Advancing National Cybersecurity Resilience: Integrating Zero Trust Architecture and Secure Access Service Edge for Protecting Critical Cloud and Network Infrastructure

 Corresponding author: Emma JUNIOR Emmanuel Copyright © 2024 Author(s) retain the copyright of this article. This article is published under the terms of the Creative Commons Attribution License 4.0. Advancing National Cybersecurity Resilience: Integrating Zero Trust Architecture and Secure Access Service Edge for Protecting Critical Cloud and Network Infrastructure Emma Junior Emmanuel * Department of Computer Science, Roy G. Perry College of Engineering, Prairie View A&M University, Texas, United States. World Journal of Advanced Research and Reviews, 2024, 28(01), 2148-2162 Publication history: Received on 13 September 2025; revised on 27 October 2025; accepted on 30 October 2025 Article DOI: https://doi.org/10.30574/wjarr.2025.28.1.3596 Abstract The increasing sophistication of cyber threats targeting national critical infrastructure underscores the urgent need for a robust, adaptive, and scalable cybersecurity framework. Traditional perimeter-based defenses have proven inadequate in the face of distributed cloud environments, remote work ecosystems, and dynamic data access patterns. This paper proposes an integrated model that combines Zero Trust Architecture (ZTA) and Secure Access Service Edge (SASE) principles to advance national cybersecurity resilience. The integration enables continuous verification, policydriven access, and cloud-native security enforcement across users, devices, and applications, irrespective of location. Drawing from current implementations in both government and enterprise environments, the study develops a multilayered National Cybersecurity Resilience Framework (NCRF) that aligns identity-centric control with secure edge networking. The proposed framework enhances trust decentralization, visibility, and adaptive threat response through AI-enabled analytics and unified policy orchestration. Comparative evaluation against standalone ZTA and SASE deployments demonstrates improved agility, reduced attack surfaces, and optimized access latency. The study concludes that a cohesive ZTA–SASE convergence offers a scalable pathway toward securing critical cloud and network infrastructure, providing a blueprint for nations seeking to strengthen digital sovereignty and operational resilience. Keywords: Zero Trust Architecture (ZTA); Secure Access Service Edge (SASE); Cybersecurity Resilience; Cloud Security; Network Security; National Critical Infrastructure 1. Introduction The accelerating pace of digital transformation has amplified the complexity and scale of cybersecurity risks confronting nations worldwide. Governments and critical infrastructure sectors increasingly rely on interconnected cloud platforms, Internet of Things (IoT) devices, and distributed networks to support essential services [1, p. 6667]. While these technologies enhance operational efficiency, they simultaneously expand the national attack surface, creating new vulnerabilities across identity, access, and data layers. Cyber adversaries, ranging from state-sponsored actors to organized criminal groups, are exploiting these weaknesses to target cloud environments, supply chains, and network control systems [1, p. 6668]. The resulting disruptions threaten not only digital assets but also national security, public safety, and economic stability. Traditional perimeter-based defenses, such as firewalls and Virtual Private Networks (VPNs), are no longer sufficient for securing highly dynamic hybrid infrastructures. VPNs often provide implicit trust once access is granted, making lateral movement within networks easier for adversaries [2, p. 14]. Moreover, fragmented access controls and inconsistent security postures across agencies and cloud providers hinder unified visibility and response coordination. World Journal of Advanced Research and Reviews, 2024, 28(01), 2148-2162 2149 These gaps underscore the need for a new cybersecurity paradigm centered on identity, continuous verification, and policy-driven access enforcement. In this context, Zero Trust Architecture (ZTA) and Secure Access Service Edge (SASE) have emerged as transformative paradigms for redefining network and cloud security. ZTA eliminates implicit trust by enforcing continuous authentication and authorization based on context, user identity, and device posture. SASE complements ZTA by converging network connectivity and cloud-delivered security services, such as SD-WAN, Cloud Access Security Broker (CASB), Secure Web Gateway (SWG), and Zero Trust Network Access (ZTNA), into a unified, policy-aware framework. According to [3, p. 609], when integrated, ZTA and SASE provide an adaptive and scalable