In short
Zero trust principles are usually summarised as three ideas: verify every request explicitly, give each user and device only the access it needs, and assume a breach has already happened. NIST SP 800-207 sets out seven tenets and the NCSC its own design principles; in a business they become MFA, device checks, per-app access and segmentation.
Get a quote for zero trust principles
Tell us roughly how many users or sites you have and we will come back to you with options and a quote.
The three core principles of zero trust
Ask a vendor or consultant for the zero trust 3 principles and you will usually hear the same summary. It is a convenient shorthand used across the industry, not a list any one standards body publishes:
| Principle | What it means | What it looks like in a business |
|---|---|---|
| Verify explicitly (never trust, always verify) | Every request is authenticated and authorised using several signals, not just a password or a network location | MFA on every sign-in; device health checked before access; ZTNA policy per application |
| Least privilege | Each user, device and service gets only the access it needs, for as long as it needs it | Role-based access to applications; admin rights only when needed; contractors limited to one system |
| Assume breach | Design as if an attacker is already inside, so one compromise cannot spread | Segmentation, no flat network, central logging and alerting on unusual access |
All three are visible in the formal frameworks below. NIST, for example, says access should be granted with the least privileges needed to complete the task, and treats the network as already compromised.
Not sure which option fits? Ask us
Tell us what you need and we will recommend the right option for your organisation, with a quote.
NIST's seven tenets of zero trust
NIST SP 800-207 (opens in a new tab), section 2.1, lists seven basic tenets that a zero trust architecture is designed and deployed around. NIST describes them as the ideal goal and accepts that not every tenet may be fully implemented in its purest form. In our words:
| Tenet | Plain-English meaning |
|---|---|
| 1. All data sources and computing services are resources | Everything counts, including SaaS, small devices and, if you choose, personal devices that reach company data |
| 2. All communication is secured regardless of network location | A request from the office LAN must meet the same bar as one from a café; network location alone does not imply trust |
| 3. Access is granted per session | Trust is evaluated before each session, with least privilege; access to one resource does not grant access to another |
| 4. Access is decided by dynamic policy | Policy weighs who the user is, which application, the state of the device and, optionally, behaviour and environment |
| 5. The enterprise monitors the integrity and security posture of its assets | No device is inherently trusted; unpatched or unmanaged devices can be treated differently or refused |
| 6. Authentication and authorisation are dynamic and strictly enforced before access | A constant cycle of checking, with MFA and re-authentication when policy says so |
| 7. The enterprise collects information to improve its security posture | Access, device and network data feeds back into better policy |
These seven are what people mean by the "7 tenets of zero trust". NIST notes they are technology-agnostic and apply to staff and partners, not to anonymous public users of a website.
The NCSC zero trust architecture design principles
The NCSC publishes its own zero trust architecture design principles (opens in a new tab) (version 1.1, reviewed 16 January 2026). The page introduces them as eight principles; its overview currently lists seven, which in short are:
- Know your architecture, including users, devices, services and data.
- Know your user, service and device identities.
- Assess your user behaviour, devices and services health.
- Use policies to authorise requests.
- Authenticate and authorise everywhere.
- Focus your monitoring on users, devices and services.
- Don't trust any network, including your own.
The NCSC wording is the one to quote in a UK policy or tender. We go through each principle, what it means in practice and the capabilities that support it on NCSC zero trust guidance.
Is zero trust principles the right fit for you?
We will check it against your systems and requirements and recommend the right option.
