{"name":"Netify SASE and SD-WAN Evaluation Methodology","version":"2026.1","published_by":"Netify Group Limited","description":"The canonical framework Netify uses to grade vendors, build shortlists and generate RFPs. 40 capability features across 6 categories, each with a ready-to-issue RFP question and the evidence a buyer should request. Sector and compliance maps link business context to required features.","categories":["Service delivery and operating model","Network architecture and transport","Gateway, PoP and backbone design","Security and SASE capability","Operations, assurance and automation"],"features":[{"feature_id":"f01_fully_managed_service","number":1,"category":"Service delivery and operating model","feature_name":"Fully managed service","definition":"Provider designs, deploys, monitors, changes, supports and reports on the service.","rfp_question":"Confirm whether your solution/service provides: Fully managed service. Include delivery model, limitations, geography and dependencies.","evidence_requested":"Product documentation, architecture diagram, service description, RACI, portal screenshot, sample report, SLA or contract extract."},{"feature_id":"f02_diy_self_managed_model","number":2,"category":"Service delivery and operating model","feature_name":"DIY / self-managed model","definition":"Customer operates SD-WAN controller, policies, updates and incident response.","rfp_question":"Confirm whether your solution/service provides: DIY / self-managed model. Include delivery model, limitations, geography and dependencies.","evidence_requested":"Product documentation, architecture diagram, service description, RACI, portal screenshot, sample report, SLA or contract extract."},{"feature_id":"f03_co_managed_service","number":3,"category":"Service delivery and operating model","feature_name":"Co-managed service","definition":"Provider runs platform/support while customer retains selected policy or change rights.","rfp_question":"Confirm whether your solution/service provides: Co-managed service. Include delivery model, limitations, geography and dependencies.","evidence_requested":"Product documentation, architecture diagram, service description, RACI, portal screenshot, sample report, SLA or contract extract."},{"feature_id":"f04_multi_tenant_msp_white_label_support","number":4,"category":"Service delivery and operating model","feature_name":"Multi-tenant MSP / white-label support","definition":"Tenant isolation, delegated administration, branded portals, templates and service-provider scale.","rfp_question":"Confirm whether your solution/service provides: Multi-tenant MSP / white-label support. Include delivery model, limitations, geography and dependencies.","evidence_requested":"Product documentation, architecture diagram, service description, RACI, portal screenshot, sample report, SLA or contract extract."},{"feature_id":"f05_professional_services_and_migration_support","number":5,"category":"Service delivery and operating model","feature_name":"Professional services and migration support","definition":"Discovery, design, pilot, staging, migration runbooks, rollback and training.","rfp_question":"Confirm whether your solution/service provides: Professional services and migration support. Include delivery model, limitations, geography and dependencies.","evidence_requested":"Product documentation, architecture diagram, service description, RACI, portal screenshot, sample report, SLA or contract extract."},{"feature_id":"f06_last_mile_circuit_management","number":6,"category":"Service delivery and operating model","feature_name":"Last-mile circuit management","definition":"Sourcing, monitoring and support for broadband, DIA, LTE/5G, MPLS and cross-connects.","rfp_question":"Confirm whether your solution/service provides: Last-mile circuit management. Include delivery model, limitations, geography and dependencies.","evidence_requested":"Product documentation, architecture diagram, service description, RACI, portal screenshot, sample report, SLA or contract extract."},{"feature_id":"f07_lifecycle_management","number":7,"category":"Service delivery and operating model","feature_name":"Lifecycle management","definition":"Hardware replacement, firmware upgrades, patching, renewals and EoL planning.","rfp_question":"Confirm whether your solution/service provides: Lifecycle management. Include delivery model, limitations, geography and dependencies.","evidence_requested":"Product documentation, architecture diagram, service description, RACI, portal screenshot, sample report, SLA or contract extract."},{"feature_id":"f08_flexible_commercial_model","number":8,"category":"Service delivery and operating model","feature_name":"Flexible commercial model","definition":"Per-site, per-bandwidth, per-user, per-device, consumption, NaaS or bundled pricing.","rfp_question":"Confirm whether your solution/service provides: Flexible commercial model. Include delivery model, limitations, geography and dependencies.","evidence_requested":"Product documentation, architecture diagram, service description, RACI, portal screenshot, sample report, SLA or contract extract."