defense strategy capable of protecting users and data wherever they reside. The motivation for this study arises from the growing need to institutionalize cybersecurity resilience at the national level. Most existing deployments of ZTA and SASE remain siloed within enterprises, lacking interoperability and national policy alignment [3, p. 612]. This paper, therefore, proposes an integrated ZTA–SASE National Cybersecurity Resilience Framework (NCRF) that enables coordinated protection of critical infrastructure and cloud ecosystems through identity-centric governance, secure access orchestration, and continuous threat analytics. The contributions of this paper are fourfold: • Analyze existing national resilience gaps in cloud and network infrastructure security, emphasizing limitations of current perimeter-based approaches. • Review the latest Zero Trust and SASE implementations and their interoperability challenges. • Propose an integrated ZTA–SASE framework tailored for national-level cybersecurity resilience. • Evaluate the benefits, operational challenges, and policy implications of adopting this unified model. The remainder of this paper is structured as follows. Section II reviews existing cybersecurity frameworks and emerging architectures, outlining the foundational standards and recent developments relevant to Zero Trust and SASE integration. Section III presents the technical background of these two paradigms, detailing their core principles, components, and the potential for architectural convergence. Section IV introduces the proposed National Cybersecurity Resilience Framework (NCRF), describing its multi-layered design, operational flow, and implementation tiers across national infrastructure domains. Section V provides a performance evaluation and comparative analysis of the NCRF against standalone ZTA and SASE models, highlighting its operational advantages and trade-offs. Section VI explores key challenges associated with large-scale implementation and identifies future research directions in automation, federated trust, and quantum-safe security. Finally, Section VII concludes the paper by summarizing the major contributions, policy implications, and the collaborative pathways necessary to advance national cybersecurity resilience. Figure 1 Sector-Wise Threat Level Assessment Across National Cybersecurity Categories 2. Related work Cybersecurity resilience at both organizational and national levels is guided by a variety of standards, frameworks, and emerging architectures that emphasize governance, identity-centric protection, and cloud-native security delivery. This section reviews major frameworks such as ISO/IEC 27001, NIST SP 800-207, CISA’s Zero Trust Maturity Model, and Gartner’s SASE, followed by recent academic studies integrating Zero Trust Architecture (ZTA) and Secure Access World Journal of Advanced Research and Reviews, 2024, 28(01), 2148-2162 2150 Service Edge (SASE) principles. The section concludes with a comparative discussion and the identified research gap motivating this study. 2.1. Cybersecurity Frameworks and Standards 2.1.1. ISO/IEC 27001. ISO/IEC 27001 provides an internationally recognized foundation for establishing an Information Security Management System (ISMS). It focuses on governance, risk assessment, and continuous improvement rather than on specific technologies [4, p. 2590]. While widely adopted for certification and policy alignment, it remains technology-neutral and does not prescribe modern access control or cloud-security mechanisms. 2.1.2. NIST SP 800-207 (Zero Trust Architecture). NIST SP 800-207 defines the core ZTA principles of never trust, always verify, continuous authentication, and leastprivilege enforcement. It introduces the logical components of Policy Decision Point (PDP) and Policy Enforcement Point (PEP), providing the canonical reference for designing identity-centric architectures that replace perimeter-based trust models [5, p. 850]. 2.1.3. CISA Zero Trust Maturity Model. The Cybersecurity and Infrastructure Security Agency (CISA) expand on NIST guidance by introducing maturity tiers that help public agencies plan and measure Zero Trust adoption [6, p. 103413]. It addresses people, devices, networks, applications, and data as interdependent pillars, but remains focused on agency-specific deployments rather than interagency or national integration. 2.1.4. Gartner SASE Framework. Gartner’s Secure Access Service Edge (SASE) model describes the convergence of SD-WAN networking and clouddelivered security functions including Secure Web Gateway (SWG), Cloud Access Security Broker (CASB), NextGeneration Firewall (NGFW), and Zero Trust Network Access (ZTNA), into a single, identity-aware service [7, p. 850]. SASE provides elastic scalability for distributed workforces but varies widely across vendor implementations, leading to interoperability challenges. 