Companion resources for SASE Deployment Models: Cloud vs. Sovereign SASE Explained: how SASE spans fully cloud-delivered to fully customer-hosted models, mapped across five levels of the SASE Sovereignty Scale.
Free one-page cheat sheet
All six deployment models on the SASE Sovereignty Scale, the three core SASE components, key stats with sources, a decision checklist for buyers and security teams, and clickable links to every chapter.
Download the cheat sheet (PDF)
References & sources used in this video’s research
- How to Choose a Sovereign SASE Deployment Model, Gartner (de Feligonde, Winckless, Bhogal, Lerner) (2026 (Sep 17)). Used for: “Select a ‘sovereign enough’ deployment model”. This is the closing message of the video and is cited in the description.
- Managing Sovereign SASE Market Limitations and Vendor Selection, Gartner (2026 (Sep 17)). Used for: “Despite vendor claims, no universally sovereign (SASE) solution exists.” Used for the cheat-sheet stat “0”.
- Digital Sovereignty: How I&O Leaders Protect Data and Operations, Gartner (2026 (Aug 28)). Used for: Data / operational / technological sovereignty framing (who operates matters, not just where data sits). Used for the cheat-sheet stat “31% face data residency uncertainty”.
- Stronger SD-WAN and SSE Growth Lift SASE Forecast to $24 B by 2030, Dell’Oro Group (2026 (Aug 11)). Used for: SASE market at a 15% CAGR to $24B in 2030. Cheat-sheet stat only, not in the video.
- The Future of Network Security Is in the Cloud, Gartner (MacDonald, Orans, Skorupa) (2019). Used for: SASE’s origin as a cloud-delivered model with a global PoP network (Scene 1 and 3 context).
- Regulation (EU) 2022/2554 (DORA), Art. 30, EUR-Lex / European Union (2022). Used for: Contracts must state where data is processed and stored (Level 2 example).
- Recommendations 01/2020 on supplementary transfer measures, European Data Protection Board (2021). Used for: Remote access from a third country “is also considered to be a transfer” (Level 1 caveat).
- GDPR Art. 46 (transfers subject to appropriate safeguards), EU (via gdpr-info.eu) (2016). Used for: GDPR restricts transfers, not location: no general in-country rule (Level 1).
- HIPAA and cloud computing guidance, U.S. HHS (n.d. (current page)). Used for: ePHI may be stored outside the US with a BAA: no residency rule (Level 1).
- PCI DSS Cloud Computing Guidelines (Information Supplement), PCI Security Standards Council (2013). Used for: Data sovereignty is a legal consideration, not a DSS requirement (Level 1).
- Directive (EU) 2022/2555 (NIS2), EUR-Lex / European Union (2022). Used for: Named among frameworks with no general in-country rule (Level 1).
- Regulation (EU) 2018/1807 (Free Flow of Non-Personal Data), Art. 4, EUR-Lex / European Union (2018). Used for: Background for the Germany example: no general localization law, so demand is driven by sovereignty preference (Level 3).
- BSI C3A (Cloud sovereignty criteria), BSI (Germany) (2026). Used for: Evidence of the growing German demand to keep data and processing in Germany (Level 3).
