Traditional networks trusted devices on the office network and focused defenses on the perimeter. Zero trust assumes the network may already be compromised. Each request is checked against the user's identity, the device's health, and policy before access is granted, and access is limited to the specific resource needed.
For a small business, zero trust is less a product than a set of habits, including strong identity with MFA, managed devices, least-privilege access, segmented networks, encrypted connections, and remote access tools that grant access to specific systems rather than the whole network.