2.2. Recent Studies Integrating ZTA and SASE Recent studies have increasingly explored how Zero Trust Architecture (ZTA) and Secure Access Service Edge (SASE) can be integrated to strengthen both enterprise and national cybersecurity frameworks. A multivocal literature review from 2023 to 2024 characterizes SASE as a cloud-native fusion of networking and security that offers benefits such as reduced latency and unified policy enforcement [8, p. 735]. However, the review also points out challenges including inconsistent standards, vendor fragmentation, and the absence of mature interoperability models. Complementary research on Zero Trust Network Access (ZTNA) underscores its superiority over traditional VPNs, particularly in session isolation and the prevention of lateral movement within networks [8, p. 736]. Despite these strengths, studies identify ongoing limitations related to identity federation, telemetry integration, and maintaining seamless user experiences across multi-cloud environments. More recent analyses, including systematic reviews comparing VPNs with ZTNA and SASE, reveal significant security gains and reduced attack surfaces, but also highlight persistent difficulties in integrating these models with legacy systems. Emerging discussions on what scholars describe as “Zero Trust 2.0” focus on combining artificial intelligencedriven risk scoring with SASE edge enforcement to achieve adaptive and real-time access control [9, p. 150]. This new approach represents an important step toward automation and scalability in cybersecurity architecture. However, researchers emphasize that the lack of standardized governance frameworks and interoperability across providers continues to impede broader, cross-domain implementation. Collectively, these studies show that while ZTA–SASE convergence is progressing rapidly, its application remains largely limited to enterprise and agency-level environments rather than fully national-scale ecosystems. 2.3. Comparative Discussion While ISO/IEC 27001 ensures governance and compliance consistency, it lacks operational depth for identity-centric defense. NIST SP 800-207 and CISA’s Maturity Model provide solid architectural and procedural guidance for Zero Trust but are primarily scoped for individual organizations. Gartner’s SASE and related vendor models extend protection to the cloud and network edge but vary widely in architecture, terminology, and control integration. World Journal of Advanced Research and Reviews, 2024, 28(01), 2148-2162 2151 These differences complicate cross-domain interoperability, unified visibility, and policy orchestration at national scale [10, p. 20]. 2.4. Literature Gap Across standards, governmental guidance, and emerging research, a clear gap persists in which there is no unified framework that operationalizes Zero Trust Architecture and SASE principles cohesively for national-level cybersecurity resilience. Existing models focus on organizational boundaries, whereas protecting critical infrastructure requires federated identity management, standardized policy enforcement, and coordinated threat intelligence across multiple public and private domains [11, p. 75]. This gap motivates the National Cybersecurity Resilience Framework (NCRF) proposed in this study. Table 1 Comparison of Key Frameworks and Paradigms Framework / Paradigm Scope / Focus Key Features Strengths Limitations ISO/IEC 27001 Organizational ISMS, governance Risk assessment, control selection, continual improvement Strong governance and auditability; vendor-neutral Technology-agnostic; not prescriptive on access architecture NIST SP 800207 (ZTA) Architecture & logical components PDP/PEP model, continuous verification, least privilege, micro segmentation Clear architectural model for identitycentric controls Enterprise/agency focus; integration complexity CISA Zero Trust Maturity Model Government adoption / maturity planning Phased implementation, measurement, prioritized capabilities Practical roadmap for agencies; measurable progress Agency-centric; limited cross-provider orchestration Gartner SASE Model Cloud-native convergence of network + security SD-WAN + SWG, CASB, ZTNA as a service Operationalizes secure access at edge; elastic scaling Vendor variance; interoperability & governance challenges Zero Trust Edge (Vendor Variants) Cloud/edge enforcement of Zero Trust principles Edge enforcement points, ZTNA, SD-WAN integration Practical deployment patterns for user/branch access Inconsistent terminology and feature sets across vendors 3. Technical background This section provides the foundational concepts underpinning the proposed integration of Zero Trust Architecture (ZTA) and Secure Access Service Edge (SASE). It explains the guiding principles, architectural components, and complementary functions that collectively enable adaptive, identity-driven, and cloud-native cybersecurity for critical infrastructure protection. 