SASE Pilot with Contractor BYOD and Clinic Breakout Constraints
Helio Health has 900 staff across 12 clinics, 40% of them remote, plus 300 contractors on unmanaged BYOD devices. All traffic backhauls to one data-center VPN concentrator that peaks at 1.2 Gbps; SaaS video visits show 180 ms jitter. The MPLS contract has 14 months left. Compliance requires clinical data to remain in-country, and contractors may access only the scheduling SaaS. The CISO proposes a full SASE cutover in 60 days: local internet breakout at clinics, cloud SWG, CASB, ZTNA replacing VPN, and DLP. The network team warns that clinic guest Wi-Fi shares the same breakout and two sites have 4G failover. The CFO wants no new headcount and a measurable 30-day pilot. Two clinics still run 20 Mbps DSL as primary; one has 45 staff and eight exam rooms.
1. Which user group and traffic should be in the 30-day pilot, and why?
Read the worked answer
Reasoning: a full clinical cutover in 30 days would combine the highest clinical risk with unproven local breakout. The contractor population is smaller, uses a narrow app, and is already on unmanaged devices, so it tests ZTNA, identity, and DLP without touching exam-room video.
Decision: pilot the 300 contractors against only the scheduling SaaS. Put them behind an identity-aware proxy with MFA, restrict access to that one application, and apply browser-only access plus DLP for any export. Measure login success, policy blocks, latency to the SaaS, and support tickets. Do not include clinical users or broad internet breakout in the first pilot. If the contractor pilot meets the success criteria, then pilot one clinic's corporate SSID with local breakout for approved SaaS in-country, leaving guest Wi-Fi on a separate isolated path.
2. How do you handle local internet breakout without breaking data residency and guest Wi-Fi separation?
Read the worked answer
Reasoning: local breakout reduces backhaul latency, but it must not become a flat internet path for all clinic traffic or mix guest users with corporate policy.
Design: use separate SSIDs and VLANs for corporate and guest. Guest traffic goes directly to the internet through an isolated guest policy with no access to clinical networks. Corporate clinical traffic uses local breakout only for approved SaaS whose data plane stays in-country; other traffic can remain on the tunnel until the MPLS transition. Apply the same cloud SWG and CASB policy at every breakout, including 4G failover, so policy follows the user rather than the link. Use TLS inspection selectively and document data-residency flows. Test on the 45-staff clinic with DSL first because it has the tightest bandwidth, and keep a rollback path to the VPN concentrator.
3. What identity and device-posture rules should apply to BYOD contractors?
Read the worked answer
Reasoning: BYOD cannot be treated like managed laptops. The control objective is to limit access to the scheduling app and prevent data staging without requiring invasive management of personal devices.
Rules: require phishing-resistant MFA or at least MFA with number matching; evaluate device posture for OS version, screen lock, and known-compromised state where the vendor supports it; deny local admin or rooted devices if risk warrants; grant access only to the scheduling SaaS, not the network; use conditional access based on user, device, location, and app; disable download, copy, and print where possible; watermark and log sessions; expire sessions quickly. If posture cannot be checked on a personal device, allow browser-only access with DLP rather than blocking all contractors, and require managed devices for any clinical data access.