Serving Chicagoland manufacturers since 2001.

The Short Answer

Zero Trust is a cybersecurity strategy based on a simple principle: a user, device, application, or network connection should not be trusted automatically just because it is inside the company network.

Instead, every access request should be verified based on factors such as identity, device security, location, permissions, risk, and the resource being requested. NIST describes Zero Trust as a shift away from static, perimeter-based security toward protecting users, assets, and resources without granting implicit trust based only on network location or device ownership.

For manufacturers with 25–50 computer users, Zero Trust does not necessarily require replacing the entire network or purchasing a large collection of new security products. A practical implementation usually begins with:

• Multi-factor authentication
• Strong identity protection
• Conditional Access
• Secure company devices
• Least-privilege permissions
• Network segmentation
• Controlled vendor access
• Endpoint monitoring
• Regular account reviews
• Incident-response planning

Most manufacturers can implement Zero Trust gradually, beginning with Microsoft 365 identities, administrator accounts, remote access, and production-network segmentation.

At TR Technologies, we have been serving Chicagoland manufacturers since 2001, helping companies strengthen cybersecurity without unnecessarily disrupting production.

Why Manufacturers Should Care About Zero Trust

Manufacturing companies increasingly depend on systems that exist outside a traditional office network.

Employees and vendors may access:

• Microsoft 365
• Cloud ERP systems
• Remote desktops
• Production scheduling
• Customer portals
• Supplier portals
• Engineering files
• Remote machine-support tools
• Multiple facilities
• Mobile devices
• Home networks
• Cloud applications

The older security model assumed that the company network had a clear boundary.

People outside the firewall were treated as untrusted.

People and devices inside the firewall were often given broad access.

That model becomes less effective when:

• Employees work remotely
• Applications run in the cloud
• Vendors connect from outside locations
• Employees use mobile devices
• Production systems connect to office networks
• Credentials are stolen through phishing
• A compromised laptop connects through a VPN
• Multiple facilities share systems

A valid username, internal IP address, or VPN connection does not prove that an access request is safe.

Zero Trust replaces broad assumptions with continuous, risk-based decisions.

What Does “Never Trust, Always Verify” Mean?

“Never trust, always verify” does not mean employees and vendors are assumed to be dishonest.

It means technology should verify each request before granting access.

For example, an employee attempts to open a sensitive SharePoint site.

The organization may evaluate:

• Is the username valid?
• Was MFA completed?
• Is the device managed?
• Is the device encrypted?
• Is the operating system supported?
• Is the login coming from an expected location?
• Does the employee’s role require access?
• Is the login behavior unusual?
• Is the requested information sensitive?

Access can then be:

• Allowed
• Blocked
• Limited
• Delayed pending more verification
• Restricted to a compliant device
• Approved only after MFA

Microsoft describes Conditional Access as its Zero Trust policy engine because it evaluates signals such as user identity, device, location, and session risk before allowing or limiting access.

The VERIFY Framework for Manufacturing Zero Trust

TR Technologies recommends using the VERIFY Framework to organize a practical Zero Trust strategy.

V — Verify Every Identity

Identity has become one of the most important security boundaries.

Attackers often begin with:

• Stolen passwords
• Phishing
• Compromised email accounts
• Reused credentials
• Shared administrator accounts
• Dormant vendor accounts
• Weak remote-access accounts

A Zero Trust identity strategy should include:

• Multi-factor authentication
• Named user accounts
• Separate administrator accounts
• Strong onboarding and offboarding
• Conditional Access
• Passwordless authentication where practical
• Phishing-resistant MFA for higher-risk users
• Account-expiration procedures
• Risk-based login monitoring
• Regular privilege reviews

Require MFA

MFA should be used for:

• Microsoft 365
• VPN access
• Administrator accounts
• Remote vendor access
• Cloud ERP
• Backup systems
• Security platforms
• Other critical applications

MFA is not perfect, but it significantly increases the difficulty of using a stolen password alone.

Separate Administrator Accounts

Employees who manage systems should not use the same account for:

• Email
• Internet browsing
• Daily office work
• Server administration
• Microsoft 365 administration
• Firewall management

Separate accounts reduce the chance that a compromised everyday account gains immediate administrative control.

