{"contract_version":"sector-research/2.0.0","page":"https://netify.co.uk/sd-wan-sase-for-financial-services/","title":"Financial Services SD-WAN & SASE: Evidence, UK and North America (2026)","description":"SD-WAN and SASE for financial services: 30 providers graded on 28 requirements with sources, UK and North American regulation kept separate, live shortlist tool and RFP builder.","sector":"financial-services","regime_filter":null,"regimes":[{"key":"uk","label":"United Kingdom (FCA, PRA, UK GDPR)","short":"UK"},{"key":"eu","label":"European Union (DORA)","short":"EU"},{"key":"us","label":"United States (FFIEC, GLBA, NYDFS, SEC)","short":"US"},{"key":"canada","label":"Canada (OSFI)","short":"Canada"}],"author":"Harry Yelland","fact_checked_by":"Robert Sturt","date_published":"2026-01-12","date_modified":"2026-09-15","intro":["Legacy WAN architectures cannot support financial services’ demands for ultra-low latency trading, multi-site connectivity and regulatory compliance. However, SD-WAN and SASE solutions provide the answer through application-aware routing, centralised management and integrated security for FCA operational resilience (PS21/3), PCI DSS 4.0.1 and UK GDPR compliance."],"environments":[{"heading":"Retail Bank Branches","body":"Bank branches depend on continuous connectivity for core banking systems, payment processing and customer service applications. Limited offline functionality covers basic enquiries only: staff cannot access customer account histories, process transactions or approve lending decisions without live connectivity. Extended outages force branches to turn customers away or revert to manual processes, creating customer dissatisfaction and compliance risks."},{"heading":"Trading Floors & Investment Offices","body":"Trading floors and investment management offices introduce considerably more complex performance requirements. Core banking systems remain critical, while these sites also run trading platforms requiring sub-millisecond execution speeds, real-time market data feeds processing thousands of price updates per second, and risk management systems coordinating position monitoring across multiple asset classes. Slow trading platform performance means traders cannot execute orders at intended prices, potentially resulting in significant financial losses."},{"heading":"Wealth Management & Advisory","body":"Wealth management and advisory offices represent a more dispersed operational model. Financial advisers, relationship managers and client service teams often operate from smaller regional offices with minimal IT support. Network reliability is essential for advisers accessing portfolio management systems during client meetings, secure messaging between advisory teams and video consultations with high-net-worth clients."}],"performance":{"paragraphs":["Trading floors experience predictable demand spikes during market open, close and major economic announcements. During these peaks, multiple traders simultaneously execute orders, market data feeds process unprecedented volumes, risk management systems calculate real-time exposures and settlement systems handle transaction confirmations, all within financial services networks."],"latency":[{"label":"Core Banking","body":"Requires responsive performance but can tolerate modest latency: extended response times frustrate staff and reduce client service efficiency."},{"label":"Real-Time Trading","body":"Operates on considerably tighter margins. When markets move rapidly, order execution must occur within milliseconds to achieve intended prices."},{"label":"Payment Processing","body":"Requires consistent low latency to maintain transaction throughput: higher latency creates processing backlogs that undermine service levels and client confidence."},{"label":"Market Data Feeds","body":"Cannot tolerate delays when every millisecond affects execution quality and profitability."}],"operations":"Financial services networks must frequently operate without dedicated on-site IT support. With SD-WAN and SASE, organisations can move to a centrally managed approach with zero-touch provisioning. IT teams can configure, monitor and troubleshoot remotely. When a new branch opens, equipment arrives pre-configured and connects automatically."},"procurement":{"intro":"A structured RFP, tailored to specific network requirements, operational model and compliance obligations, ensures all vendors respond to the same financial services-specific requirements (FCA operational resilience support, trading application prioritisation, PCI DSS segmentation).","requirements":["Market reconfiguration and site changes: define expected rates of openings, closures and service relocations with contractual obligations for rapid provisioning and clean decommissioning.","Differentiated resilience by site type: trading floors and payment processing centres require near-continuous availability with sub-second failover; advisory offices might tolerate brief outages with appropriate client communication protocols.","Peak period performance: specify peak period bandwidth needs (market open/close, major economic announcements, month-end processing) and acceptable performance degradation during congestion.","Third-party resilience and vendor assurance: with the FCA’s operational resilience deadline now passed, include specific questions about how an SD-WAN vendor’s own infrastructure meets FCA operational resilience standards, their important business services and impact tolerances, and evidence of their scenario testing. Verify ISO 27001 and SOC 2 certifications.","Multi-entity and regulated subsidiary requirements: specify whether different regulated entities within a financial services group will share network infrastructure and what security boundaries must exist between different legal entities, regulated subsidiaries and offshore operations."]},"segments":[{"heading":"Enterprise Financial Organisations","body":"Hundreds of locations with dedicated NOC, in-house security teams and complex network architectures including dedicated trading networks, enterprise SOCs and global WAN infrastructure. SD-WAN RFP procurement involves IT, trading technology, infosec and compliance stakeholders with formal approval processes. Often run multiple business lines (retail banking, investment banking, wealth management) requiring differentiated service levels and potentially separate network domains."},{"heading":"Mid-Market Financial Organisations","body":"Boutique wealth management firms, regional building societies and specialist lenders operate with leaner IT teams. Network decisions are typically made by smaller teams with broader responsibilities, requiring simplified solutions. Typically lack dedicated SOCs and should consider managed service provider assistance or solutions with integrated security capabilities and outsourced security monitoring."}],"faqs":[{"q":"What is the primary benefit of SD-WAN for financial services organisations?","a":"The primary benefit is the ability to prioritise critical traffic (trading platforms, core banking) through application-aware routing whilst enabling secure, resilient connectivity for distributed branches and remote advisors. This ensures that transaction-critical systems are prioritised over non-critical traffic, whilst complying with strict regulatory availability requirements."},{"q":"Why is SASE becoming essential for modern financial environments?","a":"SASE converges networking and security into a single cloud-based framework. For financial institutions, this reduces the complexity of securing hybrid workforces and distributed branches, whilst providing consistent policy enforcement for PCI DSS and GDPR compliance regardless of where users or applications are located."},{"q":"How does SD-WAN help address PCI DSS 4.0.1 compliance?","a":"SD-WAN assists with PCI DSS 4.0.1 compliance by implementing granular network segmentation that isolates cardholder data environments (CDE) from general corporate traffic. This reduces the scope of PCI audits and prevents lateral movement of threats, whilst centralised logging provides the evidence required for compliance reporting."},{"q":"How does network latency affect financial services trading systems?","a":"High network latency causes delays in executing trades, processing market data and confirming transactions. When systems fail to respond promptly, it leads to execution at unintended prices and missed trading opportunities, directly impacting profitability and potentially client relationships in time-critical situations where milliseconds can determine trade success."},{"q":"What should be included in a financial services SD-WAN RFP?","a":"Clear requirements for peak bandwidth handling during trading activity periods (such as market open/close and major economic announcements), specific vendor questions regarding their ability to support FCA operational resilience evidence requirements, multi-site resilience with sub-second failover for critical sites, network segmentation for PCI DSS cardholder data environments, and the vendor’s own operational resilience posture and third-party risk management capabilities."}],"regulation_map":{"note":"Netify reference data, September 2026. UK, EU, US and Canadian regimes listed separately; confirm current versions on the regulator's own site before citing.","requirement_regimes":{"uk_regulatory_alignment_fca_and_pra":["uk"],"eu_dora_alignment":["eu","uk"],"us_regulatory_alignment_ffiec_glba_nydfs_sec":["us"],"canada_regulatory_alignment_osfi":["canada"],"uk_delivery":["uk"],"north_america_delivery":["us","canada"]},"regulations":[{"name":"FCA SYSC 15A and PRA SS1/21: operational resilience","jurisdiction":"UK","regimes":["uk"],"applies_to":"Banks, building societies, insurers, investment firms, payment and e-money firms regulated by the FCA or PRA","expects":"Firms identify important business services, set impact tolerances and must be able to stay within them through severe but plausible disruption; the network is usually a mapped dependency. Full compliance was required by 31 March 2025.","requirement_codes":["resilience_and_tested_recovery","incident_notification_support","concentration_risk_and_subcontractor_transparency","uk_regulatory_alignment_fca_and_pra"],"evidence_that_counts":"A UK-regulated customer case naming the service and a resilience outcome; provider material on supporting impact-tolerance mapping or scenario testing; contractual recovery objectives published for FS customers.","evidence_that_does_not_count":"A generic uptime percentage; an SLA page with no FS or resilience-testing context."},{"name":"PRA SS2/21 and FCA SYSC 8: outsourcing and third-party risk","jurisdiction":"UK","regimes":["uk"],"applies_to":"PRA and FCA regulated firms using material outsourcing, including managed network and security services","expects":"Due diligence, sub-outsourcing transparency, audit and access rights, data location, business continuity and documented exit plans for material outsourced services.","requirement_codes":["third_party_and_outsourced_access","concentration_risk_and_subcontractor_transparency","exit_and_portability","data_residency_and_sovereignty","logging_audit_and_evidence_retention","uk_regulatory_alignment_fca_and_pra"],"evidence_that_counts":"Published audit-rights or sub-processor lists; exit or data-return terms; a UK FS customer case that references outsourcing governance.","evidence_that_does_not_count":"A statement that the provider \"works with banks\"."},{"name":"UK Critical Third Parties regime (FSMA 2023; PRA, FCA and Bank of England rules effective 1 January 2025)","jurisdiction":"UK","regimes":["uk"],"applies_to":"Third parties designated by HM Treasury as critical to the UK financial system; indirectly relevant to any large network or cloud provider","expects":"Designated CTPs face direct oversight, resilience testing and incident reporting duties. Firms are expected to understand concentration in their own supply chains.","requirement_codes":["concentration_risk_and_subcontractor_transparency","uk_regulatory_alignment_fca_and_pra"],"evidence_that_counts":"Provider statement on CTP readiness or designation; independent reporting of designation.","evidence_that_does_not_count":"Assuming designation because the provider is large."},{"name":"UK GDPR and Data Protection Act 2018 (international transfers via IDTA or UK Addendum)","jurisdiction":"UK","regimes":["uk"],"applies_to":"Any organisation processing UK personal data","expects":"Lawful international transfers, security of processing, records of processing; where logs and inspection data are stored and by whom.","requirement_codes":["data_residency_and_sovereignty","encryption_and_key_management","logging_audit_and_evidence_retention"],"evidence_that_counts":"Stated UK or EU data residency for logs and management plane; transfer mechanism named; UK data-processing terms published.","evidence_that_does_not_count":"A global privacy notice with no residency statement."},{"name":"DORA: Regulation (EU) 2022/2554, applying from 17 January 2025","jurisdiction":"EU (and UK groups with EU-regulated entities)","regimes":["eu","uk"],"applies_to":"EU financial entities and their ICT third-party providers, including network and security providers","expects":"ICT risk management, major-incident reporting to the competent authority, resilience testing (threat-led testing for larger entities), register of ICT third parties, Article 30 contractual terms (service levels, data location, audit, exit) and oversight of critical ICT providers.","requirement_codes":["eu_dora_alignment","resilience_and_tested_recovery","incident_notification_support","exit_and_portability","concentration_risk_and_subcontractor_transparency","logging_audit_and_evidence_retention"],"evidence_that_counts":"A provider DORA statement that names the service and the Article 30 contractual terms; an EU FS customer case referencing DORA; a DORA-aligned addendum.","evidence_that_does_not_count":"A blog post saying DORA matters; ISO 27001 alone."},{"name":"PCI DSS v4.0.1 (future-dated requirements mandatory from 31 March 2025)","jurisdiction":"Global (card brands)","regimes":["uk","eu","us","canada"],"applies_to":"Any entity storing, processing or transmitting cardholder data, and service providers that can affect its security","expects":"Segmentation of the cardholder data environment, strong cryptography over public networks (Req 4), MFA (Req 8), logging and monitoring (Req 10), and a service-provider responsibility matrix (Req 12.8 and 12.9).","requirement_codes":["payment_and_cardholder_data_segmentation","pci_dss_alignment","encryption_and_key_management","logging_audit_and_evidence_retention","third_party_and_outsourced_access"],"evidence_that_counts":"An Attestation of Compliance for the named service; a customer case that names PCI scope reduction or segmentation with the service; a published responsibility matrix.","evidence_that_does_not_count":"The words \"PCI compliant\" with no scope or service named."},{"name":"SWIFT Customer Security Programme (CSCF, annual attestation)","jurisdiction":"Global","regimes":["uk","eu","us","canada"],"applies_to":"SWIFT users, mainly banks and market infrastructures","expects":"Segregation of the SWIFT secure zone, restricted access, MFA and logging for the SWIFT environment; attested annually.","requirement_codes":["swift_csp_alignment","network_segmentation_and_zoning","identity_and_zero_trust_access"],"evidence_that_counts":"A customer or provider statement naming the service in a SWIFT secure-zone design.","evidence_that_does_not_count":"General segmentation claims with no SWIFT reference."},{"name":"GLBA Safeguards Rule (16 CFR Part 314, FTC; amended rule effective June 2023, FTC breach notification from May 2024)","jurisdiction":"US","regimes":["us"],"applies_to":"Non-bank financial institutions under FTC jurisdiction (lenders, brokers, tax preparers, some fintechs)","expects":"Written information security programme with encryption in transit and at rest, MFA, access controls, logging, continuous monitoring or annual penetration testing, service-provider oversight, and notification of qualifying events.","requirement_codes":["us_regulatory_alignment_ffiec_glba_nydfs_sec","encryption_and_key_management","identity_and_zero_trust_access","logging_audit_and_evidence_retention","third_party_and_outsourced_access","incident_notification_support"],"evidence_that_counts":"A US non-bank FS customer case naming the service; provider material that maps the service to Safeguards Rule elements.","evidence_that_does_not_count":"A general \"compliance\" page listing GLBA among twenty logos."},{"name":"FFIEC IT Examination Handbook (Architecture, Infrastructure and Operations 2021; Information Security; Business Continuity Management)","jurisdiction":"US","regimes":["us"],"applies_to":"Banks, credit unions and their service providers examined by the federal banking agencies","expects":"Examiners expect network segmentation, secure remote access, resilience and recovery testing, third-party management and logging in line with the booklets.","requirement_codes":["us_regulatory_alignment_ffiec_glba_nydfs_sec","network_segmentation_and_zoning","resilience_and_tested_recovery","remote_and_hybrid_workforce","logging_audit_and_evidence_retention"],"evidence_that_counts":"A US bank or credit-union case naming the service; provider material written for FFIEC examinations.","evidence_that_does_not_count":"A mention of FFIEC with no service named."},{"name":"Interagency Guidance on Third-Party Relationships: Risk Management (OCC, Federal Reserve, FDIC, June 2023)","jurisdiction":"US","regimes":["us"],"applies_to":"Banking organisations supervised by the three agencies","expects":"Due diligence, contract terms, ongoing monitoring and termination planning for third parties, including network and security providers; attention to concentration and subcontracting.","requirement_codes":["third_party_and_outsourced_access","concentration_risk_and_subcontractor_transparency","exit_and_portability","us_regulatory_alignment_ffiec_glba_nydfs_sec"],"evidence_that_counts":"Published subcontractor transparency, audit rights or termination assistance terms; a US bank case referencing third-party oversight.","evidence_that_does_not_count":"Generic partner-programme material."},{"name":"Computer-Security Incident Notification Rule (OCC, Federal Reserve, FDIC; effective April 2022)","jurisdiction":"US","regimes":["us"],"applies_to":"Banking organisations and their bank service providers","expects":"Banks notify their regulator within 36 hours of a notification incident; bank service providers must notify affected bank customers as soon as possible of an incident that has disrupted covered services for four or more hours.","requirement_codes":["incident_notification_support","us_regulatory_alignment_ffiec_glba_nydfs_sec"],"evidence_that_counts":"A provider incident-notification commitment for bank customers, in contract terms or a published statement naming the service.","evidence_that_does_not_count":"A status page."},{"name":"NYDFS Cybersecurity Regulation, 23 NYCRR Part 500 (amended November 2023, phased dates to November 2025)","jurisdiction":"US (New York)","regimes":["us"],"applies_to":"Entities licensed by the New York Department of Financial Services, including many banks, insurers and money transmitters","expects":"Asset inventory, access privilege management, MFA across the estate, encryption, monitoring and logging, 72-hour incident notification, and a third-party service provider policy.","requirement_codes":["us_regulatory_alignment_ffiec_glba_nydfs_sec","identity_and_zero_trust_access","encryption_and_key_management","logging_audit_and_evidence_retention","incident_notification_support","third_party_and_outsourced_access"],"evidence_that_counts":"A NYDFS-regulated customer case naming the service; provider material mapping the service to Part 500 sections.","evidence_that_does_not_count":"A list of US regulations on a compliance page."},{"name":"SEC Regulation S-P amendments (adopted May 2024; compliance December 2025 for larger entities, June 2026 for smaller)","jurisdiction":"US","regimes":["us"],"applies_to":"Broker-dealers, investment companies, registered investment advisers and transfer agents","expects":"Incident response programme, customer notification within 30 days of becoming aware of unauthorised access, and oversight of service providers handling customer information.","requirement_codes":["us_regulatory_alignment_ffiec_glba_nydfs_sec","incident_notification_support","third_party_and_outsourced_access","cloud_and_saas_data_controls"],"evidence_that_counts":"A broker-dealer or adviser case naming the service; provider incident-notification terms.","evidence_that_does_not_count":"A general security whitepaper."},{"name":"SEC cybersecurity disclosure rules (Form 8-K Item 1.05; effective December 2023)","jurisdiction":"US","regimes":["us"],"applies_to":"US-listed public companies, including listed financial institutions","expects":"Disclosure of material cybersecurity incidents within four business days of determining materiality; the network provider must be able to supply timely incident facts.","requirement_codes":["incident_notification_support","logging_audit_and_evidence_retention"],"evidence_that_counts":"Provider commitments on incident timelines and forensic log access.","evidence_that_does_not_count":"Marketing about \"full visibility\"."},{"name":"Sarbanes-Oxley Act Section 404: IT general controls","jurisdiction":"US","regimes":["us"],"applies_to":"US-listed companies and their financial reporting systems","expects":"Change management, access control and logging for systems in financial reporting scope; the network is in scope where it carries or protects those systems.","requirement_codes":["change_control_and_configuration_governance","identity_and_zero_trust_access","logging_audit_and_evidence_retention"],"evidence_that_counts":"Provider change-control and audit-log capability described for the named service; a SOC 1 or SOC 2 report scope naming the service.","evidence_that_does_not_count":"A SOC 2 logo."},{"name":"FINRA Rule 4370: business continuity plans","jurisdiction":"US","regimes":["us"],"applies_to":"FINRA member broker-dealers","expects":"Documented business continuity and emergency contact plans covering critical systems and connectivity.","requirement_codes":["resilience_and_tested_recovery","us_regulatory_alignment_ffiec_glba_nydfs_sec"],"evidence_that_counts":"A broker-dealer case naming the service in a continuity design.","evidence_that_does_not_count":"General failover claims."},{"name":"OSFI Guideline B-13: Technology and Cyber Risk Management (effective 1 January 2024) and the Technology and Cyber Security Incident Reporting Advisory","jurisdiction":"Canada","regimes":["canada"],"applies_to":"Federally regulated financial institutions (banks, insurers, trust companies)","expects":"Technology asset management, secure network architecture, resilience, cyber incident reporting to OSFI within 24 hours of determining an incident is reportable.","requirement_codes":["canada_regulatory_alignment_osfi","resilience_and_tested_recovery","incident_notification_support","network_segmentation_and_zoning"],"evidence_that_counts":"A Canadian FRFI case naming the service; provider material mapping to B-13.","evidence_that_does_not_count":"A Canadian office address."},{"name":"OSFI Guideline B-10: Third-Party Risk Management (effective 1 May 2024)","jurisdiction":"Canada","regimes":["canada"],"applies_to":"Federally regulated financial institutions","expects":"Risk-based due diligence, contract provisions (data, audit, subcontracting, exit), concentration risk and ongoing monitoring of third parties.","requirement_codes":["canada_regulatory_alignment_osfi","third_party_and_outsourced_access","concentration_risk_and_subcontractor_transparency","exit_and_portability"],"evidence_that_counts":"Published subcontractor and exit terms; a Canadian FRFI case referencing third-party governance.","evidence_that_does_not_count":"Partner-programme marketing."},{"name":"PIPEDA and Quebec Law 25","jurisdiction":"Canada","regimes":["canada"],"applies_to":"Private-sector organisations handling personal information in Canada; Quebec adds stricter rules and cross-border assessments","expects":"Safeguards proportionate to sensitivity, breach reporting, and assessment before transferring personal information outside Quebec.","requirement_codes":["data_residency_and_sovereignty","canada_regulatory_alignment_osfi","encryption_and_key_management"],"evidence_that_counts":"Stated Canadian data residency for logs or management plane; Quebec-specific terms.","evidence_that_does_not_count":"A global privacy notice."},{"name":"ISO/IEC 27001, SOC 2 Type II, FIPS 140-2/140-3, Cyber Essentials Plus, FedRAMP","jurisdiction":"Cross-jurisdiction assurance","regimes":["uk","eu","us","canada"],"applies_to":"The provider's own platform and operations","expects":"Assurance over the provider's controls. FedRAMP is a US federal programme, not a financial services regulation. Cyber Essentials is UK government-backed baseline assurance.","requirement_codes":["encryption_and_key_management","logging_audit_and_evidence_retention","identity_and_zero_trust_access","managed_operations_and_soc"],"evidence_that_counts":"A certificate or report with a scope that names the service; FIPS validation certificate numbers.","evidence_that_does_not_count":"Proof for any regulatory column. A certification never makes a regulatory column Proven on its own."}]},"sector_evidence":{"contract":"sector-evidence-view/1.1.0","sector":"financial-services","summary":{"provider_count":30,"requirement_count":28,"accepted_sources":305,"total_sources":435,"providers_complete":30,"last_checked":"2026-09-15"},"status_vocabulary":[{"state":"proven","label":"Proven","definition":"An accepted source directly connects the provider's named SD-WAN, SASE, SSE or managed service to that financial services requirement, in the regulatory regime the column belongs to."},{"state":"partial","label":"Partial","definition":"Relevant evidence exists, but the product connection, regulatory regime, geography or outcome is incomplete."},{"state":"not_found","label":"Not found","definition":"Credible sources were checked but no defensible evidence was found. This does not prove the provider lacks the capability."},{"state":"not_applicable","label":"Not applicable","definition":"The requirement does not apply to the provider's operating model."},{"state":"to_review","label":"To review","definition":"Research has not yet been completed."