In short
ZTNA for small business replaces the office-firewall VPN with access to specific applications after checking the user, MFA and the device. Small firms can do this without hardware, using cloud services licensed per user or per device, such as NordLayer, Exium SASE, Todyl SASE, TruGrid SecureRDP or Check Point SASE.
Get a quote for ZTNA for small business
Tell us roughly how many users or sites you have and we will reply by email with options and a quote.
Why small firms are moving off office-firewall VPNs
Many small businesses have the same setup: a firewall in the comms cabinet with a remote access VPN switched on, a file server or line-of-business application in the office, and Microsoft 365 for email. The VPN worked during the move to home working, but it has three weaknesses for a small firm:
- It is exposed. The VPN service on the firewall listens for connections from the internet, and a small firm may not have time to patch it the day an update is published.
- It is all or nothing. A connected laptop can usually reach every device on the office network, including the server, the printers and anything else plugged in.
- It depends on one box. If the office firewall or broadband fails, remote staff lose access too.
Insurers and customers also often ask how remote access is protected. Moving to zero trust access answers those questions more convincingly, and in a small business it can often be done in stages, alongside the existing setup. For the step-by-step project, see our VPN replacement project guide.
What good-enough zero trust looks like for a small business
You do not need every capability in the NCSC's guidance on day one. A sensible target for most small firms is:
- MFA on every account that can be used from outside the office, especially email, remote access and admin accounts
- Managed company devices, with encryption, updates and endpoint protection, so you know which devices are yours and whether they are healthy
- Per-app access to office and cloud systems, so a compromised laptop or account cannot reach everything
- DNS and web protection for staff wherever they work, to block malicious sites before they load
- A fixed IP address where suppliers or SaaS admin portals need to allowlist your traffic
- Clear joiner and leaver steps, so access is removed the day someone leaves
These map to the NCSC's zero trust principles in a proportionate way: know your users and devices, use policy to authorise each request and do not trust a network just because it is the office. See NCSC zero trust principles for the full set.
Options with no hardware, licensed per user or device
| Product | What it covers | Licensing unit | Good fit |
|---|---|---|---|
| NordLayer | Zero trust business VPN with identity-based sign-in; Core adds private gateways, a fixed IP and DNS filtering; Premium adds cloud firewall and device posture enforcement | Per user, from five users, each covering up to six devices; dedicated servers extra | Small teams replacing a firewall VPN and needing a fixed IP |
| Exium SASE | ZTNA plus DNS, web and SaaS security; Pro adds agentless access, conditional access and SIEM integration | Per user, covering up to five devices | Firms wanting private access and web protection together |
| Todyl SASE | An agent that connects automatically, with ZTNA, secure web gateway, secure DNS and cloud firewall; options for LAN segmentation, static IP and site tunnels | Per device, monthly; static IPs per tenant | Firms that want one agent for network and, later, endpoint security |
| TruGrid SecureRDP | MFA-protected remote desktop to office PCs and RDS with no inbound ports | Per user, monthly or annual | Firms whose remote work is mainly remote desktop |
| Check Point SASE | Private Access (ZTNA) and Internet Access, on-device or hybrid | Per user; monthly or fixed terms, confirmed at quote | Firms wanting an established vendor's SASE with room to grow |
Other routes exist too. Zero Networks Connect suits firms that also want to stop lateral movement inside the network, and Sophos ZTNA can suit firms already running Sophos Firewall and endpoint protection. Feature splits change, so we confirm what each plan includes when we quote.
Not sure which option fits? Ask us
Tell us what you need and we will recommend the right option for your organisation, with a quote.
Cyber Essentials and cyber insurance
Many small firms come to zero trust access through Cyber Essentials or an insurance renewal. Cyber Essentials covers firewalls, secure configuration, user access control, malware protection and security update management, and remote access touches several of them. Closing an internet-facing VPN or exposed RDP, enforcing MFA and limiting access to what each user needs all help you answer those questions.
