The Trusted Internet Connection (TIC) version 3.0 advances to a cloud-first perspective providing federal teams the opportunity to leverage cloud and mobility. While zero-trust network access (ZTNA) can replace legacy VPNs for direct access to private apps and resources in public cloud or private data centers, it requires pairing with cloud-native secure access service edge (SASE) networking and defenses. The difference from legacy web solutions that are cloud hosted—or in the cloud—from defenses designed to decode cloud traffic—or for the cloud—becomes very apparent when analyzing capabilities. At the core of SASE defenses is data context of cloud communications for granular policy controls, plus advanced data and threat protection.