The rapid proliferation of Internet of Things (IoT) devices across enterprise environments has significantly expanded the digital attack surface, exposing organisations to new classes of security threats. Traditional perimeter-based security models are increasingly ineffective in this context, as IoT devices often lack standardised controls, operate in distributed ecosystems, and frequently interact with untrusted networks and services. This paper presents a structured Zero Trust Security (ZTS) framework explicitly tailored for enterprise IoT ecosystems. Grounded in the principles of continuous verification and least-privileged access, the proposed five-step methodology addresses the unique security challenges posed by IoT deployments. Key components include protect surface definition, transaction flow mapping, Zero Trust network architecture, granular policy enforcement, and continuous monitoring. The paper also identifies practical implementation challenges, such as device discovery, authentication, and segmentation, and offers guidance on over- coming them. By aligning ZTS principles with IoT-specific requirements, this work contributes a scalable and adaptable approach to building resilient, context-aware security architectures for future enterprise infrastructures.