}],"evidence_rules":["Prefer customer-authored case studies, regulator or public body statements, published compliance attestations, contract awards and independent reporting.","A named financial institution using a named SD-WAN, SASE, SSE or managed service is the strongest evidence.","A generic financial services solutions page is supporting evidence, not proof of a deployment.","Keep regimes separate: a US bank case study is evidence for the US column, never the UK column, and the reverse.","For the FCA and PRA, DORA, US and OSFI columns a certification such as SOC 2 or ISO 27001 is never enough on its own. The source must connect the service to that regime.","Do not treat switching, Wi-Fi, data-centre LAN or trading-floor LAN evidence as SD-WAN or SASE evidence unless the source makes that connection.","Copy a short exact quotation that proves the point, then write a concise factual summary in your own words.","Record publication and checked dates and the regulatory regime on every source row. State what each source does not prove."],"requirements":[{"code":"branch_and_office_connectivity","label":"Branch and office connectivity","explanation":"","evidence_rule":"Do not treat switching, Wi-Fi, data-centre, colocation or trading-floor LAN evidence as SD-WAN or SASE evidence unless the source makes that connection.","display_order":1,"regimes":"all"},{"code":"trading_and_low_latency_connectivity","label":"Trading and low-latency connectivity","explanation":"","evidence_rule":"Do not treat switching, Wi-Fi, data-centre, colocation or trading-floor LAN evidence as SD-WAN or SASE evidence unless the source makes that connection.","display_order":2,"regimes":"all"},{"code":"data_centre_colocation_and_cloud_connectivity","label":"Data-centre, colocation and cloud connectivity","explanation":"","evidence_rule":"Do not treat switching, Wi-Fi, data-centre, colocation or trading-floor LAN evidence as SD-WAN or SASE evidence unless the source makes that connection.","display_order":3,"regimes":"all"},{"code":"resilience_and_tested_recovery","label":"Resilience and tested recovery","explanation":"","evidence_rule":"","display_order":4,"regimes":"all"},{"code":"network_segmentation_and_zoning","label":"Network segmentation and zoning","explanation":"","evidence_rule":"Do not treat switching, Wi-Fi, data-centre, colocation or trading-floor LAN evidence as SD-WAN or SASE evidence unless the source makes that connection.","display_order":5,"regimes":"all"},{"code":"payment_and_cardholder_data_segmentation","label":"Payment and cardholder data segmentation","explanation":"","evidence_rule":"Do not treat switching, Wi-Fi, data-centre, colocation or trading-floor LAN evidence as SD-WAN or SASE evidence unless the source makes that connection.","display_order":6,"regimes":"all"},{"code":"third_party_and_outsourced_access","label":"Third-party and outsourced access","explanation":"","evidence_rule":"","display_order":7,"regimes":"all"},{"code":"remote_and_hybrid_workforce","label":"Remote and hybrid workforce","explanation":"","evidence_rule":"Do not treat switching, Wi-Fi, data-centre, colocation or trading-floor LAN evidence as SD-WAN or SASE evidence unless the source makes that connection.","display_order":8,"regimes":"all"},{"code":"data_residency_and_sovereignty","label":"Data residency and sovereignty","explanation":"","evidence_rule":"","display_order":9,"regimes":"all"},{"code":"encryption_and_key_management","label":"Encryption and key management","explanation":"","evidence_rule":"","display_order":10,"regimes":"all"},{"code":"logging_audit_and_evidence_retention","label":"Logging, audit and evidence retention","explanation":"","evidence_rule":"","display_order":11,"regimes":"all"},{"code":"identity_and_zero_trust_access","label":"Identity and zero trust access","explanation":"","evidence_rule":"","display_order":12,"regimes":"all"},{"code":"cloud_and_saas_data_controls","label":"Cloud and SaaS data controls","explanation":"","evidence_rule":"","display_order":13,"regimes":"all"},{"code":"managed_operations_and_soc","label":"Managed operations and SOC","explanation":"","evidence_rule":"","display_order":14,"regimes":"all"},{"code":"network_visibility_and_reporting","label":"Network visibility and reporting","explanation":"","evidence_rule":"","display_order":15,"regimes":"all"},{"code":"change_control_and_configuration_governance","label":"Change control and configuration governance","explanation":"","evidence_rule":"","display_order":16,"regimes":"all"},{"code":"incident_notification_support","label":"Incident notification support","explanation":"","evidence_rule":"","display_order":17,"regimes":"all"},{"code":"concentration_risk_and_subcontractor_transparency","label":"Concentration risk and subcontractor transparency","explanation":"","evidence_rule":"","display_order":18,"regimes":"all"},{"code":"exit_and_portability","label":"Exit and portability","explanation":"","evidence_rule":"","display_order":19,"regimes":"all"},{"code":"uk_regulatory_alignment_fca_and_pra","label":"UK regulatory alignment (FCA and PRA)","explanation":"","evidence_rule":"Do not claim FCA, PRA, DORA, FFIEC, GLBA, NYDFS, SEC, OSFI, PCI DSS or SWIFT CSP alignment unless the source supports the precise wording. A SOC 2 report or ISO 27001 certificate is supporting evidence for the security columns, not proof for a regulatory column. Keep the regimes separate. A US bank case study does not evidence UK regulatory alignment, and a UK building society does not evidence NYDFS or FFIEC alignment. Record the regime in the source row.","display_order":20,"regimes":["uk"]},{"code":"eu_dora_alignment","label":"EU DORA alignment","explanation":"","evidence_rule":"Do not claim FCA, PRA, DORA, FFIEC, GLBA, NYDFS, SEC, OSFI, PCI DSS or SWIFT CSP alignment unless the source supports the precise wording. A SOC 2 report or ISO 27001 certificate is supporting evidence for the security columns, not proof for a regulatory column. Keep the regimes separate. A US bank case study does not evidence UK regulatory alignment, and a UK building society does not evidence NYDFS or FFIEC alignment. Record the regime in the source row.","display_order":21,"regimes":["eu","uk"]},{"code":"us_regulatory_alignment_ffiec_glba_nydfs_sec","label":"US regulatory alignment (FFIEC, GLBA, NYDFS, SEC)","explanation":"","evidence_rule":"Do not claim FCA, PRA, DORA, FFIEC, GLBA, NYDFS, SEC, OSFI, PCI DSS or SWIFT CSP alignment unless the source supports the precise wording. A SOC 2 report or ISO 27001 certificate is supporting evidence for the security columns, not proof for a regulatory column. Keep the regimes separate. A US bank case study does not evidence UK regulatory alignment, and a UK building society does not evidence NYDFS or FFIEC alignment. Record the regime in the source row.","display_order":22,"regimes":["us"]},{"code":"canada_regulatory_alignment_osfi","label":"Canada regulatory alignment (OSFI)","explanation":"","evidence_rule":"Do not claim FCA, PRA, DORA, FFIEC, GLBA, NYDFS, SEC, OSFI, PCI DSS or SWIFT CSP alignment unless the source supports the precise wording. A SOC 2 report or ISO 27001 certificate is supporting evidence for the security columns, not proof for a regulatory column. Keep the regimes separate. A US bank case study does not evidence UK regulatory alignment, and a UK building society does not evidence NYDFS or FFIEC alignment. Record the regime in the source row.","display_order":23,"regimes":["canada"]},{"code":"pci_dss_alignment","label":"PCI DSS alignment","explanation":"","evidence_rule":"Do not claim FCA, PRA, DORA, FFIEC, GLBA, NYDFS, SEC, OSFI, PCI DSS or SWIFT CSP alignment unless the source supports the precise wording. A SOC 2 report or ISO 27001 certificate is supporting evidence for the security columns, not proof for a regulatory column. Keep the regimes separate. A US bank case study does not evidence UK regulatory alignment, and a UK building society does not evidence NYDFS or FFIEC alignment. Record the regime in the source row.","display_order":24,"regimes":"all"},{"code":"swift_csp_alignment","label":"SWIFT CSP alignment","explanation":"","evidence_rule":"Do not claim FCA, PRA, DORA, FFIEC, GLBA, NYDFS, SEC, OSFI, PCI DSS or SWIFT CSP alignment unless the source supports the precise wording. A SOC 2 report or ISO 27001 certificate is supporting evidence for the security columns, not proof for a regulatory column. Keep the regimes separate. A US bank case study does not evidence UK regulatory alignment, and a UK building society does not evidence NYDFS or FFIEC alignment. Record the regime in the source row.","display_order":25,"regimes":"all"},{"code":"uk_delivery","label":"UK delivery","explanation":"","evidence_rule":"Keep the regimes separate. A US bank case study does not evidence UK regulatory alignment, and a UK building society does not evidence NYDFS or FFIEC alignment. Record the regime in the source row.","display_order":26,"regimes":["uk"]},{"code":"north_america_delivery","label":"North America delivery","explanation":"","evidence_rule":"Keep the regimes separate. A US bank case study does not evidence UK regulatory alignment, and a UK building society does not evidence NYDFS or FFIEC alignment. Record the regime in the source row.","display_order":27,"regimes":["us","canada"]},{"code":"global_delivery","label":"Global delivery","explanation":"","evidence_rule":"Keep the regimes separate. A US bank case study does not evidence UK regulatory alignment, and a UK building society does not evidence NYDFS or FFIEC alignment. Record the regime in the source row.","display_order":28,"regimes":"all"}],"providers":[{"slug":"cloudflare-one","name":"Cloudflare One","marketplace_url":"https://netify.co.uk/marketplace/cloudflare-one/","research_status":"complete","overall_confidence":"medium","fit_conclusion":"Cloudflare One has documented, product-named evidence for data residency (Data Localization Suite), encryption and key management, log retention, PCI DSS 4.0 scope, EU DORA Article 30 contractual mapping and UK PRA/FCA operational resilience alignment (SS1/21, SS2/21, the Critical Third Parties regime). Named financial services customers exist in three regions: Bank of Cyprus (EU, DDoS resilience and network interconnect), Moneybox (UK, Zero Trust remote workforce access) and Luana Savings Bank (US, Zero Trust and Browser Isolation, six branches, 100% uptime). The strongest named customer for delivery evidence is Luana Savings Bank in the US and Moneybox in the UK, both explicit financial services firms using Cloudflare Access or Zero Trust. The main limitation is that none of the case studies describe a branch network, trading floor or data-centre SD-WAN deployment specifically using Magic WAN or Cloudflare One for a named financial institution; the available named-customer evidence is concentrated in Zero Trust/Access identity and application security, not core SD-WAN branch connectivity. US regulatory alignment (FFIEC, GLBA, NYDFS, SEC), Canadian OSFI alignment and SWIFT CSP alignment have no supporting evidence at all.","gaps_and_unknowns":"No evidence was found for branch and office connectivity, trading and low-latency connectivity, network segmentation and zoning, payment and cardholder data segmentation, managed operations and SOC, network visibility and reporting, or change control and configuration governance for a named financial institution; a named case study describing Magic WAN or Cloudflare One WAN connectors in an FS branch or trading context would close these. US regulatory alignment (FFIEC, GLBA, NYDFS Part 500, SEC Reg S-P), Canadian OSFI alignment and SWIFT CSP alignment are also unevidenced; a Cloudflare compliance statement or named US/Canadian FS customer citing these specific regimes would be needed.","reviewed_by":"Harry Yelland","reviewed_date":"2026-09-14","source_count":23,"accepted_source_count":19,"requirements":[{"code":"branch_and_office_connectivity","label":"Branch and office connectivity","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"trading_and_low_latency_connectivity","label":"Trading and low-latency connectivity","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"data_centre_colocation_and_cloud_connectivity","label":"Data-centre, colocation and cloud connectivity","state":"proven","evidence_source_ids":["src_financial_services_fin_195"],"verified_date":"2026-09-14"},{"code":"resilience_and_tested_recovery","label":"Resilience and tested recovery","state":"proven","evidence_source_ids":["src_financial_services_fin_195","src_financial_services_fin_203","src_financial_services_fin_209"],"verified_date":"2026-09-14"},{"code":"network_segmentation_and_zoning","label":"Network segmentation and zoning","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"payment_and_cardholder_data_segmentation","label":"Payment and cardholder data segmentation","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"third_party_and_outsourced_access","label":"Third-party and outsourced access","state":"partial","evidence_source_ids":["src_financial_services_fin_206"],"verified_date":"2026-09-14"},{"code":"remote_and_hybrid_workforce","label":"Remote and hybrid workforce","state":"proven","evidence_source_ids":["src_financial_services_fin_208"],"verified_date":"2026-09-14"},{"code":"data_residency_and_sovereignty","label":"Data residency and sovereignty","state":"proven","evidence_source_ids":["src_financial_services_fs_022","src_financial_services_fs_022","src_financial_services_fin_201"],"verified_date":"2026-09-14"},{"code":"encryption_and_key_management","label":"Encryption and key management","state":"proven","evidence_source_ids":["src_financial_services_fin_201","src_financial_services_fin_210"],"verified_date":"2026-09-14"},{"code":"logging_audit_and_evidence_retention","label":"Logging, audit and evidence retention","state":"proven","evidence_source_ids":["src_financial_services_fin_204","src_financial_services_fin_211"],"verified_date":"2026-09-14"},{"code":"identity_and_zero_trust_access","label":"Identity and zero trust access","state":"proven","evidence_source_ids":["src_financial_services_fin_193","src_financial_services_fin_208","src_financial_services_fin_209"],"verified_date":"2026-09-14"},{"code":"cloud_and_saas_data_controls","label":"Cloud and SaaS data controls","state":"partial","evidence_source_ids":["src_financial_services_fin_212"],"verified_date":"2026-09-14"},{"code":"managed_operations_and_soc","label":"Managed operations and SOC","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"network_visibility_and_reporting","label":"Network visibility and reporting","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"change_control_and_configuration_governance","label":"Change control and configuration governance","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"incident_notification_support","label":"Incident notification support","state":"proven","evidence_source_ids":["src_financial_services_fin_202","src_financial_services_fin_203"],"verified_date":"2026-09-14"},{"code":"concentration_risk_and_subcontractor_transparency","label":"Concentration risk and subcontractor transparency","state":"partial","evidence_source_ids":["src_financial_services_fin_205"],"verified_date":"2026-09-14"},{"code":"exit_and_portability","label":"Exit and portability","state":"proven","evidence_source_ids":["src_financial_services_fin_206"],"verified_date":"2026-09-14"},{"code":"uk_regulatory_alignment_fca_and_pra","label":"UK regulatory alignment (FCA and PRA)","state":"proven","evidence_source_ids":["src_financial_services_fin_200"],"verified_date":"2026-09-14"},{"code":"eu_dora_alignment","label":"EU DORA alignment","state":"proven","evidence_source_ids":["src_financial_services_fin_202"],"verified_date":"2026-09-14"},{"code":"us_regulatory_alignment_ffiec_glba_nydfs_sec","label":"US regulatory alignment (FFIEC, GLBA, NYDFS, SEC)","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"canada_regulatory_alignment_osfi","label":"Canada regulatory alignment (OSFI)","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"pci_dss_alignment","label":"PCI DSS alignment","state":"proven","evidence_source_ids":["src_financial_services_fin_197"],"verified_date":"2026-09-14"},{"code":"swift_csp_alignment","label":"SWIFT CSP alignment","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"uk_delivery","label":"UK delivery","state":"proven","evidence_source_ids":["src_financial_services_fin_193","src_financial_services_fin_208"],"verified_date":"2026-09-14"},{"code":"north_america_delivery","label":"North America delivery","state":"proven","evidence_source_ids":["src_financial_services_fin_209"],"verified_date":"2026-09-14"},{"code":"global_delivery","label":"Global delivery","state":"partial","evidence_source_ids":["src_financial_services_fs_022"],"verified_date":"2026-09-14"}],"sources":[{"id":"src_financial_services_fs_022","workbook_source_id":"FIN-192","url":"https://www.cloudflare.com/solutions/financial-services/","title":"Cloudflare for Financial Services","publisher":"cloudflare.com","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"low","record_type":"Financial services solution page","requirement_codes":["data_residency_and_sovereignty"],"named_customer":null,"segment":"Multiple","named_product_or_service":"Cloudflare (Bot Management, API Shield, WAF, DDoS protection, Workers AI, AI Gateway)","service_family":"Supporting only","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":null,"regulatory_regime":"Not stated","exact_supporting_wording":"Cloudflare empowers over 1,700 financial services organizations to deliver secure digital experiences","reviewer_summary":"Cloudflare states it serves over 1,700 financial services organisations and lists application security products; no SD-WAN/SASE product is named on this page and no individual customer is described.","limitation_and_notes":"Generic industry solutions page with no named customer and no Cloudflare One/Magic WAN/Access naming; does not prove any deployment, only market presence and a generic sovereignty mention."},{"id":"src_financial_services_fin_193","workbook_source_id":"FIN-193","url":"https://www.cloudflare.com/case-studies/investec/","title":"Investec & Cloudflare | Case Study | Cloudflare","publisher":"cloudflare.com","publication_date":null,"checked_date":"2026-09-12","source_ownership":"customer_authored","decision":"accepted","reviewer_confidence":"medium","record_type":"Named customer case study","requirement_codes":["identity_and_zero_trust_access","uk_delivery"],"named_customer":"Investec","segment":"Multiple","named_product_or_service":"Cloudflare Workers, Cloudflare Access, Cloudflare Application Services","service_family":"Multiple","estate":null,"countries_or_regions":"South Africa, United Kingdom","ot_or_production_environment":null,"measured_or_stated_outcome":"Cloudflare makes us proactive rather than reactive","industrial_standard_or_regulation":null,"regulatory_regime":"Multiple","exact_supporting_wording":"Cloudflare makes us proactive rather than reactive - we can take a long-term strategic approach to security while remaining nimble","reviewer_summary":"Investec, an international bank operating from South Africa and the UK, uses Cloudflare Access and Workers to secure its Programmable Banking platform and open banking APIs.","limitation_and_notes":"This is an application security and API case study, not a branch network, SD-WAN or Magic WAN deployment; it does not evidence trading connectivity, branch connectivity or resilience testing."},{"id":"src_financial_services_fin_194","workbook_source_id":"FIN-194","url":"https://www.cloudflare.com/trust-hub/","title":"Cloudflare Trust Hub | Cloudflare","publisher":"cloudflare.com","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"medium","record_type":"Compliance attestation or statement","requirement_codes":["pci_dss_alignment"],"named_customer":null,"segment":"Unspecified","named_product_or_service":"Cloudflare platform","service_family":"Multiple","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":"ISO 27001, ISO 27701, PCI DSS, SOC 2 Type II","regulatory_regime":"Not stated","exact_supporting_wording":"Cloudflare protects our customers and their users by complying with a wide range of important security certifications. Explore our posture around ISO 27001, ISO 27701, PCI DSS, SOC 2 Type II, and others.","reviewer_summary":"Cloudflare's Trust Hub landing page lists the certifications it holds and links to detail pages, without naming individual products against each certification on this page.","limitation_and_notes":"A certification list without a named product or FS customer; supports Partial evidence only for regulatory columns on its own, superseded by the dedicated PCI DSS page for column 24."},{"id":"src_financial_services_fin_195","workbook_source_id":"FIN-195","url":"https://www.cloudflare.com/case-studies/bank-of-cyprus/","title":"Bank of Cyprus & Cloudflare | Customer Story","publisher":"cloudflare.com","publication_date":null,"checked_date":"2026-09-12","source_ownership":"customer_authored","decision":"accepted","reviewer_confidence":"high","record_type":"Named customer case study","requirement_codes":["data_centre_colocation_and_cloud_connectivity","resilience_and_tested_recovery"],"named_customer":"Bank of Cyprus","segment":"Retail banking","named_product_or_service":"Magic Transit, Network Firewall, Cloudflare Network Interconnect","service_family":"Multiple","estate":null,"countries_or_regions":"Cyprus","ot_or_production_environment":null,"measured_or_stated_outcome":"Automatic DDoS mitigation in ~5 seconds; large-scale attacks blocked in 3 months without manual intervention","industrial_standard_or_regulation":null,"regulatory_regime":"EU","exact_supporting_wording":"The peace of mind is priceless, and our experience with Cloudflare and Parsectix has contributed significantly to achieving that.","reviewer_summary":"Bank of Cyprus, supervised directly by the European Central Bank, uses Magic Transit, Network Firewall and Cloudflare Network Interconnect to mitigate DDoS attacks automatically and maintain service continuity.","limitation_and_notes":"Evidences network interconnect and DDoS resilience, not SD-WAN branch connectivity, trading connectivity, segmentation or RTO/RPO-style disaster recovery testing."},{"id":"src_financial_services_fin_197","workbook_source_id":"FIN-197","url":"https://www.cloudflare.com/trust-hub/compliance-resources/pci-dss/","title":"PCI DSS 4.0 FAQs | Cloudflare","publisher":"cloudflare.com","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"high","record_type":"Compliance attestation or statement","requirement_codes":["pci_dss_alignment"],"named_customer":null,"segment":"Unspecified","named_product_or_service":"Cloudflare (Application Security, Application Performance, Zero Trust Services, Network Services, Developer Platform)","service_family":"Multiple","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":"PCI DSS 4.0","regulatory_regime":"Not stated","exact_supporting_wording":"Cloudflare maintains PCI DSS Level 1 compliance for certain products","reviewer_summary":"Cloudflare documents PCI DSS Level 1 compliance, audited annually since 2014, and lists Zero Trust Services (Access, Gateway, Tunnel), Network Services (WAN, Magic Transit, Network Firewall) and other product groups as in scope.","limitation_and_notes":"Confirms PCI DSS scope for named product categories but does not describe cardholder data environment segmentation and does not name an FS customer using it."},{"id":"src_financial_services_fin_198","workbook_source_id":"FIN-198","url":"https://www.cloudflare.com/network-services/products/magic-wan/","title":"Magic WAN | Any-to-any connectivity | Cloudflare","publisher":"cloudflare.com","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"medium","record_type":"Financial services solution page","requirement_codes":["data_centre_colocation_and_cloud_connectivity","branch_and_office_connectivity"],"named_customer":null,"segment":"Unspecified","named_product_or_service":"Cloudflare WAN (Magic WAN)","service_family":"SD-WAN","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":null,"regulatory_regime":"Not stated","exact_supporting_wording":"Facilitate site-to-site connectivity across network locations like branch offices, retail locations, and factory floors with Cloudflare WAN connectors.","reviewer_summary":"Cloudflare's Magic WAN (SD-WAN) product page describes branch site-to-site connectivity and hybrid/multi-cloud routing, listing named customers such as RATP, Japan Airlines and JetBlue but no financial services customer.","limitation_and_notes":"No named financial institution uses Magic WAN on this page, so it is Partial-strength generic product evidence only, not proof of an FS deployment."},{"id":"src_financial_services_fin_200","workbook_source_id":"FIN-200","url":"https://www.cloudflare.com/trust-hub/compliance-resources/uk-operational-resilience/","title":"UK Operational Resilience FAQs | Cloudflare","publisher":"cloudflare.com","publication_date":null,"checked_date":"2026-09-15","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"medium","record_type":"Compliance attestation or statement","requirement_codes":["uk_regulatory_alignment_fca_and_pra"],"named_customer":null,"segment":"Unspecified","named_product_or_service":"Cloudflare's connectivity cloud platform","service_family":"Multiple","estate":null,"countries_or_regions":"United Kingdom","ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":"SS1/21, SS2/21, UK Critical Third Parties (CTP) regime","regulatory_regime":"UK","exact_supporting_wording":"While Cloudflare, a technology provider, is not directly regulated by the PRA, Cloudflare designs its network and services with resilience, transparency, and security to help its customers meet their regulatory obligations.","reviewer_summary":"Cloudflare's compliance page explains the FCA/PRA operational resilience regime (SS1/21, SS2/21) and the UK Critical Third Parties regime and states how Cloudflare's platform and contractual model relate to them.","limitation_and_notes":"Checker 2026-09-12: page carries the fact but the wording differs (Underlying content present but as three separate distinct sentences in FAQ, not as a single combined quote with ellipses.). Re-quote verbatim. Discusses the regime and Cloudflare's platform generically rather than naming Cloudflare One or Magic WAN specifically, and does not cite a named FS customer applying it. [2026-09-15] Re-quoted verbatim from live page."},{"id":"src_financial_services_fin_201","workbook_source_id":"FIN-201","url":"https://www.cloudflare.com/data-localization/","title":"Cloudflare Data Localization Suite | Cloudflare","publisher":"cloudflare.com","publication_date":null,"checked_date":"2026-09-15","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"high","record_type":"Compliance attestation or statement","requirement_codes":["data_residency_and_sovereignty","encryption_and_key_management"],"named_customer":null,"segment":"Unspecified","named_product_or_service":"Cloudflare Data Localization Suite (Customer Metadata Boundary, Keyless SSL, Geo Key Manager, Regional Services)","service_family":"Multiple","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":null,"regulatory_regime":"Not stated","exact_supporting_wording":"Keyless SSL and Geo Key Manager store private SSL keys in a user-specified region. / Customer Metadata Boundary ensures that logs do not leave the specified region.","reviewer_summary":"Cloudflare's Data Localization Suite names specific products (Customer Metadata Boundary, Keyless SSL, Geo Key Manager) that keep logs and private keys within a chosen region, covering Zero Trust, Network Services and other product families.","limitation_and_notes":"Checker 2026-09-12: page carries the fact but the wording differs (Both clauses present individually as separate bullet points, in reverse order, not combined as one sentence.). Re-quote verbatim. Confirms the mechanism and named products but this page does not itself list which specific regions (UK, EU, US, Canada) are supported, directing readers to the Trust Hub instead. [2026-09-15] Re-quoted verbatim as two separate bullet points from the live page, matching the checker's finding."},{"id":"src_financial_services_fin_202","workbook_source_id":"FIN-202","url":"https://cf-assets.www.cloudflare.com/slt3lc6tev37/ViEUAx1zxG5eXNp8i4ajd/3fb244ea97d604ac83fd74893d093432/Cloudflare_DORA_Mapping__1_.pdf","title":"EU - Digital Operational Resilience Act (DORA) mapping","publisher":"cf-assets.www.cloudflare.com","publication_date":null,"checked_date":"2026-09-15","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"high","record_type":"Compliance attestation or statement","requirement_codes":["incident_notification_support","eu_dora_alignment"],"named_customer":null,"segment":"Unspecified","named_product_or_service":"Cloudflare Enterprise Subscription Services","service_family":"Multiple","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":"DORA (Article 30)","regulatory_regime":"EU","exact_supporting_wording":"This document is designed to help Cloudflare customers who are a financial entity according to the EU Regulation 2022/2554 Digital Operational Resilience Act (\"DORA\")... to understand how Cloudflare's Enterprise Subscription Terms of Service (\"ToS\") and its appendices address the key contractual provisions stated under Article 30 of the DORA.","reviewer_summary":"Cloudflare's DORA mapping document walks through Article 30(1)-(3) contractual requirements and matches them to its Enterprise Subscription Terms, SLA availability commitment, breach notification and annual business continuity framework maintenance.","limitation_and_notes":"Checker 2026-09-12: page carries the fact but the wording differs (Two related but separate sentences exist; combined quote omits 'of the breach' and post-incident assessment language, and business continuity sentence is separa). Re-quote verbatim. Maps the contract terms to DORA Article 30 but does not name Cloudflare One or Magic WAN specifically and is not tied to a named EU financial institution customer. [2026-09-15] Re-quoted verbatim from the live PDF's opening paragraph, which maps specific ToS sections clause-by-clause to Article 30 sub-provisions."},{"id":"src_financial_services_fin_203","workbook_source_id":"FIN-203","url":"https://www.cloudflare.com/enterprise-support-sla/","title":"Enterprise Subscription Service Level Agreement | Cloudflare","publisher":"cloudflare.com","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"high","record_type":"Compliance attestation or statement","requirement_codes":["resilience_and_tested_recovery","incident_notification_support"],"named_customer":null,"segment":"Unspecified","named_product_or_service":"Cloudflare Enterprise Subscription","service_family":"Multiple","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":null,"regulatory_regime":"Not stated","exact_supporting_wording":"The Service will serve Customer Content globally 100% of the time.","reviewer_summary":"Cloudflare's Enterprise SLA commits to 100% availability with service credits up to six months of fees, and sets P1 response times of under 1 hour for Premium Support and 30 minutes for Technical Account Management.","limitation_and_notes":"General enterprise contractual SLA, not specific to Magic WAN or Cloudflare One, and not tied to a named FS customer or a tested DR/RTO-RPO exercise."},{"id":"src_financial_services_fin_204","workbook_source_id":"FIN-204","url":"https://developers.cloudflare.com/logs/logpull/enabling-log-retention/","title":"Enabling log retention - Cloudflare Logs docs","publisher":"developers.cloudflare.com","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"low","record_type":"Other","requirement_codes":["logging_audit_and_evidence_retention"],"named_customer":null,"segment":"Unspecified","named_product_or_service":"Cloudflare Logpull API","service_family":"Supporting only","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":null,"regulatory_regime":"Not stated","exact_supporting_wording":"By default, your HTTP request logs are not retained.","reviewer_summary":"Cloudflare documents that HTTP request log retention via Logpull must be explicitly enabled and is off by default, without stating a specific retention period on this page.","limitation_and_notes":"Explains the retention toggle mechanism only; it does not state a specific retention duration in days, so on its own it only Partially supports the logging/retention column."},{"id":"src_financial_services_fin_205","workbook_source_id":"FIN-205","url":"https://www.cloudflare.com/gdpr/subprocessors/","title":"Cloudflare Sub-Processors | Cloudflare","publisher":"cloudflare.com","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"medium","record_type":"Compliance attestation or statement","requirement_codes":["concentration_risk_and_subcontractor_transparency"],"named_customer":null,"segment":"Unspecified","named_product_or_service":"Cloudflare services and professional services","service_family":"Not relevant","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":null,"regulatory_regime":"Not stated","exact_supporting_wording":"Any sub-processor that processes our customers' personal data undergoes a thorough information security and privacy review process.","reviewer_summary":"Cloudflare publishes separate sub-processor lists for its services and for professional services, and states each sub-processor undergoes a security and privacy review.","limitation_and_notes":"Confirms a published sub-processor list exists but this landing page does not itself show the list, a change-notification process, or customer audit rights, and is not FS-specific."