Written by Mike Pearlstein, CISSP, CEO of Fusion Computing Limited. Helping Canadian businesses build and manage secure IT infrastructure since 2012 across Toronto, Hamilton, and Metro Vancouver.
Across our 24 Canadian SMB zero-trust engagements through Q1 2026, I will tell you the part that surprises every owner I sit down with: zero trust is not a product you buy. It is a posture I help leadership teams take, and the technology is the easy part.
The hard part is deciding that the username and password your bookkeeper logged in with this morning are no longer enough proof to trust her with the financials. That single decision restructures your network and your identity controls. It also changes how you answer the next PIPEDA safeguards question on a cyber-insurance renewal form.
If you need a forcing function, run the identity cleanup as week 1 of the October Cyber Security Awareness Month playbook.
KEY TAKEAWAYS
- Zero trust is a strategic posture, not a SKU. The boardroom decision precedes the technical rollout by months.
- The five pillars (identity, devices, networks, applications, data) come from CISA’s Zero Trust Maturity Model v2.0. The definition underneath them comes from NIST SP 800-207.
- Microsoft Entra ID Conditional Access is the single foundation control I deploy first in roughly 9 of every 10 SMB engagements.
- Identity-layer mistakes have derailed more pilots in our practice than every other failure mode combined.
- For a 50 to 150 user Canadian SMB, I budget CA$25,000 to CA$45,000 first year. Against IBM’s record USD 4.99 million average breach cost, the math is not close.
Book a Free Cybersecurity Consultation
Why every Canadian SMB needs to think about zero trust now
According to the Canadian Centre for Cyber Security (2022), no subject in a system is trusted by default. Trust gets re-assessed every time that subject requests a new resource. Its ITSAP.10.008 guidance tells Canadian organizations to enforce strong multifactor authentication at Level of Assurance 3.
Zero trust + Copilot: generative AI inherits the same permission cascade zero-trust controls are designed to contain. The Pre-Copilot SharePoint Audit is the data-layer companion to a zero-trust rollout.
If you run a 50 to 150 user Canadian business in 2026, three forces are pressing on you at once and I see them collide on every assessment call. Cyber insurance carriers want phishing-resistant MFA evidence on the renewal form. Your enterprise customers are flowing Bill C-8 supplier expectations down to you. And the credential is now the perimeter, because the attackers are logging in instead of breaking in.
Last fall I sat with the COO of a 70-person Hamilton manufacturer whose largest customer had just shipped a 32-question security review with a 30-day deadline. Question 7 asked for their zero trust maturity stage. They had no answer. We deployed Conditional Access and Defender for Endpoint inside six weeks and kept the contract.
IBM’s Cost of a Data Breach report puts the global average at USD 4.99 million, a 12% increase and a record high. CCCS calls ransomware the top cybercrime threat facing Canada’s critical infrastructure. I am not selling fear. I am pointing at the underwriting form on your desk and saying yes, this is now the floor.
What is zero trust (NIST SP 800-207 framing for SMBs)
According to NIST Special Publication 800-207 (2020), no implicit trust is granted to any asset or user account based on network location. That single assumption is what a 50 to 150 user Canadian SMB has to design around, and it can be adopted in stages rather than in one cutover.
Zero trust is a security architecture where I assume no user, device, or network connection is trustworthy by default. I verify every access request continuously through identity, device posture, location, and session-risk signals. The document I cite to every board I present to was finalized in August 2020, and Canadian regulators and underwriters both treat it as canonical.
For an SMB owner, the operational translation I use is short. Verify explicitly on every request. Grant the least access required for the least time required. Operate as if a breach is already in progress. That third principle is the one most owners resist, and it is the one that changes the design of the network. CCCS states the same idea in four words: never trust, always verify.
The CISA Zero Trust Maturity Model v2.0 is where the five pillars actually come from, and it adds three cross-cutting capabilities plus a four-stage ladder (traditional, initial, advanced, optimal). CCCS points Canadian organizations at the same framework. I show clients where they sit on the ladder on day one of every engagement, because underwriters now ask.
“Zero trust is a collection of concepts and ideas designed to minimize uncertainty in enforcing accurate, least-privilege per-request access decisions in information systems and services”. The definition then adds the clause that changes the engineering: those decisions get made “in the face of a network viewed as compromised”.
For the business case that sits underneath a zero trust programme, see why cybersecurity is important for Canadian businesses.
The 5 zero trust pillars (Identity, Devices, Network, Apps, Data)
As the Canadian Centre for Cyber Security puts it, CISA proposes a zero trust model built on five pillars and three capabilities. Those pillars are identity, devices, networks, applications and workloads, and data. Multifactor authentication anchors the identity pillar, and pairing it with conditional access and device compliance carries that verification into the four pillars above it.
