## 1 Introduction  
Growing pressure on the industry to secure smart environments and to demonstrate their commitment to taking the right steps in securing their products and services has been elaborated in the public domain [1]. The impact of security compromises on products and services include data breaches, data exfiltration, unauthorised access to devices with incorrect configurations and exploitation of vulnerabilities in software components [2], of not just IT systems, but also of Operational Technology (OT), Internet of Things (IoT) and smart home devices. The causes of these compromises include but are not limited to incorrect access decisions or stolen credentials or because of default, reusable credentials. With the pervasiveness and interconnection of smart home devices [3], the security of smart home devices is under scrutiny, resulting in 200+ companies joining the Connectivity Standards Alliance (CSA) as members. The security of smart home devices has been highlighted in a cyber security certification program announced by the [PERSON] government in the USA [4]. With the proliferation of cloud environments, the interconnectivity of devices, remote working and increasing digitisation, perimeter-based security does not address the prevailing threat landscape, as it lags behind the innovativeness of malicious actors. Zero trust provides a viable alternative approach with a paradigm shift that seeks to address compromises by mitigating unauthorised access [1; 2] with continual authentication of access requests before granting access, thus never trusting but always verifying. This approach is encapsulated in the seven tenets of zero trust [5]. Zero trust includes moving security controls closer to data, applications, assets and services [2]. Lately, zero trust research has advanced beyond the concept of \"never trust, always verify\" [6]. Zero trust is implemented using the zero trust five-step implementation process [7], which includes (a) _Define your protect surface_, (b) _Map the transaction flows_, (c) _Build a Zero Trust architecture_, (d) _Create Zero Trust Policy_ (e) _Monitor and maintain the network_. This paper surveys the adoption of the zero trust five-step implementation process for smart environments. Smart environments are elastic, i.e., (i) the number of devices expands and contracts, depending on the users' appreciation and attraction to the ever-increasing availability of IoT devices, and (ii) they use heterogeneous communication vectors, such as Bluetooth, ZigBee and Wi-Fi. This poses a challenging situation, as many smart devices are mass produced and are installed by users and consumers. However, unlike traditional devices like laptops and desktops, the security of such smart devices is not very well understood by both technology-aware and technology-unaware users [8], as has been noticed with any new smart device introduced into the market, e.g., smartphones [9; 10] and smart locks [11]. In the face of such elasticity, coupled with the speed with which manufacturers ship smart devices to market, security considerations take a backseat [8; 11]. The industry's response to the growing pressure to address security issues includes applying zero trust to smart environments [12]. This paper provides a state-of-the-art review of the adoption of the zero trust five-step implementation process in smart home environments and IoT, as well as providing directions for future research. The major contributions of the paper are as follows:  
1. Contrary to most surveys that cover zero trust architecture and network security, this paper provides a comprehensive review of the adoption of zero trust five-step implementation for smart homes and IoT. To the best of our knowledge, we are the first to discuss the five-step zero trust implementation process for smart homes and IoT. 2. We believe that zero trust cannot be applied without understanding the protect surface, which includes the data or the asset we seek to secure and the communication flows between assets.