},{"id":"src_financial_services_fin_206","workbook_source_id":"FIN-206","url":"https://www.cloudflare.com/cloudflare-customer-dpa/","title":"Cloudflare Data Processing Addendum | Cloudflare","publisher":"cloudflare.com","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"medium","record_type":"Compliance attestation or statement","requirement_codes":["third_party_and_outsourced_access","exit_and_portability"],"named_customer":null,"segment":"Unspecified","named_product_or_service":"Cloudflare Services (Data Processing Addendum)","service_family":"Not relevant","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":null,"regulatory_regime":"Not stated","exact_supporting_wording":"following termination or expiry of the Main Agreement or completion of the Service, at the choice of Customer, delete or return all Personal Data (including copies thereof) processed pursuant to this DPA","reviewer_summary":"Cloudflare's DPA commits to deleting or returning customer personal data at the customer's choice on termination, and separately authorises Cloudflare Group entities and named categories of third parties to act as sub-processors.","limitation_and_notes":"Data return/deletion clause is contractual and generic across all customers, not FS-specific; sub-processor authorisation language does not describe FS-specific third-party or contractor access controls."},{"id":"src_financial_services_fin_208","workbook_source_id":"FIN-208","url":"https://www.cloudflare.com/case-studies/moneybox/","title":"Moneybox | Case Study | Cloudflare","publisher":"cloudflare.com","publication_date":null,"checked_date":"2026-09-12","source_ownership":"customer_authored","decision":"accepted","reviewer_confidence":"high","record_type":"Named customer case study","requirement_codes":["identity_and_zero_trust_access","remote_and_hybrid_workforce","uk_delivery"],"named_customer":"Moneybox","segment":"Asset and wealth management","named_product_or_service":"Cloudflare Access, Cloudflare Zero Trust","service_family":"SASE","estate":"300+ employees","countries_or_regions":"United Kingdom","ot_or_production_environment":null,"measured_or_stated_outcome":"Least privilege access to applications they need to do their job","industrial_standard_or_regulation":null,"regulatory_regime":"UK","exact_supporting_wording":"The Cloudflare Zero Trust platform delivers the high level of security required by a company operating in the financial services space.","reviewer_summary":"Moneybox, a UK digital wealth management platform with over 750,000 customers, uses Cloudflare Access and Zero Trust to give its 300+ staff least-privilege remote access, moving all employees to secure remote work during the pandemic.","limitation_and_notes":"Covers workforce identity and remote access only; does not evidence branch connectivity, trading connectivity, segmentation or DR testing."},{"id":"src_financial_services_fin_209","workbook_source_id":"FIN-209","url":"https://www.cloudflare.com/case-studies/luana-savings-bank/","title":"Luana Savings Bank & Cloudflare | Case Study","publisher":"cloudflare.com","publication_date":null,"checked_date":"2026-09-12","source_ownership":"customer_authored","decision":"accepted","reviewer_confidence":"high","record_type":"Named customer case study","requirement_codes":["resilience_and_tested_recovery","identity_and_zero_trust_access","north_america_delivery"],"named_customer":"Luana Savings Bank","segment":"Retail banking","named_product_or_service":"Cloudflare Browser Isolation, Cloudflare Zero Trust","service_family":"SASE","estate":"six branches, 100+ employees, approximately $2 billion in assets","countries_or_regions":"United States (Iowa)","ot_or_production_environment":null,"measured_or_stated_outcome":"Zero malware infections for seven years; 100% uptime with Cloudflare, up from 96% with the previous provider","industrial_standard_or_regulation":null,"regulatory_regime":"US","exact_supporting_wording":"Malicious code doesn't hit our computers. Browser Isolation is the quickest and easiest way we can deal with malware issues.","reviewer_summary":"Luana Savings Bank, a $2 billion Iowa bank with six branches, uses Cloudflare Browser Isolation and Zero Trust, reporting zero malware infections for seven years and 100% uptime, up from 96% previously.","limitation_and_notes":"The six branches are named but Cloudflare's role is endpoint/browser isolation, not a branch network SD-WAN connectivity product, so it is not usable for the branch connectivity column."},{"id":"src_financial_services_fin_210","workbook_source_id":"FIN-210","url":"https://developers.cloudflare.com/reference-architecture/diagrams/security/fips-140-3/","title":"FIPS 140 level 3 compliance with Cloudflare Application Services","publisher":"developers.cloudflare.com","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"medium","record_type":"Other","requirement_codes":["encryption_and_key_management"],"named_customer":null,"segment":"Unspecified","named_product_or_service":"Cloudflare Keyless SSL, Cloudflare Tunnel","service_family":"Supporting only","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":"FIPS 140 Level 3","regulatory_regime":"Not stated","exact_supporting_wording":"This document outlines a reference architecture for achieving Federal Information Processing Standard (FIPS) 140 Level 3 compliance using Cloudflare's Application Services.","reviewer_summary":"Cloudflare's reference architecture shows how Keyless SSL and Tunnel can be combined with a customer-managed, third-party validated HSM (AWS CloudHSM, Azure Key Vault or Google Cloud KMS) so the private key never leaves the FIPS 140 Level 3 validated hardware.","limitation_and_notes":"The FIPS 140 Level 3 validation belongs to the third-party HSM, not to a Cloudflare-owned cryptographic module, so this is architecture guidance rather than a Cloudflare FIPS certification."},{"id":"src_financial_services_fin_211","workbook_source_id":"FIN-211","url":"https://developers.cloudflare.com/cloudflare-one/insights/logs/","title":"Logs - Cloudflare One docs","publisher":"developers.cloudflare.com","publication_date":null,"checked_date":"2026-09-15","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"high","record_type":"Other","requirement_codes":["logging_audit_and_evidence_retention"],"named_customer":null,"segment":"Unspecified","named_product_or_service":"Cloudflare One","service_family":"SASE","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":null,"regulatory_regime":"Not stated","exact_supporting_wording":"Cloudflare stores Zero Trust logs for different periods of time based on the service and plan type. Admin logs: 18 months (all plans).","reviewer_summary":"Cloudflare One documentation states Gateway DNS, HTTP, Network and Access log retention ranges from 24 hours up to 180 days depending on plan (180 days on Enterprise), with Admin/audit logs retained for 18 months across all plans, and supports Logpush export.","limitation_and_notes":"Checker 2026-09-12: page carries the fact but the wording differs (Page phrasing is 'Cloudflare stores Zero Trust logs for different periods...' plus a table showing Admin logs = 18 months; not phrased as the quoted ellipsis se). Re-quote verbatim. Confirms named-product (Cloudflare One) retention periods and Logpush export, but is generic documentation, not tied to a named FS customer's actual retention configuration. [2026-09-15] Re-quoted verbatim from the live developer docs page and its retention table."},{"id":"src_financial_services_fin_212","workbook_source_id":"FIN-212","url":"https://www.cloudflare.com/zero-trust/products/dlp/","title":"Cloudflare Data Loss Prevention (DLP) | Secure sensitive data | Cloudflare","publisher":"cloudflare.com","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"low","record_type":"Other","requirement_codes":["cloud_and_saas_data_controls"],"named_customer":null,"segment":"Unspecified","named_product_or_service":"Cloudflare DLP, CASB (Cloudflare One)","service_family":"SASE","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":null,"regulatory_regime":"Not stated","exact_supporting_wording":"works together with CASB to scan connected SaaS applications and cloud storage environments to identify exposed sensitive data at rest","reviewer_summary":"Cloudflare's DLP product, part of the SASE/Zero Trust family, works with CASB to scan SaaS applications and outbound traffic for sensitive data such as PII, with no financial services context on this page.","limitation_and_notes":"Generic product capability page with no financial services customer or PCI/PII-specific compliance claim, so it only Partially supports the cloud and SaaS data controls column."},{"id":"src_financial_services_fin_196","workbook_source_id":"FIN-196","url":"https://www.cloudflare.com/case-studies/nyc-government-financial-agency/","title":"NYC Government Financial Agency & Cloudflare | Customer Story | Cloudflare","publisher":"cloudflare.com","publication_date":null,"checked_date":"2026-09-12","source_ownership":"customer_authored","decision":"rejected","reviewer_confidence":"low","record_type":"Named customer case study","requirement_codes":[],"named_customer":null,"segment":"Unspecified","named_product_or_service":"Cloudflare WAF, DDoS Protection","service_family":"Supporting only","estate":"300,000+ community members served","countries_or_regions":"United States","ot_or_production_environment":null,"measured_or_stated_outcome":"Attack volume reduced by over 90% immediately; blocks approximately 500 million malicious requests monthly","industrial_standard_or_regulation":null,"regulatory_regime":"US","exact_supporting_wording":"Zero Trust is the only way to achieve a manageable level of security assurance.","reviewer_summary":"An unnamed NYC government financial agency used Cloudflare WAF and DDoS protection to stop a credential-stuffing attack and is exploring Cloudflare Access and Cloudflare One Client.","limitation_and_notes":"The institution is anonymised (a public-sector agency, not a named financial institution), the case study is about web application attack mitigation, and Cloudflare One/Access adoption is only described as being explored, not implemented; not usable for any of the 28 columns."},{"id":"src_financial_services_fin_199","workbook_source_id":"FIN-199","url":"https://www.cloudflare.com/lp/dora-compliance-fortifying-financial-security-and-resilience-with-cloudflare/","title":"DORA compliance: Fortifying financial security and resilience with Cloudflare","publisher":"cloudflare.com","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"rejected","reviewer_confidence":"low","record_type":"Financial services solution page","requirement_codes":[],"named_customer":null,"segment":"Unspecified","named_product_or_service":"Cloudflare","service_family":"Not relevant","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":"DORA","regulatory_regime":"Not stated","exact_supporting_wording":"Mapping DORA requirements to Cloudflare capabilities - See how Cloudflare's solutions align with DORA's five key pillars and multitude of requirements.","reviewer_summary":"A gated landing page promoting a DORA whitepaper; the substantive DORA-to-product mapping is contained in a separate downloadable PDF, not in the page content itself.","limitation_and_notes":"No specific product names, article references or facts are present on the page itself; the actual DORA mapping evidence comes from the separate PDF document, which is recorded as its own source row."},{"id":"src_financial_services_fin_207","workbook_source_id":"FIN-207","url":"https://www.cloudflare.com/the-net/securing-financial-services/","title":"theNET | Digital transformation in banking & financial services | Cloudflare","publisher":"cloudflare.com","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"rejected","reviewer_confidence":"low","record_type":"Financial services solution page","requirement_codes":[],"named_customer":null,"segment":"Unspecified","named_product_or_service":"Cloudflare connectivity cloud","service_family":"Not relevant","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":"GDPR, PSD2","regulatory_regime":"Not stated","exact_supporting_wording":"The Payment Services Directive (PSD2) are encouraging banks to adopt digital solutions","reviewer_summary":"An industry thought-leadership article discussing threats to banks (citing breaches at TD Bank, Santander, DBS Bank and others as third-party incidents, not Cloudflare customers) and referencing GDPR and PSD2 generically.","limitation_and_notes":"The named institutions are breach examples unrelated to Cloudflare, not Cloudflare customers; no Cloudflare One, Magic WAN or Access product is named, so this cannot support any of the 28 columns."},{"id":"src_financial_services_fs_021","workbook_source_id":"FS-021","url":"https://www.cloudflare.com/sase/","title":"Cloudflare | The agile SASE platform (Cloudflare One SASE product page)","publisher":"cloudflare.com","publication_date":null,"checked_date":"2026-07-29","source_ownership":"provider_authored","decision":"superseded","reviewer_confidence":"high","record_type":"Existing source lead","requirement_codes":[],"named_customer":null,"segment":"To review","named_product_or_service":"Cloudflare One","service_family":"SASE","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":null,"regulatory_regime":null,"exact_supporting_wording":"Cloudflare empowers over 1,700 financial services organizations to deliver secure digital experiences while meeting data sovereignty, regulatory, and resiliency requirements.","reviewer_summary":"Dedicated financial services industry page with a quantified customer count and named financial logos (Visa, SoFi, NCR Voyix, Stripe). The 1,700 figure is vendor self reported and unaudited. No SASE specific financial services case study was found; the named testimonial on the page is from Shopify, a commerce platform rather than a bank.","limitation_and_notes":"Tier 1 supplier page. Primary SASE positioning page named in the brief. Carries the 300+ cities SASE delivery claim, the single global per-seat pricing claim and a large customer logo wall. Logo wall carries no sector labels, so it supports named customers but not sector grading on its own. | New Source: https://www.cloudflare.com/solutions/financial-services"}]},{"slug":"zscaler","name":"Zscaler","marketplace_url":"https://netify.co.uk/marketplace/zscaler/","research_status":"complete","overall_confidence":"medium","fit_conclusion":"Zscaler has strong, named evidence of financial services customers using its SASE platform (ZIA, ZPA, ZDX, Zero Trust Exchange) for branch and campus connectivity, cloud/data-centre on-ramps, zero trust segmentation and remote workforce access, with Hastings Direct as the strongest UK case and Fannie Mae and OneMain Financial as the strongest US cases. Encryption (FIPS 140-2 for ZIA/ZPA) and data residency architecture are documented at the platform level, and a sub-processor list is published with notification and objection rights. The main limitation is regulatory: no page connects the named service to FCA/PRA rules, US banking-specific regimes (FFIEC, GLBA, NYDFS, SEC), or OSFI, and the one DORA reference concerns a separate DSPM product without a named EU institution. There is also no evidence of trading/low-latency use, managed SOC service, incident notification commitments, or exit/portability terms for financial services customers. An IT decision maker in a regulated FS firm would need to request FCA/DORA/NYDFS-specific compliance statements and a PCI DSS Attestation of Compliance directly from Zscaler, as none were found published for the named service in this evidence set.","gaps_and_unknowns":"No evidence was found for trading/low-latency connectivity, managed operations/SOC, change control governance, incident notification timelines, exit and portability terms, or any of the UK, US, or Canada regulatory alignment columns; closing these would need direct FCA/PRA, FFIEC/NYDFS/SEC and OSFI compliance statements from Zscaler naming the service, an incident-notification clause from its contract or DPA, and a named FS customer case describing a managed SOC or tested DR/failover exercise. PCI DSS alignment and EU DORA alignment are only Partial and would need a PCI DSS Attestation of Compliance naming ZIA/ZPA/Zero Trust Exchange, and a DORA statement or EU FS case naming that same core service rather than the separate DSPM product.","reviewed_by":"Harry Yelland","reviewed_date":"2026-09-14","source_count":18,"accepted_source_count":14,"requirements":[{"code":"branch_and_office_connectivity","label":"Branch and office connectivity","state":"proven","evidence_source_ids":["src_financial_services_fin_485"],"verified_date":"2026-09-14"},{"code":"trading_and_low_latency_connectivity","label":"Trading and low-latency connectivity","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"data_centre_colocation_and_cloud_connectivity","label":"Data-centre, colocation and cloud connectivity","state":"proven","evidence_source_ids":["src_financial_services_fin_475","src_financial_services_fin_476","src_financial_services_fin_485"],"verified_date":"2026-09-14"},{"code":"resilience_and_tested_recovery","label":"Resilience and tested recovery","state":"partial","evidence_source_ids":["src_financial_services_fin_479"],"verified_date":"2026-09-14"},{"code":"network_segmentation_and_zoning","label":"Network segmentation and zoning","state":"proven","evidence_source_ids":["src_financial_services_fin_474","src_financial_services_fin_476"],"verified_date":"2026-09-14"},{"code":"payment_and_cardholder_data_segmentation","label":"Payment and cardholder data segmentation","state":"partial","evidence_source_ids":["src_financial_services_fin_484"],"verified_date":"2026-09-14"},{"code":"third_party_and_outsourced_access","label":"Third-party and outsourced access","state":"partial","evidence_source_ids":["src_financial_services_fin_480"],"verified_date":"2026-09-14"},{"code":"remote_and_hybrid_workforce","label":"Remote and hybrid workforce","state":"proven","evidence_source_ids":["src_financial_services_fin_474","src_financial_services_fin_476","src_financial_services_fin_485"],"verified_date":"2026-09-14"},{"code":"data_residency_and_sovereignty","label":"Data residency and sovereignty","state":"partial","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"encryption_and_key_management","label":"Encryption and key management","state":"proven","evidence_source_ids":["src_financial_services_fin_477","src_financial_services_fin_482"],"verified_date":"2026-09-14"},{"code":"logging_audit_and_evidence_retention","label":"Logging, audit and evidence retention","state":"partial","evidence_source_ids":["src_financial_services_fin_487"],"verified_date":"2026-09-14"},{"code":"identity_and_zero_trust_access","label":"Identity and zero trust access","state":"partial","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"cloud_and_saas_data_controls","label":"Cloud and SaaS data controls","state":"partial","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"managed_operations_and_soc","label":"Managed operations and SOC","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"network_visibility_and_reporting","label":"Network visibility and reporting","state":"proven","evidence_source_ids":["src_financial_services_fin_486"],"verified_date":"2026-09-14"},{"code":"change_control_and_configuration_governance","label":"Change control and configuration governance","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"incident_notification_support","label":"Incident notification support","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"concentration_risk_and_subcontractor_transparency","label":"Concentration risk and subcontractor transparency","state":"proven","evidence_source_ids":["src_financial_services_fin_480"],"verified_date":"2026-09-14"},{"code":"exit_and_portability","label":"Exit and portability","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"uk_regulatory_alignment_fca_and_pra","label":"UK regulatory alignment (FCA and PRA)","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"eu_dora_alignment","label":"EU DORA alignment","state":"partial","evidence_source_ids":["src_financial_services_fin_478"],"verified_date":"2026-09-14"},{"code":"us_regulatory_alignment_ffiec_glba_nydfs_sec","label":"US regulatory alignment (FFIEC, GLBA, NYDFS, SEC)","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"canada_regulatory_alignment_osfi","label":"Canada regulatory alignment (OSFI)","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"pci_dss_alignment","label":"PCI DSS alignment","state":"partial","evidence_source_ids":["src_financial_services_fin_477"],"verified_date":"2026-09-14"},{"code":"swift_csp_alignment","label":"SWIFT CSP alignment","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"uk_delivery","label":"UK delivery","state":"proven","evidence_source_ids":["src_financial_services_fin_474"],"verified_date":"2026-09-14"},{"code":"north_america_delivery","label":"North America delivery","state":"proven","evidence_source_ids":["src_financial_services_fin_475","src_financial_services_fin_485"],"verified_date":"2026-09-14"},{"code":"global_delivery","label":"Global delivery","state":"proven","evidence_source_ids":["src_financial_services_fs_080","src_financial_services_fin_476","src_financial_services_fin_486"],"verified_date":"2026-09-14"}],"sources":[{"id":"src_financial_services_fs_080","workbook_source_id":"FIN-473","url":"https://www.zscaler.com/industries/financial-services","title":"Zscaler for Financial Services","publisher":"zscaler.com","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"medium","record_type":"Financial services solution page","requirement_codes":["global_delivery"],"named_customer":null,"segment":"Multiple","named_product_or_service":"Zscaler Zero Trust Exchange","service_family":"SASE","estate":null,"countries_or_regions":"Multiple (customers named include UK, US, South Africa, India)","ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":null,"regulatory_regime":"Multiple","exact_supporting_wording":"Compliance mandates like GDPR, PCI DSS, and SOX put friction on innovation","reviewer_summary":"Zscaler's financial services industry page names Fannie Mae, Hastings Direct, Capitec and L&T Financial Services as customers and lists Zero Trust Exchange, ZIA, ZPA, Zero Trust Branch and other products, but gives no per-institution deployment detail on this page itself.","limitation_and_notes":"Generic industry page; does not itself prove any single capability with FS-specific detail beyond naming customers across UK, US, South Africa and India, which is used only as supporting evidence for global spread of named FS deployments."},{"id":"src_financial_services_fin_474","workbook_source_id":"FIN-474","url":"https://www.zscaler.com/customers/hastings-direct","title":"Hastings Direct Case Study | Customer Stories | Zscaler","publisher":"zscaler.com","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"high","record_type":"Named customer case study","requirement_codes":["network_segmentation_and_zoning","remote_and_hybrid_workforce","uk_delivery"],"named_customer":"Hastings Direct","segment":"Insurance","named_product_or_service":"Zscaler Internet Access (ZIA), Zscaler Private Access (ZPA), Zscaler Digital Experience (ZDX)","service_family":"SASE","estate":"3.9 million policyholders; 4,500 employees and outsource partners","countries_or_regions":"United Kingdom (East Sussex)","ot_or_production_environment":null,"measured_or_stated_outcome":"2.5 billion transactions processed and 45 million policy violations prevented in a single quarter; 14,000+ threats blocked including 4,500 hidden in encrypted traffic","industrial_standard_or_regulation":null,"regulatory_regime":"UK","exact_supporting_wording":"no matter when or where our colleagues choose to work","reviewer_summary":"Hastings Direct, a UK insurer with 3.9 million policyholders, replaced legacy VPNs and proxies with ZIA, ZPA and ZDX, using ZPA to give users microsegmented access only to authorised resources.","limitation_and_notes":"Does not mention branch/office count, trading, PCI, DR/RTO-RPO testing, or any UK regulator (FCA/PRA) by name."},{"id":"src_financial_services_fin_475","workbook_source_id":"FIN-475","url":"https://www.zscaler.com/customers/fannie-mae","title":"Fannie Mae Case Study | Customer Stories | Zscaler","publisher":"zscaler.com","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"high","record_type":"Named customer case study","requirement_codes":["data_centre_colocation_and_cloud_connectivity","north_america_delivery"],"named_customer":"Fannie Mae","segment":"Market infrastructure","named_product_or_service":"Zscaler Internet Access (ZIA), Zscaler Zero Trust Exchange","service_family":"SASE","estate":"7,400+ US employees; 10,000 employees targeted for direct-to-internet access","countries_or_regions":"United States","ot_or_production_environment":null,"measured_or_stated_outcome":"Reduced IT complexity from 38 data replication models to 2; eliminated network backhauling with local internet breakouts","industrial_standard_or_regulation":null,"regulatory_regime":"US","exact_supporting_wording":"When you make that shift to Microsoft 365 while still backhauling everyone's traffic to HQ, the bandwidth usage goes through the roof.","reviewer_summary":"Fannie Mae, described as part of the nation's critical financial infrastructure, used ZIA to give employees direct internet access to Microsoft 365 and is migrating security infrastructure toward AWS.","limitation_and_notes":"No RTO/RPO or tested DR outcome stated; no named US regulation (FFIEC, GLBA, NYDFS, SEC) referenced; segmentation and PCI not discussed."},{"id":"src_financial_services_fin_476","workbook_source_id":"FIN-476","url":"https://www.zscaler.com/customers/capitec-bank-limited","title":"Capitec Bank Limited | Zscaler","publisher":"zscaler.com","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"high","record_type":"Named customer case study","requirement_codes":["data_centre_colocation_and_cloud_connectivity","network_segmentation_and_zoning","remote_and_hybrid_workforce","global_delivery"],"named_customer":"Capitec Bank Limited","segment":"Retail banking","named_product_or_service":"Zscaler Zero Trust Exchange, Zscaler Internet Access (ZIA), Zscaler Private Access (ZPA), Zscaler Digital Experience (ZDX), Zscaler Cloud Connector","service_family":"SASE","estate":"17,000 users protected; 860 branches; 15,450 employees; 21 million bank customers","countries_or_regions":"South Africa","ot_or_production_environment":null,"measured_or_stated_outcome":"744,758 security threats blocked and 125 million policy violations prevented annually; banking application migrated to AWS in 3 seconds with zero downtime","industrial_standard_or_regulation":null,"regulatory_regime":"Multiple","exact_supporting_wording":"users are never placed on the corporate network, which reduces the attack surface","reviewer_summary":"Capitec, South Africa's largest retail bank, used Zscaler Cloud Connector and ZPA/ZIA to migrate its banking application to AWS and to remove users from the corporate network as part of a zero trust rollout.","limitation_and_notes":"South Africa is outside the UK/North America scope of this evidence page so used only as global-delivery and general capability evidence, not for UK or NA delivery columns; no PCI or specific regulator named."},{"id":"src_financial_services_fin_477","workbook_source_id":"FIN-477","url":"https://compliance.zscaler.com/","title":"Zscaler's Compliance Center","publisher":"compliance.zscaler.com","publication_date":null,"checked_date":"2026-09-14","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"medium","record_type":"Compliance attestation or statement","requirement_codes":["encryption_and_key_management","pci_dss_alignment"],"named_customer":null,"segment":"Unspecified","named_product_or_service":"Zscaler Zero Trust Exchange platform","service_family":"Multiple","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":"SOC 2 Type 2; ISO/IEC 27001; ISO/IEC 27018:2019; PCI DSS; FIPS 140-2; FIPS 140-3; CSA STAR Level 2","regulatory_regime":"Not stated","exact_supporting_wording":"SOC 2 Type 2; SOC 3; ISO/IEC 27001; ISO/IEC 27018:2019; FIPS 140-2; FIPS 140-3; CSA STAR Level 2; PCI DSS","reviewer_summary":"Zscaler's compliance portal lists certifications and attestations held by the company, including SOC 2, ISO 27001/27018, PCI DSS, FIPS 140-2/140-3 and CSA STAR, without stating which specific product each certificate scopes.","limitation_and_notes":"Checker 2026-09-12: page carries the fact but the wording differs (All listed certifications individually confirmed on page but presented as separate list items/links, not as one semicolon-joined string.). Re-quote verbatim. Certificates are listed at company level without naming which service (ZIA/ZPA/Zero Trust Exchange) each attestation covers, and full certificate documents sit behind an authenticated portal not accessible here; not sufficient alone to prove PCI DSS AoC scope for a named service. [2026-09-15] Playwright fetch attempt 2026-09-15 was itself blocked by a Cloudflare bot-verification challenge ('Performing security verification') - this is not a script-rendering issue but active bot protection that a headless browser cannot pass. Manually opening this URL in a normal logged-in browser session is the only way to read it. [2026-09-14, Harry] Personally opened and confirmed live by Harry Yelland - the recorded wording matches the page/document exactly. This was previously unreachable by automation (bot-verification wall or unfetchable PDF)."},{"id":"src_financial_services_fin_478","workbook_source_id":"FIN-478","url":"https://www.zscaler.com/blogs/product-insights/how-zscaler-dspm-helps-europe-s-financial-sector-achieve-dora-compliance","title":"How Zscaler DSPM Helps Europe's Financial Sector Achieve DORA Compliance","publisher":"zscaler.com","publication_date":"2025-07-30","checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"medium","record_type":"Compliance attestation or statement","requirement_codes":["eu_dora_alignment"],"named_customer":null,"segment":"Unspecified","named_product_or_service":"Zscaler DSPM","service_family":"Supporting only","estate":null,"countries_or_regions":"European Union","ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":"DORA","regulatory_regime":"EU","exact_supporting_wording":"DORA emphasizes the importance of reducing risks introduced by third-party ICT service providers. Zscaler DSPM amplifies transparency","reviewer_summary":"A Zscaler blog post connects the Zscaler DSPM product to DORA's third-party ICT risk requirements, using a hypothetical EU financial institution rather than a named customer.","limitation_and_notes":"No named EU financial institution; the product discussed (DSPM) is a data security posture management add-on, not the core ZIA/ZPA/Zero Trust Exchange/Zero Trust SD-WAN service; does not cite specific DORA Article 30 contractual terms."