There are five pillars. I work all five, but I work them in order. Skipping identity to chase network segmentation is the single most expensive mistake I see SMBs make, and I have walked into 3 rebuilds in the last 18 months that started exactly that way.
| Pillar | Control I deploy | What I default to. |
|---|---|---|
| Identity | Phishing-resistant MFA, Conditional Access policies, no standing admin | Microsoft Entra ID Conditional Access. |
| Devices | EDR on every endpoint, compliance baselines (encryption, patch, agent health) | Microsoft Defender for Endpoint with Intune. |
| Network | ZTNA replacing VPN, micro-segmentation, east-west firewall rules | Microsoft Entra Private Access, or a ZTNA broker matched to the firewall estate. |
| Applications | SSO with role-based access, SaaS posture monitoring, sanctioned-app inventory | Microsoft Defender for Cloud Apps. |
| Data | Sensitivity labels, DLP, encryption in transit and at rest, retention | Microsoft Purview. |
The Microsoft stack covers four of the five pillars cleanly for an SMB on Microsoft 365 Business Premium or E3 plus E5 Security. The remaining gap is network access, which is where a dedicated ZTNA broker earns its licence fee.
Which of the seven types of firewalls sits at that edge decides the rollout order. I recommend the platform your team can actually operate on Monday morning.
Each pillar needs a tool behind it. The software and tools behind Fusion’s managed IT maps identity, device, network and data controls to the platforms that deliver them.
The 6-step zero trust roadmap for a 50-150 user Canadian SMB
According to the Canadian Centre for Cyber Security (2025), ransomware is the top cybercrime threat facing Canadian critical infrastructure. Its National Cyber Threat Assessment 2025-2026 also names financially motivated cybercrime as the activity most likely to affect Canadian organizations, which is why the sequence below front-loads identity.
I run a 6-step sequence on every engagement, not five. Most public roadmaps drop the governance bookends because vendors do not sell them. I keep them because they carry the program past month 4, when leadership attention wanders and the CISA maturity review is the only thing still holding the line.
| Step | What I do | Typical timeline. |
|---|---|---|
| 1. Discovery and posture baseline | CISA maturity scoring, asset inventory, identity hygiene audit, executive briefing | Weeks 1 to 2. |
| 2. Identity foundation | Entra ID Conditional Access, MFA on 100% of accounts, eliminate standing admin | Weeks 2 to 4. |
| 3. Device trust | Defender for Endpoint, Intune compliance baselines, fleet remediation | Weeks 4 to 8. |
| 4. Network and access modernization | ZTNA cutover, retire flat VPN, segment production from workstations and IoT | Weeks 8 to 14. |
| 5. Application and data controls | Defender for Cloud Apps, Purview labels, DLP on email and SharePoint | Weeks 12 to 20. |
| 6. Continuous monitoring and governance | Managed detection and response, quarterly maturity review, IR plan tested annually, board reporting | Month 5 onward. |
Steps 1 and 6 are the bookends I will not skip. Step 1 turns the conversation from theology into evidence. Step 6 keeps it operational after the launch dopamine wears off. Between them the order never changes: identity, then devices, then network, then apps, then data.
Microsoft Entra ID Conditional Access: the foundation
According to the Microsoft Digital Defense Report (2024), password-based attacks are over 99% of the 600 million daily identity attacks Microsoft sees. Microsoft blocked 7,000 password attacks per second across that reporting year. Conditional Access is the control built to absorb exactly that pressure on an SMB tenant.
If I am only allowed to deploy one zero trust control, I deploy Microsoft Entra ID Conditional Access. It is the single highest-impact technology I touch on an SMB engagement. It enforces MFA, gates access on device compliance, blocks legacy authentication, and adapts to user risk signals from one policy surface.
The starter set I configure in week 2 of every engagement is small and tested. Block legacy auth. Require MFA for all users. Require compliant or hybrid-joined devices for Microsoft 365 apps. Require phishing-resistant MFA for admins. Block sign-ins from countries the business does not operate in. Five policies, deployed in report-only first, then enforced.
Microsoft researchers who studied its own tenant telemetry reported that MFA reduces the risk of compromise by 99.22%, and by 98.56% even where credentials have already leaked. That number is what convinces every CFO I present to. Conditional Access is how I turn a research finding into a deployed control on your tenant by Friday.
How does zero trust map to PIPEDA, Bill C-8, OSFI B-13?
According to OSFI Guideline B-13 (2022), federally regulated financial institutions should implement risk-based identity and access controls, including multi-factor authentication and privileged access management. The same guideline tells them to enforce least privilege. That is a zero trust specification written by a Canadian prudential regulator.