},{"feature_id":"f09_encrypted_overlay_fabric","number":9,"category":"Network architecture and transport","feature_name":"Encrypted overlay fabric","definition":"Secure tunnels across broadband, DIA, MPLS, LTE/5G, satellite or private WAN.","rfp_question":"Confirm whether your solution/service provides: Encrypted overlay fabric. Include delivery model, limitations, geography and dependencies.","evidence_requested":"Product documentation, architecture diagram, service description, RACI, portal screenshot, sample report, SLA or contract extract."},{"feature_id":"f10_dynamic_path_selection","number":10,"category":"Network architecture and transport","feature_name":"Dynamic path selection","definition":"Real-time routing based on latency, jitter, packet loss, brownouts, MOS and policy.","rfp_question":"Confirm whether your solution/service provides: Dynamic path selection. Include delivery model, limitations, geography and dependencies.","evidence_requested":"Product documentation, architecture diagram, service description, RACI, portal screenshot, sample report, SLA or contract extract."},{"feature_id":"f11_active_active_link_utilisation","number":11,"category":"Network architecture and transport","feature_name":"Active-active link utilisation","definition":"Use multiple links concurrently rather than passive backup only.","rfp_question":"Confirm whether your solution/service provides: Active-active link utilisation. Include delivery model, limitations, geography and dependencies.","evidence_requested":"Product documentation, architecture diagram, service description, RACI, portal screenshot, sample report, SLA or contract extract."},{"feature_id":"f12_application_aware_routing","number":12,"category":"Network architecture and transport","feature_name":"Application-aware routing","definition":"Identification and routing for SaaS, UCaaS, ERP and custom applications.","rfp_question":"Confirm whether your solution/service provides: Application-aware routing. Include delivery model, limitations, geography and dependencies.","evidence_requested":"Product documentation, architecture diagram, service description, RACI, portal screenshot, sample report, SLA or contract extract."},{"feature_id":"f13_qos_and_traffic_shaping","number":13,"category":"Network architecture and transport","feature_name":"QoS and traffic shaping","definition":"Per-application and per-class prioritisation, reservation and policing.","rfp_question":"Confirm whether your solution/service provides: QoS and traffic shaping. Include delivery model, limitations, geography and dependencies.","evidence_requested":"Product documentation, architecture diagram, service description, RACI, portal screenshot, sample report, SLA or contract extract."},{"feature_id":"f14_packet_loss_remediation","number":14,"category":"Network architecture and transport","feature_name":"Packet loss remediation","definition":"FEC, packet duplication, jitter buffering, TCP optimisation and WAN optimisation.","rfp_question":"Confirm whether your solution/service provides: Packet loss remediation. Include delivery model, limitations, geography and dependencies.","evidence_requested":"Product documentation, architecture diagram, service description, RACI, portal screenshot, sample report, SLA or contract extract."},{"feature_id":"f15_local_internet_breakout","number":15,"category":"Network architecture and transport","feature_name":"Local internet breakout","definition":"Secure direct internet access from branch sites.","rfp_question":"Confirm whether your solution/service provides: Local internet breakout. Include delivery model, limitations, geography and dependencies.","evidence_requested":"Product documentation, architecture diagram, service description, RACI, portal screenshot, sample report, SLA or contract extract."},{"feature_id":"f16_mpls_coexistence_and_migration","number":16,"category":"Network architecture and transport","feature_name":"MPLS coexistence and migration","definition":"Hybrid MPLS/internet/cellular during transition.","rfp_question":"Confirm whether your solution/service provides: MPLS coexistence and migration. Include delivery model, limitations, geography and dependencies.","evidence_requested":"Product documentation, architecture diagram, service description, RACI, portal screenshot, sample report, SLA or contract extract."},{"feature_id":"f17_cellular_and_5g_support","number":17,"category":"Network architecture and transport","feature_name":"Cellular and 5G support","definition":"Integrated/external modem, SIM management, signal monitoring and failover.","rfp_question":"Confirm whether your solution/service provides: Cellular and 5G support. Include delivery model, limitations, geography and dependencies.","evidence_requested":"Product documentation, architecture diagram, service description, RACI, portal screenshot, sample report, SLA or contract extract."