},{"id":"src_financial_services_fin_479","workbook_source_id":"FIN-479","url":"https://www.zscaler.com/legal/sla-support","title":"Zscaler SLA Support | Service Level Agreement Documentation","publisher":"zscaler.com","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"high","record_type":"Compliance attestation or statement","requirement_codes":["resilience_and_tested_recovery"],"named_customer":null,"segment":"Unspecified","named_product_or_service":"Zscaler Internet Access (ZIA), Zscaler Private Access (ZPA), Zscaler Digital Experience (ZDX), Zscaler Zero Trust Branch","service_family":"Multiple","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":null,"regulatory_regime":"Not stated","exact_supporting_wording":"99.999% of Customer's Transactions and Sessions during every month","reviewer_summary":"Zscaler publishes SLA uptime commitments of 99.999% for ZIA, ZPA, ZDX and Zero Trust Branch, with tiered service credits and support response times ranging from 15 minutes to 48 hours depending on severity and plan.","limitation_and_notes":"This is an uptime/service-credit SLA, not a tested DR/failover outcome or RTO/RPO commitment, and it is not FS-specific; support response times are for support tickets, not security incident notification."},{"id":"src_financial_services_fin_480","workbook_source_id":"FIN-480","url":"https://www.zscaler.com/privacy-compliance/subprocessors","title":"Zscaler Sub-Processors: Security & Privacy Standards","publisher":"zscaler.com","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"high","record_type":"Compliance attestation or statement","requirement_codes":["concentration_risk_and_subcontractor_transparency","third_party_and_outsourced_access"],"named_customer":null,"segment":"Unspecified","named_product_or_service":"Zscaler Zero Trust Exchange platform","service_family":"Multiple","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":null,"regulatory_regime":"Not stated","exact_supporting_wording":"On this page, we maintain a current list of Sub-Processors authorized to process Customer Data","reviewer_summary":"Zscaler publishes a list of sub-processors including AWS, Azure, Google Cloud, Snowflake and Databricks, states it performs due diligence on them, and allows customers to register for change notices and to object to new sub-processors.","limitation_and_notes":"Generic company-wide sub-processor disclosure, not FS-specific; no explicit audit-rights clause quoted; does not name concentration-risk or multi-region independence statements beyond the sub-processor list itself."},{"id":"src_financial_services_fin_481","workbook_source_id":"FIN-481","url":"https://www.zscaler.com/blogs/product-insights/understanding-zscaler-s-approach-digital-sovereignty-modern-era","title":"Understanding Digital Sovereignty in the Modern Era","publisher":"zscaler.com","publication_date":"2025-07-01","checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"medium","record_type":"Compliance attestation or statement","requirement_codes":["data_residency_and_sovereignty"],"named_customer":null,"segment":"Unspecified","named_product_or_service":"Zscaler Zero Trust Exchange","service_family":"Multiple","estate":null,"countries_or_regions":"United States, European Union, and other regions via Private Service Edges","ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":"FedRAMP","regulatory_regime":"Multiple","exact_supporting_wording":"pseudonymized local logging through public hub sites for regional or in-country requirements","reviewer_summary":"Zscaler describes over 160 global data centres, a FedRAMP-authorised US GovCloud, an EU ZSCloud, and options for pseudonymised local logging, private on-premises logging infrastructure and sovereign sites, plus a 90-day emergency disconnect from the global cloud.","limitation_and_notes":"Does not explicitly name UK or Canada data residency regions; not FS-specific; describes architecture options rather than a guaranteed default residency for all customer log and management-plane data."},{"id":"src_financial_services_fin_482","workbook_source_id":"FIN-482","url":"https://ir.zscaler.com/news-releases/news-release-details/zscaler-security-cloud-receives-fips-140-2-validation-encryption","title":"Zscaler Security Cloud Receives FIPS 140-2 Validation for Encryption","publisher":"ir.zscaler.com","publication_date":"2018-04-11","checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"high","record_type":"Compliance attestation or statement","requirement_codes":["encryption_and_key_management"],"named_customer":null,"segment":"Unspecified","named_product_or_service":"Zscaler Internet Access (ZIA), Zscaler Private Access (ZPA)","service_family":"Multiple","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":"FIPS 140-2","regulatory_regime":"Not stated","exact_supporting_wording":"Zscaler, Inc. (NASDAQ: ZS), an industry leader in cloud security, is proud to announce the immediate availability of FIPS 140-2 validated encryption within Zscaler Internet Access (ZIA) and Zscaler Private Access (ZPA).","reviewer_summary":"Zscaler announced FIPS 140-2 validated encryption modules (Zscaler Mobile Cryptographic Module, certificate #3154, and Zscaler Crypto Module, certificate #3159) for ZIA and ZPA.","limitation_and_notes":"Press release is from 2018; does not confirm current FIPS 140-3 status of the present-day service, and is not FS-specific."},{"id":"src_financial_services_fin_484","workbook_source_id":"FIN-484","url":"https://www.zscaler.com/privacy-compliance/customer-compliance/pci-dss","title":"SASE Solutions for PCI DSS 4.0 Compliance & Enhanced Security","publisher":"zscaler.com","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"medium","record_type":"Financial services solution page","requirement_codes":["payment_and_cardholder_data_segmentation"],"named_customer":null,"segment":"Unspecified","named_product_or_service":"Zscaler Private Access (ZTNA)","service_family":"SSE","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":"PCI DSS 4.0","regulatory_regime":"Not stated","exact_supporting_wording":"With Zero Trust Network Access (ZTNA), Zscaler enforces least-privileged access and isolates payment systems from other business applications, minimizing unauthorized access.","reviewer_summary":"Zscaler's PCI DSS 4.0 page states that its ZTNA capability isolates payment systems from other business applications, but does not reference a PCI DSS Attestation of Compliance for a named service or cite a customer.","limitation_and_notes":"No named financial institution or PCI scope reduction outcome; no Attestation of Compliance referenced for ZIA/ZPA/Zero Trust Exchange; generic marketing-style compliance page."},{"id":"src_financial_services_fin_485","workbook_source_id":"FIN-485","url":"https://www.zscaler.com/customers/onemain-financial","title":"OneMain Financial Case Study | Customer Stories | Zscaler","publisher":"zscaler.com","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"high","record_type":"Named customer case study","requirement_codes":["data_centre_colocation_and_cloud_connectivity","branch_and_office_connectivity","remote_and_hybrid_workforce","north_america_delivery"],"named_customer":"OneMain Financial","segment":"Lending and consumer finance","named_product_or_service":"Zscaler Internet Access (ZIA), Zscaler Zero Trust Exchange, Zscaler Client Connector","service_family":"SASE","estate":"8,000+ employees across 1,400 branches in 44 states","countries_or_regions":"United States","ot_or_production_environment":null,"measured_or_stated_outcome":"96% of traffic experiences under 1ms latency with zero employee complaints post-migration; full SSL inspection of 96% of encrypted traffic","industrial_standard_or_regulation":null,"regulatory_regime":"US","exact_supporting_wording":"Using Zscaler now gives us the capability to route things directly out through the internet in our branches and campus location.","reviewer_summary":"OneMain Financial, a US consumer lender with 1,400 branches across 44 states, replaced Broadcom/Blue Coat proxy appliances with ZIA to give branch and campus locations direct internet breakout and centralised policy administration.","limitation_and_notes":"No PCI, segmentation detail, RTO/RPO, or US regulator (FFIEC, GLBA, NYDFS, SEC) named on this page."},{"id":"src_financial_services_fin_486","workbook_source_id":"FIN-486","url":"https://www.zscaler.com/customers/abanca","title":"ABANCA Case Study | Customer Stories | Zscaler","publisher":"zscaler.com","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"medium","record_type":"Named customer case study","requirement_codes":["network_visibility_and_reporting","global_delivery"],"named_customer":"ABANCA","segment":"Retail banking","named_product_or_service":"Zscaler Digital Experience (ZDX), Zscaler Internet Access (ZIA), Zscaler Zero Trust Exchange","service_family":"SASE","estate":"6,000+ employees","countries_or_regions":"Spain and 11 countries","ot_or_production_environment":null,"measured_or_stated_outcome":"Comprehensive global visibility into network traffic patterns and stronger controls for mission-critical applications","industrial_standard_or_regulation":null,"regulatory_regime":"EU","exact_supporting_wording":"Zscaler is clearly giving us an opportunity to model new capabilities and new architectures, while reducing complexity.","reviewer_summary":"ABANCA, a Spanish bank operating in 11 countries, deployed ZDX, ZIA and Zero Trust Exchange for global network visibility and detection of application-specific risk.","limitation_and_notes":"No DORA, branch count, PCI, or segmentation detail stated on this page; EU DORA alignment is not mentioned despite ABANCA being an EU bank."},{"id":"src_financial_services_fin_487","workbook_source_id":"FIN-487","url":"https://www.zscaler.com/resources/data-sheets/zscaler-nanolog-streaming-service.pdf","title":"Zscaler Nanolog Streaming Service data sheet","publisher":"zscaler.com","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"medium","record_type":"Compliance attestation or statement","requirement_codes":["logging_audit_and_evidence_retention"],"named_customer":null,"segment":"Unspecified","named_product_or_service":"Zscaler Nanolog Streaming Service (NSS)","service_family":"Supporting only","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":null,"regulatory_regime":"Not stated","exact_supporting_wording":"Transmit logs from all users and locations to the SIEM in real time","reviewer_summary":"The Nanolog Streaming Service data sheet describes real-time streaming of web and firewall logs to up to eight SIEM destinations with customer-chosen filters and formats, and refers to historical log analysis beyond six months, but does not state a fixed Zscaler-side log retention period.","limitation_and_notes":"No explicit fixed log retention period stated; log storage location is described as customer-determined rather than a documented Zscaler data residency commitment; not FS-specific."},{"id":"src_financial_services_fin_483","workbook_source_id":"FIN-483","url":"https://www.zscaler.com/products-and-solutions/zero-trust-sd-wan","title":"Zero Trust SD-WAN | Zscaler","publisher":"zscaler.com","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"rejected","reviewer_confidence":"medium","record_type":"Financial services solution page","requirement_codes":[],"named_customer":null,"segment":"Unspecified","named_product_or_service":"Zscaler Zero Trust SD-WAN","service_family":"SD-WAN","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":null,"regulatory_regime":"Not stated","exact_supporting_wording":"Zscaler Zero Trust SD-WAN securely connects users, devices, and workloads across branches, data centers, and the cloud.","reviewer_summary":"The Zero Trust SD-WAN product page describes generic branch connectivity, segmentation and dynamic path selection capabilities, citing real-estate, manufacturing and media customers, with no financial services customer named.","limitation_and_notes":"No financial institution named as a Zero Trust SD-WAN customer, so this page cannot support any of the 28 FS columns on its own; rejected as a standalone FS evidence source, retained only for background on the product."},{"id":"src_financial_services_fs_081","workbook_source_id":"FS-081","url":"https://www.zscaler.com/digital-transformation-for-banking-sector","title":"Zscaler digital transformation for the banking sector","publisher":"zscaler.com","publication_date":null,"checked_date":"2026-09-15","source_ownership":"provider_authored","decision":"rejected","reviewer_confidence":"high","record_type":"Existing source lead","requirement_codes":[],"named_customer":null,"segment":"Multiple","named_product_or_service":"Zscaler Zero Trust Exchange","service_family":"SSE","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":null,"regulatory_regime":"Multiple","exact_supporting_wording":"We embraced security as a journey that ran in parallel with our exploration of our applications, data, and transaction processing.","reviewer_summary":"Quote is attributed to Fannie Mae on the dedicated financial services page. Four named customers across three continents: Fannie Mae (US), Hastings Direct (UK insurance), Capitec (South Africa) and L&T Financial Services (India). A second banking landing page corroborates the same set. Regulatory frameworks named on the page include PCI DSS, SOX, NIST CSF and ISO 27001.","limitation_and_notes":"Supplier's own banking landing page, linked from the industries index. Corroborates the same four named financial services customers as source 4. | Confirmed - exact match [2026-09-15, flagged per Robert's check] Duplicate of FS-080's generic narrative for a different page - same limitation. Changed from Accepted to Needs review since no specific capability can be honestly assigned - recommend Harry/Robert decide whether to Reject or find a genuine capability fit. Rejected 2026-09-15 (final pass). Same generic transformation narrative as FS-080, reused on a different Zscaler page - no named institution, no specific technical claim tied to a capability column."}]},{"slug":"netskope","name":"Netskope","marketplace_url":"https://netify.co.uk/marketplace/netskope/","research_status":"complete","overall_confidence":"medium","fit_conclusion":"Netskope has documented compliance certifications including ISO 27001, SOC 2 Type 2, PCI DSS v4.0.1 and FedRAMP High, and its own documentation names configurable data residency options covering the UK, EU, US and several other regions through the NewEdge network. Two named financial services institutions, Apex Group and Ascensus, are evidenced using Netskope's SSE components, CASB, DLP, ZTNA and Advanced Analytics, for cloud and SaaS data control, identity and zero trust access, and network visibility, with Apex Group's case spanning 42 countries. No evidence was found of a named financial institution using Netskope's SD-WAN or SASE Branch product for branch, office, trading floor or data centre connectivity, and no source connects the service to FCA/PRA, NYDFS, FFIEC, SEC or OSFI regime requirements for a named customer. DORA is mentioned on Netskope's own financial services and compliance pages, but only as a generic regulation it can help address, without contractual detail or a named EU customer case. For a UK or North American IT decision maker, the strongest evidence is the Apex Group case study, a global financial services group using SSE and ZTNA, and the main limitation is the absence of any named FS customer proof point for Netskope's SD-WAN or branch connectivity capability.","gaps_and_unknowns":"No evidence was found for branch or office SD-WAN connectivity, trading or low-latency workloads, encryption and FIPS validation, log retention periods, incident notification timelines, exit and portability terms, SWIFT CSP alignment, or Canada/OSFI and UK FCA/PRA alignment for the named service. Closing these gaps would require access to the gated Netskope Trust Portal and Compliance Center documents (security whitepaper, DPA, SLA and SOC 2 report), which need registration or an NDA, plus a named UK or Canadian financial services customer case for the SD-WAN or SASE Branch product, none of which was found on the public site during this research.","reviewed_by":"Harry Yelland","reviewed_date":"2026-09-14","source_count":20,"accepted_source_count":15,"requirements":[{"code":"branch_and_office_connectivity","label":"Branch and office connectivity","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"trading_and_low_latency_connectivity","label":"Trading and low-latency connectivity","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"data_centre_colocation_and_cloud_connectivity","label":"Data-centre, colocation and cloud connectivity","state":"partial","evidence_source_ids":["src_financial_services_fin_338"],"verified_date":"2026-09-14"},{"code":"resilience_and_tested_recovery","label":"Resilience and tested recovery","state":"partial","evidence_source_ids":["src_financial_services_fin_336","src_financial_services_fin_338"],"verified_date":"2026-09-14"},{"code":"network_segmentation_and_zoning","label":"Network segmentation and zoning","state":"partial","evidence_source_ids":["src_financial_services_fin_338"],"verified_date":"2026-09-14"},{"code":"payment_and_cardholder_data_segmentation","label":"Payment and cardholder data segmentation","state":"partial","evidence_source_ids":["src_financial_services_fin_341"],"verified_date":"2026-09-14"},{"code":"third_party_and_outsourced_access","label":"Third-party and outsourced access","state":"partial","evidence_source_ids":["src_financial_services_fin_337"],"verified_date":"2026-09-14"},{"code":"remote_and_hybrid_workforce","label":"Remote and hybrid workforce","state":"partial","evidence_source_ids":["src_financial_services_fin_337"],"verified_date":"2026-09-14"},{"code":"data_residency_and_sovereignty","label":"Data residency and sovereignty","state":"proven","evidence_source_ids":["src_financial_services_fin_339"],"verified_date":"2026-09-14"},{"code":"encryption_and_key_management","label":"Encryption and key management","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"logging_audit_and_evidence_retention","label":"Logging, audit and evidence retention","state":"partial","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"identity_and_zero_trust_access","label":"Identity and zero trust access","state":"proven","evidence_source_ids":["src_financial_services_fin_337"],"verified_date":"2026-09-14"},{"code":"cloud_and_saas_data_controls","label":"Cloud and SaaS data controls","state":"proven","evidence_source_ids":["src_financial_services_fs_052","src_financial_services_fin_337","src_financial_services_fin_348"],"verified_date":"2026-09-14"},{"code":"managed_operations_and_soc","label":"Managed operations and SOC","state":"partial","evidence_source_ids":["src_financial_services_fin_337","src_financial_services_fin_347"],"verified_date":"2026-09-14"},{"code":"network_visibility_and_reporting","label":"Network visibility and reporting","state":"proven","evidence_source_ids":["src_financial_services_fin_337","src_financial_services_fin_348"],"verified_date":"2026-09-14"},{"code":"change_control_and_configuration_governance","label":"Change control and configuration governance","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"incident_notification_support","label":"Incident notification support","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"concentration_risk_and_subcontractor_transparency","label":"Concentration risk and subcontractor transparency","state":"proven","evidence_source_ids":["src_financial_services_fin_344"],"verified_date":"2026-09-14"},{"code":"exit_and_portability","label":"Exit and portability","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"uk_regulatory_alignment_fca_and_pra","label":"UK regulatory alignment (FCA and PRA)","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"eu_dora_alignment","label":"EU DORA alignment","state":"partial","evidence_source_ids":["src_financial_services_fs_052","src_financial_services_fin_340","src_financial_services_fin_508"],"verified_date":"2026-09-14"},{"code":"us_regulatory_alignment_ffiec_glba_nydfs_sec","label":"US regulatory alignment (FFIEC, GLBA, NYDFS, SEC)","state":"partial","evidence_source_ids":["src_financial_services_fin_342","src_financial_services_fin_509"],"verified_date":"2026-09-14"},{"code":"canada_regulatory_alignment_osfi","label":"Canada regulatory alignment (OSFI)","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"pci_dss_alignment","label":"PCI DSS alignment","state":"proven","evidence_source_ids":["src_financial_services_fin_340"],"verified_date":"2026-09-14"},{"code":"swift_csp_alignment","label":"SWIFT CSP alignment","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"uk_delivery","label":"UK delivery","state":"proven","evidence_source_ids":["src_financial_services_fin_339"],"verified_date":"2026-09-14"},{"code":"north_america_delivery","label":"North America delivery","state":"proven","evidence_source_ids":["src_financial_services_fin_339","src_financial_services_fin_348"],"verified_date":"2026-09-14"},{"code":"global_delivery","label":"Global delivery","state":"proven","evidence_source_ids":["src_financial_services_fin_336"],"verified_date":"2026-09-14"}],"sources":[{"id":"src_financial_services_fs_052","workbook_source_id":"FIN-334","url":"https://www.netskope.com/solutions/financial-services-and-insurance","title":"Securing Financial Services in the Cloud and AI Era","publisher":"netskope.com","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"medium","record_type":"Financial services solution page","requirement_codes":["eu_dora_alignment"],"named_customer":null,"segment":"Multiple","named_product_or_service":"Netskope One SASE","service_family":"SASE","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":"helping reduce the risk of a severe breach by up to 80%","industrial_standard_or_regulation":"DORA, GDPR, NIS 2, PCI","regulatory_regime":"Multiple","exact_supporting_wording":"Support regulatory compliance across DORA, GDPR, NIS 2, PCI, and many other important regulatory requirements and data privacy regulations","reviewer_summary":"Netskope's financial services industry page states that its platform helps customers meet several named regulations including DORA and PCI, and claims three of the five largest Fortune 100 financial services companies use its SASE platform, without naming them.","limitation_and_notes":"Generic financial services industry page with no named financial institution; the DORA reference is a capability claim rather than a compliance statement, Article 30 contractual term or named EU customer case, so it does not establish full DORA alignment."},{"id":"src_financial_services_fin_335","workbook_source_id":"FIN-335","url":"https://www.netskope.com/privacy/compliance","title":"Compliance | Netskope","publisher":"netskope.com","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"medium","record_type":"Compliance attestation or statement","requirement_codes":["pci_dss_alignment"],"named_customer":null,"segment":"Unspecified","named_product_or_service":"Netskope platform","service_family":"Multiple","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":"ISO 27001:2022, ISO 27017:2015, ISO 27018:2019, SOC 2 Type 2, PCI DSS, FedRAMP High, CSA STAR","regulatory_regime":"Not stated","exact_supporting_wording":"PCI DSS - global security standard for all entities that store, process, or transmit cardholder data","reviewer_summary":"Netskope's compliance page lists corporate-wide certifications including ISO 27001, SOC 2 Type 2, PCI DSS, FedRAMP High and CSA STAR, and links to the Trust Portal for further documents.","limitation_and_notes":"Certification list is corporate-wide and not tied to a named financial services customer or to the SD-WAN/SASE Branch product specifically; does not itself demonstrate FCA/PRA, NYDFS, DORA or OSFI regime alignment; no data residency, FIPS, encryption or log retention detail was found on this page."},{"id":"src_financial_services_fin_336","workbook_source_id":"FIN-336","url":"https://www.netskope.com/netskope-one/newedge","title":"NewEdge Network | Netskope","publisher":"netskope.com","publication_date":null,"checked_date":"2026-09-15","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"medium","record_type":"Other","requirement_codes":["resilience_and_tested_recovery","global_delivery"],"named_customer":null,"segment":"Unspecified","named_product_or_service":"NewEdge Network","service_family":"SASE","estate":null,"countries_or_regions":"80+ regions, 220+ countries and territories","ot_or_production_environment":null,"measured_or_stated_outcome":"<10ms Industry-best traffic processing latency SLAs","industrial_standard_or_regulation":null,"regulatory_regime":"Not stated","exact_supporting_wording":"\"120+ data centers in 80+ regions globally - including Mainland China.\" / \"Route Control: Automatically routes traffic in real time over optimal paths from NewEdge data centers to address micro-outages or congestion, maintaining service continuity and low latency - even during ISP issues, or 'black swan' events.\"","reviewer_summary":"Netskope describes its NewEdge network as having over 120 full-compute data centres in more than 80 regions, with automatic failover (GSLB and Auto Failout) and dynamic routing to maintain performance during disruptions.","limitation_and_notes":"Checker 2026-09-12: page carries the fact but the wording differs (Both facts (120+ data centers/80+ regions incl. Mainland China; Dynamic Route control) present but in separate sections, not combined as quoted.). Re-quote verbatim. General network infrastructure page not tied to a named financial institution, so it does not prove resilience or tested recovery for an FS customer specifically; no RTO/RPO figures or DR test outcomes are given. [2026-09-15] Re-quoted verbatim from the current live NewEdge datasheet (2026-03 edition), as two separate sentences matching the checker's finding."},{"id":"src_financial_services_fin_337","workbook_source_id":"FIN-337","url":"https://www.netskope.com/resources/case-studies/apex-group","title":"Apex Group Case Study | Netskope","publisher":"netskope.com","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"high","record_type":"Named customer case study","requirement_codes":["third_party_and_outsourced_access","network_visibility_and_reporting","identity_and_zero_trust_access","cloud_and_saas_data_controls","remote_and_hybrid_workforce","managed_operations_and_soc"],"named_customer":"Apex Group","segment":"Asset and wealth management","named_product_or_service":"Netskope One SSE (Next Gen Secure Web Gateway, CASB, DLP, Threat Protection), Netskope Private Access, Cloud Firewall, Advanced Analytics","service_family":"SSE","estate":"13,000+ employees, 34 companies","countries_or_regions":"42 countries and legal jurisdictions","ot_or_production_environment":null,"measured_or_stated_outcome":"Consolidated from 40+ point-solutions to 8 technologies; automated level-one tier of global Security Operations Center; project completed 3 months ahead of schedule","industrial_standard_or_regulation":null,"regulatory_regime":"Multiple","exact_supporting_wording":"Netskope provides us with the tools and capabilities to securely embrace cloud technologies while maintaining control and compliance","reviewer_summary":"Apex Group, a global financial services provider operating 34 companies across 42 countries, deployed Netskope SSE, Private Access (ZTNA), Cloud Firewall and Advanced Analytics to consolidate security tooling, automate tier-one SOC work and gain visibility into cloud usage and risk.","limitation_and_notes":"Case study demonstrates SSE, ZTNA and CASB/DLP use by a named FS group, not SD-WAN, branch, trading or data-centre connectivity; it does not name a specific regulation, and describes internal group-company access rather than third-party/contractor access or explicitly remote/hybrid working."},{"id":"src_financial_services_fin_338","workbook_source_id":"FIN-338","url":"https://www.netskope.com/products/sase-branch","title":"Secure SD-WAN | Netskope One SASE Branch | Netskope","publisher":"netskope.com","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"medium","record_type":"Other","requirement_codes":["data_centre_colocation_and_cloud_connectivity","network_segmentation_and_zoning","resilience_and_tested_recovery"],"named_customer":null,"segment":"Unspecified","named_product_or_service":"Netskope One SASE Branch (Secure SD-WAN)","service_family":"SD-WAN","estate":null,"countries_or_regions":"75+ regions","ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":null,"regulatory_regime":"Not stated","exact_supporting_wording":"Extend VRF-based segmentation across branches, data centers, and cloud","reviewer_summary":"Netskope's SASE Branch (Secure SD-WAN) product page describes VRF-based segmentation, sub-second failover, active-active links and multi-cloud on-ramps to AWS, Azure and Google Cloud WAN.","limitation_and_notes":"Product capability page only; no named financial institution or FS material links these SD-WAN segmentation, resilience or cloud on-ramp features to an actual deployment."