I get this compliance question on every regulated client engagement. Zero trust is structurally easier to evidence than anything that came before it. PIPEDA Fair Information Principle 7 requires safeguards chosen for the sensitivity of the information and the risk of harm. It names passwords, encryption and access limits among the tools. My Conditional Access logs and Purview labels are exactly that evidence.
Bill C-8 received royal assent on June 15, 2026 as Statutes of Canada 2026, chapter 9. It obliges designated critical-systems operators to run cybersecurity programs and report incidents once the relevant provisions are brought into force. Even if you are never designated, your designated customers are already flowing the expectations down the supply chain to you.
A documented zero trust roadmap is the cleanest single artifact you can put in front of a regulator, an underwriter, or an enterprise third-party risk team. For the privacy-law layer, see my companion guide on PIPEDA compliance for Canadian small businesses.
What I tell clients who think zero trust is too expensive
According to the CIRA 2025 Cybersecurity Survey, 24% of Canadian organizations were ransomware victims in the previous 12 months. That is just under a quarter of the country’s organizations in a single year. Set it against a first-year zero trust program for a 50-user firm and the cost objection stops being a budget argument.
Some version of “we cannot afford this” comes up on roughly half my first calls. I push back gently, because the math does not survive contact with a quote. For a 50-user Canadian SMB I budget CA$25,000 to CA$45,000 in first-year implementation across discovery, identity, devices, network, and governance. Ongoing managed security with detection and response runs CA$130 to CA$180 per user per month.
IBM puts the current global average breach cost at USD 4.99 million, a 12% increase and a record high. A CA$25,000 to CA$45,000 first-year program is well under 1% of that figure. No CFO has pushed back on that math after seeing it written down beside their own renewal premium.
What clients usually mean by “too expensive” is “I do not understand what I am buying.” That is a scoping problem, not a budget problem. Book a sized estimate and I will walk you through the CA$25,000 to CA$45,000 range line by line →.
Common zero trust mistakes I have actually seen
According to the CrowdStrike Global Threat Report (2026), 82% of detections in 2025 were malware-free and average eCrime breakout time fell to 29 minutes. Attackers are signing in with valid credentials rather than dropping tooling, which is why all four mistakes below trace back to the identity pillar.
I have walked into more than 12 failed or stalled zero trust pilots in the last 3 years. The failure modes repeat. I am going to name the 4 I see most, because they are all preventable and they all start as reasonable-sounding decisions in the kickoff meeting.
1. ZTNA before identity
A team replaces the VPN and declares victory. The credential exposure behind 82% of malware-free detections is still sitting untouched in Entra ID. ZTNA on top of weak identity is decoration. Identity discipline comes first, always.
2. Exempting the executives
I have heard “the CEO travels too much” often enough that I now write the policy expectation into the engagement letter. Executives are the highest-value identity targets in your tenant. Phishing-resistant MFA on those accounts is not negotiable, and the modern Microsoft Authenticator passkey experience makes the friction argument obsolete.
3. All five pillars at once
The pillars are sequential for a reason. Running them in parallel with one IT manager looks faster on a Gantt chart, drowns the team in week 6, and produces a half-deployed control surface that audits worse than the starting point.
4. Treating zero trust as a project
The CISA maturity ladder is a ladder. I review my clients quarterly and re-score them annually, because underwriters and customer questionnaires now ask for evidence of progression rather than attestation. If your provider deploys and disappears, you have bought a project instead of a program. For the wider context, see managed cybersecurity services.
Zero trust vs VPN: what changes for a Canadian SMB
According to CCCS guidance ITSAP.10.008, access decisions should rest on user and device information rather than logical location alone. A traditional VPN does the opposite. It authenticates once at the edge and then trusts the session, which is the design assumption NIST SP 800-207 tells Canadian organizations to abandon.
The practical difference is scope of access. A VPN puts a laptop on your network, so a stolen credential inherits everything that network can reach. Zero trust network access authenticates the user and the device for each application separately, so the same stolen credential reaches one app and stops.
The second difference is evidence. A VPN log tells an underwriter who connected. A ZTNA log tells them which identity reached which application, from which device posture, at what risk score. On a 2026 renewal form, only the second answers the question asked.
I do not rip out working VPNs on day one. On our engagements the VPN stays until step 4, then retires application by application.
Zero trust readiness checklist for Canadian SMBs
According to the Canadian Centre for Cyber Security, its Baseline Cyber Security Controls (2020) set 13 control areas for smaller organizations. The identity control says to implement two-factor authentication wherever possible and document every decision not to. Another requires accounts provisioned with minimum functionality and restricted administrator rights.