},{"feature_id":"f18_cloud_on_ramp","number":18,"category":"Network architecture and transport","feature_name":"Cloud on-ramp","definition":"Automated/simplified connectivity to AWS, Azure, Google Cloud, Oracle, Equinix, Megaport and SaaS.","rfp_question":"Confirm whether your solution/service provides: Cloud on-ramp. Include delivery model, limitations, geography and dependencies.","evidence_requested":"Product documentation, architecture diagram, service description, RACI, portal screenshot, sample report, SLA or contract extract."},{"feature_id":"f19_public_cloud_gateways","number":19,"category":"Gateway, PoP and backbone design","feature_name":"Public cloud gateways","definition":"Vendor-operated gateways/PoPs for SaaS optimisation, remote access or security enforcement.","rfp_question":"Confirm whether your solution/service provides: Public cloud gateways. Include delivery model, limitations, geography and dependencies.","evidence_requested":"Product documentation, architecture diagram, service description, RACI, portal screenshot, sample report, SLA or contract extract."},{"feature_id":"f20_private_pops_dedicated_pops","number":20,"category":"Gateway, PoP and backbone design","feature_name":"Private PoPs / dedicated PoPs","definition":"Customer-hosted, dedicated or sovereign PoP options.","rfp_question":"Confirm whether your solution/service provides: Private PoPs / dedicated PoPs. Include delivery model, limitations, geography and dependencies.","evidence_requested":"Product documentation, architecture diagram, service description, RACI, portal screenshot, sample report, SLA or contract extract."},{"feature_id":"f21_private_global_backbone","number":21,"category":"Gateway, PoP and backbone design","feature_name":"Private global backbone","definition":"Vendor-owned or controlled backbone between PoPs.","rfp_question":"Confirm whether your solution/service provides: Private global backbone. Include delivery model, limitations, geography and dependencies.","evidence_requested":"Product documentation, architecture diagram, service description, RACI, portal screenshot, sample report, SLA or contract extract."},{"feature_id":"f22_regional_breakout_and_data_residency","number":22,"category":"Gateway, PoP and backbone design","feature_name":"Regional breakout and data residency","definition":"Pin traffic to countries, regions or approved inspection locations.","rfp_question":"Confirm whether your solution/service provides: Regional breakout and data residency. Include delivery model, limitations, geography and dependencies.","evidence_requested":"Product documentation, architecture diagram, service description, RACI, portal screenshot, sample report, SLA or contract extract."},{"feature_id":"f23_multi_cloud_transit_fabric","number":23,"category":"Gateway, PoP and backbone design","feature_name":"Multi-cloud transit fabric","definition":"Branch-to-cloud, cloud-to-cloud and user-to-cloud connectivity under common policy.","rfp_question":"Confirm whether your solution/service provides: Multi-cloud transit fabric. Include delivery model, limitations, geography and dependencies.","evidence_requested":"Product documentation, architecture diagram, service description, RACI, portal screenshot, sample report, SLA or contract extract."},{"feature_id":"f24_flexible_edge_form_factors","number":24,"category":"Gateway, PoP and backbone design","feature_name":"Flexible edge form factors","definition":"Physical, virtual, cloud marketplace, container or uCPE.","rfp_question":"Confirm whether your solution/service provides: Flexible edge form factors. Include delivery model, limitations, geography and dependencies.","evidence_requested":"Product documentation, architecture diagram, service description, RACI, portal screenshot, sample report, SLA or contract extract."},{"feature_id":"f25_high_availability_design","number":25,"category":"Gateway, PoP and backbone design","feature_name":"High availability design","definition":"Dual appliances, dual circuits, dual power, HA clustering and gateway redundancy.","rfp_question":"Confirm whether your solution/service provides: High availability design. Include delivery model, limitations, geography and dependencies.","evidence_requested":"Product documentation, architecture diagram, service description, RACI, portal screenshot, sample report, SLA or contract extract."},{"feature_id":"f26_sla_backed_service_fabric","number":26,"category":"Gateway, PoP and backbone design","feature_name":"SLA-backed service fabric","definition":"SLA for uptime, response, change handling and possibly latency/jitter/loss.","rfp_question":"Confirm whether your solution/service provides: SLA-backed service fabric. Include delivery model, limitations, geography and dependencies.","evidence_requested":"Product documentation, architecture diagram, service description, RACI, portal screenshot, sample report, SLA or contract extract."