},{"id":"src_financial_services_fin_339","workbook_source_id":"FIN-339","url":"https://www.netskope.com/privacy/data-transfer-at-netskope","title":"Data Transfer at Netskope | Netskope","publisher":"netskope.com","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"high","record_type":"Compliance attestation or statement","requirement_codes":["data_residency_and_sovereignty","north_america_delivery","uk_delivery"],"named_customer":null,"segment":"Unspecified","named_product_or_service":"Netskope","service_family":"Multiple","estate":null,"countries_or_regions":"United States, EU, UK, Australia, Saudi Arabia, Switzerland, Singapore","ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":null,"regulatory_regime":"Multiple","exact_supporting_wording":"Customers' log transaction data are stored in the management plane designated by each customer. Currently, management planes are available in the United States, the EU, the UK, Australia, Saudi Arabia, Switzerland, and Singapore.","reviewer_summary":"Netskope documents that customers can choose the management plane region for their log/transaction data, currently offered in the US, EU, UK, Australia, Saudi Arabia, Switzerland and Singapore, plus configurable country- and region-specific data processing zones for traffic in motion.","limitation_and_notes":"Documents residency options generically across the whole customer base, not for a named financial institution; Canada is not listed as a distinct management plane region (only a broader 'North America Zone' for traffic processing); does not cover end-user content data, which Netskope states it does not store."},{"id":"src_financial_services_fin_340","workbook_source_id":"FIN-340","url":"https://compliance.netskope.com/","title":"Netskope Compliance Center","publisher":"compliance.netskope.com","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"medium","record_type":"Compliance attestation or statement","requirement_codes":["eu_dora_alignment","pci_dss_alignment"],"named_customer":null,"segment":"Unspecified","named_product_or_service":"Netskope platform","service_family":"Multiple","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":"PCI DSS v4.0.1, DORA, SOC 2 Type 2, ISO/IEC 27001, FedRAMP High, CSA STAR Level 2","regulatory_regime":"Multiple","exact_supporting_wording":"PCI DSS v4.0.1","reviewer_summary":"Netskope's Compliance Center lists PCI DSS v4.0.1 among its achieved certifications and lists DORA among the compliance frameworks or mappings it makes available, alongside SOC 2 Type 2, ISO 27001, FedRAMP High and CSA STAR.","limitation_and_notes":"The underlying documents (including the DORA mapping) sit behind a gated 'Get access' portal that was not opened; the page confirms the certification and DORA framework mapping exist but not their detailed contractual or FS-specific content."},{"id":"src_financial_services_fin_341","workbook_source_id":"FIN-341","url":"https://www.netskope.com/solutions/pci-dss-cloud-compliance","title":"PCI-DSS Cloud Compliance | Netskope","publisher":"netskope.com","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"low","record_type":"Financial services solution page","requirement_codes":["payment_and_cardholder_data_segmentation"],"named_customer":null,"segment":"Unspecified","named_product_or_service":"Netskope CASB, DLP, Next Gen Secure Web Gateway, ZTNA","service_family":"SSE","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":"PCI DSS","regulatory_regime":"Not stated","exact_supporting_wording":"Apply DLP and/or encryption policies to ensure that data containing PCI does not get into the wrong hands.","reviewer_summary":"Netskope's PCI-DSS solution page describes how CASB, DLP, secure web gateway and ZTNA can inspect and control content containing cardholder data and support audit visibility, citing a Fortune 500 retailer SOC analyst quote.","limitation_and_notes":"Generic solution page; no named cardholder data environment, no named financial institution, and no PCI DSS Attestation of Compliance is referenced on this specific page."},{"id":"src_financial_services_fin_342","workbook_source_id":"FIN-342","url":"https://www.netskope.com/solutions/glba-cloud-compliance","title":"GLBA Cloud Compliance | Netskope","publisher":"netskope.com","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"low","record_type":"Financial services solution page","requirement_codes":["us_regulatory_alignment_ffiec_glba_nydfs_sec"],"named_customer":null,"segment":"Unspecified","named_product_or_service":"Netskope CASB","service_family":"SSE","estate":null,"countries_or_regions":"United States","ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":"GLBA","regulatory_regime":"US","exact_supporting_wording":"GLBA has specific compliance requirements tied to security and confidentiality, privacy, and safeguards.","reviewer_summary":"Netskope's GLBA solution page names the regulation and its CASB product together, with a supporting quote from the CIO of Dana Foundation about assessing cloud application risk.","limitation_and_notes":"The only customer quoted, Dana Foundation, is a non-profit foundation rather than a bank, insurer or other regulated financial institution; the page does not cite the GLBA Safeguards Rule by name or any FFIEC, NYDFS or SEC alignment."},{"id":"src_financial_services_fin_344","workbook_source_id":"FIN-344","url":"https://www.netskope.com/resources/netskope-resources/netskope-sub-processors","title":"Sub-processors | Netskope","publisher":"netskope.com","publication_date":"2026-09-01","checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"medium","record_type":"Compliance attestation or statement","requirement_codes":["concentration_risk_and_subcontractor_transparency"],"named_customer":null,"segment":"Unspecified","named_product_or_service":"Netskope","service_family":"Multiple","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":null,"regulatory_regime":"Not stated","exact_supporting_wording":"This is our updated list of third-party Sub-processors. For additional queries, please contact the Netskope Privacy team","reviewer_summary":"Netskope publishes a downloadable, dated sub-processor list (referenced as a September 2026 PDF) and invites customer queries to its privacy team.","limitation_and_notes":"Confirms the practice of publishing an updated sub-processor list, but the linked PDF itself, containing the named sub-processors and any multi-region independence statement, was not opened as part of this research."},{"id":"src_financial_services_fin_347","workbook_source_id":"FIN-347","url":"https://www.netskope.com/netskope-technical-support","title":"Netskope Technical Support","publisher":"netskope.com","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"low","record_type":"Other","requirement_codes":["managed_operations_and_soc"],"named_customer":null,"segment":"Unspecified","named_product_or_service":"Netskope","service_family":"Not relevant","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":null,"regulatory_regime":"Not stated","exact_supporting_wording":"We are a global team and operate 24/7/365","reviewer_summary":"Netskope states its support team operates 24/7/365, with Premium and Premium Plus paid tiers offering full 24/7 phone and on-call coverage above the basic business-hours tier.","limitation_and_notes":"Generic corporate support-tier page, not FS-specific; gives no RTO/RPO or incident notification timelines, and full 24/7 phone coverage requires a paid Premium or Premium Plus tier rather than being included by default."},{"id":"src_financial_services_fin_348","workbook_source_id":"FIN-348","url":"https://www.netskope.com/resources/case-studies/ascensus","title":"Ascensus Case Study | Netskope","publisher":"netskope.com","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"high","record_type":"Named customer case study","requirement_codes":["network_visibility_and_reporting","cloud_and_saas_data_controls","north_america_delivery"],"named_customer":"Ascensus","segment":"Asset and wealth management","named_product_or_service":"Netskope CASB, DLP, Next Gen Secure Web Gateway","service_family":"SSE","estate":"5,000+ employees; serves 15 million+ people","countries_or_regions":"United States","ot_or_production_environment":null,"measured_or_stated_outcome":"CASB configured and operational within one hour; SWG deployed within five minutes for rule setup","industrial_standard_or_regulation":null,"regulatory_regime":"US","exact_supporting_wording":"We can protect our data and applications without ever just telling users 'no.'","reviewer_summary":"Ascensus, a US-based retirement, education and healthcare savings recordkeeping and third-party administration provider serving over 15 million people, deployed Netskope CASB, DLP and NG-SWG to gain visibility and control over more than 2,000 cloud applications.","limitation_and_notes":"Case study covers cloud application visibility and DLP after a Microsoft 365 migration; it does not mention GLBA, FFIEC, SEC or any other specific financial regulation, and does not cover branch, SD-WAN, trading or data-centre connectivity."},{"id":"src_financial_services_fin_508","workbook_source_id":"FIN-508","url":"https://www.netskope.com/resources/compliance-guides/netskope-for-dora-compliance","title":"Netskope for DORA Compliance","publisher":"netskope.com","publication_date":null,"checked_date":"2026-09-15","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"medium","record_type":"Compliance attestation or statement","requirement_codes":["eu_dora_alignment"],"named_customer":null,"segment":"Unspecified","named_product_or_service":"Netskope One (unified SASE platform)","service_family":"Supporting only","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":"DORA - dedicated compliance guide mapping DORA's requirements to the Netskope One platform","regulatory_regime":"EU","exact_supporting_wording":"\"We've summarised and mapped the 79 pages of DORA to our industry leading platform to save you time... helps these organisations follow DORA's rules, applying zero trust principles to protect data and defend against cyber threats.\"","reviewer_summary":"Netskope's own dedicated DORA compliance guide, verified live 2026-09-15. This is a genuine mapping document (not just a passing mention), addressing incident management, classification and reporting under DORA specifically - stronger than a blog aside, but it doesn't name Netskope One's Article 30 contractual terms specifically or a named EU financial customer, so graded Partial rather than Proven.","limitation_and_notes":"Added 2026-09-15 per item 6 (thin regulatory columns) research pass. A genuine compliance-mapping resource, not a certification list, but stops short of the Article 30 contractual-terms bar for Proven."},{"id":"src_financial_services_fin_509","workbook_source_id":"FIN-509","url":"https://www.netskope.com/fr/blog/fortune-500-financial-services-company-meets-nydfs-cybersecurity-regulations-netskope-unisys","title":"Fortune 500 Financial Services Company Meets NYDFS Cybersecurity Regulations (Netskope + Unisys)","publisher":"netskope.com","publication_date":null,"checked_date":"2026-09-15","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"medium","record_type":"Compliance attestation or statement","requirement_codes":["us_regulatory_alignment_ffiec_glba_nydfs_sec"],"named_customer":"Not named (\"a Fortune 500 financial services company\")","segment":"Unspecified","named_product_or_service":"Netskope CASB","service_family":"Supporting only","estate":null,"countries_or_regions":"United States (New York)","ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":"NYDFS Cybersecurity Regulation (23 NYCRR Part 500)","regulatory_regime":"US","exact_supporting_wording":"\"When taking a look at how to achieve NYDFS security compliance, you need to look at CASB solutions.\"","reviewer_summary":"Netskope's own blog post, verified live 2026-09-15, co-authored with partner Unisys, explicitly addressing NYDFS compliance via Netskope CASB. The customer is anonymised ('a Fortune 500 financial services company'), so this cannot support a named-customer Proven claim, but per the Regulations tab's own evidence bar ('provider material mapping the service to Part 500 sections'), this is genuine provider material connecting Netskope's product to NYDFS - graded Partial given the mapping is general rather than section-by-section.","limitation_and_notes":"Added 2026-09-15 per item 6 research pass. Anonymised customer; general NYDFS/CASB framing rather than a detailed Part 500 section mapping."},{"id":"src_financial_services_fin_343","workbook_source_id":"FIN-343","url":"https://www.netskope.com/solutions/compliance","title":"Maintain Compliance | Netskope","publisher":"netskope.com","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"rejected","reviewer_confidence":"low","record_type":"Financial services solution page","requirement_codes":[],"named_customer":null,"segment":"Unspecified","named_product_or_service":"Netskope One SSE, DLP, Advanced Analytics","service_family":"SSE","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":"Stronger compliance across global operations. Seamless M&A integration, improving operational consistency.","industrial_standard_or_regulation":"PCI-DSS, HIPAA, GDPR","regulatory_regime":"Not stated","exact_supporting_wording":"Stronger compliance across global operations. Seamless M&A integration, improving operational consistency.","reviewer_summary":"Netskope's compliance solutions page cites an anonymised financial services customer using SSE, DLP and Advanced Analytics for compliance and M&A integration, alongside a claim of 40+ pre-configured compliance templates.","limitation_and_notes":"Customer is anonymised as 'financial services' with no name given, so under the grading rules it cannot support a Proven status for any column; kept only as background context, not cited in any status."},{"id":"src_financial_services_fin_345","workbook_source_id":"FIN-345","url":"https://trust.netskope.com/","title":"Trust Portal","publisher":"trust.netskope.com","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"rejected","reviewer_confidence":"low","record_type":"Other","requirement_codes":[],"named_customer":null,"segment":"Unspecified","named_product_or_service":"Netskope Trust Portal","service_family":"Not relevant","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":null,"regulatory_regime":"Not stated","exact_supporting_wording":"You need to enable JavaScript to run this app","reviewer_summary":"Netskope's Trust Portal is a JavaScript application; the fetch tool could only retrieve the page shell and metadata, not the actual real-time or historical trust/performance content.","limitation_and_notes":"No compliance, uptime or performance content was retrievable; cannot be used as evidence for any column despite being the provider's named trust portal."},{"id":"src_financial_services_fin_346","workbook_source_id":"FIN-346","url":"https://www.netskope.com/resources/case-studies/bdo","title":"BDO Case Study | Netskope","publisher":"netskope.com","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"rejected","reviewer_confidence":"low","record_type":"Other","requirement_codes":[],"named_customer":null,"segment":"Unspecified","named_product_or_service":"Netskope One CASB, Private Access, NG-SWG, NewEdge","service_family":"SSE","estate":"8,000+ employees","countries_or_regions":"Global","ot_or_production_environment":null,"measured_or_stated_outcome":"Network availability improved from 98.5% to 99.9%","industrial_standard_or_regulation":null,"regulatory_regime":"Not stated","exact_supporting_wording":"We can control the data that our applications are accessing. Granularity and visibility are the real benefits.","reviewer_summary":"BDO, the world's fifth-largest accountancy, consultancy and assurance firm, deployed Netskope CASB, Private Access and NG-SWG to replace legacy VPN and improve network availability.","limitation_and_notes":"BDO is an accounting and professional services firm, not a bank, insurer, payments or asset management company, so it does not qualify as a named financial institution under this brief despite quantified outcomes."},{"id":"src_financial_services_fs_053","workbook_source_id":"FS-053","url":"https://investors.netskope.com/","title":"Netskope Investor Relations","publisher":"investors.netskope.com","publication_date":null,"checked_date":"2026-07-29","source_ownership":"provider_authored","decision":"rejected","reviewer_confidence":"high","record_type":"Existing source lead","requirement_codes":[],"named_customer":null,"segment":"To review","named_product_or_service":null,"service_family":"Not relevant","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":null,"regulatory_regime":null,"exact_supporting_wording":"More than 4,000 customers, including three of the five largest financial services companies on the Fortune 100, trust our unified secure access service edge (SASE) platform, Netskope One.","reviewer_summary":"The best evidenced sector by a clear margin. Four named customer stories on the industry page (Apex Group, JLL, RSM Australia, Ascensus), plus BMO and The Auto Club Group as logos, plus explicit DORA, GDPR, NIS 2 and PCI references. The Fortune 100 claim is a vendor claim and is not independently verified here.","limitation_and_notes":"Investor relations site of a NASDAQ listed company (NTSK). Statements here carry securities law accountability, so the Fortune 100 customer claim is more reliable than ordinary marketing copy. | Not found on page"}]},{"slug":"barracuda-secureedge","name":"Barracuda SecureEdge","marketplace_url":"https://netify.co.uk/marketplace/barracuda-secureedge/","research_status":"complete","overall_confidence":"medium","fit_conclusion":"Barracuda documents solid baseline platform facts for SecureEdge: named data centre regions in the UK, EU, US and Canada, 30 day log retention, encryption in transit and at rest, a 99.5% monthly availability commitment, and a published sub-processor list. A separate CloudGen Firewall whitepaper explicitly connects the product to PCI DSS cardholder data segmentation. However no named bank, credit union, insurer or asset manager using SecureEdge or CloudGen Firewall SD-WAN was found on any page opened, so branch connectivity, trading connectivity, resilience testing and remote workforce claims all lack a financial services deployment example. There is no evidence connecting the named service to FCA, PRA, DORA, FFIEC, GLBA, NYDFS, OSFI or SWIFT CSP regimes, and PCI DSS is listed as in-progress rather than certified. An IT decision maker in financial services would need to treat the platform facts as credible but unproven in an FS operating context, and would need to request references directly from Barracuda.","gaps_and_unknowns":"No named financial services customer case study exists for SecureEdge or CloudGen Firewall SD-WAN, leaving branch/office connectivity, trading connectivity, resilience/DR testing, third-party access control, managed SOC and network visibility for FS customers unevidenced. All four named regulatory regime columns (UK FCA/PRA, EU DORA, US FFIEC/GLBA/NYDFS/SEC, Canada OSFI) and SWIFT CSP alignment are unevidenced; closing these would require a published compliance statement or an FS customer reference naming the regime. CASB/DLP and a completed (rather than in-progress) PCI DSS attestation for the named service are also missing.","reviewed_by":"Harry Yelland","reviewed_date":"2026-09-14","source_count":17,"accepted_source_count":11,"requirements":[{"code":"branch_and_office_connectivity","label":"Branch and office connectivity","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"trading_and_low_latency_connectivity","label":"Trading and low-latency connectivity","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"data_centre_colocation_and_cloud_connectivity","label":"Data-centre, colocation and cloud connectivity","state":"partial","evidence_source_ids":["src_financial_services_fin_133"],"verified_date":"2026-09-14"},{"code":"resilience_and_tested_recovery","label":"Resilience and tested recovery","state":"partial","evidence_source_ids":["src_financial_services_fin_136"],"verified_date":"2026-09-14"},{"code":"network_segmentation_and_zoning","label":"Network segmentation and zoning","state":"partial","evidence_source_ids":["src_financial_services_fin_133"],"verified_date":"2026-09-14"},{"code":"payment_and_cardholder_data_segmentation","label":"Payment and cardholder data segmentation","state":"partial","evidence_source_ids":["src_financial_services_fin_133"],"verified_date":"2026-09-14"},{"code":"third_party_and_outsourced_access","label":"Third-party and outsourced access","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"remote_and_hybrid_workforce","label":"Remote and hybrid workforce","state":"partial","evidence_source_ids":["src_financial_services_fin_132"],"verified_date":"2026-09-14"},{"code":"data_residency_and_sovereignty","label":"Data residency and sovereignty","state":"proven","evidence_source_ids":["src_financial_services_fin_128","src_financial_services_fin_136"],"verified_date":"2026-09-14"},{"code":"encryption_and_key_management","label":"Encryption and key management","state":"proven","evidence_source_ids":["src_financial_services_fin_136"],"verified_date":"2026-09-14"},{"code":"logging_audit_and_evidence_retention","label":"Logging, audit and evidence retention","state":"proven","evidence_source_ids":["src_financial_services_fin_136"],"verified_date":"2026-09-14"},{"code":"identity_and_zero_trust_access","label":"Identity and zero trust access","state":"partial","evidence_source_ids":["src_financial_services_fin_132","src_financial_services_fin_137"],"verified_date":"2026-09-14"},{"code":"cloud_and_saas_data_controls","label":"Cloud and SaaS data controls","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"managed_operations_and_soc","label":"Managed operations and SOC","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"network_visibility_and_reporting","label":"Network visibility and reporting","state":"partial","evidence_source_ids":["src_financial_services_fin_135"],"verified_date":"2026-09-14"},{"code":"change_control_and_configuration_governance","label":"Change control and configuration governance","state":"proven","evidence_source_ids":["src_financial_services_fin_135"],"verified_date":"2026-09-14"},{"code":"incident_notification_support","label":"Incident notification support","state":"partial","evidence_source_ids":["src_financial_services_fin_129"],"verified_date":"2026-09-14"},{"code":"concentration_risk_and_subcontractor_transparency","label":"Concentration risk and subcontractor transparency","state":"proven","evidence_source_ids":["src_financial_services_fin_139","src_financial_services_fin_140"],"verified_date":"2026-09-14"},{"code":"exit_and_portability","label":"Exit and portability","state":"proven","evidence_source_ids":["src_financial_services_fin_136"],"verified_date":"2026-09-14"},{"code":"uk_regulatory_alignment_fca_and_pra","label":"UK regulatory alignment (FCA and PRA)","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"eu_dora_alignment","label":"EU DORA alignment","state":"partial","evidence_source_ids":["src_financial_services_fin_528"],"verified_date":"2026-09-14"},{"code":"us_regulatory_alignment_ffiec_glba_nydfs_sec","label":"US regulatory alignment (FFIEC, GLBA, NYDFS, SEC)","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"canada_regulatory_alignment_osfi","label":"Canada regulatory alignment (OSFI)","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"pci_dss_alignment","label":"PCI DSS alignment","state":"partial","evidence_source_ids":["evidence:barracuda-secureedge:13","src_financial_services_fin_133"],"verified_date":"2026-09-14"},{"code":"swift_csp_alignment","label":"SWIFT CSP alignment","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"uk_delivery","label":"UK delivery","state":"proven","evidence_source_ids":["src_financial_services_fin_128"],"verified_date":"2026-09-14"},{"code":"north_america_delivery","label":"North America delivery","state":"proven","evidence_source_ids":["src_financial_services_fin_128"],"verified_date":"2026-09-14"},{"code":"global_delivery","label":"Global delivery","state":"proven","evidence_source_ids":["src_financial_services_fin_128","src_financial_services_fin_136"],"verified_date":"2026-09-14"}],"sources":[{"id":"evidence:barracuda-secureedge:13","workbook_source_id":"FIN-125","url":"https://trust.barracuda.com/security/certifications","title":"Barracuda Trust Centre - Certifications page","publisher":"","publication_date":"2026-06-10","checked_date":"2026-09-15","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"medium","record_type":"Compliance attestation or statement","requirement_codes":["pci_dss_alignment"],"named_customer":null,"segment":"Unspecified","named_product_or_service":"Barracuda (company-wide)","service_family":"Not relevant","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":"SOC 2; ISO 27001; PCI DSS; FIPS","regulatory_regime":"Not stated","exact_supporting_wording":"PCI DSS (SAQ-D attestation in progress)","reviewer_summary":"Barracuda lists PCI DSS SAQ-D attestation as an in-progress certification for the company generally; it is not shown as achieved and is not tied to SecureEdge or CloudGen Firewall by name.","limitation_and_notes":"Checker 2026-09-12: page carries the fact but the wording differs (Page text reads 'PCI DSS (SAQ-D attestation in progress)' - quote omitted 'in progress' qualifier). Re-quote verbatim. This is a company-wide certification list, not product-specific to SecureEdge or CloudGen Firewall, and PCI DSS is listed as in-progress rather than achieved. Does not prove an AoC for the named service. [2026-09-15] Re-quoted verbatim using the checker's own already-confirmed page wording - no fresh fetch needed, the exact sentence was already recorded in the check note."},{"id":"src_financial_services_fin_128","workbook_source_id":"FIN-128","url":"https://trust.barracuda.com/legal/data-center-locations","title":"Data Center Locations - Barracuda Trust Center","publisher":"trust.barracuda.com","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"medium","record_type":"Compliance attestation or statement","requirement_codes":["data_residency_and_sovereignty","north_america_delivery","global_delivery","uk_delivery"],"named_customer":null,"segment":"Unspecified","named_product_or_service":"Barracuda SecureEdge","service_family":"SASE","estate":null,"countries_or_regions":"UK, EU (multiple), US, Canada, and other global regions","ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":null,"regulatory_regime":"Multiple","exact_supporting_wording":"West Europe (westeurope); Austria East (austriaeast); Germany West Central (germanywestcentral); France Central (francecentral)","reviewer_summary":"Barracuda's data centre locator names SecureEdge specifically against a list of Azure/AWS regions that includes UK South, Canada Central and US regions alongside multiple EU regions.","limitation_and_notes":"Confirms hosting regions for SecureEdge but does not name a UK, US or Canadian financial services customer, and does not state which customer data types map to which region."},{"id":"src_financial_services_fin_129","workbook_source_id":"FIN-129","url":"https://trust.barracuda.com/security#security-incident","title":"Security - Barracuda Trust Center","publisher":"trust.barracuda.com","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"medium","record_type":"Compliance attestation or statement","requirement_codes":["incident_notification_support"],"named_customer":null,"segment":"Unspecified","named_product_or_service":"Barracuda (all products)","service_family":"Not relevant","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":null,"regulatory_regime":"Not stated","exact_supporting_wording":"Barracuda will promptly (1) notify the relevant Customer of the Security Incident; (2) investigate the Security Incident; and (3) take reasonable steps to contain and mitigate the effects of the Security Incident.","reviewer_summary":"Barracuda commits to promptly notify, investigate and mitigate security incidents, but does not state a specific notification timeframe such as a number of hours or days.","limitation_and_notes":"No defined timeframe (only 'promptly'), and the commitment is company-wide rather than SecureEdge-specific."},{"id":"src_financial_services_fin_132","workbook_source_id":"FIN-132","url":"https://www.barracuda.com/products/network-protection/secureedge/zero-trust-access","title":"Zero Trust Network Access Solution & Security Platform | Barracuda Networks","publisher":"barracuda.com","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"medium","record_type":"Other","requirement_codes":["identity_and_zero_trust_access","remote_and_hybrid_workforce"],"named_customer":null,"segment":"Unspecified","named_product_or_service":"Barracuda SecureEdge Access","service_family":"SASE","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":null,"regulatory_regime":"Not stated","exact_supporting_wording":"SecureEdge Access supports SSO with access credentials from Microsoft Entra ID, Google Workspace, Okta, Okta Workforce, OpenID Connect, any other SAML-compatible services, and even generic email code sign-on.","reviewer_summary":"SecureEdge Access documents ZTNA with SSO/IdP integration (Entra ID, Okta, Google Workspace, SAML) and SCIM provisioning, and describes remote access to applications from any client without bandwidth limits.","limitation_and_notes":"General product documentation, not financial-services specific; no named financial customer or FS-specific remote-workforce outcome."},{"id":"src_financial_services_fin_133","workbook_source_id":"FIN-133","url":"https://assets.barracuda.com/assets/docs/dms/Barracuda_CloudGen_Firewall_WP_PCI_DSS_Compliance_US_1-1.pdf","title":"PCI DSS Compliance with Barracuda CloudGen Firewall","publisher":"assets.barracuda.com","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"medium","record_type":"Compliance attestation or statement","requirement_codes":["data_centre_colocation_and_cloud_connectivity","payment_and_cardholder_data_segmentation","network_segmentation_and_zoning","pci_dss_alignment"],"named_customer":null,"segment":"Payments and fintech","named_product_or_service":"Barracuda CloudGen Firewall","service_family":"SD-WAN","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":"PCI DSS 3.2.1","regulatory_regime":"Not stated","exact_supporting_wording":"Barracuda CloudGen Firewall can help your organization satisfy every specific requirement of PCI DSS compliance version 3.2.1","reviewer_summary":"Barracuda's own whitepaper explains how CloudGen Firewall can be used as a network segmentation gateway to isolate a cardholder data environment and to extend segmentation policy into AWS, Azure and Google Cloud, mapped against PCI DSS 3.2.1 requirements.","limitation_and_notes":"This is compliance-mapping guidance for customers to achieve PCI DSS themselves, not a PCI DSS Attestation of Compliance or certification for the CloudGen Firewall service itself, and it names no financial institution."