Protect a distributed network by protecting each resource instead of the boundary: verify the user and the device before every session, give least privilege, log the decisions, and keep an inventory of assets. NIST SP 800-207 describes this as zero trust, and CISA's performance goals provide a baseline.
What changed about the perimeter?
A traditional network assumed a trusted inside and an untrusted outside. NIST SP 800-207 says that zero trust is a response to enterprise trends that include remote users, bring your own device and cloud-based assets not located within an enterprise-owned boundary. It assumes no implicit trust based on physical or network location, or on whether the asset is company or personally owned.
In a distributed network the "inside" is a laptop in a cafe, a SaaS tenant, a container in a cloud account and an office router. Pretending they share a perimeter does not make it so.
What are the building blocks?
SP 800-207 breaks the decision into logical components. A policy engine decides, a policy administrator sets up the session and a policy enforcement point sits in the path. Authentication and authorization, for both subject and device, are separate functions done before a session to a resource is established.
For a small team, that translates to a few concrete controls: an identity provider with strong sign in, device management to know which machines are yours, and per application access rules rather than a flat network tunnel.
Which baseline should you start with?
CISA's Cross-Sector Cybersecurity Performance Goals 2.0 are voluntary, align to NIST CSF 2.0 functions and are designed to help small and medium sized organizations prioritize a limited number of high impact actions. They now include goals on oversight, risks from managed service providers and least privilege.
Pair the goals with the CISA Cyber Essentials, which tell leaders to learn what is on the network and keep inventories of hardware and software. You cannot protect nodes you do not know exist.
What does it look like in practice?
A constructed example: a 120 person company with staff in six countries, a data store in one cloud account and two SaaS finance tools. The security lead does four things in order. She inventories accounts and devices. She enforces phishing resistant sign in for administrators first. She replaces the flat remote access tunnel with per application access for the finance tools. She turns on logging for sign in and administrative actions and sends it to one place.
None of this requires a new product category. It requires a map of what you have and a decision on who can reach what.
Where do distributed networks fail?
Privilege creep is common: accounts keep access after role changes. Unmanaged devices are another, since a policy that checks device state only works if the device is known. NIST also notes a resource portal model can only scan a device when it connects, so assets may be invisible between sessions.
Third parties matter too. The CPG update added goals specifically for risks tied to managed service providers.
Does this scale down to a small company?
Yes, and small companies often find it easier because there is less legacy. The point of zero trust in NIST's framing is that you do not need a physical perimeter to apply it. A 15 person startup using only SaaS can apply the same principles with a good identity provider, managed laptops and a short list of who can administer what.
The mistake to avoid is buying a platform before you have the inventory. Tools enforce policy, but you still have to decide the policy.
How to check or apply this
- List users, devices, applications, data stores and cloud accounts.
- Classify the ten resources whose loss would hurt most.
- Require strong multi-factor authentication for all administrators and remote access.
- Replace broad network access with per application rules where you can.
- Check device state before granting access to sensitive resources.
- Centralize logs for sign in, administrative actions and access decisions.
- Review access quarterly and remove leftover permissions.
- Add managed service providers to the inventory and review their access.
Quick check
Does zero trust mean no firewalls?
No. NIST says zero trust focuses on protecting resources rather than network segments, but segmentation and enforcement points still play a role.
Where should a small team start?
Inventory, administrator authentication and logging. They cost little and make every later control better.
Sources
- NIST SP 800-207, Zero Trust Architecture
- CISA, Cross-Sector Cybersecurity Performance Goals
- CISA, Cyber Essentials
Last reviewed: 18 October 2026.
