In short
ZTNA for retail gives store staff, head office and suppliers access to stock, rota and back-office systems one application at a time, after identity and device checks. UK retailers and franchise groups use it to replace VPN sprawl and to keep payment systems separate, since PCI SSC guidance says a flat network puts the entire network in scope.
Get a quote for ZTNA for retail
Tell us roughly how many users or sites you have and we will come back to you with options and a quote.
Who this page is for
This page is for IT and operations leads at multi-site retailers, franchise groups, hospitality operators and the support companies that look after their stores.
Retail networks grow store by store. Each site has tills, back-office PCs, tablets, cameras and Wi-Fi, often joined to head office by site-to-site VPNs. Staff change with the seasons, devices are shared, and a long list of suppliers (EPoS, stock and ordering, CCTV, refrigeration, building management) need remote access to their own systems. Zero trust network access (ZTNA) replaces broad network access with a check on every request to every application. For the basics, see what ZTNA is.
Why zero trust for retail
| Retail challenge | Risk with network-level access | What ZTNA changes |
|---|---|---|
| Shared tills, tablets and back-office PCs | A logged-in device gives anyone who uses it the same broad access | Each user signs in with their own identity, and access follows the role |
| Seasonal and temporary staff | Accounts and VPN access are created in a rush and left behind | Per-app access tied to the HR record, removed when the contract ends |
| Suppliers supporting EPoS, CCTV and building systems | Remote support tools and shared accounts reach the whole store network | Named supplier access to the one system they support, logged and time-limited |
| Many stores on site-to-site VPNs | One compromised store can reach head office and other stores | Stores reach central systems per application, without full network trust |
| Payment systems on the same network as everything else | A flat network can bring every device into PCI DSS scope | Segmentation keeps the cardholder data environment separate |
Not sure which level fits? Ask us
Tell us what you need and we will recommend the right level for your organisation, with a quote.
How ZTNA works for stores and head office
In a retail ZTNA design, central systems (stock and ordering, rotas and HR, finance, file shares, reporting) are published through a cloud policy engine using connectors that make outbound connections only. Nothing at head office or in the data centre has to accept inbound connections from the internet.
- Head office and area managers use a client on managed laptops and reach each application after MFA and a device check.
- Store staff sign in on shared devices with their own accounts; access is limited to the store systems their role needs.
- Suppliers get agentless, browser-based access to the system they support, approved and logged; see agentless ZTNA.
- Remote desktops for back-office servers go through a broker with MFA instead of exposed RDP; see secure remote desktop access.
This is often called retail remote access done the zero trust way: access is granted to an application, not to the store network. Our secure remote access guide covers the wider options.
Segmenting payment systems: PCI DSS scope
The PCI Security Standards Council's information supplement on PCI DSS scoping and network segmentation (opens in a new tab) (version 1.1, May 2017) is direct about this. Segmenting the cardholder data environment (CDE) from the rest of the network is not a PCI DSS requirement, but the Council strongly recommends it as a method that may reduce the scope and cost of a PCI DSS assessment and the risk to the organisation. Without adequate segmentation, a "flat network", the entire network is in scope. The guidance also says to start from the assumption that everything is in scope until verified otherwise, and that where segmentation is used to reduce scope, the assessor must verify that it is adequate.
In September 2024 the Council added a further information supplement, PCI DSS Scoping and Segmentation Guidance for Modern Network Architectures (opens in a new tab), which covers the impact of zero trust architecture on PCI DSS scope and how to define scope boundaries with micro-segmentation and multi-cloud. The Council says it is supplemental and does not supersede or replace any PCI standard.
Zero trust supports that in two ways:
- Segmentation and microsegmentation keep tills and payment devices in their own zone, allowing only the flows they need. See microsegmentation vs network segmentation.
- Per-app access means staff and suppliers who reach stock or rota systems never get a network path to the payment zone in the first place.
Your scope is confirmed by your PCI DSS assessment; zero trust design gives the assessor a clearer, better-documented boundary to verify.
Is ZTNA for retail the right fit for you?
We will check it against your systems and requirements and recommend the right option.