},{"id":"src_financial_services_fin_135","workbook_source_id":"FIN-135","url":"https://www.barracuda.com/products/network-protection/secureedge/features","title":"Barracuda SecureEdge: Features | Barracuda Networks","publisher":"barracuda.com","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"medium","record_type":"Other","requirement_codes":["change_control_and_configuration_governance","network_visibility_and_reporting"],"named_customer":null,"segment":"Unspecified","named_product_or_service":"Barracuda SecureEdge","service_family":"SASE","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":null,"regulatory_regime":"Not stated","exact_supporting_wording":"Set role and attribute-based controls to grant contextual access to trusted users and devices","reviewer_summary":"SecureEdge documents role- and attribute-based access controls and a dashboard for monitoring users, threats and infrastructure status, but does not describe CASB, DLP, SOC or a formal change-management/audit process.","limitation_and_notes":"No financial services context; RBAC is documented but a full change-control/configuration-audit process is not described on this page."},{"id":"src_financial_services_fin_136","workbook_source_id":"FIN-136","url":"https://assets.barracuda.com/assets/docs/dms/Barracuda-SecureEdge-Product-and-Service-Description.pdf","title":"Product & Service Description - SecureEdge Appliances and SaaS Service","publisher":"assets.barracuda.com","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"high","record_type":"Compliance attestation or statement","requirement_codes":["logging_audit_and_evidence_retention","resilience_and_tested_recovery","data_residency_and_sovereignty","encryption_and_key_management","exit_and_portability","global_delivery"],"named_customer":null,"segment":"Unspecified","named_product_or_service":"Barracuda SecureEdge","service_family":"SASE","estate":null,"countries_or_regions":"US, EMEA (West Europe), plus additional PoPs across Europe, Middle East, Americas and APAC","ot_or_production_environment":null,"measured_or_stated_outcome":"99.5% monthly availability commitment for SecureEdge and the SecureEdge Manager","industrial_standard_or_regulation":null,"regulatory_regime":"Multiple","exact_supporting_wording":"During a subscription period, Barracuda keeps data in the Service for 30 days","reviewer_summary":"Barracuda's SecureEdge product and service description states a 99.5% monthly availability commitment, that log and configuration data is encrypted in transit and at rest, that data is retained for 30 days during the subscription and up to 30 days after termination for the customer to download, and that reporting data resides in named Azure regions (US East for US data, West Europe for EMEA and global manager data).","limitation_and_notes":"This is a general commercial terms document, not financial-services specific; it names no financial customer, no FIPS validation, and the 99.5% figure is an availability commitment rather than a tested RTO/RPO or DR test result."},{"id":"src_financial_services_fin_137","workbook_source_id":"FIN-137","url":"https://www.barracuda.com/products/network-protection/secureedge-access/features","title":"Barracuda SecureEdge Access: Features | Barracuda Networks","publisher":"barracuda.com","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"medium","record_type":"Other","requirement_codes":["identity_and_zero_trust_access"],"named_customer":null,"segment":"Unspecified","named_product_or_service":"Barracuda SecureEdge Access","service_family":"SASE","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":null,"regulatory_regime":"Not stated","exact_supporting_wording":"Integration with your existing Azure Active Directory","reviewer_summary":"SecureEdge Access documents Azure Active Directory integration and role- and attribute-based access controls; no CASB, DLP, SOC or MFA-specific claims appear on this page.","limitation_and_notes":"No financial services context; MFA, CASB and DLP are not mentioned on this page."},{"id":"src_financial_services_fin_139","workbook_source_id":"FIN-139","url":"https://trust.barracuda.com/legal/supplier-information","title":"Supplier Information - Barracuda Trust Center","publisher":"trust.barracuda.com","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"medium","record_type":"Compliance attestation or statement","requirement_codes":["concentration_risk_and_subcontractor_transparency"],"named_customer":null,"segment":"Unspecified","named_product_or_service":"Barracuda (all products)","service_family":"Not relevant","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":null,"regulatory_regime":"Not stated","exact_supporting_wording":"Sub-Processors and Critical Vendors View online","reviewer_summary":"Barracuda's trust centre links to a published sub-processors and critical vendors list.","limitation_and_notes":"Index page pointing to the actual sub-processor list; company-wide, not SecureEdge-specific."},{"id":"src_financial_services_fin_140","workbook_source_id":"FIN-140","url":"https://trust.barracuda.com/privacy/sub-processors-and-cricital-vendors","title":"Sub-Processors and Critical Vendors - Barracuda Trust Center","publisher":"trust.barracuda.com","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"medium","record_type":"Compliance attestation or statement","requirement_codes":["concentration_risk_and_subcontractor_transparency"],"named_customer":null,"segment":"Unspecified","named_product_or_service":"Barracuda (all products)","service_family":"Not relevant","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":null,"regulatory_regime":"Not stated","exact_supporting_wording":"The following colocation data centers provide physical and environmental security to the Barracuda infrastructure; they don't have logical access.","reviewer_summary":"Barracuda publishes a named list of sub-processors and critical vendors (including AWS, Microsoft Azure, Equinix, Redcentric, CoreSite, Canada15Edge and others) and distinguishes colocation providers with no logical data access from data-processing vendors.","limitation_and_notes":"This is a company-wide sub-processor list, not filtered to SecureEdge specifically, and contains no explicit multi-region independence statement beyond the colocation distinction."},{"id":"src_financial_services_fin_528","workbook_source_id":"FIN-528","url":"https://trust.barracuda.com/legal/product-guide","title":"Barracuda Trust Center Product Guide","publisher":"trust.barracuda.com","publication_date":null,"checked_date":"2026-09-15","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"medium","record_type":"Compliance attestation or statement","requirement_codes":["eu_dora_alignment"],"named_customer":null,"segment":"Unspecified","named_product_or_service":"Barracuda's DORA Article 30 Amendment (Trust Center product guide)","service_family":"Supporting only","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":"DORA Article 30","regulatory_regime":"EU","exact_supporting_wording":"Product guide lists a 'DORA Article 30 Amendment' as an available legal document, alongside a dedicated DORA compliance category.","reviewer_summary":"Harry personally verified this live 2026-09-15. Confirms and strengthens the earlier finding (FS-107/FIN-107) of a named DORA Article 30 Amendment document, now located within Barracuda's structured product guide rather than just the Trust Center navigation. Still platform-wide rather than confirmed SecureEdge-specific, and the amendment's actual terms were not read, so kept at Partial.","limitation_and_notes":"Added 2026-09-15, Harry-verified. Corroborates and locates precisely the DORA Article 30 Amendment already noted for Barracuda earlier in this project."},{"id":"src_financial_services_fin_126","workbook_source_id":"FIN-126","url":"https://www.barracuda.com/solutions/financial-services","title":"Financial Services Cybersecurity: Cybersecurity in Financial Sector | Barracuda Networks","publisher":"barracuda.com","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"rejected","reviewer_confidence":"low","record_type":"Financial services solution page","requirement_codes":[],"named_customer":null,"segment":"Unspecified","named_product_or_service":"Barracuda (general)","service_family":"Not relevant","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":null,"regulatory_regime":"Not stated","exact_supporting_wording":"Financial services are a prime target for cyber attacks. Learn how Barracuda can help.","reviewer_summary":"The page is a generic financial services landing page that links to SecureEdge, CloudGen Firewall and SD-WAN in navigation menus but does not discuss them or name any customer, regulation or capability on the page itself.","limitation_and_notes":"No named customer, no named regulation, no discussion of SecureEdge/CloudGen/SD-WAN capabilities on the page itself; only navigation links. Does not support any column."},{"id":"src_financial_services_fin_127","workbook_source_id":"FIN-127","url":"https://trust.barracuda.com/","title":"Trust Center | Barracuda Networks","publisher":"trust.barracuda.com","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"rejected","reviewer_confidence":"low","record_type":"Other","requirement_codes":[],"named_customer":null,"segment":"Unspecified","named_product_or_service":"Barracuda (all products)","service_family":"Not relevant","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":null,"regulatory_regime":"Not stated","exact_supporting_wording":"Barracuda cloud-based SaaS offerings, and associated customer data (if applicable), are available in the Data center locator","reviewer_summary":"This is an index page pointing to separate data residency, privacy, incident notification and sub-processor pages, which were opened and cited individually.","limitation_and_notes":"Index/navigation page only; no product-specific or capability-specific facts of its own beyond links, so the specific subpages are cited instead."},{"id":"src_financial_services_fin_130","workbook_source_id":"FIN-130","url":"https://www.barracuda.com/products/network-protection/secureedge","title":"SASE Platform & Cloud-First SASE Solution | Barracuda SecureEdge | Barracuda Networks","publisher":"barracuda.com","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"rejected","reviewer_confidence":"low","record_type":"Other","requirement_codes":[],"named_customer":null,"segment":"Unspecified","named_product_or_service":"Barracuda SecureEdge","service_family":"SASE","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":null,"regulatory_regime":"Not stated","exact_supporting_wording":"SASE is an integrated service that provides comprehensive secure access for modern computing environments, reduces complexity and costs","reviewer_summary":"General marketing description of SecureEdge as a SASE platform covering SD-WAN, ZTNA and Firewall-as-a-Service, with no customer names or measurable claims.","limitation_and_notes":"Generic marketing content only; no financial services context, no named customer, no specific figures."},{"id":"src_financial_services_fin_131","workbook_source_id":"FIN-131","url":"https://documentation.campus.barracuda.com/wiki/spaces/SEP/pages/209191114/SecureEdge+Logs","title":"SecureEdge Logs | Barracuda Campus","publisher":"documentation.campus.barracuda.com","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"rejected","reviewer_confidence":"low","record_type":"Other","requirement_codes":[],"named_customer":null,"segment":"Unspecified","named_product_or_service":"Barracuda SecureEdge","service_family":"SASE","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":null,"regulatory_regime":"Not stated","exact_supporting_wording":"Not applicable - page describes log types and filtering only","reviewer_summary":"This product documentation page describes the types of logs available in SecureEdge and how to filter them, but does not state a retention period or SIEM export detail.","limitation_and_notes":"Does not state retention period or SIEM export; the retention fact was instead found in the Product and Service Description document."},{"id":"src_financial_services_fin_134","workbook_source_id":"FIN-134","url":"https://assets.barracuda.com/assets/docs/dms/OV_SecureEdge_Specifications_US.pdf","title":"Barracuda SecureEdge - Specifications","publisher":"assets.barracuda.com","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"rejected","reviewer_confidence":"low","record_type":"Other","requirement_codes":[],"named_customer":null,"segment":"Unspecified","named_product_or_service":"Barracuda SecureEdge","service_family":"SASE","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":null,"regulatory_regime":"Not stated","exact_supporting_wording":"For information on mandatory and optional service/feature subscription, see SecureEdge Licensing documentation","reviewer_summary":"This datasheet covers hardware form factors, throughput and physical specifications for SecureEdge appliances; it does not cover SLA, encryption, MFA, CASB, DLP, SOC or reporting.","limitation_and_notes":"Hardware specification sheet only; no SLA, security control or compliance detail relevant to any of the 28 columns."},{"id":"src_financial_services_fin_138","workbook_source_id":"FIN-138","url":"https://www.barracuda.com/products/network-protection/secureedge/resources","title":"Barracuda SecureEdge: Resources | Barracuda Networks","publisher":"barracuda.com","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"rejected","reviewer_confidence":"low","record_type":"Other","requirement_codes":[],"named_customer":null,"segment":"Unspecified","named_product_or_service":"Barracuda SecureEdge","service_family":"SASE","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":null,"regulatory_regime":"Not stated","exact_supporting_wording":"Not applicable - resource hub with filters only, no case studies rendered in fetched content","reviewer_summary":"This is a filterable resource hub for SecureEdge; no individual case studies, and no financial services or named customer content, were present in the fetched page content.","limitation_and_notes":"No case study content retrievable from this page; searches for named financial institution case studies using SecureEdge or CloudGen Firewall found none."}]},{"slug":"aryaka","name":"Aryaka","marketplace_url":"https://netify.co.uk/marketplace/aryaka/","research_status":"complete","overall_confidence":"medium","fit_conclusion":"Aryaka has one substantive named financial services customer found in this research, Calypso Technology, a financial software company that connected more than 20 offices across 18 countries and over 35,000 users on Aryaka's service, evidenced by a 2013 press release and an undated case study. General platform compliance documentation, including ISO 27001, SOC 2 Type II, encrypted transport and Universal ZTNA with SAML and MFA, is proven for the platform overall but is not linked to Calypso or any other named financial institution. No evidence was found connecting Aryaka's named service to UK FCA or PRA rules, EU DORA, US FFIEC, GLBA, NYDFS or SEC rules, Canadian OSFI rules, PCI DSS certification, or SWIFT CSP, and Aryaka's own FIPS page confirms the service is not FIPS 140-2 or 140-3 certified. UK and North American delivery is evidenced through Aryaka's published point of presence list, covering London, ten US cities and Toronto, rather than through named financial customers based there. Overall, Aryaka's evidence for financial services IT decision makers rests on general security certifications and one dated fintech customer story rather than on regime-specific regulatory proof.","gaps_and_unknowns":"No evidence was found for trading or low-latency workloads, network segmentation, cardholder data segmentation, third-party or subcontractor access controls, change control governance, subcontractor transparency, exit and portability terms, or any of the four named regulatory regimes (FCA/PRA, DORA, US federal and state rules, OSFI), and PCI DSS and SWIFT CSP alignment remain unproven. These gaps would be closed by a current, dated financial services case study naming a bank, insurer or asset manager, a published sub-processor list, a PCI DSS Attestation of Compliance for the named service, and an explicit statement mapping the service to FCA SYSC 15A, DORA Article 30, US FFIEC or NYDFS Part 500, or OSFI B-13.","reviewed_by":"Harry Yelland","reviewed_date":"2026-09-14","source_count":16,"accepted_source_count":12,"requirements":[{"code":"branch_and_office_connectivity","label":"Branch and office connectivity","state":"proven","evidence_source_ids":["src_financial_services_fs_005","src_financial_services_fin_101","src_financial_services_fin_102"],"verified_date":"2026-09-14"},{"code":"trading_and_low_latency_connectivity","label":"Trading and low-latency connectivity","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"data_centre_colocation_and_cloud_connectivity","label":"Data-centre, colocation and cloud connectivity","state":"partial","evidence_source_ids":["src_financial_services_fin_101"],"verified_date":"2026-09-14"},{"code":"resilience_and_tested_recovery","label":"Resilience and tested recovery","state":"proven","evidence_source_ids":["src_financial_services_fin_101","src_financial_services_fin_105","src_financial_services_fin_111"],"verified_date":"2026-09-14"},{"code":"network_segmentation_and_zoning","label":"Network segmentation and zoning","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"payment_and_cardholder_data_segmentation","label":"Payment and cardholder data segmentation","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"third_party_and_outsourced_access","label":"Third-party and outsourced access","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"remote_and_hybrid_workforce","label":"Remote and hybrid workforce","state":"proven","evidence_source_ids":["src_financial_services_fin_101","src_financial_services_fin_102"],"verified_date":"2026-09-14"},{"code":"data_residency_and_sovereignty","label":"Data residency and sovereignty","state":"partial","evidence_source_ids":["src_financial_services_fin_107","src_financial_services_fin_108"],"verified_date":"2026-09-14"},{"code":"encryption_and_key_management","label":"Encryption and key management","state":"proven","evidence_source_ids":["src_financial_services_fin_104","src_financial_services_fin_107"],"verified_date":"2026-09-14"},{"code":"logging_audit_and_evidence_retention","label":"Logging, audit and evidence retention","state":"partial","evidence_source_ids":["src_financial_services_fin_107"],"verified_date":"2026-09-14"},{"code":"identity_and_zero_trust_access","label":"Identity and zero trust access","state":"partial","evidence_source_ids":["src_financial_services_fin_107"],"verified_date":"2026-09-14"},{"code":"cloud_and_saas_data_controls","label":"Cloud and SaaS data controls","state":"partial","evidence_source_ids":["src_financial_services_fin_107"],"verified_date":"2026-09-14"},{"code":"managed_operations_and_soc","label":"Managed operations and SOC","state":"proven","evidence_source_ids":["src_financial_services_fs_007","src_financial_services_fin_101"],"verified_date":"2026-09-14"},{"code":"network_visibility_and_reporting","label":"Network visibility and reporting","state":"proven","evidence_source_ids":["src_financial_services_fin_101"],"verified_date":"2026-09-14"},{"code":"change_control_and_configuration_governance","label":"Change control and configuration governance","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"incident_notification_support","label":"Incident notification support","state":"proven","evidence_source_ids":["src_financial_services_fin_105","src_financial_services_fin_104"],"verified_date":"2026-09-14"},{"code":"concentration_risk_and_subcontractor_transparency","label":"Concentration risk and subcontractor transparency","state":"partial","evidence_source_ids":["src_financial_services_fin_104"],"verified_date":"2026-09-14"},{"code":"exit_and_portability","label":"Exit and portability","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"uk_regulatory_alignment_fca_and_pra","label":"UK regulatory alignment (FCA and PRA)","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"eu_dora_alignment","label":"EU DORA alignment","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"us_regulatory_alignment_ffiec_glba_nydfs_sec","label":"US regulatory alignment (FFIEC, GLBA, NYDFS, SEC)","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"canada_regulatory_alignment_osfi","label":"Canada regulatory alignment (OSFI)","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"pci_dss_alignment","label":"PCI DSS alignment","state":"partial","evidence_source_ids":["src_financial_services_fin_107"],"verified_date":"2026-09-14"},{"code":"swift_csp_alignment","label":"SWIFT CSP alignment","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"uk_delivery","label":"UK delivery","state":"proven","evidence_source_ids":["src_financial_services_fin_109","src_financial_services_fin_110"],"verified_date":"2026-09-14"},{"code":"north_america_delivery","label":"North America delivery","state":"proven","evidence_source_ids":["src_financial_services_fin_110"],"verified_date":"2026-09-14"},{"code":"global_delivery","label":"Global delivery","state":"proven","evidence_source_ids":["src_financial_services_fin_101","src_financial_services_fin_110"],"verified_date":"2026-09-14"}],"sources":[{"id":"src_financial_services_fin_101","workbook_source_id":"FIN-101","url":"https://www.aryaka.com/docs/sd-wan-case-study-calypso.pdf","title":"Calypso Technology SD-WAN Case Study","publisher":"aryaka.com","publication_date":null,"checked_date":"2026-09-15","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"medium","record_type":"Named customer case study","requirement_codes":["data_centre_colocation_and_cloud_connectivity","network_visibility_and_reporting","branch_and_office_connectivity","resilience_and_tested_recovery","remote_and_hybrid_workforce","managed_operations_and_soc","global_delivery"],"named_customer":"Calypso Technology","segment":"Investment banking and trading","named_product_or_service":"Aryaka SmartServices","service_family":"SD-WAN","estate":"20+ global sites; 35,000 users in 60+ countries; 800+ employees managed by IT","countries_or_regions":"18 countries (offices); 60+ countries (users)","ot_or_production_environment":null,"measured_or_stated_outcome":"100% 24/7 availability, reliable network performance and reduced WAN management overhead for a lean IT team","industrial_standard_or_regulation":null,"regulatory_regime":"Not stated","exact_supporting_wording":"\"The saving grace of Aryaka is that it allows us to manage the WAN and our IT with such a lean staff.\" - Russell Wong, Global Director - IT, Calypso Technology","reviewer_summary":"Calypso Technology, a global financial software company, deployed Aryaka SmartServices to connect more than 20 offices in 18 countries serving over 35,000 users, achieving 100% 24/7 availability and letting a lean IT team rely on Aryaka's proactive monitoring and support.","limitation_and_notes":"Checker 2026-09-12: page carries the fact but the wording differs (PDF loaded ok; near-exact match but actual wording is 'Seeing an alert before I go to bed at night and knowing that Aryaka is already diving into it, so that wh). Re-quote verbatim. No publication date is shown; does not mention trading-floor latency, PCI or cardholder data, network segmentation, encryption specifics, or any named regulatory regime; the SmartServices branding reflects Aryaka's legacy product naming. [2026-09-15] Re-quoted 2026-09-15 from the live webpage version of this case study (aryaka.com/?p=26019) rather than the original PDF URL, which could not be re-fetched directly - content matches (same customer, same Russell Wong quote source), so treated as equivalent."},{"id":"src_financial_services_fin_102","workbook_source_id":"FIN-102","url":"https://www.globenewswire.com/en/news-release/2013/03/11/909076/0/en/Global-Financial-Leader-Calypso-Technology-Trades-Up-to-Aryaka-for-WAN-Optimization.html","title":"Global Financial Leader Calypso Technology Trades Up to Aryaka for WAN Optimization","publisher":"globenewswire.com","publication_date":"2013-03-11","checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"medium","record_type":"Contract award","requirement_codes":["branch_and_office_connectivity","remote_and_hybrid_workforce"],"named_customer":"Calypso Technology","segment":"Investment banking and trading","named_product_or_service":"WAN Optimization as-a-Service, Network as-a-Service, Application Delivery as-a-Service","service_family":"Supporting only","estate":"Distributed teams and remote employees around the world","countries_or_regions":"Global (specific countries not stated)","ot_or_production_environment":null,"measured_or_stated_outcome":"SCP over SSH ran 20 times faster; SVN source-code checkout ran 13 times faster; deployment completed in hours; bandwidth burst to 140% of subscribed levels","industrial_standard_or_regulation":null,"regulatory_regime":"Not stated","exact_supporting_wording":"SCP over SSH runs 20X faster over Aryaka. SVN source-code checkout runs 13X faster.","reviewer_summary":"A 2013 wire press release states that Calypso Technology, described as a global financial and software services company serving banks, prime brokers and buy-side firms, adopted Aryaka's WAN optimization, network and application delivery as-a-service for distributed teams and remote employees.","limitation_and_notes":"Dated 2013, predates Aryaka's current SD-WAN/SASE branding; does not mention trading-floor latency, PCI, segmentation, or any regulatory regime; Calypso is a financial software vendor to banks rather than a bank itself."},{"id":"src_financial_services_fin_105","workbook_source_id":"FIN-105","url":"https://www.aryaka.com/aryaka-service-level-agreement/","title":"Aryaka Service Level Agreement: Definitions And Details","publisher":"aryaka.com","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"medium","record_type":"Compliance attestation or statement","requirement_codes":["resilience_and_tested_recovery","incident_notification_support"],"named_customer":null,"segment":"Unspecified","named_product_or_service":"Aryaka PrivateCore, L3EnhancedCore, ANAP High Availability, SmartCDN, Hosted Firewall","service_family":"Multiple","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":"99.999% uptime for PrivateCore services; ANAP failover in under 5 minutes; Tunnel Down notification within 30 minutes","industrial_standard_or_regulation":null,"regulatory_regime":"Not stated","exact_supporting_wording":"Failover to the Standby ANAP in less than 5 minutes","reviewer_summary":"Aryaka's published SLA commits to failover from a primary to standby ANAP appliance in under five minutes, tunnel-down notification to customers within 30 minutes, and uptime targets of up to 99.999% for PrivateCore services, with service credits for missed targets.","limitation_and_notes":"Not specific to financial services customers; states contractual failover and notification timings but no RTO/RPO terminology or DR test evidence, and no named FS customer."},{"id":"src_financial_services_fin_106","workbook_source_id":"FIN-106","url":"https://www.aryaka.com/fips-compliance-readiness-for-federal-customers/","title":"FIPS Compliance Readiness For Federal Customers","publisher":"aryaka.com","publication_date":"2025-09-29","checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"high","record_type":"Contradiction","requirement_codes":["encryption_and_key_management"],"named_customer":null,"segment":"Unspecified","named_product_or_service":"Aryaka security services","service_family":"Multiple","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":"FIPS 140-2 / FIPS 140-3","regulatory_regime":"Not stated","exact_supporting_wording":"Aryaka is not currently FIPS 140-2 or 140-3 certified across the full product stack.","reviewer_summary":"Aryaka states it is not currently FIPS 140-2 or 140-3 certified across its full product stack, but claims a FIPS-aligned posture using FIPS-validated cryptographic modules and restricted TLS 1.2/1.3 cipher suites, with formal certification under evaluation for federal and defence demand.","limitation_and_notes":"Confirms that formal FIPS validation is not in place; used only as a limitation on the encryption and key management column, not as positive proof of certification, and is not financial-services specific. [2026-09-15, capability assigned per Robert's check] This is DISCONFIRMING evidence: the source states Aryaka is NOT currently FIPS 140-2/140-3 certified across the full product stack. Accepted as an accurate absence-of-certification finding, not as support for a Proven/Partial claim - should not be used to justify any positive rating."},{"id":"src_financial_services_fin_107","workbook_source_id":"FIN-107","url":"https://www.aryaka.com/faq/","title":"Security FAQs | Universal ZTNA, AI Secure & Next-Gen DLP | Aryaka","publisher":"aryaka.com","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"medium","record_type":"Compliance attestation or statement","requirement_codes":["logging_audit_and_evidence_retention","data_residency_and_sovereignty","identity_and_zero_trust_access","encryption_and_key_management","cloud_and_saas_data_controls","pci_dss_alignment"],"named_customer":null,"segment":"Unspecified","named_product_or_service":"Aryaka Universal ZTNA; Aryaka Next-Gen DLP","service_family":"SASE","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":"GDPR; HIPAA; PCI (referenced generically for DLP audit packs)","regulatory_regime":"Not stated","exact_supporting_wording":"Standards-based SAML with major IdPs (e.g., Okta, Entra ID, etc.); we inherit MFA/SSO and can apply step-up based on risk/posture.","reviewer_summary":"Aryaka's security FAQ states that Universal ZTNA integrates with SAML identity providers such as Okta and Entra ID, inheriting MFA/SSO with risk-based step-up, and that Next-Gen DLP provides retention controls, RBAC and SIEM-exportable audit logs, with audit packs mapped to GDPR, HIPAA and PCI; it also notes that data residency options must be confirmed per customer region.","limitation_and_notes":"General FAQ content, not tied to a named financial services customer; the PCI reference is only that DLP audit packs are mapped to PCI, not a PCI DSS Attestation of Compliance for the service; data residency answer is vague rather than a firm regional commitment."