From principle to control to product
Principles only help if they turn into controls. This is how each maps to something you can deploy, with examples of products we supply:
| Principle | Control | Example product we supply |
|---|---|---|
| Verify explicitly | MFA and device health checks at every sign-in | Cisco Duo (opens in a new tab) MFA and Duo device trust (opens in a new tab) |
| Least privilege (users) | Per-application access instead of network access | ZTNA platforms such as Cisco Secure Access or Check Point Private Access |
| Least privilege (admins) | Just-in-time MFA on admin protocols such as RDP and SSH | Zero Networks |
| Assume breach | Microsegmentation so a compromised device cannot reach other systems | Zero Networks segmentation; see microsegmentation vs network segmentation |
| Don't trust any network | Encrypted, authenticated access for office users as well as remote | ZTNA for on-site users; see zero trust networking |
| Monitor users, devices and services | Central identity, endpoint and access logs with alerting | ZTNA and identity logs feeding your monitoring platform |
Vendor facts are from each vendor's own pages, read on 9 November 2026: Duo describes Device Trust (opens in a new tab) as checking device visibility, device health and continuous verification, including on unmanaged and personal devices; Zero Networks describes automated microsegmentation (opens in a new tab) built from observed traffic and just-in-time MFA for protocols such as RDP, SMB and SSH.
Assume breach and never trust, always verify, with an example
Two phrases do most of the work, so it helps to see them in a real situation.
Never trust, always verify. A finance assistant signs in to the accounts system from the office. In a perimeter model the office network is trusted, so a password is enough. Under zero trust the request is checked like any other: MFA, a managed laptop with its disk encrypted and patches current, and a policy that says finance staff may use this application. A contractor on the same office Wi-Fi gets nothing from being there.
Zero trust assume breach. Suppose that same laptop is later infected through a malicious attachment. Because the laptop can reach only the applications its user is allowed, and servers are segmented, the attacker cannot scan and spread across the network. Device health signals can also cut off its access as soon as the endpoint protection flags it. The NCSC's Introduction to Zero Trust (opens in a new tab) says zero trust will improve monitoring and detection of attempts at lateral movement but won't completely remove the threat, which is why monitoring stays a principle in its own right.
How we help you apply the principles
We can look at your current set-up against these principles and suggest the controls and products that close the biggest gaps first, drawing on the several platforms we supply. Contact us for free advice or a quote.
How Forever Systems helps with ZTNA
Forever Systems supplies and supports several zero trust network access platforms, so we can recommend what fits how your people work and the tools you already run.
- Assess first: we look at your current VPN, firewall, identity set-up and the applications people need to reach before suggesting anything new
- Vendor-aware advice across the ZTNA products we supply, including Cisco Secure Access (opens in a new tab) and Check Point Private Access
- Pilots and phased roll-out: we can help you start with one group of users or one application, then extend access policy by policy
- VPN replacement: planning the move away from remote access VPNs, including identity provider integration and device posture checks
- Ongoing support: policy changes, licence reviews and renewals, with the details confirmed at quote
We work with businesses, schools, charities and public sector organisations. Pricing depends on users, features and term, so ask us for a quote.
Frequently asked questions
What are the three principles of zero trust?
The common summary is verify explicitly, use least privilege and assume breach. It is a widely used shorthand rather than one standards body's list; NIST SP 800-207 sets out seven tenets and the NCSC its own design principles, and all three ideas appear in both.
What does assume breach mean in zero trust?
It means designing your systems as if an attacker is already inside, so a single compromised account or device cannot reach everything else. In practice that means segmentation, per-application access, short-lived sessions and monitoring for unusual behaviour.
How many tenets of zero trust does NIST list?
Seven, in section 2.1 of NIST SP 800-207 (August 2020). NIST calls them the ideal goal and accepts that not every tenet may be fully implemented in its purest form.
How many NCSC zero trust principles are there?
The NCSC principles page introduces them as eight principles, but its overview currently lists seven, from 'know your architecture' to 'don't trust any network, including your own'. Check the NCSC page (opens in a new tab) for the current wording before quoting it.
Where do I start with the principles?
Most businesses start with verify explicitly: MFA for every account and device checks at sign-in. Those make per-application access through ZTNA possible, which delivers least privilege for remote and office staff. Our zero trust assessment page explains how to find your own starting point.
Still have a question about zero trust principles?
Ask us and a member of our team will get back to you.