device, while downloading sensitive data or using administrative tools may require a managed company device.

Device health can also be used to make sensible access decisions. For example, a laptop missing critical updates should not automatically receive the same level of access as a fully managed, encrypted device.

Applications, cloud services and data

Most organisations have more applications than they realise. Some are formally procured and supported; others have been adopted by departments to solve an immediate problem. A review should identify where business information is held, how it is shared and whether those services are configured appropriately.

For Microsoft 365 users, this commonly includes checking sharing settings in SharePoint, Teams and OneDrive, reviewing guest access, and understanding who can create new groups or invite external users. The aim is not to restrict collaboration unnecessarily. It is to ensure that sensitive material is shared intentionally and remains visible to the organisation.

Data should be classified according to its value and sensitivity. Payroll records, pupil data, commercially sensitive designs and routine internal documents do not require identical protections. Knowing the difference supports proportionate controls, such as stronger sign-in requirements for sensitive systems or restrictions on downloading files to unmanaged devices.

Networks, systems and supplier connections

Network access still matters, particularly where there are on-site servers, production systems, specialist equipment or legacy applications. A review should check whether critical systems are separated from everyday user activity and whether administrative access is limited, monitored and properly protected.

Third parties need the same scrutiny. Remote support providers, software suppliers and contractors may require legitimate access, but it should be time-limited where possible, granted to named individuals and removed when the work ends. Shared supplier accounts make accountability difficult and should be replaced wherever feasible.

Turning findings into an achievable plan

The value of a review is determined by what happens next. A report containing dozens of technical observations may be accurate, but it does not help a leadership team decide what to do on Monday morning.

A practical action plan should separate urgent fixes from structured improvements. Urgent actions might include disabling dormant accounts, enforcing multi-factor authentication, removing unnecessary administrator rights or applying critical security updates. These are often high-impact changes that can be completed quickly.

The next stage may involve improving device management, redesigning permissions, segmenting networks or introducing conditional access policies. These projects require planning because they affect how people work. Testing with a representative group before wider rollout can reduce disruption and reveal exceptions that need a different approach.

Longer-term work may include formalising data governance, modernising legacy systems or replacing unsupported applications. It is reasonable for these changes to take time, particularly where budgets and operational commitments must be balanced. The key is to document the risk, assign ownership and set realistic milestones rather than allowing known weaknesses to drift.

Avoiding the common mistakes

The first mistake is treating zero trust as a product purchase. Tools can support the model, but no platform can fix unclear ownership, weak leaver processes or excessive permissions on its own.

The second is applying controls without considering the people affected. If authentication is unreliable, access policies are confusing or essential systems are blocked without warning, staff will find workarounds. Security must be tested against real workflows, including emergencies, remote work and temporary staff arrangements.

The third is assuming that compliance equals security. Frameworks such as Cyber Essentials provide a valuable baseline, but a passing assessment does not automatically show whether sensitive data is overshared or whether a compromised account could move freely through the business. A zero trust approach asks more specific questions about actual access and likely impact.

Make security a routine management discipline

Zero trust is not a one-off state that can be ticked off after a project. People join and leave, software changes, suppliers change, and permissions expand unless they are reviewed. Regular access reviews, patching oversight, device checks and incident exercises keep the approach grounded in day-to-day operations.

For organisations without a large internal IT team, the most useful support is not a flood of jargon or an unrealistic transformation plan. It is a partner that can assess the environment, explain the trade-offs clearly and put the highest-value improvements into practice without interrupting the business.

CETSAT approaches security in that practical way: protecting the systems people rely on while helping them remain productive. The right review should leave you with clearer decisions, accountable owners and a manageable route towards fewer surprises when access is tested.