},{"id":"src_financial_services_fin_108","workbook_source_id":"FIN-108","url":"https://www.aryaka.com/privacy-policy/","title":"Privacy Policy - Aryaka","publisher":"aryaka.com","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"high","record_type":"Compliance attestation or statement","requirement_codes":["data_residency_and_sovereignty"],"named_customer":null,"segment":"Unspecified","named_product_or_service":"Aryaka","service_family":"Not relevant","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":"GDPR; CCPA/CPRA; VCDPA; CPA; CTDPA","regulatory_regime":"Not stated","exact_supporting_wording":"Your Personal Information may be stored and processed in any country or region where we have facilities or engage service providers","reviewer_summary":"Aryaka's privacy policy states personal information may be stored and processed in any country or region where Aryaka or its service providers have facilities, including the United States, and uses standard contractual clauses for EU/UK transfers, with retention tied to business need rather than a fixed period.","limitation_and_notes":"Shows that Aryaka does not commit to regional data residency for personal data by default; does not name a financial services customer or a specific management-plane residency guarantee for the UK, EU, US or Canada."},{"id":"src_financial_services_fin_109","workbook_source_id":"FIN-109","url":"https://www.aryaka.com/press/financial-services-organisations-digital-transformation-paving-way-smarter-digital-future-find-cloud-industry-forum-aryaka/","title":"Financial Services Organisations Digital Transformation Paving Way To A Smarter, Digital Future, Find Cloud Industry Forum And Aryaka | Aryaka","publisher":"aryaka.com","publication_date":null,"checked_date":"2026-09-15","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"medium","record_type":"Independent analysis","requirement_codes":["uk_delivery"],"named_customer":null,"segment":"Multiple","named_product_or_service":"Aryaka Managed SD-WAN","service_family":"Managed SD-WAN","estate":"Survey of 250 UK financial services IT/business decision makers (50+ employees, ~GBP 8m average IT procurement budget)","countries_or_regions":"UK","ot_or_production_environment":null,"measured_or_stated_outcome":"52% of UK financial services firms lack confidence in meeting regulatory obligations; 58% say their cloud security posture needs improvement","industrial_standard_or_regulation":null,"regulatory_regime":"UK","exact_supporting_wording":"\"This research demonstrates that now is a crucial time for the UK's financial services sector to move to the cloud.\" - Ian McEwan, Senior Vice President of International Sales, Aryaka","reviewer_summary":"A joint Aryaka and Cloud Industry Forum survey of 250 UK financial services IT and business decision makers found high cloud adoption alongside gaps in confidence around regulatory compliance and cloud security posture, with an Aryaka SVP commenting that cloud migration must not compromise security and regulatory requirements.","limitation_and_notes":"Checker 2026-09-12: page carries the fact but the wording differs (Page loaded; actual text reads 'how they achieve this is more relevant than ever and it is critical that the move to the cloud does not compromise security, reg). Re-quote verbatim. No named financial institution or deployment; general survey commentary rather than a connection of Aryaka's product to a specific FS regulatory outcome; does not name FCA, PRA or DORA. [2026-09-15] Re-quoted verbatim, live-verified. This is a Cloud Industry Forum/Aryaka survey of the UK FS sector generally, not a named institution or product deployment - correctly stays sector-context evidence, not named-customer proof."},{"id":"src_financial_services_fin_110","workbook_source_id":"FIN-110","url":"https://www.aryaka.com/about-us/global-pop-locations/","title":"Aryaka Global Points-of-Presence (PoPs)","publisher":"aryaka.com","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"high","record_type":"Other","requirement_codes":["north_america_delivery","global_delivery","uk_delivery"],"named_customer":null,"segment":"Unspecified","named_product_or_service":"Aryaka Unified SASE","service_family":"Multiple","estate":null,"countries_or_regions":"US: Ashburn, Atlanta, Chicago, Dallas, Denver, Los Angeles, Miami, Newark, San Jose, Seattle; Canada: Toronto; UK: London; plus EMEA and APAC PoPs","ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":null,"regulatory_regime":"Not stated","exact_supporting_wording":"fast and reliable cloud and SaaS access from any location in the world","reviewer_summary":"Aryaka lists points of presence including ten US cities, Toronto in Canada, and London in the UK, alongside EMEA and APAC coverage, as part of its global network delivery footprint.","limitation_and_notes":"Confirms geographic PoP footprint only; does not name any financial services customer using these PoPs and does not describe UK-based support or a UK data centre beyond the London PoP."},{"id":"src_financial_services_fin_111","workbook_source_id":"FIN-111","url":"https://www.aryaka.com/datasheet/high-availability-solution/","title":"Aryaka High Availability: Resilient, Secure, And Seamless Connectivity","publisher":"aryaka.com","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"medium","record_type":"Other","requirement_codes":["resilience_and_tested_recovery"],"named_customer":null,"segment":"Unspecified","named_product_or_service":"Aryaka High Availability (ANAP)","service_family":"SD-WAN","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":null,"regulatory_regime":"Not stated","exact_supporting_wording":"Virtual ANAP Redundancy Protocol (VARP)","reviewer_summary":"Aryaka's High Availability datasheet describes dual-ISP redundancy, active-active SMARTlink link usage and ANAP failover using VARP, without quantified RTO or RPO metrics.","limitation_and_notes":"No RTO/RPO figures, no DR test evidence, and no named financial services customer; a general architecture datasheet only."},{"id":"src_financial_services_fin_104","workbook_source_id":"FIN-524","url":"https://trustcenter.aryaka.com/","title":"Aryaka Trust Center | Powered by SafeBase","publisher":"trustcenter.aryaka.com","publication_date":null,"checked_date":"2026-09-15","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"low","record_type":"Compliance attestation or statement","requirement_codes":["concentration_risk_and_subcontractor_transparency","incident_notification_support"],"named_customer":null,"segment":"Unspecified","named_product_or_service":"Aryaka Unified SASE / SD-WAN","service_family":"Supporting only","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":"SSAE-18 SOC 2 Type II; ISO 27001","regulatory_regime":null,"exact_supporting_wording":"SafeBase-hosted Trust Center describing Aryaka's security programme, customer-data protection, SSAE-18 SOC 2 Type II, ISO 27001, encrypted IPsec, and compliance/assurance documentation.","reviewer_summary":"Harry personally verified this live 2026-09-15. A structured Trust Center exists with real certifications, but the landing page alone doesn't connect Aryaka's named service to a specific SLA-backed incident-notification commitment or a detailed subprocessor list with audit/objection rights - graded Partial pending the underlying documents themselves.","limitation_and_notes":"Added 2026-09-15, Harry-verified. Trust Center landing page only - underlying detailed documents not individually opened."},{"id":"src_financial_services_fs_005","workbook_source_id":"FS-005","url":"https://www.aryaka.com/resources/","title":"Resources | Aryaka SD-WAN & SASE","publisher":"aryaka.com","publication_date":null,"checked_date":"2026-07-29","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"medium","record_type":"Existing source lead","requirement_codes":["branch_and_office_connectivity"],"named_customer":null,"segment":"Investment banking and trading","named_product_or_service":null,"service_family":"Supporting only","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":null,"regulatory_regime":"Not stated","exact_supporting_wording":"Financial Services Company Calypso","reviewer_summary":"Graded yes on a named customer (Calypso, a capital markets software firm) presented by Aryaka explicitly as a financial services company, plus 'Banking/Financial Services' being one of only six labels in Aryaka's own published industry filter. Confidence is medium not high because the evidence is an undated video testimonial rather than a written case study, there is no dedicated financial services industry page to sit alongside manufacturing, transport and professional services, and no banking accreditation or regulatory framework was found.","limitation_and_notes":"Supplier's own resource library. Its 'By Industries' filter is the authoritative published list of the sectors Aryaka itself indexes: Manufacturing, Banking/Financial Services, Transportation & Logistics, Business Services, Energy, Retail. Useful as a negative check for the four sectors absent from it. | Confirmed - exact match [2026-09-15, capability assigned per Robert's check] Calypso resource listing page - same underlying customer as FIN-101; weak on its own, corroborative only."},{"id":"src_financial_services_fs_007","workbook_source_id":"FS-007","url":"https://www.aryaka.com/videos/financial-services-company-calypso-on-aryakas-customer-support/","title":"Financial Services Company Calypso On Aryaka's Customer Support","publisher":"aryaka.com","publication_date":null,"checked_date":"2026-07-29","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"medium","record_type":"Existing source lead","requirement_codes":["managed_operations_and_soc"],"named_customer":null,"segment":"Investment banking and trading","named_product_or_service":null,"service_family":"Supporting only","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":null,"regulatory_regime":"Not stated","exact_supporting_wording":"Financial Services Company Calypso","reviewer_summary":"Graded yes on a named customer (Calypso, a capital markets software firm) presented by Aryaka explicitly as a financial services company, plus 'Banking/Financial Services' being one of only six labels in Aryaka's own published industry filter. Confidence is medium not high because the evidence is an undated video testimonial rather than a written case study, there is no dedicated financial services industry page to sit alongside manufacturing, transport and professional services, and no banking accreditation or regulatory framework was found.","limitation_and_notes":"Supplier's own customer video page. The only named financial services customer found. Undated video testimonial rather than a written case study, hence medium confidence. | Confirmed - exact match [2026-09-15, capability assigned per Robert's check] Support-specific angle on the same Calypso case."},{"id":"src_financial_services_fin_112","workbook_source_id":"FIN-112","url":"https://www.aryaka.com/case-study/financial-company/","title":"The Financial Case For Unified SASE As A Service: Cut Costs & Accelerate ROI | Aryaka","publisher":"aryaka.com","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"rejected","reviewer_confidence":"medium","record_type":"Financial services solution page","requirement_codes":[],"named_customer":null,"segment":"Unspecified","named_product_or_service":"Aryaka Unified SASE as a Service","service_family":"SASE","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":null,"regulatory_regime":"Not stated","exact_supporting_wording":"Discover how Aryaka's Unified SASE helps enterprises cut costs, reduce CapEx, and boost ROI","reviewer_summary":"This page is a general financial and ROI ebook about Unified SASE as a Service, not a case study naming a financial services sector customer.","limitation_and_notes":"Despite its URL and title referencing 'financial', this is a cost/ROI business case document, not evidence about the financial services industry or any named financial institution."},{"id":"src_financial_services_fin_113","workbook_source_id":"FIN-113","url":"https://www.aryaka.com/resources/sd-wan-case-study-calypso/","title":"Aryaka Customer Case Studies: Real-World SD-WAN & SASE Success Stories","publisher":"aryaka.com","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"rejected","reviewer_confidence":"low","record_type":"Other","requirement_codes":[],"named_customer":null,"segment":"Unspecified","named_product_or_service":"Aryaka Unified SASE / SD-WAN","service_family":"Multiple","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":null,"regulatory_regime":"Not stated","exact_supporting_wording":null,"reviewer_summary":"This URL, expected to be the Calypso case study, instead rendered as a general case studies listing page naming other customers (Thetford, Lauridsen Group, AL-KO, Albemarle, Hubbell) and no financial services company.","limitation_and_notes":"Content did not match the expected Calypso case study; no financial services evidence found on this specific URL, so it is not used as a source (the separate Calypso PDF was used instead)."},{"id":"src_financial_services_fs_006","workbook_source_id":"FS-006","url":"https://www.aryaka.com/sase-reviews/","title":"See Why Customers Rank Aryaka #1 In SD-WAN On G2 Summer 2026","publisher":"aryaka.com","publication_date":null,"checked_date":"2026-07-29","source_ownership":"provider_authored","decision":"superseded","reviewer_confidence":"medium","record_type":"Existing source lead","requirement_codes":[],"named_customer":null,"segment":"To review","named_product_or_service":"Aryaka Unified SASE / SD-WAN","service_family":"SD-WAN","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":null,"regulatory_regime":null,"exact_supporting_wording":"Financial Services Company Calypso","reviewer_summary":"Graded yes on a named customer (Calypso, a capital markets software firm) presented by Aryaka explicitly as a financial services company, plus 'Banking/Financial Services' being one of only six labels in Aryaka's own published industry filter. Confidence is medium not high because the evidence is an undated video testimonial rather than a written case study, there is no dedicated financial services industry page to sit alongside manufacturing, transport and professional services, and no banking accreditation or regulatory framework was found.","limitation_and_notes":"Supplier's own review round-up page. Names Cathay, World Kinect, Hubbell, NVIDIA, Makino and Pilot, and states the industries customers span. Vendor-curated selection of third-party reviews, so treat the review scores as promotional. | New Source: https://www.aryaka.com/videos/financial-services-company-calypso-on-aryakas-customer-support/"}]},{"slug":"cato-networks","name":"Cato Networks","marketplace_url":"https://netify.co.uk/marketplace/cato-networks/","research_status":"complete","overall_confidence":"medium","fit_conclusion":"Cato Networks has clear, named evidence of financial services deployments for branch connectivity, cloud on-ramp and remote workforce security, strongest in the US credit union segment through Guardian Credit Union and in insurance through the Philippines-based Standard Insurance. Data residency, sub-processor transparency and log retention are documented in Cato's own compliance material, though FIPS 140-2/140-3 validation is explicitly absent. No evidence connects the named service to FCA/PRA, DORA, US banking regulation (FFIEC, GLBA, NYDFS) or OSFI, and trading/low-latency, cardholder-data segmentation and SWIFT-specific evidence are also absent. The strongest named customer overall is Guardian Credit Union for North American delivery and branch/remote-workforce evidence. IT decision makers in regulated UK, EU or Canadian financial firms would need Cato to supply regime-specific compliance statements before relying on public material alone.","gaps_and_unknowns":"No FCA/PRA, DORA, FFIEC/GLBA/NYDFS or OSFI alignment statement was found for the named service; a compliance statement or contractual annex addressing these regimes would close this. Trading/low-latency, payment/cardholder data segmentation, SWIFT CSP alignment, managed SOC for FS customers, change control governance and exit/portability terms are also unevidenced and would need dedicated documentation or named case studies to confirm.","reviewed_by":"Harry Yelland","reviewed_date":"2026-09-14","source_count":16,"accepted_source_count":12,"requirements":[{"code":"branch_and_office_connectivity","label":"Branch and office connectivity","state":"proven","evidence_source_ids":["src_financial_services_fs_016","src_financial_services_fs_016","src_financial_services_fin_158","src_financial_services_fin_168"],"verified_date":"2026-09-14"},{"code":"trading_and_low_latency_connectivity","label":"Trading and low-latency connectivity","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"data_centre_colocation_and_cloud_connectivity","label":"Data-centre, colocation and cloud connectivity","state":"proven","evidence_source_ids":["src_financial_services_fin_168"],"verified_date":"2026-09-14"},{"code":"resilience_and_tested_recovery","label":"Resilience and tested recovery","state":"partial","evidence_source_ids":["src_financial_services_fin_163"],"verified_date":"2026-09-14"},{"code":"network_segmentation_and_zoning","label":"Network segmentation and zoning","state":"partial","evidence_source_ids":["src_financial_services_fin_158","src_financial_services_fin_168"],"verified_date":"2026-09-14"},{"code":"payment_and_cardholder_data_segmentation","label":"Payment and cardholder data segmentation","state":"not_found","evidence_source_ids":["src_financial_services_fin_164"],"verified_date":"2026-09-14"},{"code":"third_party_and_outsourced_access","label":"Third-party and outsourced access","state":"partial","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"remote_and_hybrid_workforce","label":"Remote and hybrid workforce","state":"proven","evidence_source_ids":["src_financial_services_fs_016","src_financial_services_fin_158","src_financial_services_fin_159"],"verified_date":"2026-09-14"},{"code":"data_residency_and_sovereignty","label":"Data residency and sovereignty","state":"proven","evidence_source_ids":["src_financial_services_fin_161"],"verified_date":"2026-09-14"},{"code":"encryption_and_key_management","label":"Encryption and key management","state":"partial","evidence_source_ids":["src_financial_services_fin_160"],"verified_date":"2026-09-14"},{"code":"logging_audit_and_evidence_retention","label":"Logging, audit and evidence retention","state":"proven","evidence_source_ids":["src_financial_services_fin_166"],"verified_date":"2026-09-14"},{"code":"identity_and_zero_trust_access","label":"Identity and zero trust access","state":"partial","evidence_source_ids":["src_financial_services_fin_167"],"verified_date":"2026-09-14"},{"code":"cloud_and_saas_data_controls","label":"Cloud and SaaS data controls","state":"proven","evidence_source_ids":["src_financial_services_fin_159"],"verified_date":"2026-09-14"},{"code":"managed_operations_and_soc","label":"Managed operations and SOC","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"network_visibility_and_reporting","label":"Network visibility and reporting","state":"proven","evidence_source_ids":["src_financial_services_fs_016"],"verified_date":"2026-09-14"},{"code":"change_control_and_configuration_governance","label":"Change control and configuration governance","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"incident_notification_support","label":"Incident notification support","state":"partial","evidence_source_ids":["src_financial_services_fin_164"],"verified_date":"2026-09-14"},{"code":"concentration_risk_and_subcontractor_transparency","label":"Concentration risk and subcontractor transparency","state":"proven","evidence_source_ids":["src_financial_services_fin_162"],"verified_date":"2026-09-14"},{"code":"exit_and_portability","label":"Exit and portability","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"uk_regulatory_alignment_fca_and_pra","label":"UK regulatory alignment (FCA and PRA)","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"eu_dora_alignment","label":"EU DORA alignment","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"us_regulatory_alignment_ffiec_glba_nydfs_sec","label":"US regulatory alignment (FFIEC, GLBA, NYDFS, SEC)","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"canada_regulatory_alignment_osfi","label":"Canada regulatory alignment (OSFI)","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"pci_dss_alignment","label":"PCI DSS alignment","state":"proven","evidence_source_ids":["src_financial_services_fin_160"],"verified_date":"2026-09-14"},{"code":"swift_csp_alignment","label":"SWIFT CSP alignment","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"uk_delivery","label":"UK delivery","state":"partial","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"north_america_delivery","label":"North America delivery","state":"partial","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"global_delivery","label":"Global delivery","state":"partial","evidence_source_ids":[],"verified_date":"2026-09-14"}],"sources":[{"id":"src_financial_services_fs_016","workbook_source_id":"FIN-157","url":"https://www.catonetworks.com/customers/guardian-credit-union-improves-network-control-security-with-cato/","title":"Guardian Credit Union Improves Network Control & Security with Cato","publisher":"catonetworks.com","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"high","record_type":"Named customer case study","requirement_codes":["network_visibility_and_reporting","branch_and_office_connectivity","remote_and_hybrid_workforce"],"named_customer":"Guardian Credit Union","segment":"Building society or credit union","named_product_or_service":"Cato SASE Platform (with SD-WAN)","service_family":"SASE","estate":"20 sites across a dozen Alabama counties","countries_or_regions":"United States (Alabama)","ot_or_production_environment":null,"measured_or_stated_outcome":"Improved network visibility and control, reduced operational complexity, cloud traffic no longer backhauled to the datacentre","industrial_standard_or_regulation":null,"regulatory_regime":"US","exact_supporting_wording":"Guardian Credit Union, an Alabama-based credit union, had a private network connecting 20 sites across a dozen Alabama counties.","reviewer_summary":"Guardian Credit Union, a US credit union with 20 sites across Alabama, replaced its private network with Cato's SASE platform for network visibility, control and remote worker support.","limitation_and_notes":"Does not address trading/low latency, DC or cloud on-ramp naming, cardholder data segmentation, PCI, or any regulatory regime; page last modified 2024-09-26 but no original publish date shown."},{"id":"src_financial_services_fin_158","workbook_source_id":"FIN-158","url":"https://www.catonetworks.com/customers/cato-sase-cloud-secures-networking-of-bank-avera-locations-and-its-mobile-employees/","title":"Cato SASE Cloud secures networking of Bank Avera locations and its mobile employees","publisher":"catonetworks.com","publication_date":"2021-11-25","checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"high","record_type":"Named customer case study","requirement_codes":["network_segmentation_and_zoning","branch_and_office_connectivity","remote_and_hybrid_workforce"],"named_customer":"Bank Avera","segment":"Retail banking","named_product_or_service":"Cato SASE Cloud (NGFW, SWG, anti-malware, IPS, Cato Sockets SD-WAN)","service_family":"SASE","estate":"Twelve locations, around 45,000 customers","countries_or_regions":"Switzerland (greater Zurich area)","ot_or_production_environment":null,"measured_or_stated_outcome":"Complexity was reduced, uptime increased and processes simplified; new users, bandwidth and locations can be easily integrated","industrial_standard_or_regulation":null,"regulatory_regime":"EU","exact_supporting_wording":"Bank Avera, which has been rooted in the greater Zurich area since 1828, serves around 45,000 satisfied customers via a network of twelve locations.","reviewer_summary":"Bank Avera, a Swiss regional bank with twelve locations, uses Cato SASE Cloud to secure branch connectivity and mobile/home-working employees on one platform.","limitation_and_notes":"Switzerland is not UK, EU (post-Brexit EU membership), US or Canada for the regulatory columns in this brief; no PCI, DORA, resilience metrics or cardholder data segmentation stated."},{"id":"src_financial_services_fin_159","workbook_source_id":"FIN-159","url":"https://www.catonetworks.com/customers/moonpay-stopped-blocking-ai-and-started-governing-it/","title":"How MoonPay Stopped Blocking AI and Started Governing It","publisher":"catonetworks.com","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"medium","record_type":"Named customer case study","requirement_codes":["cloud_and_saas_data_controls","remote_and_hybrid_workforce"],"named_customer":"MoonPay","segment":"Payments and fintech","named_product_or_service":"Cato AI Security","service_family":"SASE","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":"Network-layer monitoring of prompts and responses, blocking of sensitive data such as crypto wallet addresses from being sent to AI tools, and anonymising outbound data","industrial_standard_or_regulation":"PCI Level 1; SOC 2 Type 2; ISO 27001/27018/27701","regulatory_regime":"Not stated","exact_supporting_wording":"I could secure the data coming into the computers. I could secure the data going out.","reviewer_summary":"MoonPay, a crypto payments fintech, uses Cato AI Security to monitor and control AI tool usage and prevent sensitive data such as wallet addresses leaving the organisation.","limitation_and_notes":"Case is about AI governance/DLP only, not branch connectivity, SD-WAN, segmentation, resilience or any named regulatory regime; PCI/SOC2/ISO are cited as MoonPay's own certifications, not a Cato attestation for the named service."},{"id":"src_financial_services_fin_160","workbook_source_id":"FIN-160","url":"https://www.catonetworks.com/security-compliance-and-privacy/","title":"Security, Compliance and Privacy | Cato Networks","publisher":"catonetworks.com","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"medium","record_type":"Compliance attestation or statement","requirement_codes":["encryption_and_key_management","pci_dss_alignment"],"named_customer":null,"segment":"Unspecified","named_product_or_service":"Cato SASE Cloud Platform","service_family":"SASE","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":"PCI-DSS Level 1; SOC 2; SOC 3; ISO/IEC 27001:2013; ISO/IEC 27017:2015; ISO/IEC 27018:2019; ISO/IEC 27701:2019; GDPR","regulatory_regime":"Not stated","exact_supporting_wording":"Cato is PCI-DSS Level 1 certified","reviewer_summary":"Cato Networks states it holds SOC 2, SOC 3, PCI-DSS Level 1, several ISO 27000-series certifications and is GDPR compliant, without naming individual financial customers.","limitation_and_notes":"General corporate certification list, does not name a financial customer or give FIPS, data residency, log retention or key management specifics; a certification list is not by itself Proven for regulatory-regime columns 20-23 per the grading rules."},{"id":"src_financial_services_fin_161","workbook_source_id":"FIN-161","url":"https://knowledge.catonetworks.com/docs/sase-sovereignty-at-cato-networks","title":"SASE Sovereignty at Cato Networks","publisher":"knowledge.catonetworks.com","publication_date":"2026-06-22","checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"high","record_type":"Compliance attestation or statement","requirement_codes":["data_residency_and_sovereignty"],"named_customer":null,"segment":"Unspecified","named_product_or_service":"Cato Management Application (CMA) / Cato SASE Cloud","service_family":"SASE","estate":null,"countries_or_regions":"US, EU, India, Japan (control plane); UK, Germany, Netherlands, Italy, France, Singapore, Australia, Philippines, Israel (regional legal entities)","ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":null,"regulatory_regime":"Multiple","exact_supporting_wording":"Customer policy, configuration, and event data is anchored to the selected region and does not leave it","reviewer_summary":"Cato documents regional Cato Management Application instances in the US, EU, India and Japan, with customer configuration and event data anchored to the chosen region, and lists regional legal entities including the UK, but does not list Canada.","limitation_and_notes":"No Canada region listed for the management/data plane; document does not name a financial customer using a specific region, and gives no encryption algorithm or key-management specifics beyond who holds keys in Private CMA deployments."},{"id":"src_financial_services_fin_162","workbook_source_id":"FIN-162","url":"https://support.catonetworks.com/hc/en-us/articles/360012763918-Cato-Networks-Sub-Processors","title":"Cato Networks Sub-Processors","publisher":"support.catonetworks.com","publication_date":"2026-05-19","checked_date":"2026-09-15","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"high","record_type":"Compliance attestation or statement","requirement_codes":["concentration_risk_and_subcontractor_transparency"],"named_customer":null,"segment":"Unspecified","named_product_or_service":"Cato SASE Cloud Platform","service_family":"SASE","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":null,"regulatory_regime":"Not stated","exact_supporting_wording":"Cloud computing provider and data hosting","reviewer_summary":"Cato publishes a named list of sub-processors covering general services, remote browser isolation, sandboxing and AI security services, including AWS, Datadog, Snowflake, Twilio, OpenAI and others, last updated 19 May 2026.","limitation_and_notes":"Checker 2026-09-12: page carries the fact but the wording differs (Page lists AWS as 'Cloud computing provider and data hosting' rather than exact quoted phrasing 'Cloud computing and data hosting'). Re-quote verbatim. List names sub-processors but contains no multi-region independence statement or audit-rights language, and is not specific to financial services customers. [2026-09-15] Re-quoted verbatim using the checker's own already-confirmed page wording - no fresh fetch needed, the exact sentence was already recorded in the check note."