What It Means
Why This Matters
What "Zero Trust" Actually Means
Zero Trust is not a product you buy, a licence you switch on, or a box you tick for compliance. It is a way of designing and running your IT so that access is checked properly every time.
The older model of business IT was built around a clear perimeter. If someone was inside the building or on the office network, they were trusted more by default. That model no longer fits the way most SMEs work — people work from home, client sites, and on the move. Your data may sit in cloud email, accounting software, CRM systems, and supplier portals.
Zero Trust starts from a different assumption: do not trust access just because it appears to come from a familiar place. Instead, each access request should be checked — who is the user, is multi-factor authentication in place, is the device known and healthy, does the user genuinely need this data?
For an SME, this does not mean making work impossible. It means replacing vague trust with clear rules and review. This assessment helps you see where your organisation has good foundations, where controls are partial, and where old assumptions create avoidable risk.
Identity
Q1-5: Unique accounts, MFA, admin separation, offboarding, conditional access.
Devices
Q6-10: Device management, encryption, compliance, remote access, remote wipe.
Network & Access
Q11-15: Firewalls, per-app access, supplier access, network segments, visibility,
Applications
Q16-20: Least-privilege, external sharing, access reviews, conditional access, shadow IT.
Yes (2 points) - This is in place, documented where appropriate and maintained over time.
Partial (1 point) - Some of this is in place, but it is inconsistent, undocumented, limited to some users or devices, or not regularly checked.
No (0 points) - This is not in place, not known, or relies mainly on informal practice.
Maximum raw score: 40 points (20 questions x 2 points each). Converted to a 100-point readiness score.
It is not a formal audit. It is a practical way to make your current security position visible, so you can decide what to fix first. A higher score does not mean your organisation is "finished" with security. A lower score does not mean failure — it means there are practical gaps that should be prioritised.
81 - 100
Likely meeting or exceeding most CE 2026 requirements.
61 - 80
Meets some CE 2026 requirements but may have gaps.
0 - 60
Significant gaps across multiple CE 2026 control areas.
Download Your Free Zero Trust Readiness Self-Assessment
20 questions, a scoring sheet, CE+ alignment mapping, and a clear "where to start" map. Complete it at your own pace.
Is this assessment related to Microsoft's Zero Trust model?
The concepts overlap with industry Zero Trust principles, but this assessment is designed for SMEs in plain English. It does not require any specific technology stack or vendor commitment.
Does this replace a professional security assessment?
No. This is a self-assessment tool to help you see where you stand. A professional assessment provides deeper analysis and specific remediation steps tailored to your environment.
What happens after I complete the assessment?
You get the PDF instantly and can work through it at your own pace. If you find gaps you are not sure how to close, you can book a free Security Triage Call to discuss your findings with Infinite Cloud IT. There is no obligation.
How does this relate to Cyber Essentials Plus?
Many of the controls assessed in this checker — MFA, device management, network segmentation, least-privilege access — directly overlap with CE+ requirements. The CE+ alignment section in the guide shows how your score maps to CE+ readiness.