},{"feature_id":"f27_integrated_next_generation_firewall","number":27,"category":"Security and SASE capability","feature_name":"Integrated next-generation firewall","definition":"Stateful firewall, app control, IPS/IDS, malware inspection and URL filtering.","rfp_question":"Confirm whether your solution/service provides: Integrated next-generation firewall. Include delivery model, limitations, geography and dependencies.","evidence_requested":"Product documentation, architecture diagram, service description, RACI, portal screenshot, sample report, SLA or contract extract."},{"feature_id":"f28_full_sase_platform","number":28,"category":"Security and SASE capability","feature_name":"Full SASE platform","definition":"SD-WAN plus SWG, CASB, ZTNA, FWaaS, DLP, RBI, DNS security and threat prevention.","rfp_question":"Confirm whether your solution/service provides: Full SASE platform. Include delivery model, limitations, geography and dependencies.","evidence_requested":"Product documentation, architecture diagram, service description, RACI, portal screenshot, sample report, SLA or contract extract."},{"feature_id":"f29_sse_ecosystem_integration","number":29,"category":"Security and SASE capability","feature_name":"SSE ecosystem integration","definition":"Interoperation with Zscaler, Netskope, Palo Alto Prisma Access, Cisco Secure Access, Cloudflare etc.","rfp_question":"Confirm whether your solution/service provides: SSE ecosystem integration. Include delivery model, limitations, geography and dependencies.","evidence_requested":"Product documentation, architecture diagram, service description, RACI, portal screenshot, sample report, SLA or contract extract."},{"feature_id":"f30_zero_trust_network_access","number":30,"category":"Security and SASE capability","feature_name":"Zero Trust Network Access","definition":"Identity and posture-based access to private applications.","rfp_question":"Confirm whether your solution/service provides: Zero Trust Network Access. Include delivery model, limitations, geography and dependencies.","evidence_requested":"Product documentation, architecture diagram, service description, RACI, portal screenshot, sample report, SLA or contract extract."},{"feature_id":"f31_secure_web_gateway","number":31,"category":"Security and SASE capability","feature_name":"Secure web gateway","definition":"URL filtering, SSL inspection, malware scanning and acceptable-use controls.","rfp_question":"Confirm whether your solution/service provides: Secure web gateway. Include delivery model, limitations, geography and dependencies.","evidence_requested":"Product documentation, architecture diagram, service description, RACI, portal screenshot, sample report, SLA or contract extract."},{"feature_id":"f32_casb_capability","number":32,"category":"Security and SASE capability","feature_name":"CASB capability","definition":"SaaS discovery, sanctioned/unsanctioned app control and SaaS policy enforcement.","rfp_question":"Confirm whether your solution/service provides: CASB capability. Include delivery model, limitations, geography and dependencies.","evidence_requested":"Product documentation, architecture diagram, service description, RACI, portal screenshot, sample report, SLA or contract extract."},{"feature_id":"f33_data_loss_prevention","number":33,"category":"Security and SASE capability","feature_name":"Data loss prevention","definition":"Data classification, inspection, blocking, alerting and exception workflow.","rfp_question":"Confirm whether your solution/service provides: Data loss prevention. Include delivery model, limitations, geography and dependencies.","evidence_requested":"Product documentation, architecture diagram, service description, RACI, portal screenshot, sample report, SLA or contract extract."},{"feature_id":"f34_remote_user_access","number":34,"category":"Security and SASE capability","feature_name":"Remote user access","definition":"Client or clientless access for remote workers, contractors and mobile users.","rfp_question":"Confirm whether your solution/service provides: Remote user access. Include delivery model, limitations, geography and dependencies.","evidence_requested":"Product documentation, architecture diagram, service description, RACI, portal screenshot, sample report, SLA or contract extract."},{"feature_id":"f35_soc_siem_soar_integration","number":35,"category":"Security and SASE capability","feature_name":"SOC/SIEM/SOAR integration","definition":"Syslog, APIs, event export, threat intelligence and workflow integration.","rfp_question":"Confirm whether your solution/service provides: SOC/SIEM/SOAR integration. Include delivery model, limitations, geography and dependencies.","evidence_requested":"Product documentation, architecture diagram, service description, RACI, portal screenshot, sample report, SLA or contract extract."},{"feature_id":"f36_centralised_orchestration","number":36,"category":"Operations, assurance and automation","feature_name":"Centralised orchestration","definition":"Templates, intent-based policy, zero-touch provisioning and configuration compliance.","rfp_question":"Confirm whether your solution/service provides: Centralised orchestration. Include delivery model, limitations, geography and dependencies.","evidence_requested":"Product documentation, architecture diagram, service description, RACI, portal screenshot, sample report, SLA or contract extract."