Remote work has settled into a durable operating model rather than a temporary response. A global survey of college-educated employees across 40 countries found that working from home stabilized at roughly one day per week – about a quarter of all workdays – between 2023 and early 2025, according to research published in PNAS in July 2025. In the United States, Gallup’s May 2026 tracking places 52% of remote-capable employees in hybrid arrangements and 26% fully remote.
A single company can now have staff in a dozen countries, applications hosted across several clouds, and customer data subject to multiple legal regimes at once. Access management designed around a building with one front door does not survive that geometry. The sections below explain why the traditional model fails across borders, and which components of a modern access stack address each failure.
Why the office-perimeter model breaks across borders
For most of the past two decades, access control was largely network control. Employees signed in from an office, traffic passed through a corporate firewall, and once inside, an authorized user could reach a broad set of internal systems. NIST’s zero trust architecture guidance describes the weakness of that pattern directly: authenticated subjects were given wide access to resources once they were on the internal network, which left unauthorized lateral movement as one of the hardest problems to contain.
When there is no single office, there is no “inside” to grant. A cross-border team adds three further complications: employees connect over consumer and mobile networks instead of a managed corporate link; the workforce sits in several regulatory jurisdictions at once; and the devices in use range from company-issued laptops to personal phones and home machines.
Credentials are the weak point that perimeter thinking tends to underestimate. The 2025 Verizon Data Breach Investigations Report, which analyzed more than 22,000 security incidents and 12,195 confirmed breaches, found that the use of stolen credentials was the initial access vector in 22% of breaches, ahead of vulnerability exploitation at 20% and phishing at 16%. The same report found that, among users whose systems were infected by credential-stealing malware, only 49% of their passwords were unique across services in the median case, and that credential-stuffing attempts accounted for 19% of daily authentication attempts at the median organization.
There is also a lifecycle problem that has little to do with attackers. In BetterCloud’s 2026 State of SaaS survey of 525 IT and security professionals, 18% of organizations reported a data breach caused by a former employee who still had access. The same survey found that the average company now runs about 118 SaaS applications, only 56% of which carry IT approval, and that 37% of corporate apps sit outside single sign-on.
The five layers of a cross-border access stack
No single product fixes access sprawl. What works is a sequence of controls that answer five different questions, each cheaper to implement once the layer beneath it is in place. The CISA Zero Trust Maturity Model organizes this work into five pillars – identity, devices, networks, applications and workloads, and data – with visibility, automation, and governance cutting across all of them.
| Layer | Question it answers | Representative control | Failure it prevents |
|---|---|---|---|
| Identity | Who is asking for access? | Single sign-on with phishing-resistant multi-factor authentication; automated provisioning | Credential reuse and orphaned accounts |
| Devices | Is the device healthy? | Mobile device management and endpoint detection; disk encryption; posture checks | Compromised or unmanaged endpoints |
| Network access | What may they reach? | Application-level access (ZTNA or SSE) rather than a broad VPN | Lateral movement after a stolen login |
| Cloud and workloads | Which production resources? | Cloud identity tied to the directory; just-in-time privileged access | Standing administrator rights |
| Data | Where may data legally go? | Regional storage and access controls; logging; data-loss prevention | Unlawful cross-border transfers |
The interesting row is usually device posture, because it is the one most cross-border teams skip. Identity can confirm who someone is while saying nothing about whether their laptop is patched or their disk is encrypted.
Identity replaces the perimeter as the primary control
NIST’s guidance treats authentication and authorization as discrete functions performed before a session is established, and it applies the same requirements regardless of whether the user is on a corporate network. In practice, that means a single sign-on layer with multi-factor authentication for every employee, not just administrators. Phishing-resistant methods such as FIDO2 security keys or passkeys are generally preferred where the provider supports them, since one-time codes can still be relayed by a determined attacker.
Provisioning matters as much as authentication. When access is granted through the directory and synchronized to applications automatically, onboarding and role changes update permissions without manual tickets, and a departure revokes access in one action rather than a checklist.
Device trust covers the half of the question identity cannot
An identity provider knows the person; it does not know the state of the machine they are using. Mobile device management enforces encryption, screen locks, and patch levels, and it can wipe a lost device remotely. Endpoint detection adds visibility into malicious activity on the device itself. When device posture feeds into access decisions, a machine that fails a check can be denied access to sensitive resources while remaining able to reach lower-risk tools.
Bring-your-own-device policies fit here rather than under identity. Many organizations allow personal devices to reach email and collaboration tools while reserving access to production systems and customer data for managed hardware.
Application-level access replaces network-wide VPN access
A traditional VPN authenticates a user and then places them on the corporate network, where they can often reach far more than their role requires. Zero trust network access takes a different approach: it grants access to a specific application after checking identity, device health, and context, and it does not expose the wider network. If a session is stolen, the attacker inherits access to one application rather than a network segment.
VPNs have not disappeared, and they still serve legitimate purposes such as reaching legacy systems or during a migration. The design goal is narrower access as the default, not the absence of any encrypted tunnel.
Cloud and workload access: the layer most teams underestimate
Long-lived cloud credentials – API keys and static user accounts created once and never rotated – tend to outlive the projects they were created for. A more defensible pattern ties cloud identity to the same directory used for everything else, issues short-lived credentials, and grants privileged production access only when it is needed, for a defined window. Non-human identities such as service accounts deserve the same inventory discipline as people; they are easy to create and easy to forget.