Products we supply for retail
| Need | Approach | Products we supply |
|---|---|---|
| Head office and area manager access | Client-based ZTNA with device checks | Cisco Secure Access (opens in a new tab), Check Point ZTNA, Timus, Exium |
| Supplier and contractor access | Agentless ZTNA or an enterprise browser (opens in a new tab) | Island Private Access, Check Point Enterprise Browser (opens in a new tab) |
| Back-office remote desktops | Brokered RDP with MFA and no open ports | TruGrid SecureRDP |
| Separating payment and store devices | Microsegmentation with just-in-time MFA on admin ports | Zero Networks segmentation (opens in a new tab) |
How they differ: Zero Networks describes its network segmentation (opens in a new tab) as blocking lateral movement, with admin ports and sensitive systems closed by default and opened only after just-in-time MFA. Island says contractors using its Private Access (opens in a new tab) install its browser, authenticate and reach only the applications they are authorised to use, without agents, VPNs or portals. TruGrid says SecureRDP (opens in a new tab) secures Windows desktops and apps without firewall exposure. Vendor descriptions checked 9 November 2026.
Licensing is usually per user for ZTNA and enterprise browsers and per protected server, workstation or device for segmentation, so seasonal headcount matters when you plan. Subscriptions can be billed monthly, terms confirmed at quote; see ZTNA cost.
Branch connectivity, Wi-Fi and the SASE angle
ZTNA handles access to applications; the connections between stores are a separate layer. If you want store connectivity, web security and access managed together in one cloud platform, that is SASE (opens in a new tab), covered on our sister site. For the circuits, see leased lines for retail (opens in a new tab); for store networks, see retail Wi-Fi (opens in a new tab) on our Cisco Meraki (opens in a new tab) site.
How we help retailers
Forever Systems supplies the ZTNA, enterprise browser, remote desktop and segmentation products on this site. We can review how staff, stores and suppliers reach your systems today, recommend an approach, pilot it with a few stores and help roll it out across the estate in stages. Scope and timescales are confirmed at quote.
Contact us to talk through your plans.
How Forever Systems helps with ZTNA
Forever Systems supplies and supports several zero trust network access platforms, so we can recommend what fits how your people work and the tools you already run.
- Assess first: we look at your current VPN, firewall, identity set-up and the applications people need to reach before suggesting anything new
- Vendor-aware advice across the ZTNA products we supply, including Cisco Secure Access (opens in a new tab) and Check Point Private Access
- Pilots and phased roll-out: we can help you start with one group of users or one application, then extend access policy by policy
- VPN replacement: planning the move away from remote access VPNs, including identity provider integration and device posture checks
- Ongoing support: policy changes, licence reviews and renewals, with the details confirmed at quote
We work with businesses, schools, charities and public sector organisations. Pricing depends on users, features and term, so ask us for a quote.
Frequently asked questions
What is ZTNA for retail?
ZTNA for retail is zero trust network access applied to stores, head office and suppliers. Each user reaches specific applications such as stock, rota or reporting systems after identity and device checks, instead of joining the store or head office network through a VPN.
How does zero trust for retail help with PCI DSS?
PCI SSC guidance says segmentation is not a PCI DSS requirement but is strongly recommended as a way to reduce assessment scope, and that a flat network puts the whole network in scope. Zero trust segmentation keeps payment systems separate, and per-app access stops staff and suppliers getting a network path to them.
Can ZTNA replace site-to-site VPNs between stores?
For user access to central applications, yes: stores reach each application through the policy engine instead of the whole head office network. Connections between sites for other traffic are usually handled by SD-WAN or a SASE platform.
How do suppliers get access to store systems?
With agentless ZTNA or an enterprise browser. The supplier signs in with a named account and MFA, reaches only the system they support, and the session is logged. Access can be time-limited and removed when the contract ends.
Does ZTNA work on shared tills and tablets?
Yes, as long as each person signs in with their own identity. Access then follows the user's role rather than the device, and the logs show who did what. Devices that cannot run a client are protected by segmentation instead.
Still have a question about ZTNA for retail?
Ask us and a member of our team will get back to you.