3.1. Zero Trust Architecture (ZTA) 3.1.1. Principles. Zero Trust Architecture (ZTA) marks a significant shift from traditional perimeter-based security models to a contextdriven approach to access control. At its core, ZTA operates on the principle of "never trust, always verify," meaning that every access request, regardless of its origin, is considered untrusted until it has been explicitly authenticated and authorized [12, p. 144]. The framework also emphasizes least privilege access, ensuring that users and devices receive only the minimum permission necessary to perform their tasks, thereby reducing the risk of unauthorized actions. Furthermore, ZTA relies on continuous verification, where authentication and authorization are not treated as one-time events but are enforced continuously, considering factors such as user behavior, device health, and the overall risk associated with each session [12, p. 145]. This approach ensures a dynamic, context-aware security posture that adapts to evolving threats in real time. World Journal of Advanced Research and Reviews, 2024, 28(01), 2148-2162 2152 3.1.2. Components. Zero Trust Architecture (ZTA) is typically built around a central Policy Engine (PE), which evaluates access requests using contextual information, and a Policy Enforcement Point (PEP), which executes the PE’s decisions by granting, denying, or restricting access [13, p. 30]. Supporting this core functionality are several key components. The Identity Provider (IdP) is responsible for authenticating users and devices, issuing identity assertions or tokens to verify their legitimacy. The Policy Administrator (PA) takes the decisions made by the PE and translates them into actionable configurations that can be applied at enforcement points. A Continuous Diagnostics and Mitigation (CDM) system monitors device posture and user behavior in real time, ensuring ongoing security compliance. Additionally, a Threat Intelligence and Analytics layer provide contextual risk indicators to enhance the accuracy of access decisions [13, p. 32]. Together, these components interact dynamically to enforce trust-based decisions across the network, applications, and data layers, ensuring that access is continuously evaluated and controlled. Figure 2 Layered Architecture of a Zero Trust System 3.2. Secure Access Service Edge (SASE) 3.2.1. Overview. Secure Access Service Edge (SASE) is a cloud-native architectural model introduced by Gartner that converges network connectivity and security-as-a-service functions into a unified platform. It replaces the traditional hub-and-spoke model with an edge-delivered service fabric that enforces policies closer to users, devices, and cloud workloads. 3.2.2. Key Components. A comprehensive Secure Access Service Edge (SASE) implementation combines multiple networking and security functions within a unified, cloud-delivered framework. At its foundation, the Software-Defined Wide Area Network (SDWAN) provides intelligent routing and connectivity optimization across distributed environments. Complementing this, the Cloud Access Security Broker (CASB) monitors user interactions with Software-as-a-Service (SaaS) applications, enforcing data governance and compliance policies [14, p. 145]. The Secure Web Gateway (SWG) component filters internet traffic to block malicious content and unauthorized access, while Zero Trust Network Access (ZTNA) ensures that connections to internal and cloud-based resources are granted strictly on an identityand context-aware basis. Perimeter protection is extended through Firewall-as-a-Service (FWaaS), which offers scalable, cloud-hosted firewall capabilities that eliminate the need for on-premises appliances. Finally, Data Loss Prevention (DLP) and integrated Threat Analytics functions perform contextual data inspection and anomaly detection, enabling proactive identification World Journal of Advanced Research and Reviews, 2024, 28(01), 2148-2162 2153 of insider threats and external attacks [14, p. 146]. Together, these elements form a cohesive service edge architecture that unifies security enforcement, visibility, and performance optimization across cloud and network domains. 