Run this 10-control check before you spend anything. It is the sheet I work from on a CISSP-led readiness review. Every line maps to a CCCS baseline control or a CISA pillar, so the output doubles as your evidence pack for a supplier security review.
The 10-control readiness check
| What to verify | Maps to. |
|---|---|
| MFA enforced on 100% of accounts, with documented exceptions | CCCS BC.5.1. |
| No standing administrator privilege; rights raised just in time | CCCS BC.12.1. |
| Legacy authentication protocols blocked at the tenant level | CISA identity pillar. |
| Every endpoint reports compliance before it reaches company data | CISA devices pillar. |
| Remote access requires two-factor authentication on every path | CCCS BC.9.3. |
| Cloud admin accounts separate from internal admin accounts | CCCS BC.10.5. |
| Accounts removed the day someone stops needing them | CCCS BC.12.3. |
| Sensitive data carries a label and a data-loss policy that fires | CISA data pillar. |
| Sign-in and access logs retained and reviewed on a stated cadence | CISA visibility capability. |
| Whole posture scored against the CISA ladder at least annually | CISA governance capability. |
If more than 3 of those 10 lines are unanswered, the gap is a governance gap rather than a tooling gap, and no purchase order fixes it. Send me your list and I will tell you which 3 to fix first →.
Frequently Asked Questions
What is zero trust security in plain English?
Zero trust is a security posture where I do not trust any user, device, or connection by default. Every access request gets verified continuously against identity, device health, location, and session risk before I let it through. NIST SP 800-207 is the canonical definition, and the Canadian Centre for Cyber Security states the operating rule in four words: never trust, always verify.
Do small businesses really need zero trust, or is this an enterprise concern?
Small businesses need it more. The CrowdStrike Global Threat Report finds 82% of detections in 2025 were malware-free, meaning attackers log in with stolen credentials. Your antivirus does not stop that. CIRA found 24% of Canadian organizations hit by ransomware in the 12 months before its 2025 survey, and SMBs are over-represented because attackers know the controls are weaker.
How long does zero trust implementation take for a 50 to 150 user Canadian SMB?
Four to six months on the engagements I run. Identity in weeks 2 to 4. Devices in weeks 4 to 8. ZTNA replacing VPN in weeks 8 to 14. Apps and data in weeks 12 to 20. Continuous monitoring from month 5 onward. Fleets with legacy infrastructure stretch to nine or 12 months.
Can you implement zero trust on Microsoft 365 alone?
Mostly. Microsoft 365 Business Premium and E3 plus E5 Security cover identity (Entra ID Conditional Access), devices (Defender for Endpoint, Intune), apps (Defender for Cloud Apps), and data (Purview). The network pillar still needs ZTNA and segmentation work, which I deliver through Microsoft Entra Private Access or a broker matched to your firewall estate. Microsoft covers about 80% of the technical surface for an SMB.
Does zero trust satisfy cyber insurance requirements?
It is the cleanest way I know to satisfy them. The 2026 renewal forms I help clients fill out ask about MFA coverage, EDR deployment percentage, segmented backup design, and last incident response test. A documented zero trust roadmap answers all four at once, and underwriters reward progression along the CISA maturity ladder with better terms.
What is the difference between zero trust, ZTNA, and SASE?
Zero trust is the strategy itself. ZTNA (Zero Trust Network Access) is one tactical control inside it that authenticates each user-and-app pair on every request. SASE (Secure Access Service Edge) bundles ZTNA with cloud firewall, secure web gateway, and CASB. SMBs typically buy ZTNA standalone first; SASE makes sense at scale.
Does Bill C-8 require Canadian SMBs to implement zero trust?
Bill C-8 received royal assent on June 15, 2026 and applies to designated critical-systems operators in finance, telecom, energy, and federally regulated transport. It does not name zero trust. SMBs that supply or partner with designated operators feel the pull-through, because those clients now flow C-8-grade control expectations into their supplier security questionnaires. A documented zero trust roadmap is the cleanest answer.
Where does zero trust intersect with PIPEDA safeguards?
PIPEDA Fair Information Principle 7 requires safeguards matched to the sensitivity of the personal information held and the risk of harm to the individual. The Office of the Privacy Commissioner names passwords, encryption, firewalls and access limits among the technological and organizational tools. Every zero trust pillar maps to a Principle 7 control, and the Conditional Access and Purview logs I configure are the evidence trail.
Related Resources
For the operational hub, my managed cybersecurity services page describes how I deliver every control in this guide. For the identity pillar, see multi-factor authentication for Canadian SMBs. For the remote workforce angle, see work-from-home cybersecurity. For step 6, see managed detection and response.
Scoped and run by Mike Pearlstein, CISSP, since 2012.
