baselineRFIWhich core SSE components (SWG, CASB, ZTNA, FWaaS/cloud firewall) are natively built on a single unified data plane versus acquired/integrated products running as separate services under one brand?weight 3
Answer key — what a strong answer shows
A single-pass, unified architecture avoids the duplicate latency/policy management that multi-product 'platforms' built through acquisition often carry — ask for architectural specifics, not a marketing diagram.
baselineRFPDescribe the global points-of-presence (PoP) footprint and provide measured latency benchmarks (not vendor lab numbers) for representative regions relevant to the buyer's workforce distribution.weight 3
Answer key — what a strong answer shows
Look for independently-measured or customer-validated latency figures by region, and a real PoP count/map, not just 'global coverage.'
baselineRFIHow does ZTNA application access work — is it agent-based, agentless/clientless, or both, and how are legacy/non-web (TCP/UDP) applications supported without a full VPN fallback?weight 3
Answer key — what a strong answer shows
Strong answers cover both agent and clientless modes and explain non-web app support specifically, since many ZTNA products only handle HTTP/HTTPS well.
baselineRFIWhat data-loss-prevention capability is embedded natively within the SSE data plane (inline DLP across web/cloud/private app traffic) versus requiring a separate DLP product bolted on?weight 3
Answer key — what a strong answer shows
Native inline DLP across all traffic types is stronger than DLP that only covers one channel (e.g., only CASB-managed SaaS apps).
baselineRFPDetail the migration path and coexistence model for customers moving off legacy MPLS/VPN and existing firewall infrastructure — can it run in a hybrid mode during a phased rollout, and what is a typical migration timeline with a customer reference?weight 3
Answer key — what a strong answer shows
Look for a real phased-migration case study with a stated timeline, not just 'easy migration' marketing language.
baselineRFIDoes the platform provide unified policy management across all SSE pillars from a single console, or do SWG/CASB/ZTNA policies need to be configured separately in different interfaces?weight 3
Answer key — what a strong answer shows
A single unified policy engine is materially easier to operate and audit than fragmented per-pillar policy consoles.
baselineRFPExplain SLA commitments for uptime and latency, including how outages/incidents are communicated and what remediation/credits apply — provide the actual SLA terms, not a general reliability statement.weight 3
Answer key — what a strong answer shows
Look for concrete numeric SLA terms and a named incident-communication process, not vague reliability assurances.
baselineRFIHow is the platform priced — per user, per Gbps, per app — and what happens to cost as the organization scales (does DLP, additional PoPs, or higher throughput trigger separate add-on fees)?weight 3
Answer key — what a strong answer shows
Strong answers give a transparent, itemized pricing structure and disclose common scale-triggered add-on costs upfront.
baselineRFIDoes the platform provide remote browser isolation (RBI) for high-risk web categories or uncategorized sites, rendering content in an isolated environment rather than directly in the user's browser, and what is the measured latency/UX impact?weight 3
Answer key — what a strong answer shows
Native RBI (versus no isolation capability at all) is a materially stronger defense against browser-based exploits; ask for a real latency figure since isolation can meaningfully degrade page-load experience if poorly implemented.
baselineRFIHow does the platform handle IoT and headless/unmanaged devices that can't run a client agent — is there an agentless enforcement path (e.g., network-level policy at the branch/edge) for these devices?weight 3
Answer key — what a strong answer shows
An agent-only architecture leaves IoT/OT and unmanaged devices completely uncovered — look for a specific agentless enforcement mechanism for this device class.
baselineRFPDescribe real-user network experience monitoring — can IT proactively see per-user, per-application latency/performance degradation caused by the SASE platform itself, distinct from the underlying internet path, and is there self-service diagnostic tooling for end users?weight 3
Answer key — what a strong answer shows
Strong answers show a genuine per-user visibility/diagnostic capability; without it, IT has no way to distinguish 'the SASE platform is slow' from 'the user's home internet is slow' when troubleshooting complaints.
baselineRFIHow is third-party/contractor access scoped differently from full employee access — can policy grant time-bounded, application-specific access to an external party without provisioning a full corporate identity?weight 3
Answer key — what a strong answer shows
Look for genuine least-privilege, time-bounded external-party access; treating contractors identically to full employees is a common over-provisioning risk.
baselineRFPDetail incident forensics capability — is full packet capture or detailed session-level logging available for a security investigation after the fact, what is the retention period, and does retaining more history cost extra?weight 3
Answer key — what a strong answer shows
Strong answers state a specific retention period and whether extended retention is a separate paid add-on — this materially affects investigation capability months after an incident.
baselineRFIWhat compliance certifications does the platform itself hold (SOC 2 Type II, ISO 27001, FedRAMP) given that it now sits inline on all customer traffic, and can the customer request the actual audit report, not just a compliance-badge claim?weight 3
Answer key — what a strong answer shows
A vendor sitting inline on all traffic is itself a significant attack surface — insist on the actual audit report rather than accepting a logo/badge as sufficient evidence.
baselineRFIHow does the platform integrate with the customer's existing SIEM/SOAR for exporting security events (not just connectivity logs), and is this a real-time streaming export or a periodic batch/manual pull?weight 3
Answer key — what a strong answer shows
Real-time streaming export is materially more useful for active detection than periodic batch exports that introduce detection lag.
baselineRFPExplain onboarding support for M&A scenarios — how quickly can a newly acquired company's users and sites be brought under the platform's policy, and what is a customer-referenced timeline for a comparable-sized acquisition?weight 3
Answer key — what a strong answer shows
Look for a concrete, customer-validated timeline; rapid, low-friction onboarding of acquired entities is a real differentiator for organizations that grow by acquisition.
baselineRFPTask Area 3: Contractor shall support administration, configuration, sustainment, enhancement and optimization of SIEM-related capabilities, including onboarding/integrating new data sources, normalizing/validating telemetry, tuning alerts/rules, and supporting correlation logic; conduct detection refinement (tuning SIEM rules, EDR alerts, WAF/CDN policies) and continuously validate telemetry from sources including Zscaler SASE and Microsoft Defender, identifying/correcting configuration drift.weight 3
baselineRFPZero Trust Phase 1 planning: Contractor shall develop technical requirements/implementation plans for Defender for Servers & Cloud Apps (CASB) integration, migration from traditional VPNs to a SASE model, and Security Orchestration, Automation and Response (SOAR) with Conditional Access — engineering automated response playbooks and identity-centric access policies.weight 3
These questions and weights are the reviewed standard for this category — start scoring straight away. To change them, or to import your own questions from a spreadsheet and reuse them on every evaluation, create a free buyer account.