Data residency is an access-control problem, not just a storage choice
Storing data in a specific region does not by itself keep it there if anyone in another region can query it. Regional controls usually need to combine storage location, access policies that reflect those boundaries, encryption whose keys remain in the region, and logging that shows who accessed what. Dashboards and audit trails turn these policies into something a team can verify rather than assume.
The compliance layer: where data is allowed to go
Technical controls only take a global company so far, because the law constrains where personal data may travel. Under the EU General Data Protection Regulation, transfers of personal data outside the European Economic Area are permitted only through one of a small set of routes: an adequacy decision under Article 45, appropriate safeguards under Article 46, or a narrow derogation under Article 49.
| Route | Legal basis | Typical use |
|---|---|---|
| Adequacy decision | Article 45 | A country or framework the European Commission has recognised, such as the EU–US Data Privacy Framework for certified US recipients |
| Appropriate safeguards | Article 46 | Standard Contractual Clauses, Binding Corporate Rules, approved codes of conduct or certifications |
| Derogations | Article 49 | Occasional, non-repetitive situations such as explicit consent or contract necessity |
Regulators generally present Article 49 derogations as exceptional rather than a routine fallback for regular data flows.
One detail surprises many distributed teams: a transfer does not require moving a file. If an engineer in a third country can open EU customer records stored on a server inside the EU, that remote access is itself treated as a transfer. Where Standard Contractual Clauses are used, the European Data Protection Board’s Recommendations 01/2020 set out a six-step assessment that includes documenting a Transfer Impact Assessment and, where necessary, adding supplementary technical measures such as encryption where the keys stay with the exporter.
The rules are also not uniform across jurisdictions. The EU–US Data Privacy Framework, adopted in July 2023, provides an adequacy route for US organizations that self-certify, and certification has to be verified company by company rather than assumed. Brazil’s LGPD, China’s PIPL, and India’s Digital Personal Data Protection Act 2023 each take a different approach, and some rely on government-designated restrictions rather than a published list of adequate countries.
Because these rules change over time – the Data Privacy Framework replaced an earlier arrangement that courts had invalidated, and it has faced legal challenge – global teams generally treat compliance as an ongoing process. Following international business reporting alongside local counsel helps a company learn about a shifting requirement before it moves a workload or hires into a new jurisdiction.
A phased rollout that avoids a big-bang cutover
CISA’s maturity model moves through four stages – traditional, initial, advanced, and optimal – and most organizations progress through them in order rather than jumping to the end state. A workable sequence for a distributed company tends to follow the same logic as the table above:
- Phase 1 – Identity: deploy single sign-on, enforce multi-factor authentication for everyone, and connect the first tranche of high-value applications to the directory.
- Phase 2 – Devices: enroll managed laptops in device management, turn on encryption and patching, and begin feeding device health into access decisions.
- Phase 3 – Network access: identify the internal tools currently reached through a VPN and move the highest-value ones to application-level access first.
- Phase 4 – Cloud and workloads: connect cloud identity to the directory, retire long-lived credentials, and introduce just-in-time access for privileged roles.
- Phase 5 – Data and governance: map where personal data lives and travels, apply regional controls, and centralize logging across the earlier layers.
Keeping the VPN running in parallel during the transition is normal; the milestone that matters is a period with no logins to it before it is switched off.
Common failure modes
- Running two access systems indefinitely. A VPN and an application-access layer can coexist during migration, but a permanent split means two sets of policies and two places to check during an incident.
- Assuming single sign-on is complete. If a meaningful share of applications still use local passwords, the directory is no longer the source of truth, and offboarding is incomplete by default.
- Forgetting non-human identities. Service accounts and API keys are frequently left out of reviews, even though they can hold broad production permissions.
- Treating local data storage as localization. Storage location without matching access controls does not stop cross-border access.
- Leaving offboarding to manual checklists. The survey finding above – a former employee retaining access in 18% of surveyed organizations – is usually a process gap rather than a technology one.
Frequently asked questions
What is ZTNA in one sentence?
Zero trust network access grants a user access to a specific application after verifying identity, device health, and context, instead of placing them on a broader network.
Do global teams still need a VPN?
Often during a transition, and sometimes for legacy systems that cannot be reached another way. For everyday work, many organizations use application-level access as the default and keep a VPN for the narrow cases that require it.
How do we handle data residency without fragmenting security?
Keep one identity and device layer globally, and vary the data layer by region through storage location, access policy, and regional encryption keys. Centralized logging keeps oversight intact even when data is segmented.
What is the fastest first win?
Single sign-on plus multi-factor authentication for every employee, followed by automated provisioning. It reduces the number of standing credentials immediately and makes later layers easier to enforce.
How many applications should sit behind single sign-on?
As many as support it, prioritizing anything holding customer data, financial information, or administrative privileges. Where an application cannot use the directory, an access gateway in front of it can still enforce the same policy.
How this article was put together
This piece set out to explain which technical controls address access problems specific to cross-border remote teams, and why the traditional network-perimeter model does not fit them. Facts were drawn from NIST SP 800-207, the CISA Zero Trust Maturity Model, the 2025 Verizon Data Breach Investigations Report, BetterCloud’s 2026 State of SaaS survey, the European Data Protection Board’s Recommendations 01/2020, Gallup’s 2026 workplace data, and a peer-reviewed study of global working arrangements published in PNAS in July 2025. Figures reflect the editions and dates cited and should be rechecked as new reports are released. This article does not cover employment classification, payroll, or tax rules, which vary by jurisdiction and sit outside the scope of access management.
