Single-vendor SASE with SD-WAN, ZTNA, SWG, CASB and FWaaS for a 38-site UK retailer (sample)

Project background

Fictional worked example. A UK retailer with 38 stores, a distribution centre and head-office and remote staff, replacing an ageing MPLS estate and a remote-access VPN with single-vendor SASE: SD-WAN for the stores, plus ZTNA for remote and hybrid users, SWG, CASB and DLP for SaaS and web traffic, FWaaS at the security edge, identity integration with the existing directory, and UK data residency for logs. Stores trade seven days a week, so migration must be phased with no trading-hours downtime.

Service delivery and operating model

1. MandatoryConfirm whether your solution/service provides: Fully managed service. Include delivery model, limitations, geography and dependencies.

   Evidence required: Product documentation, architecture diagram, service description, RACI, portal screenshot, sample report, SLA or contract extract.

   Why this matters: Included because: recommended for Retail and e-commerce; fully managed operating model requested (per SASE Methodology v2026.1, Fully managed service).

   Weighting 4/5 · required

Network architecture and transport

1. Confirm whether your solution/service provides: Local internet breakout. Include delivery model, limitations, geography and dependencies.

   Evidence required: Product documentation, architecture diagram, service description, RACI, portal screenshot, sample report, SLA or contract extract.

   Why this matters: Included because: recommended for Retail and e-commerce (per SASE Methodology v2026.1, Local internet breakout).

   Weighting 3/5

2. MandatoryConfirm whether your solution/service provides: Cellular and 5G support. Include delivery model, limitations, geography and dependencies.

   Evidence required: Product documentation, architecture diagram, service description, RACI, portal screenshot, sample report, SLA or contract extract.

   Why this matters: Included because: Retail and e-commerce sector requirement (per SASE Methodology v2026.1, Cellular and 5G support).

   Weighting 4/5 · required

Gateway, PoP and backbone design

1. MandatoryConfirm whether your solution/service provides: Regional breakout and data residency. Include delivery model, limitations, geography and dependencies.

   Evidence required: Product documentation, architecture diagram, service description, RACI, portal screenshot, sample report, SLA or contract extract.

   Why this matters: Included because: UK GDPR / DPA 2018 / Data (Use and Access) Act 2025 compliance (per SASE Methodology v2026.1, Regional breakout and data residency).

   Weighting 4/5 · required

2. MandatoryConfirm whether your solution/service provides: Flexible edge form factors. Include delivery model, limitations, geography and dependencies.

   Evidence required: Product documentation, architecture diagram, service description, RACI, portal screenshot, sample report, SLA or contract extract.

   Why this matters: Included because: Retail and e-commerce sector requirement; large estate benefits from flexible edge options (per SASE Methodology v2026.1, Flexible edge form factors).

   Weighting 4/5 · required

Security and SASE capability

1. MandatoryConfirm whether your solution/service provides: Integrated next-generation firewall. Include delivery model, limitations, geography and dependencies.

   Evidence required: Product documentation, architecture diagram, service description, RACI, portal screenshot, sample report, SLA or contract extract.

   Why this matters: Included because: Retail and e-commerce sector requirement; PCI DSS v4.0 compliance (per SASE Methodology v2026.1, Integrated next-generation firewall).

   Weighting 4/5 · required

2. MandatoryConfirm whether your solution/service provides: Full SASE platform. Include delivery model, limitations, geography and dependencies.

   Evidence required: Product documentation, architecture diagram, service description, RACI, portal screenshot, sample report, SLA or contract extract.

   Why this matters: Included because: single-vendor SASE scope (per SASE Methodology v2026.1, Full SASE platform).

   Weighting 4/5 · required

3. MandatoryConfirm whether your solution/service provides: Zero Trust Network Access. Include delivery model, limitations, geography and dependencies.

   Evidence required: Product documentation, architecture diagram, service description, RACI, portal screenshot, sample report, SLA or contract extract.

   Why this matters: Included because: PCI DSS v4.0 compliance (per SASE Methodology v2026.1, Zero Trust Network Access).

   Weighting 4/5 · required

4. MandatoryConfirm whether your solution/service provides: Data loss prevention. Include delivery model, limitations, geography and dependencies.

   Evidence required: Product documentation, architecture diagram, service description, RACI, portal screenshot, sample report, SLA or contract extract.

   Why this matters: Included because: UK GDPR / DPA 2018 / Data (Use and Access) Act 2025 compliance (per SASE Methodology v2026.1, Data loss prevention).

   Weighting 4/5 · required

Operations, assurance and automation

1. Confirm whether your solution/service provides: Centralised orchestration. Include delivery model, limitations, geography and dependencies.

   Evidence required: Product documentation, architecture diagram, service description, RACI, portal screenshot, sample report, SLA or contract extract.

   Why this matters: Included because: recommended for Retail and e-commerce; 38 sites need central orchestration (per SASE Methodology v2026.1, Centralised orchestration).

   Weighting 3/5

2. Confirm whether your solution/service provides: Managed service assurance. Include delivery model, limitations, geography and dependencies.

   Evidence required: Product documentation, architecture diagram, service description, RACI, portal screenshot, sample report, SLA or contract extract.

   Why this matters: Included because: managed service needs assured operations (per SASE Methodology v2026.1, Managed service assurance).

   Weighting 3/5

Evidence checklist

Vendors should return these artefacts with their response:

• Product documentation, architecture diagram, service description, RACI, portal screenshot, sample report, SLA or contract extract. (11 questions)

Scoring approach

Responses are scored per question (1 to 5) multiplied by the question weighting. Mandatory questions are pass/fail gates: a failed mandatory excludes the response regardless of score.