How to use this checklist
Send these questions in writing and ask for written answers with links to documents. Score each answer against the same scale for every vendor. Where a vendor's public pages already answer a question, the answer should match; where they do not, the RFP is where you get it on record.
Converged architecture
- How many products appear on the order form for SD-WAN and security together?
- Is traffic decrypted and inspected once, or by several engines in turn? Show the path for one session.
- Is there one policy model for networking and security, for sites and remote users?
- Is there one data lake for logs, and can one query cover networking and security events?
- How many software release cycles does the customer see in a year, across all components?
Network
- List the locations nearest our sites and users, and the services that run at each.
- Who owns and operates the hardware at each location?
- How does traffic move between locations: private backbone, public internet or a cloud provider's network?
- Provide the SLA document, its measurement method and the credit terms. Several vendors state uptime figures on their pages without the terms.
Source: Cato global private backbone
Source: Palo Alto Networks Prisma Access
- Which locations serve users in regions with special rules, such as Mainland China?
Components
- Which of SD-WAN, SWG, CASB, ZTNA, FWaaS, DLP, RBI and DEM are included in the quoted bundle, and which cost extra?
- Are all components managed from the same console and policy?
- Which components are delivered by a partner or an acquired product with its own console?
Management and operations
- Show the rule base for a branch and for a remote user side by side.
- How do managed service partners access the environment, and who can change which rules?
- Is there an assistant in the console, what data does it use, and can it be turned off?
Vulnerability response
- What is the target time from public disclosure to protection for critical CVEs?
- Is protection on by default, or opt-in?
- Is there a published record of past responses? Cato publishes one on its Rapid CVE Mitigation page; ask other vendors for the equivalent.
Source: Cato Rapid CVE Mitigation
- How are customers told about vulnerabilities in the vendor's own service?
Compliance
- Provide the current SOC 2 Type II report, ISO 27001 certificate and scope statement.
- Which products, regions and tiers does each certification or authorization cover?
- If FedRAMP is required: which offering, which impact level, and where is it listed?
- Where are logs stored, and can we choose the region?
AI security
- Which AI tools and agents can the platform discover, and how is the list kept current?
- Can prompts and uploads be inspected, redacted and blocked inline?
- Does the platform see and control MCP traffic and agent tool calls?
- Can it protect our own AI applications at runtime against prompt injection?
- Are AI controls part of the same policy and logs as web and SaaS controls?
Deployment
- Can we adopt in stages, for example SSE first and SD-WAN later?
- Which access methods are offered: agent, browser extension, enterprise browser, clientless portal?
- Is there a self-hosted or sovereign option, and what does it exclude?
Before you sign
- What is the licensing basis: per user, per site, per bandwidth or a mix?
- How is temporary overage handled?
- What are the exit terms, and how do we export configuration and logs?
None of the six vendors publishes a SASE price list on the pages we read, so the commercial answers will come only from this process.
How do you score the answers?
Use a 0 to 10 scale per criterion and keep a one-line reason for each score, as we do. Weight the criteria for your own situation; the weighting lab shows how changes in weight move a ranking.
The short version
Our public scores stop where vendors' pages stop. An RFP that asks for scope, terms and records turns brochure claims into commitments you can compare.