Use Conditional Access

Conditional Access can apply rules such as:

• Require MFA for all users
• Block older authentication methods
• Require compliant devices
• Restrict high-risk sign-ins
• Apply stronger controls to administrators
• Limit access by location
• Require approved applications

Microsoft states that Conditional Access can provide more granular protections than basic security defaults, though the exact features depend on Microsoft Entra licensing.

E — Evaluate Every Device

A valid employee account should not automatically make every device trustworthy.

The device may be:

• Infected with malware
• Missing security updates
• Unencrypted
• Personally owned
• Shared with family members
• Running unsupported software
• Missing endpoint protection
• Previously lost or stolen

A Zero Trust device strategy evaluates whether the device meets company requirements before granting access.

Review Device Security

Company-managed devices should generally include:

• Supported operating systems
• Automatic security updates
• Endpoint Detection and Response
• Disk encryption
• Screen-lock requirements
• Device inventory
• Remote-management capabilities
• Secure configuration
• Backup where appropriate
• Restricted local administrator rights

Address Personal Devices

Manufacturers should decide whether employees can use personal devices for:

• Email
• Microsoft 365
• File access
• Remote desktop
• ERP
• Administrative tasks

Possible approaches include:

• Blocking personal devices
• Allowing browser-only access
• Requiring mobile application management
• Preventing downloads
• Requiring device enrollment
• Limiting access to low-risk applications

The correct approach depends on business needs, employee roles, licensing, and risk tolerance.

Prepare for Lost Devices

A documented process should answer:

• Who reports the lost device?
• Can company data be remotely removed?
• Can active sessions be revoked?
• Is the drive encrypted?
• Does the device store local files?
• Should credentials be reset?
• Does cyber insurance require notification?

R — Restrict Access with Least Privilege

Least privilege means employees and vendors receive only the access required to perform approved work.

They should not receive broad access simply because it is easier to configure.

Common Excessive-Permission Problems

Examples include:

• Every employee can open most SharePoint folders.
• Shop-floor users can access accounting files.
• Former employees remain in security groups.
• Department managers have global administrator rights.
• Vendors can access the entire network through VPN.
• Employees use local administrator accounts.
• Temporary access becomes permanent.
• Shared production accounts have broad permissions.

Apply Role-Based Access

Permissions should reflect job responsibilities.

Accounting

May need access to:

• Financial systems
• Payroll
• Banking
• Accounts payable
• Accounts receivable

Engineering

May need access to:

• Drawings
• Specifications
• CAD systems
• Engineering document libraries
• Selected production resources

Production

May need access to:

• Work orders
• Scheduling
• Quality systems
• Approved file locations
• Specific production applications

Human Resources

May need access to:

• Employee records
• Benefits information
• Hiring documents
• Confidential policies

These departments do not automatically need access to one another’s sensitive information.

Review Permissions Regularly

Review:

• Microsoft 365 roles
• SharePoint groups
• ERP roles
• File-share permissions
• Local administrator accounts
• Vendor access
• VPN access
• Security groups
• Application permissions

Quarterly reviews are often appropriate for sensitive or privileged access.

I — Isolate Critical Systems

Production systems should not automatically trust office computers, guest devices, security cameras, or vendor equipment.

Network isolation limits the damage one compromised system can cause.

Manufacturing Segments May Include

• Office users
• Servers
• Production equipment
• Engineering
• Voice systems
• Security cameras
• Building systems
• Guest Wi-Fi
• Vendor access
• Industrial IoT
• Backup infrastructure

Firewalls and access rules should control communication between these segments.

Secure Remote Vendors

Machine and software vendors should generally connect through:

• Named accounts
• MFA
• Controlled VPN groups
• Jump hosts
• Restricted network segments
• Approval-based sessions
• Time-limited access
• Logged activity

They should not receive unrestricted access to the entire network.

Zero Trust and OT

Production technology may present special challenges:

• Unsupported operating systems
• Long equipment lifecycles
• Vendor restrictions
• Limited maintenance windows
• Proprietary protocols
• Safety concerns
• Limited endpoint-security support

Zero Trust controls should therefore be adapted carefully.

CISA’s current OT guidance notes that Zero Trust principles can be applied to operational environments, but implementation must account for the unique reliability, safety, and operational constraints of those systems.

