What Is Zero Trust Security? A Guide for NZ Businesses

The office has a firewall. The files are in Microsoft 365, the accounts system is a browser tab, two staff work from home on their own laptops and the bookkeeper logs in from Auckland. The wall is still there, but a lot of the work now happens outside it.

This guide explains what zero trust security means for a New Zealand business, how it works alongside a VPN and the tools you already have, what government guidance says, and where to start.

What is zero trust security?

Zero trust security is an approach that checks access to business systems using identity, device condition and the access being requested, rather than trusting a connection because of where it comes from. Access is limited to what is needed and reassessed as relevant information changes.

For a business, that means knowing who can reach each system, protecting their sign-ins, checking the devices they use and removing access that is no longer needed. It is an approach put into practice through policies, processes and tools, rather than one product.

The New Zealand government’s own definition is a useful one. The NZISM describes zero trust as “a security architecture centered on the concept that organisations should not automatically trust anything inside or outside its perimeters and instead must verify anything and everything trying to connect to its systems before granting access”. It adds that trust “is continuously earned through verifying factors, such as identity, context and activity”.

Continuously does not mean a fresh sign-in for every click. It means access decisions can be re-evaluated when something relevant changes, such as a device falling out of policy or a sign-in from an unexpected place. How that works depends on the application and how it is set up.

An example of zero trust security in practice

A staff member needs the payroll system from home. The access policy checks their account, how they signed in and whether their device meets the required conditions. Passing those checks gives them payroll, not every internal system. If the conditions change, the policy may ask for another check or restrict access.

What are the core principles of zero trust security?

This guide uses four practical principles to summarise the approach. They draw on the NZISM, the NCSC’s modern defensible architecture guidance and NIST Special Publication 800-207, which sets out its own seven tenets in more detail.

• Verify explicitly. Access decisions use current signals: identity, how someone signed in, device condition, location and the sensitivity of what is being reached.
• Use least privilege. People and systems get the access the task needs, and no more. This is NCSC Critical Control 9 and Minimum Cyber Security Standard 7 in its own right.
• Assume breach. Design as though somebody already has a foothold. Segmentation, application-level access and monitoring follow from that assumption.
• Reassess access. Access already granted can be tightened or ended as the signals change, where the application supports it.

Least privilege is a good place to start the internal conversation about zero trust security, because it stands on its own in New Zealand guidance: a Critical Control the NCSC recommends to everyone, and a Minimum Standard that mandated government agencies are required to implement. It can also be the hardest conversation, because trimming access from people who have it is unpopular in a small business where everybody knows everybody.

Where should a New Zealand small business start with zero trust security?

Start with the systems that matter most and the people and accounts that can reach them. The order below is a practical sequence, but priorities should follow your exposure and business impact rather than a fixed checklist.

• Identify important systems and who uses them. List the people, devices and service accounts that reach each one. A first review can turn up admin rights nobody needs, old service accounts and logins that were never disabled.
• Strengthen sign-ins and reduce privileges. Use multi-factor authentication for people, with a phishing-resistant method where the platform supports one, and protection suited to service and workload accounts. Our guide to multi-factor authentication covers the options and where each one breaks down.
• Pilot access policies and device requirements. Test conditional access with a small group first, keep an emergency-access route, and review the effect before enforcing it for everyone.
• Test application access and segmentation. Move from broad network access to access for specific applications where it suits, then segment what remains. Our network security services cover segmentation and remote access.
• Monitor and review exceptions. Check what the policies are blocking, which exceptions have been granted and whether they are still needed.

Cloud workloads follow the same logic with different mechanics, which our cloud security page covers, and which is also where the NZISM puts one of its zero trust controls. Device requirements depend on devices being enrolled and protected, which our endpoint security service covers.

The NZISM’s own starting advice is modest. It suggests factoring zero trust principles into the digital roadmap, asking suppliers whether they are zero trust ready when investing in an IT solution, and talking to current suppliers about how they might begin.

What does New Zealand government guidance say about zero trust security?

The New Zealand Information Security Manual, version 3.9, carries three numbered controls that name zero trust. All three are a SHOULD, meaning recommended practice. The table shows those selected controls, not the full set of obligations an organisation may have.

The NZISM is written for government agencies and for the vendors, contractors and consultants who provide services to them, and other organisations are encouraged to use it. For a private business it is a useful benchmark for zero trust security. It is also worth checking your contracts, including any government contracts, for security requirements that apply to you.

The controls sit in identity, remote access and cloud. The manual also says the GCSB recommends zero trust “as the approach agencies should take”, which is a strong endorsement.

There is a second New Zealand source worth knowing about. In October 2025 the National Cyber Security Centre published guidance on modern defensible architecture, jointly with its counterparts in Australia, Canada, Germany, Japan, Korea and Czechia. It is not branded as a zero trust document, but zero trust sits inside it as a named component, described as the principles of “never trust, always verify”, assume breach and verify explicitly.

Where zero trust sits in the NCSC’s lists

Zero trust is not one of the NCSC’s ten Critical Controls or its ten Minimum Cyber Security Standards, and the NCSC notes that the standards “do not cover the entire cyber security spectrum”. Both lists do name multi-factor authentication and the principle of least privilege, two of the foundations zero trust security builds on.

What does zero trust security cost?

Before buying anything labelled zero trust security, check the features and licences you already have. In Microsoft 365, for example, Conditional Access requires Microsoft Entra ID P1, which Business Premium includes, and risk-based policies require Entra ID P2. Plans and add-ons differ, so the licence check comes first.

Costs also depend on application compatibility, device enrolment, cleaning up existing access, testing, staff support and ongoing management. Where monitoring is part of the plan, our managed detection and response service covers analyst investigation and response around those signals.

Zero trust security mistakes worth avoiding

Four mistakes are worth knowing about before you start.

• Buying a product and calling it done. The NZISM says you cannot buy zero trust. Vendors sell components, and a component bought without the principles behind it becomes another console nobody opens.
• Attempting the whole model at once. The layers depend on each other, so one large project can stall with the identity work half finished.
• Skipping identity for something more visible. Identity is the layer the others read from, and zero trust security built on weak identity does not hold.
• Ignoring what it feels like to use. Prompting people at every turn produces fatigue, and fatigued people approve things. Good design lets low-risk access through quietly and saves the friction for requests that warrant it.

Multi-factor fatigue is a documented attack technique, which is why the design of the checks matters as much as having them.