},{"feature_id":"f37_customer_portal_and_rbac","number":37,"category":"Operations, assurance and automation","feature_name":"Customer portal and RBAC","definition":"Real-time status, role-based access, reporting, tickets and change requests.","rfp_question":"Confirm whether your solution/service provides: Customer portal and RBAC. Include delivery model, limitations, geography and dependencies.","evidence_requested":"Product documentation, architecture diagram, service description, RACI, portal screenshot, sample report, SLA or contract extract."},{"feature_id":"f38_observability_and_digital_experience_monitoring","number":38,"category":"Operations, assurance and automation","feature_name":"Observability and digital experience monitoring","definition":"App experience, user experience, device health, SaaS telemetry and path analytics.","rfp_question":"Confirm whether your solution/service provides: Observability and digital experience monitoring. Include delivery model, limitations, geography and dependencies.","evidence_requested":"Product documentation, architecture diagram, service description, RACI, portal screenshot, sample report, SLA or contract extract."},{"feature_id":"f39_apis_and_automation","number":39,"category":"Operations, assurance and automation","feature_name":"APIs and automation","definition":"REST APIs, Terraform, webhooks, event streaming and ITSM integration.","rfp_question":"Confirm whether your solution/service provides: APIs and automation. Include delivery model, limitations, geography and dependencies.","evidence_requested":"Product documentation, architecture diagram, service description, RACI, portal screenshot, sample report, SLA or contract extract."},{"feature_id":"f40_managed_service_assurance","number":40,"category":"Operations, assurance and automation","feature_name":"Managed service assurance","definition":"24/7 NOC/SOC, proactive monitoring, incident ownership, RCA, service reviews and change governance.","rfp_question":"Confirm whether your solution/service provides: Managed service assurance. Include delivery model, limitations, geography and dependencies.","evidence_requested":"Product documentation, architecture diagram, service description, RACI, portal screenshot, sample report, SLA or contract extract."}],"sectors":[{"key":"healthcare","label":"Healthcare","required":["f30_zero_trust_network_access","f33_data_loss_prevention","f25_high_availability_design"],"recommended":["f31_secure_web_gateway","f35_soc_siem_soar_integration","f01_fully_managed_service","f22_regional_breakout_and_data_residency"]},{"key":"financial_services","label":"Financial services","required":["f30_zero_trust_network_access","f33_data_loss_prevention","f32_casb_capability","f35_soc_siem_soar_integration"],"recommended":["f31_secure_web_gateway","f26_sla_backed_service_fabric","f22_regional_breakout_and_data_residency"]},{"key":"retail_ecommerce","label":"Retail and e-commerce","required":["f17_cellular_and_5g_support","f24_flexible_edge_form_factors","f27_integrated_next_generation_firewall"],"recommended":["f01_fully_managed_service","f15_local_internet_breakout","f36_centralised_orchestration"]},{"key":"manufacturing","label":"Manufacturing","required":["f30_zero_trust_network_access","f12_application_aware_routing","f25_high_availability_design","f27_integrated_next_generation_firewall"],"recommended":["f17_cellular_and_5g_support","f35_soc_siem_soar_integration","f24_flexible_edge_form_factors","f36_centralised_orchestration"]},{"key":"energy_utilities","label":"Energy and utilities","required":["f30_zero_trust_network_access","f25_high_availability_design","f35_soc_siem_soar_integration"],"recommended":["f17_cellular_and_5g_support","f27_integrated_next_generation_firewall","f22_regional_breakout_and_data_residency"]},{"key":"government_public_sector","label":"Government and public sector","required":["f22_regional_breakout_and_data_residency","f30_zero_trust_network_access","f33_data_loss_prevention","f35_soc_siem_soar_integration"],"recommended":["f01_fully_managed_service","f26_sla_backed_service_fabric"]},{"key":"education","label":"Education","required":["f31_secure_web_gateway","f34_remote_user_access"],"recommended":["f15_local_internet_breakout","f37_customer_portal_and_rbac","f08_flexible_commercial_model"]},{"key":"transport_logistics","label":"Transport and logistics","required":["f17_cellular_and_5g_support","f24_flexible_edge_form_factors"],"recommended":["f25_high_availability_design","f36_centralised_orchestration","f10_dynamic_path_selection"]},{"key":"professional_services","label":"Professional services","required":["f34_remote_user_access","f30_zero_trust_network_access"],"recommended":["f31_secure_web_gateway","f33_data_loss_prevention","f18_cloud_on_ramp"]},{"key":"hospitality_leisure","label":"Hospitality and leisure","required":["f15_local_internet_breakout","f27_integrated_next_generation_firewall"],"recommended":["f17_cellular_and_5g_support","f01_fully_managed_service","f24_flexible_edge_form_factors"]}],"compliance":[{"key":"uk_gdpr","label":"UK