3.2.3. Benefits. The Secure Access Service Edge (SASE) model offers several distinct advantages that directly support national cybersecurity resilience objectives. First, it enables unified policy enforcement through centralized management of security controls across cloud, edge, and user environments, ensuring consistent protection regardless of location. By consolidating multiple security functions into a single, cloud-native platform, SASE significantly reduces architectural complexity and minimizes operational overhead [15, p. 125]. Its scalability allows seamless expansion to support growing numbers of remote and mobile users without compromising performance or security posture. In addition, SASE provides enhanced visibility, enabling end-to-end monitoring of user behavior, data flows, and network traffic. Finally, through optimized performance achieved by direct-to-cloud routing and intelligent traffic steering, SASE reduces latency and bandwidth congestion while maintaining robust security standards [15, p. 126]. Collectively, these attributes make SASE an ideal foundation for implementing resilient, adaptive cybersecurity architectures at a national scale. Figure 3 Conceptual SASE Architecture 3.3. Integration Potential of ZTA and SASE 3.3.1. Complementary Strengths. Zero Trust Architecture (ZTA) and Secure Access Service Edge (SASE) share a common objective which is providing secure, identity-driven access to resources, but they achieve this through distinct yet complementary approaches. ZTA functions as the logical control plane, defining access policies based on identity, contextual factors, and assessed risk levels [16, p. 100106]. In contrast, SASE operates as the delivery and enforcement plane, ensuring that these policies are consistently implemented across distributed users, networks, and cloud environments. When integrated, the two frameworks form a federated trust fabric in which ZTA governs the access logic while SASE dynamically enforces it at the network and cloud edges, creating a unified and adaptive security model. 3.3.2. Overlapping Controls. Both architectures rely on authentication, authorization, and continuous monitoring. World Journal of Advanced Research and Reviews, 2024, 28(01), 2148-2162 2154 ZTA ensures granular identity control, while SASE enables scalable enforcement through cloud-based service edges [17, p. 437]. Their convergence allows unified telemetry collection, real-time threat detection, and adaptive risk-based responses across multiple agencies or infrastructure sectors. 3.3.3. 3) Communication Model and Data Flow. In an integrated Zero Trust Architecture (ZTA)–Secure Access Service Edge (SASE) model, the process of securing access begins when a user or device initiates a connection request to an application or data resource. This request is first evaluated by the ZTA Policy Engine, which authenticates and authorizes access based on identity credentials, device posture, and behavioral analytics [18, p. 106]. Once validated, the SASE fabric enforces additional security measures such as encryption, traffic inspection, and intelligent routing to ensure secure and efficient data delivery. Throughout this process, continuous monitoring and AI-driven analytics provide feedback that enables dynamic adjustments to access policies, allowing the system to respond adaptively to changing risk conditions in real time. Figure 4 Integrated ZTA–SASE Model 4. Proposed framework: national cybersecurity resilience model The proposed National Cybersecurity Resilience Framework (NCRF) integrates Zero Trust Architecture (ZTA) principles with Secure Access Service Edge (SASE) delivery to provide a unified, adaptive defense model for nationalscale digital ecosystems. The framework aligns policy-driven access control with secure, cloud-native enforcement mechanisms to safeguard critical infrastructure and government services. It is designed to ensure continuous trust evaluation, dynamic policy orchestration, and cross-sector interoperability. 4.1. Framework Overview The National Cyber Resilience Framework (NCRF) is designed as a five-layered model which entails Policy, Access, Network, Cloud, and Monitoring, that forms an integrated trust continuum across government, enterprise, and serviceprovider domains. The Policy Layer defines governance rules and risk models through AI-driven policy engines, while the Access Layer enforces Zero Trust principles by authenticating users and devices and supporting adaptive, role-based authorization [19, p. 94754]. The Network Layer, built on SASE’s cloud-native edge, secures data in motion through encryption, segmentation, and traffic inspection, integrating SD-WAN, CASB, SWG, and FWaaS services for consistent policy enforcement. The Cloud Layer protects workloads across hybrid environments by ensuring visibility, compliance, and automated remediation of misconfigurations. At the foundation, the Monitoring Layer continuously gathers telemetry and event World Journal of Advanced Research and Reviews, 2024, 28(01), 2148-2162 2155 data from all layers to enable real-time diagnostics, anomaly detection, and