ANSSI Publishes Zero Trust Model for Small Businesses

The French National Cybersecurity Agency (ANSSI) has published a model for implementing Zero Trust in small businesses. The model emphasizes the need to reduce implicit trust in users and equipment accessing the system. This includes verifying every access request, regardless of whether it comes from inside or outside the network. The ANSSI also recommends regular dynamic evaluation of the access context, including the security status of the device used. This can help differentiate between legitimate and illegitimate access requests.

The model is designed to be complementary to existing security measures, rather than a replacement. It includes five principles: least privilege access, request control, dynamic access evaluation, and regular security assessments. The ANSSI also notes that the increasing use of remote work, personal devices, and cloud services requires a more dynamic approach to security.

Small businesses with fewer than 250 employees are particularly vulnerable to cyber threats, with 21% of assistance cases in 2025 related to account hacking. The ANSSI’s model aims to provide a framework for small businesses to implement Zero Trust principles and reduce their vulnerability to cyber attacks.