Where direct security controls cannot be installed, compensating protections may include:

• Segmentation
• Restricted access
• Jump hosts
• Monitoring
• Allow-listed communication
• Vendor coordination
• Isolation
• Replacement planning

F — Follow and Monitor Activity

Zero Trust assumes security incidents may still occur.

The objective is to identify suspicious activity quickly and limit its impact.

Manufacturers should monitor:

• Failed login attempts
• Unusual geographic logins
• Impossible travel
• New administrator accounts
• Disabled security software
• Endpoint alerts
• Firewall events
• Vendor connections
• Large file transfers
• Backup failures
• New remote-access tools
• Changes to security groups
• Suspicious Microsoft 365 activity

Continuous Verification

Access should not be treated as permanently safe after the initial login.

A session may need to be reevaluated when:

• The device becomes noncompliant
• The user’s risk level changes
• The login location changes
• The user requests a sensitive resource
• Security tools detect suspicious activity
• Administrator privileges are requested

Assign Responsibility

Monitoring only works when someone is responsible for:

• Receiving alerts
• Investigating events
• Escalating incidents
• Disabling compromised accounts
• Isolating devices
• Contacting leadership
• Coordinating with cyber insurance
• Preserving evidence

Connect Monitoring to Incident Response

A Zero Trust program should include procedures for:

• Compromised Microsoft 365 accounts
• Lost devices
• Suspicious vendor access
• Malware alerts
• Unauthorized privilege changes
• Ransomware
• Data theft
• Production-system concerns

Y — Yearly Review and Continuous Improvement

Zero Trust is not a product that can be installed once and forgotten.

NIST has documented multiple Zero Trust architecture patterns and implementations, demonstrating that organizations may use different combinations of technologies to apply the same underlying principles.

A manufacturer’s approach should evolve as:

• Employees change
• Vendors change
• New machines are installed
• Applications move to the cloud
• Locations are added
• Cyber insurance requirements change
• Threats evolve
• Microsoft services change
• Production systems are modernized

Recommended Review Schedule

Monthly

Review:

• Critical security alerts
• Failed backups
• High-risk accounts
• New administrator assignments
• Endpoint coverage

Quarterly

Review:

• User permissions
• Vendor access
• Administrator accounts
• Conditional Access policies
• Microsoft 365 security
• Security roadmap progress

Annually

Complete:

• Cybersecurity assessment
• Incident-response exercise
• Disaster recovery test
• Network segmentation review
• Cyber insurance readiness review
• Security policy review
• Zero Trust roadmap update

CISA’s Zero Trust Maturity Model emphasizes that adoption is progressive, moving through stages rather than occurring in one project.

Common Zero Trust Myths

Myth 1: Zero Trust Means Trusting Nobody

Reality: Zero Trust verifies access before granting the appropriate level of permission.

Employees and vendors can still work effectively.

Myth 2: Zero Trust Is Only for Large Companies

Reality: Small and mid-sized manufacturers can benefit from MFA, least privilege, device security, segmentation, and monitoring.

Myth 3: Zero Trust Requires Replacing Everything

Reality: Many organizations begin with existing Microsoft 365, firewall, endpoint-security, and network tools.

Myth 4: Zero Trust Slows Everyone Down

Reality: Poorly planned controls can frustrate employees, but well-designed access policies often improve both security and consistency.

Myth 5: A VPN Provides Zero Trust

Reality: A VPN creates a secure connection, but it does not automatically verify device condition, restrict permissions, monitor behavior, or limit access to one application.

Myth 6: A Firewall Provides Zero Trust

Reality: Firewalls remain important, but Zero Trust also includes identity, devices, applications, data, permissions, and continuous monitoring.

Myth 7: Zero Trust Prevents Every Cyberattack

Reality: No security strategy eliminates all risk. Zero Trust reduces unnecessary access and can limit the impact of compromised users or devices.

A Practical Zero Trust Roadmap for Manufacturers

Manufacturers do not need to complete everything at once.

First 30 Days

• Enable MFA for Microsoft 365.
• Separate daily and administrator accounts.
• Disable former employee accounts.
• Review active vendor accounts.
• Confirm endpoint protection coverage.
• Block unsupported remote-access methods.
• Identify critical systems.

