Worked example · Created 6 September 2026

A SASE RFP, from first brief to supplier questions.

Follow a manufacturer with 15 sites and 600 users. See what Netify’s checker flags, which decisions a buyer still needs to make, and how Short and Detailed RFPs request evidence.

Build your SASE RFP Check your existing RFP

Fictional manufacturing example. No customer project, supplier response or procurement outcome is represented. Nothing in this demonstration is published to the Opportunity Board. Read and download both examples freely. They are assembled from Netify’s question bank and the explicit example decisions below; the checker does not invent those decisions.

1. The original buyer brief

We are a manufacturing company with 15 sites: 10 in the UK and five in Germany. We have 600 users, including 30 remote users. We want a managed SASE solution to replace our existing VPN and protect access to cloud applications. Please provide a proposal and pricing.

This is useful starting context. It leaves important security, operational and procurement decisions unstated.

2. What the actual checker finds

The production checker assessed the exact brief above. Confirm the following information before developing it into supplier instructions.

This is a deterministic text-coverage check. Some checks overlap. Mentioning a topic can satisfy a check without specifying an adequate design or measurable target. The score is not certification that an RFP is ready to issue.

Solution scope: add required security components, business outcomes or use cases
Resilience and availability: add availability or SLA targets, failover or access diversity, performance requirements
Manufacturing: add IT/OT segmentation and industrial security
Manufacturing: add plant, production or warehouse continuity
Security, identity and data: add identity and access controls, threat and data controls, logging, compliance or data residency
Operating model and support: add managed, co-managed or self-managed model, support and service management, roles, reporting or governance
Migration and implementation: add deployment or migration approach, timeline, phases or milestones, pilot, cutover, rollback or training
Commercial and contractual: add licensing or contract term, exit, liability or contractual protections
Ask suppliers for dated evidence, certificates, reports or comparable customer references
Define mandatory requirements, scoring or evaluation weightings
Specify a common response and pricing format so bids can be compared

All section checks and comparison warnings

Organisation and scale

Not detected: No missing topic checks.

Solution scope

Not detected: required security components; business outcomes or use cases.

Current estate

Not detected: identity, security or operational tooling.

Resilience and availability

Not detected: availability or SLA targets; failover or access diversity; performance requirements.

Security, identity and data

Not detected: identity and access controls; threat and data controls; logging, compliance or data residency.

Operating model and support

Not detected: managed, co-managed or self-managed model; support and service management; roles, reporting or governance.

Migration and implementation

Not detected: deployment or migration approach; timeline, phases or milestones; pilot, cutover, rollback or training.

Commercial and contractual

Not detected: licensing or contract term; exit, liability or contractual protections.

Mandatory and desirable requirements are not clearly separated
Suppliers are not given one common response structure
Pricing is not requested in a common one-off, recurring and total-cost structure
Evidence requests do not state how current the evidence must be

3. Decisions supplied by the example buyer

These additions are illustrative choices, not facts extracted from the original brief. A real buyer must confirm their own requirements.

Example buyer decision: use the existing Entra ID directory for identity, MFA and device posture. Require ZTNA, SWG, CASB, FWaaS and DLP, with logging exported to the existing SIEM. Suppliers must identify unsupported devices and application dependencies.
Example buyer decision: protect production continuity with an IT/OT segmentation boundary. Contractor access must be individually approved, time-bound and audited. SASE must not be assumed to replace plant safety controls.
Example buyer decision: request regional PoP coverage, availability SLA and latency evidence, plus a failover test. Exact bandwidths and maximum tolerable outage remain to be confirmed by each plant; suppliers must state assumptions separately.
Example buyer decision: require a managed service, 24/7 incident support, escalation contacts and a RACI defining policy ownership. Request data residency, retention and sub-processor details for UK and German operations; retention periods remain a buyer decision.
Example buyer decision: plan phased migration within six months, with a pilot, approved cutover windows, rollback and training. The dates and acceptance thresholds require buyer confirmation before contract award.
Example buyer decision: compare a 36-month contract term in GBP using one pricing table for one-off and recurring charges, licences, total cost, exclusions and exit/data-return terms. This is an illustrative evaluation basis, not a supplier quote.
Example evaluation rule: mandatory identity integration, the IT/OT boundary and a rollback plan are pass/fail. Score compliant bids on security fit (30%), resilience (25%), operations (20%), implementation (10%) and total cost (15%). Require dated evidence within the last 12 months, current certificates and expiry dates. Buyers must adapt these example weights and evidence periods.
Response format: answer each question by ID with compliance, delivery method, limitations, evidence reference and price impact. Separate confirmed capability from roadmap commitments. These supplier answers have not been provided in this demonstration.

4. Inspect the resulting RFPs

The Short example selects one bank question per area. The Detailed example includes all 43 extended SASE questions. Both retain the same buyer context, decisions and bespoke question. These are example selections; you control the questions and depth in your own project.

Short SASE RFP

Includes the original brief and all example buyer decisions above. The expected topics are covered by these example questions and decisions. Technical adequacy and the open decisions below still require buyer review.

Download the complete Short example (text)

Identity and private application access

Describe how your platform enforces zero trust access to private applications.
Evidence: Architecture diagram; Policy example; Identity provider integration list.
Why it matters: Private application access is a core SASE use case and should be controlled by identity, device and application context rather than broad network access.
Question bank reference: SASE-ZTNA-001

Web, SaaS and threat protection

Describe your secure web gateway, including TLS inspection and URL category coverage.
Evidence: SWG architecture; TLS inspection approach; Category list.
Why it matters: The SWG is the primary control plane for web traffic and must inspect TLS to be effective.
Question bank reference: SASE-SWG-001

Branch integration and resilience

Describe how SD-WAN integrates with your SSE stack.
Evidence: Reference architecture; Integration mode list.
Why it matters: Tight SD-WAN and SSE integration determines branch user experience and policy consistency.
Question bank reference: SASE-SDWAN-001

Logging and data residency

Which log types are captured and what retention options are available?
Evidence: Log schema; Retention options.
Why it matters: Log coverage and retention drive audit, investigation and regulatory reporting.
Question bank reference: SASE-LOG-001

Managed service and responsibilities

Describe your service model, including managed, co-managed and self-managed options.
Evidence: Service description.
Why it matters: The service model defines the split of responsibilities and informs operational cost.
Question bank reference: SASE-SVC-001

Migration and acceptance

Describe a typical deployment plan for an estate of our size.
Evidence: Reference deployment plan.
Why it matters: A credible deployment plan reduces project risk and surprises.
Question bank reference: SASE-DEP-001

Pricing and contractual terms

Describe your pricing model and what is included.
Evidence: Pricing schedule.
Why it matters: Clarity on the pricing model drives like-for-like supplier comparison.
Question bank reference: SASE-COM-001

Supplier evidence

Provide your current certifications and expiry dates.
Evidence: Certification list; Expiry dates.
Why it matters: Current certifications support regulated buyer due diligence.
Question bank reference: SASE-VE-001

Bespoke buyer question

How will you revoke a maintenance contractor’s access to a legacy production application during an identity outage without disrupting production or bypassing the IT/OT boundary?

Evidence: Proposed test procedure, access-revocation behaviour, audit trail and rollback plan.

This buyer-specific question tests the interaction between access control and production continuity. A product checklist alone cannot settle it.

Buyer reference: BUYER-OT-001

Still to confirm: site bandwidths, application inventory, outage tolerances, retention periods, acceptance thresholds and approved migration dates. No supplier capabilities or prices have been verified.

Detailed SASE RFP

Download the complete Detailed example (text)