No product makes you compliant on its own: certification depends on how your whole estate is configured, and insurance terms are set by the insurer. What ZTNA does is make the remote access part of the answer simpler and easier to evidence.
A simple rollout for a small business
- List who works remotely and what they reach: the file server, the accounts package, remote desktops, cloud admin portals.
- Turn on MFA for Microsoft 365 and every other remote route, if it is not already.
- Bring company laptops under management so you can check they are encrypted, patched and protected.
- Pick the access method: a ZTNA or zero trust VPN service for file shares and apps, an RDP broker if people work on office PCs.
- Pilot with two or three people for a week or two and fix anything that does not work.
- Move everyone across, then switch off the firewall VPN and any port forwards.
- Review access each time someone joins, changes role or leaves.
Our how to implement zero trust network access guide covers the same steps for larger organisations.
Is ZTNA for small business the right fit for you?
We will check it against your systems and requirements and recommend the right option.
How we help small businesses
Forever Systems supplies each of the options above, so we can recommend the one that fits your size, devices and applications rather than steer you to one vendor. We can set up the service, connect it to Microsoft 365 or your identity provider, roll out the app to your devices and help you switch off the old VPN, with scope confirmed at quote. Pricing depends on users or devices and the plan, so ask us for a quote; our zero trust network access cost page explains what drives it. Compare the platforms on ZTNA providers, then contact us.
How Forever Systems helps with ZTNA and SASE
We are an independent IT and cyber security provider. We supply and support several zero trust access and SASE platforms, so we can recommend what fits how your people work rather than one vendor's answer to everything.
- Assess first: we look at your current VPN, firewall, identity set-up and the applications people need to reach before suggesting anything new
- Vendor-aware advice across ZTNA, SSE and SASE options, including Cisco Secure Access and Check Point Harmony SASE
- Pilots and phased roll-out: we can help you start with one group of users or one application, then extend access policy by policy
- VPN replacement: planning the move away from remote access VPNs, including identity provider integration and device posture checks
- Ongoing support: policy changes, licence reviews and renewals, with the details confirmed at quote
We work with businesses, schools, charities and public sector organisations. Pricing depends on users, features and term, so ask us for a quote.
Frequently asked questions
Is ZTNA worth it for a small business?
For most small businesses with remote staff, yes. It removes the internet-facing VPN, limits what a compromised laptop or account can reach and makes MFA part of every connection. Cloud services licensed per user or device mean there is no hardware to buy.
What is the best VPN for small business remote access?
It depends on what staff reach. For file shares and apps, a zero trust business VPN or ZTNA service such as NordLayer, Exium SASE or Todyl SASE is a common choice; for remote desktops, an RDP broker such as TruGrid SecureRDP. We publish no rankings, but we can recommend one for your setup.
Do small businesses need hardware for ZTNA?
Usually not. The options on this page are cloud services with an app on each device and, where needed, lightweight software connectors next to your applications.
How many users do I need for ZTNA?
It depends on the product and plan. NordLayer plans start at five users and TruGrid's Business plan has a minimum user count, while Exium, Todyl and Check Point SASE are licensed per user or per device, so small teams can often start with just the people who need access. We confirm any minimum for your chosen plan at quote.
Will ZTNA help us pass Cyber Essentials?
It can help with the remote access parts, such as removing exposed services and enforcing MFA and least privilege, but Cyber Essentials certification depends on how your whole estate is configured. No product makes you compliant on its own.
Still have a question about ZTNA for small business?
Ask us and a member of our team will reply by email.
More zero trust access guides
NordLayer ZTNAHow NordLayer delivers zero trust access: identity sign-in, private gateways, device posture and cloud firewall.
Todyl SASETodyl's SASE module: ZTNA, secure web gateway, secure DNS and cloud NGFW through one agent and the Todyl SGN.