automated policy adjustments [19, p. 94755]. Together, these interconnected layers deliver a defense-in-depth approach that enhances cyber resilience through automation, intelligence, and centralized governance. - Figure 5 End-to-End Operational Flow Across NCRF Layers 4.2. Operational Flow The NCRF operational flow operates as a four-phase trust evaluation cycle designed to maintain continuous protection throughout the access and data lifecycle. In the access request phase, a user, device, or workload initiates a connection to a protected resource. The Access Layer then validates identity credentials, device posture, and contextual risk in alignment with Zero Trust principles [20, p. 3304]. During the policy evaluation phase, the Policy Engine integrates identity data, network context, and behavioral analytics to generate a dynamic risk score. These decisions evolve in real time, drawing on live threat intelligence and historical trust patterns. Figure 6 End-to-End Data Flow in the NCRF World Journal of Advanced Research and Reviews, 2024, 28(01), 2148-2162 2156 Once access is approved, the process transitions into the enforcement and delivery phase, where the SASE fabric securely routes traffic through edge nodes. Embedded security functions such as CASB, SWG, and DLP inspect data flows and ensure compliance with organizational and sectoral policies. Finally, in the continuous monitoring phase, telemetry from endpoints, networks, and cloud workloads is aggregated within the Monitoring Layer [20, p. 3304]. AI-driven analytics continuously refine user risk profiles and adjust access controls accordingly. This closed feedback loop fosters resilience by enabling continuous adaptation rather than relying on static configurations. 4.3. Implementation Tiers The NCRF is designed to operate seamlessly across diverse environments through three implementation tiers, each addressing the unique needs of different classes of national infrastructure. Tier 1 focuses on government networks, emphasizing secure inter-agency connectivity, data sharing, and identity federation across ministries. By integrating Zero Trust Architecture (ZTA) and Secure Access Service Edge (SASE), this tier ensures consistent policy enforcement and isolation of sensitive systems, even within multi-cloud settings [21, p. 30]. Tier 2 applies to critical infrastructure sectors such as energy, transportation, healthcare, and finance. Here, the priority is integrating operational technology (OT) with cloud-based management systems. Strong network segmentation, encrypted communication, and continuous monitoring safeguard against lateral movement, supply-chain threats, and system disruptions [21, p. 31]. Finally, Tier 3 encompasses cloud service providers, establishing standardized security and compliance expectations for both national and regional platforms. This tier promotes interoperability and federated trust, enabling secure yet seamless data exchange between public and private entities within the broader digital ecosystem. Table 2 Mapping of NCRF Core Components to National Cybersecurity Objectives Across Implementation Tiers Framework Component Primary Function Associated Objective Implementation Tier(s) Policy Engine & Governance Defines access control and compliance rules Unified policy enforcement and oversight Tier 1, 2, 3 Zero Trust Network Access (ZTNA) Identity and device authentication Secure, identity-based access Tier 1, 2 SASE Edge Infrastructure Cloud-delivered security and routing Data protection and lowlatency access Tier 2, 3 AI-Driven Risk Analytics Continuous threat detection and trust scoring Proactive resilience and adaptive defense All tiers Cloud Security Posture Management (CSPM) Visibility and automated configuration checks Secure cloud operations Tier 3 Telemetry & Continuous Monitoring (CDM) Aggregate, analyze, and respond to events Real-time situational awareness All tiers Federated Identity Management Inter-agency and crossdomain trust National identity interoperability Tier 1, 3 5. Performance evaluation and comparative analysis To validate the operational advantages of the proposed National Cybersecurity Resilience Framework (NCRF), a comparative evaluation was conducted against two baseline models: a standalone Zero Trust Architecture (ZTA) deployment and a standalone Secure Access Service Edge (SASE) implementation. The goal of this evaluation is to quantify how the integrated ZTA–SASE approach enhances national-level cybersecurity across multiple performance dimensions. 5.1. Evaluation Methodology The analysis uses a hybrid assessment model combining simulated network conditions, policy-orchestration scenarios, and expert-based scoring. Representative configurations for ZTA, SASE, and NCRF were modeled within a controlled