Next 90 Days

• Review SharePoint and file permissions.
• Implement Conditional Access.
• Remove unnecessary administrator rights.
• Improve device compliance.
• Segment guest Wi-Fi.
• Restrict vendor VPN access.
• Document incident-response contacts.

Next 3–12 Months

• Improve office and production segmentation.
• Implement stronger device management.
• Expand identity monitoring.
• Create approval-based vendor access.
• Review ERP permissions.
• Improve centralized logging.
• Conduct an incident-response exercise.

Next 12–36 Months

• Modernize unsupported production systems.
• Implement privileged-access management.
• Expand application-specific access.
• Improve multi-site security.
• Develop formal IT and OT governance.
• Review Zero Trust maturity annually.

Questions to Ask Before Starting Zero Trust

• Is MFA enabled for every user?
• Do administrators use separate accounts?
• Are former employees removed promptly?
• Are vendor accounts reviewed?
• Are company devices encrypted?
• Is endpoint protection installed everywhere?
• Are SharePoint permissions appropriate?
• Are ERP roles based on job responsibilities?
• Are office and production systems segmented?
• Can vendors access only the systems they support?
• Are suspicious logins monitored?
• Do we have an incident-response plan?
• Who owns cybersecurity governance?
• Which improvements should happen first?

Frequently Asked Questions

What is Zero Trust security?

Zero Trust is a cybersecurity strategy that requires users, devices, and access requests to be verified rather than automatically trusted based on network location.

Does every manufacturer need Zero Trust?

Most manufacturers benefit from Zero Trust principles such as MFA, least privilege, segmentation, device security, and continuous monitoring. The scope should reflect the company’s risk and operational needs.

Is Zero Trust expensive?

It can be implemented gradually. Many manufacturers can begin with tools already available through Microsoft 365, firewalls, endpoint-security platforms, and managed IT services.

Does Microsoft 365 support Zero Trust?

Yes. Microsoft Entra ID, Conditional Access, MFA, device compliance, identity protection, and role-based permissions can support a Zero Trust strategy.

Does Zero Trust replace a firewall?

No. Firewalls remain important for segmentation and traffic control. Zero Trust expands security beyond the perimeter to include identity, devices, applications, data, and behavior.

Can Zero Trust protect production systems?

Yes, but controls must be adapted to operational requirements. Segmentation, controlled vendor access, monitoring, and restricted communication are often practical starting points.

Does Zero Trust stop ransomware?

Zero Trust cannot guarantee prevention, but it can reduce broad access, limit lateral movement, strengthen identity security, and improve detection.

How long does Zero Trust implementation take?

Initial improvements may be completed in 30–90 days. Broader identity, device, application, and production-network improvements may take 12–36 months.

What should a manufacturer implement first?

Begin with MFA, administrator-account separation, account cleanup, endpoint coverage, vendor-access review, and identification of critical systems.

Why Manufacturers Choose TR Technologies

Manufacturers throughout Chicagoland choose TR Technologies because we provide:

• Serving Chicagoland manufacturers since 2001
• Manufacturing cybersecurity expertise
• Microsoft 365 security
• Conditional Access planning
• IT and OT experience
• Network segmentation
• Secure remote vendor access
• Endpoint security
• Cyber insurance readiness
• Incident-response planning
• Strategic vCIO services
• Average response under 15 minutes
• 99% uptime for managed systems
• One trusted technology partner

We help manufacturers apply Zero Trust principles in practical stages that improve security while supporting employees, vendors, and production.

Key Takeaways

• Zero Trust removes automatic trust based on network location.
• Identity is a major modern security boundary.
• Users should receive only the access required for their work.
• Devices should meet security requirements before accessing company resources.
• Office, production, guest, vendor, and IoT networks should be appropriately separated.
• Monitoring and incident response remain essential.
• Zero Trust should be implemented gradually.
• Manufacturers can often begin with existing Microsoft, network, and endpoint-security tools.
• Security controls must be adapted carefully for OT and legacy production systems.

Is Your Manufacturing Company Ready for Zero Trust?

TR Technologies helps Chicagoland manufacturers evaluate Microsoft 365 security, identity protection, endpoint security, network segmentation, remote vendor access, and Zero Trust readiness.

Contact TR Technologies with a Discovery call today.