GDPR / DPA 2018 / Data (Use and Access) Act 2025","jurisdiction":"United Kingdom","applies_to":"Any organisation processing UK personal data.","in_force":"DUAA received Royal Assent 19 June 2025.","required_features":["f33_data_loss_prevention","f22_regional_breakout_and_data_residency"],"clauses":["The vendor shall act as processor under a UK GDPR Article 28 compliant data processing agreement, including sub-processor disclosure and approval.","The vendor shall confirm the geographic locations in which personal data is processed and stored, and support UK or EU data residency on request.","The vendor shall notify the buyer of any personal data breach without undue delay and within 72 hours of becoming aware."],"note":"Personal data handling requires DLP, residency control and breach notification terms."},{"key":"pci_dss","label":"PCI DSS v4.0","jurisdiction":"Global (card schemes)","applies_to":"Any organisation storing, processing or transmitting cardholder data.","in_force":"v4.0 mandatory since 31 March 2025.","required_features":["f27_integrated_next_generation_firewall","f30_zero_trust_network_access"],"clauses":["The vendor shall support network segmentation that isolates the cardholder data environment from other networks.","The vendor shall provide an Attestation of Compliance (AOC) or evidence of PCI DSS v4.0 controls relevant to the services supplied."],"note":"Cardholder data environments require segmentation and access control with attestation."},{"key":"iec_62443","label":"IEC 62443 (OT / industrial control systems)","jurisdiction":"International standard","applies_to":"Operators of industrial control and OT environments.","in_force":"Current series.","required_features":["f30_zero_trust_network_access","f27_integrated_next_generation_firewall"],"clauses":["The vendor shall support the definition and enforcement of zones and conduits between IT and OT environments.","The vendor shall evidence how the solution prevents lateral movement from enterprise IT into OT networks."],"note":"OT security requires enforced zones and conduits between IT and OT."},{"key":"iso_27001","label":"ISO/IEC 27001","jurisdiction":"International standard","applies_to":"Organisations operating an information security management system.","in_force":"ISO/IEC 27001:2022.","required_features":["f35_soc_siem_soar_integration","f40_managed_service_assurance"],"clauses":["The vendor shall hold a current ISO/IEC 27001:2022 certificate covering the services supplied, and provide the certificate and statement of applicability scope on request."],"note":"Treat ISO 27001 certification as a baseline, not a differentiator."},{"key":"cyber_resilience_bill","label":"UK Cyber Security and Resilience Bill","jurisdiction":"United Kingdom","applies_to":"Critical infrastructure and, increasingly, their vendors and service providers.","in_force":"Introduced to Parliament 12 November 2025.","required_features":["f35_soc_siem_soar_integration","f25_high_availability_design","f26_sla_backed_service_fabric"],"clauses":["The vendor shall support security incident detection, reporting and response aligned with the buyer's regulatory reporting obligations.","The vendor shall evidence resilience and high-availability design appropriate to critical service continuity."],"note":"Prepare for broadening scope: monitored operations and resilient design."},{"key":"dora","label":"EU DORA (Digital Operational Resilience Act)","jurisdiction":"European Union","applies_to":"Financial entities and their ICT third-party service providers.","in_force":"Applicable since 17 January 2025; first enforcement cycle 2026.","required_features":["f35_soc_siem_soar_integration","f26_sla_backed_service_fabric","f25_high_availability_design","f40_managed_service_assurance"],"clauses":["The vendor shall include DORA-compliant ICT third-party provisions: defined service levels, audit and access rights, incident reporting, and exit and subcontracting terms.","The vendor shall support threat-led penetration testing and provide the information required for the buyer's Register of Information.","The vendor shall report ICT-related incidents within the timeframes the buyer must meet under DORA."],"note":"Financial-sector ICT contracts must carry DORA third-party clauses and incident reporting."},{"key":"nis2","label":"EU NIS2 Directive","jurisdiction":"European Union","applies_to":"Essential and important entities across critical sectors.","in_force":"National transposition deadlines through October 2026.","required_features":["f35_soc_siem_soar_integration","f30_zero_trust_network_access","f25_high_availability_design"],"clauses":["The vendor shall support the buyer's NIS2 risk management and incident reporting obligations, including 24-hour early warning and 72-hour notification timeframes.","The vendor shall evidence supply-chain security measures applied to its own operations."],"note":"Baseline cyber risk management and incident reporting for essential and important entities."}]}