},{"id":"src_financial_services_fin_163","workbook_source_id":"FIN-163","url":"https://cato.digital/terms/sla/","title":"Service Level Agreement","publisher":"cato.digital","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"medium","record_type":"Compliance attestation or statement","requirement_codes":["resilience_and_tested_recovery"],"named_customer":null,"segment":"Unspecified","named_product_or_service":"Cato Cloud service","service_family":"SASE","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":null,"regulatory_regime":"Not stated","exact_supporting_wording":"any instance that is Unavailable for more than six minutes of a clockhour","reviewer_summary":"Cato's published SLA commits to at least 99.5 percent instance-level uptime with tiered service credits, but defines unavailability narrowly as loss of external connectivity and states no RTO, RPO or failover procedure.","limitation_and_notes":"No RTO/RPO or tested-failover commitment is stated; this is a generic commercial SLA, not a financial-services-specific resilience commitment, and does not name any FS customer."},{"id":"src_financial_services_fin_164","workbook_source_id":"FIN-164","url":"https://www.catonetworks.com/sase/sase-for-credit-unions/","title":"SASE for Credit Unions | Cato Networks","publisher":"catonetworks.com","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"medium","record_type":"Financial services solution page","requirement_codes":["payment_and_cardholder_data_segmentation","incident_notification_support"],"named_customer":"Guardian Credit Union","segment":"Building society or credit union","named_product_or_service":"Cato SASE Cloud","service_family":"SASE","estate":null,"countries_or_regions":"United States","ot_or_production_environment":null,"measured_or_stated_outcome":"Cato SASE enables compliance policies to be configured in a few days via zero-touch deployment and self-service portals","industrial_standard_or_regulation":"PCI-DSS; NCUA policies","regulatory_regime":"US","exact_supporting_wording":"Federally insured credit unions are required to report cyber security incidents within 72 hours.","reviewer_summary":"Cato's credit union solution page states that credit unions must comply with PCI-DSS and NCUA rules, including a 72-hour cyber incident reporting requirement, and features Guardian Credit Union as its case study, but does not itself state that Cato's service carries a PCI DSS attestation.","limitation_and_notes":"States the regulatory requirement credit unions face, not that Cato's own service has a PCI DSS Attestation of Compliance or a specific incident-notification SLA to customers; no FFIEC or GLBA mention."},{"id":"src_financial_services_fin_166","workbook_source_id":"FIN-166","url":"https://knowledge.catonetworks.com/docs/en/guide-to-cato-data-lake","title":"Guide to Cato Data Lake","publisher":"knowledge.catonetworks.com","publication_date":"2026-08-24","checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"high","record_type":"Compliance attestation or statement","requirement_codes":["logging_audit_and_evidence_retention"],"named_customer":null,"segment":"Unspecified","named_product_or_service":"Cato Data Lake","service_family":"SASE","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":null,"regulatory_regime":"Not stated","exact_supporting_wording":"For contracts and renewals starting from January 1st, 2024, the default retention period for events is 3 months.","reviewer_summary":"Cato documents a default 3-month event log retention period, with 6- and 12-month extended retention available for purchase, and free integrations to export logs to AWS S3, Azure Blob Storage or SIEM tools.","limitation_and_notes":"Retention and export are documented for the general Cato Cloud service, not specifically for a financial services customer; no audit-trail-specific retention statement is given."},{"id":"src_financial_services_fin_167","workbook_source_id":"FIN-167","url":"https://www.catonetworks.com/platform/universal-zero-trust-network-access-ztna/","title":"Universal ZTNA | Cato Networks","publisher":"catonetworks.com","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"medium","record_type":"Compliance attestation or statement","requirement_codes":["identity_and_zero_trust_access"],"named_customer":null,"segment":"Unspecified","named_product_or_service":"Cato Universal ZTNA","service_family":"SASE","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":null,"regulatory_regime":"Not stated","exact_supporting_wording":"Use your SSO/MFA or Cato's user database","reviewer_summary":"Cato's ZTNA platform page documents identity- and context-based access control with SSO/MFA integration, applied uniformly across users, devices and locations.","limitation_and_notes":"Generic product documentation with no financial services customer or industry context named on this page."},{"id":"src_financial_services_fin_168","workbook_source_id":"FIN-168","url":"https://www.catonetworks.com/customers/standard-insurance-uses-cato-for-cloud-migration-and-digital-transformation/","title":"Standard Insurance Uses Cato for Cloud Migration and Digital Transformation","publisher":"catonetworks.com","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"high","record_type":"Named customer case study","requirement_codes":["data_centre_colocation_and_cloud_connectivity","network_segmentation_and_zoning","branch_and_office_connectivity"],"named_customer":"Standard Insurance","segment":"Insurance","named_product_or_service":"Cato SASE Platform (Cato Socket SD-WAN devices)","service_family":"SASE","estate":"60 branches, 700+ dealer/agent networks, 1,500 associates","countries_or_regions":"Philippines","ot_or_production_environment":null,"measured_or_stated_outcome":"Internet bandwidth increased 10x; branch deployment reduced to minutes; security costs reduced by half","industrial_standard_or_regulation":null,"regulatory_regime":"Not stated","exact_supporting_wording":"allows our branches to easily connect to the AWS cloud via the Cato network","reviewer_summary":"Standard Insurance, a Philippines-based insurer with 60 branches, uses Cato's SASE platform with Cato Sockets to connect branches and route traffic to AWS through Cato Points of Presence co-located with AWS IXPs.","limitation_and_notes":"Philippines is outside the UK/EU/US/Canada regulatory scope of this brief; no PCI, resilience testing or cardholder data segmentation stated."},{"id":"src_financial_services_fin_165","workbook_source_id":"FIN-165","url":"https://support.catonetworks.com/hc/en-us/articles/28357323624861-FIPS-Compliance-and-TLS-Configuration-at-Cato-Networks","title":"FIPS Compliance and TLS Configuration at Cato Networks","publisher":"support.catonetworks.com","publication_date":"2025-06-24","checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"rejected","reviewer_confidence":"high","record_type":"Contradiction","requirement_codes":[],"named_customer":null,"segment":"Unspecified","named_product_or_service":"Cato Networks platform","service_family":"SASE","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":"FIPS 140-2; FIPS 140-3","regulatory_regime":"Not stated","exact_supporting_wording":"Cato Networks is not FIPS 140-2 or 140-3 certified","reviewer_summary":"Cato's own support documentation confirms Cato Networks is not FIPS 140-2 or 140-3 certified, and instead documents how to configure TLS cipher suites that align with FIPS-approved algorithms as a workaround.","limitation_and_notes":"This page disproves FIPS validation rather than supporting any capability column; kept as a contradiction record only, not used to support column 10."},{"id":"src_financial_services_fs_014","workbook_source_id":"FS-014","url":"https://www.catonetworks.com/customers/?industry=financial-services","title":"Customers filtered by Financial Services","publisher":"catonetworks.com","publication_date":null,"checked_date":"2026-07-29","source_ownership":"provider_authored","decision":"superseded","reviewer_confidence":"high","record_type":"Existing source lead","requirement_codes":[],"named_customer":null,"segment":"To review","named_product_or_service":null,"service_family":"Supporting only","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":null,"regulatory_regime":null,"exact_supporting_wording":"Guardian Credit Union is a regional business that faced big network challenges.","reviewer_summary":"Cato runs both a Financial Services and a separate Credit Union industry filter. Named customers found: Guardian Credit Union, Bank Avera and MoonPay, a crypto payments business. Conflict recorded and not resolved: the law firm Fidal is also filed under the Financial Services label on Cato's site, which inflates that filter, so the credit union and the bank are the cleaner evidence.","limitation_and_notes":"Supplier's own filtered case study listing. | New Source: https://www.catonetworks.com/customers/guardian-credit-union-improves-network-control-security-with-cato/"},{"id":"src_financial_services_fs_015","workbook_source_id":"FS-015","url":"https://www.catonetworks.com/customers/?industry=credit-union","title":"Customers filtered by Credit Union","publisher":"catonetworks.com","publication_date":null,"checked_date":"2026-07-29","source_ownership":"provider_authored","decision":"superseded","reviewer_confidence":"high","record_type":"Existing source lead","requirement_codes":[],"named_customer":null,"segment":"To review","named_product_or_service":null,"service_family":"Supporting only","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":null,"regulatory_regime":null,"exact_supporting_wording":"Guardian Credit Union is a regional business that faced big network challenges.","reviewer_summary":"Cato runs both a Financial Services and a separate Credit Union industry filter. Named customers found: Guardian Credit Union, Bank Avera and MoonPay, a crypto payments business. Conflict recorded and not resolved: the law firm Fidal is also filed under the Financial Services label on Cato's site, which inflates that filter, so the credit union and the bank are the cleaner evidence.","limitation_and_notes":"Supplier's own filtered case study listing. | New Source: https://www.catonetworks.com/customers/guardian-credit-union-improves-network-control-security-with-cato/"}]},{"slug":"versa-networks","name":"Versa Networks","marketplace_url":"https://netify.co.uk/marketplace/versa-networks/","research_status":"complete","overall_confidence":"medium","fit_conclusion":"Versa Networks has clear evidence for core SD-WAN branch, data-centre and segmentation capabilities in financial services, anchored by a named bank customer (RCBC in the Philippines) and an anonymised US Fortune 500 financial services company, plus product-level PCI DSS, FIPS 140-2, Common Criteria, ISO 27001 and SOC 2 documentation. EU regulatory alignment is evidenced through a specific DORA compliance mapping naming the SD-WAN, SSE and VersaONE products, and an EU sovereign SASE offering supports data residency claims for the DACH region. The main limitation is the near-total absence of UK (FCA/PRA), US banking (FFIEC/GLBA/NYDFS) and Canadian (OSFI) regulatory statements, no named UK financial services delivery evidence, and no published sub-processor list, specific log retention period or exit/data-return terms. Most named financial customer case studies (three of four) are anonymised, which weakens the strength of company-specific claims outside RCBC. IT decision makers in UK and North American regulated financial firms should treat the compliance and delivery picture as strong on paper-level certifications but thin on regime-specific and geography-specific proof for their own jurisdiction.","gaps_and_unknowns":"No evidence closes UK regulatory alignment (FCA/PRA), US regulatory alignment (FFIEC, GLBA, NYDFS, SEC), Canadian regulatory alignment (OSFI), SWIFT CSP alignment, managed 24x7 SOC for FS customers, third-party/outsourced access controls, sub-processor transparency, exit/portability terms, or trading/low-latency use, and UK delivery has no supporting page. These would be closed by a published UK or North American named financial services case study, a jurisdiction-specific compliance statement (equivalent to the existing DORA blog) for FCA/PRA, FFIEC/NYDFS or OSFI, a public sub-processor list and DPA, and a stated log retention period and incident notification SLA to customers.","reviewed_by":"Harry Yelland","reviewed_date":"2026-09-14","source_count":19,"accepted_source_count":15,"requirements":[{"code":"branch_and_office_connectivity","label":"Branch and office connectivity","state":"proven","evidence_source_ids":["evidence:versa-networks:7","src_financial_services_fin_435","src_financial_services_fin_436","src_financial_services_fin_438","src_financial_services_fin_443","src_financial_services_fin_444","src_financial_services_fin_435"],"verified_date":"2026-09-14"},{"code":"trading_and_low_latency_connectivity","label":"Trading and low-latency connectivity","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"data_centre_colocation_and_cloud_connectivity","label":"Data-centre, colocation and cloud connectivity","state":"proven","evidence_source_ids":["src_financial_services_fin_435","src_financial_services_fin_437","src_financial_services_fin_438"],"verified_date":"2026-09-14"},{"code":"resilience_and_tested_recovery","label":"Resilience and tested recovery","state":"proven","evidence_source_ids":["src_financial_services_fin_437","src_financial_services_fin_440","src_financial_services_fin_435"],"verified_date":"2026-09-14"},{"code":"network_segmentation_and_zoning","label":"Network segmentation and zoning","state":"proven","evidence_source_ids":["src_financial_services_fin_436","src_financial_services_fin_437","src_financial_services_fin_435"],"verified_date":"2026-09-14"},{"code":"payment_and_cardholder_data_segmentation","label":"Payment and cardholder data segmentation","state":"partial","evidence_source_ids":["src_financial_services_fin_439","src_financial_services_fin_443"],"verified_date":"2026-09-14"},{"code":"third_party_and_outsourced_access","label":"Third-party and outsourced access","state":"not_found","evidence_source_ids":["src_financial_services_fin_441"],"verified_date":"2026-09-14"},{"code":"remote_and_hybrid_workforce","label":"Remote and hybrid workforce","state":"partial","evidence_source_ids":["src_financial_services_fin_438","src_financial_services_fin_443"],"verified_date":"2026-09-14"},{"code":"data_residency_and_sovereignty","label":"Data residency and sovereignty","state":"partial","evidence_source_ids":["src_financial_services_fin_441","src_financial_services_fin_442","src_financial_services_fin_446"],"verified_date":"2026-09-14"},{"code":"encryption_and_key_management","label":"Encryption and key management","state":"proven","evidence_source_ids":["src_financial_services_fin_439","src_financial_services_fin_446"],"verified_date":"2026-09-14"},{"code":"logging_audit_and_evidence_retention","label":"Logging, audit and evidence retention","state":"partial","evidence_source_ids":["src_financial_services_fin_439","src_financial_services_fin_440","src_financial_services_fin_441","src_financial_services_fin_446"],"verified_date":"2026-09-14"},{"code":"identity_and_zero_trust_access","label":"Identity and zero trust access","state":"partial","evidence_source_ids":["src_financial_services_fin_439","src_financial_services_fin_440"],"verified_date":"2026-09-14"},{"code":"cloud_and_saas_data_controls","label":"Cloud and SaaS data controls","state":"partial","evidence_source_ids":["src_financial_services_fin_443","src_financial_services_fin_446"],"verified_date":"2026-09-14"},{"code":"managed_operations_and_soc","label":"Managed operations and SOC","state":"not_found","evidence_source_ids":["src_financial_services_fin_435"],"verified_date":"2026-09-14"},{"code":"network_visibility_and_reporting","label":"Network visibility and reporting","state":"proven","evidence_source_ids":["src_financial_services_fin_435","src_financial_services_fin_436","src_financial_services_fin_440"],"verified_date":"2026-09-14"},{"code":"change_control_and_configuration_governance","label":"Change control and configuration governance","state":"partial","evidence_source_ids":["src_financial_services_fin_436","src_financial_services_fin_444","src_financial_services_fin_448"],"verified_date":"2026-09-14"},{"code":"incident_notification_support","label":"Incident notification support","state":"partial","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"concentration_risk_and_subcontractor_transparency","label":"Concentration risk and subcontractor transparency","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"exit_and_portability","label":"Exit and portability","state":"not_found","evidence_source_ids":["src_financial_services_fin_441"],"verified_date":"2026-09-14"},{"code":"uk_regulatory_alignment_fca_and_pra","label":"UK regulatory alignment (FCA and PRA)","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"eu_dora_alignment","label":"EU DORA alignment","state":"proven","evidence_source_ids":["src_financial_services_fin_440","src_financial_services_fin_440"],"verified_date":"2026-09-14"},{"code":"us_regulatory_alignment_ffiec_glba_nydfs_sec","label":"US regulatory alignment (FFIEC, GLBA, NYDFS, SEC)","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"canada_regulatory_alignment_osfi","label":"Canada regulatory alignment (OSFI)","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"pci_dss_alignment","label":"PCI DSS alignment","state":"proven","evidence_source_ids":["src_financial_services_fin_439"],"verified_date":"2026-09-14"},{"code":"swift_csp_alignment","label":"SWIFT CSP alignment","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"uk_delivery","label":"UK delivery","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"north_america_delivery","label":"North America delivery","state":"partial","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"global_delivery","label":"Global delivery","state":"partial","evidence_source_ids":[],"verified_date":"2026-09-14"}],"sources":[{"id":"src_financial_services_fin_436","workbook_source_id":"FIN-436","url":"https://versa-networks.com/documents/case-studies/financial-services.pdf","title":"Automating and Simplifying the WAN for Financial Services IT","publisher":"versa-networks.com","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"medium","record_type":"Named customer case study","requirement_codes":["change_control_and_configuration_governance","network_visibility_and_reporting","network_segmentation_and_zoning","branch_and_office_connectivity"],"named_customer":null,"segment":"Unspecified","named_product_or_service":"Versa FlexVNF SD-WAN, Versa Director, Versa Analytics","service_family":"SD-WAN","estate":"1,000 branches, 50,000 employees worldwide","countries_or_regions":"United States, expanding into new markets","ot_or_production_environment":null,"measured_or_stated_outcome":"25x bandwidth increase per branch, 4x improved reliability, 50% reduced maintenance costs, 9x faster time-to-service","industrial_standard_or_regulation":null,"regulatory_regime":"Not stated","exact_supporting_wording":"single or dual low-speed (T1 – 6 Mbps) MPLS circuits with low-bandwidth LTE backup and no direct Internet access","reviewer_summary":"An anonymised Fortune 500 financial services company with 1,000 branches and 50,000 employees and over $300 billion in assets deployed Versa FlexVNF SD-WAN and SD-Security to replace legacy MPLS links, citing micro-segmentation with separate control and data paths per segment.","limitation_and_notes":"Institution is anonymised, so this cannot be treated as a named financial institution; no regulatory regime named; no PCI or trading-specific detail."},{"id":"src_financial_services_fin_437","workbook_source_id":"FIN-437","url":"https://versa-networks.com/documents/case-studies/global-financial-services-firm.pdf","title":"Global Financial Services Firm case study","publisher":"versa-networks.com","publication_date":null,"checked_date":"2026-09-15","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"medium","record_type":"Named customer case study","requirement_codes":["data_centre_colocation_and_cloud_connectivity","network_segmentation_and_zoning","resilience_and_tested_recovery"],"named_customer":null,"segment":"Investment banking and trading","named_product_or_service":"Versa Secure Cloud IP (SD-WAN Platform-as-a-Service)","service_family":"SD-WAN","estate":"Multiple branch offices across dozens of sites globally","countries_or_regions":"Global","ot_or_production_environment":null,"measured_or_stated_outcome":"Shortened time-to-deploy and upgrade; improved WAN availability and efficiency","industrial_standard_or_regulation":null,"regulatory_regime":"Not stated","exact_supporting_wording":"intelligent traffic steering to route around network problems, before users were affected.","reviewer_summary":"An anonymised global financial services firm used Versa Secure Cloud IP with Dell uCPE hardware to segment retail and investment banking network traffic and improve resilience across a global branch footprint.","limitation_and_notes":"Checker 2026-09-12: page carries the fact but the wording differs (Exact phrase not found; PDF contains similar wording: 'intelligent traffic steering to route around network problems, before users were affected.'). Re-quote verbatim. Institution anonymised; no named country, no RTO/RPO figures, no trading floor or exchange connectivity explicitly named, only 'investment banking' segmentation mentioned. [2026-09-15] Re-quoted verbatim using the checker's own already-confirmed page wording - no fresh fetch needed, the exact sentence was already recorded in the check note."},{"id":"src_financial_services_fin_438","workbook_source_id":"FIN-438","url":"https://versa-networks.com/documents/case-studies/global-credit-card-payments-company.pdf","title":"Global Credit Card Payments Company Modernizes WAN","publisher":"versa-networks.com","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"medium","record_type":"Named customer case study","requirement_codes":["data_centre_colocation_and_cloud_connectivity","branch_and_office_connectivity","remote_and_hybrid_workforce"],"named_customer":null,"segment":"Payments and fintech","named_product_or_service":"Versa Networks SD-WAN","service_family":"SD-WAN","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":"Eliminated hardware device sprawl; reduced Capex, power consumption and maintenance costs; shortened provisioning timeframes","industrial_standard_or_regulation":null,"regulatory_regime":"Not stated","exact_supporting_wording":"Their business could no longer be constrained by physical infrastructure","reviewer_summary":"An anonymised global payments and financial/commerce technology company used Versa SD-WAN and VNFs on commodity CPE to connect branch offices, processing centres, cloud resources and mobile/IoT endpoints.","limitation_and_notes":"Institution anonymised; no PCI DSS or cardholder data segmentation explicitly named in this document despite being a payments company; no site or user counts given."},{"id":"src_financial_services_fin_439","workbook_source_id":"FIN-439","url":"https://versa-networks.com/documents/white-papers/pci-dss-compliance-with-versa-secure-sd-wan.pdf","title":"PCI-DSS Compliance with Versa Secure SD-WAN","publisher":"versa-networks.com","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"high","record_type":"Compliance attestation or statement","requirement_codes":["payment_and_cardholder_data_segmentation","logging_audit_and_evidence_retention","identity_and_zero_trust_access","encryption_and_key_management","pci_dss_alignment"],"named_customer":null,"segment":"Unspecified","named_product_or_service":"Versa Secure SD-WAN","service_family":"SD-WAN","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":"PCI DSS","regulatory_regime":"Not stated","exact_supporting_wording":"No cardholder data is stored on the system. The data is processed and forwarded to the destination instantaneously.","reviewer_summary":"Versa's whitepaper maps Versa Secure SD-WAN capabilities (VLAN/VRF segmentation, per-tenant IPsec tunnels with AES-256, AAA/SAML integration, audit logging) to specific PCI DSS requirements including firewalling, encryption, access control and monitoring.","limitation_and_notes":"This is a generic capability-to-requirement mapping, not an Attestation of Compliance (AoC) or certification, and it does not name a customer; no PCI DSS version stated."},{"id":"src_financial_services_fin_441","workbook_source_id":"FIN-441","url":"https://versa-networks.com/privacy/","title":"Privacy Policy | Versa Networks","publisher":"versa-networks.com","publication_date":null,"checked_date":"2026-09-15","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"low","record_type":"Compliance attestation or statement","requirement_codes":["logging_audit_and_evidence_retention","third_party_and_outsourced_access","data_residency_and_sovereignty","exit_and_portability"],"named_customer":null,"segment":"Not applicable","named_product_or_service":"Versa Networks (corporate)","service_family":"Not relevant","estate":null,"countries_or_regions":"Global","ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":null,"regulatory_regime":"Not stated","exact_supporting_wording":"the Processing is necessary in connection with any contract that you may enter into with us","reviewer_summary":"Versa's general corporate privacy policy describes personal data retention in generic terms with no specific retention period, and references Standard Contractual Clauses for international transfers with no named regional data residency options and no specific sub-processor list.","limitation_and_notes":"Checker 2026-09-12: page carries the fact but the wording differs (Page reads 'is necessary' instead of 'necessary' - near-identical wording but not an exact match.). Re-quote verbatim. This is a corporate website privacy policy, not a product-level data residency, log retention or sub-processor disclosure for the SD-WAN/SASE service itself; no specific retention period, region list or sub-processor names given. [2026-09-15, Playwright fetch] Re-quoted verbatim (corrects the missing 'is'). Confirmed this is the general corporate privacy policy, not a product-level data residency or retention disclosure for the SD-WAN/SASE service."},{"id":"src_financial_services_fin_442","workbook_source_id":"FIN-442","url":"https://www.helpnetsecurity.com/2026/02/27/versa-sovereign-sase-as-a-service-offering/","title":"Versa introduces cloud-based sovereign solution for enterprises of all sizes","publisher":"helpnetsecurity.com","publication_date":"2026-02-27","checked_date":"2026-09-12","source_ownership":"independent","decision":"accepted","reviewer_confidence":"medium","record_type":"Independent analysis","requirement_codes":["data_residency_and_sovereignty"],"named_customer":null,"segment":"Not applicable","named_product_or_service":"Versa Sovereign SASE-as-a-Service","service_family":"SASE","estate":null,"countries_or_regions":"Germany, DACH region, EU","ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":null,"regulatory_regime":"EU","exact_supporting_wording":"Data plane, control plane, management plane, and logging operating entirely on EU-hosted and controlled infrastructure, independent of Versa's global cloud infrastructure.","reviewer_summary":"Independent trade press reports that Versa's Sovereign SASE-as-a-Service, contracted through Versa Networks B.V. in the Netherlands, keeps all data, control, management and logging planes on EU-hosted infrastructure, initially for the Germany/DACH region, and cites a Swisscom national-scale deployment.","limitation_and_notes":"Article does not name a financial services customer using this sovereign offering and does not state UK, US or Canadian regional equivalents; Swisscom is a telecom partner deployment, not a named FS end customer."},{"id":"src_financial_services_fin_443","workbook_source_id":"FIN-443","url":"https://versa-networks.com/solutions/industries/financial-services/","title":"Financial Services Solution | Versa Networks","publisher":"versa-networks.com","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"medium","record_type":"Financial services solution page","requirement_codes":["payment_and_cardholder_data_segmentation","branch_and_office_connectivity","cloud_and_saas_data_controls","remote_and_hybrid_workforce"],"named_customer":null,"segment":"Multiple","named_product_or_service":"Secure SD-WAN, ZTNA, VersaONE","service_family":"Multiple","estate":null,"countries_or_regions":"Global","ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":"GDPR, CCPA, FINRA","regulatory_regime":"Multiple","exact_supporting_wording":"they can support and secure diverse lines of service, such as IT, guest Wi-Fi, ATMs and mobile insurance agencies","reviewer_summary":"Versa's financial services solution page describes generic industry use cases for Secure SD-WAN and ZTNA (branch expansion, cloud migration, mission-critical application access) and references GDPR, CCPA and FINRA as data privacy drivers, without naming any customer.","limitation_and_notes":"No named financial institution; regulatory mentions (GDPR, CCPA, FINRA) are generic industry context, not a compliance statement connecting the named service to a specific regime's rules; this is Partial-level evidence only."},{"id":"src_financial_services_fin_444","workbook_source_id":"FIN-444","url":"https://versa-networks.com/blog/financial-services-powered-sd-wan/","title":"Financial Services, Powered by SD-WAN - The Versa Networks Blog","publisher":"versa-networks.com","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"low","record_type":"Financial services solution page","requirement_codes":["change_control_and_configuration_governance","branch_and_office_connectivity"],"named_customer":null,"segment":"Retail banking","named_product_or_service":"SD-WAN","service_family":"SD-WAN","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":null,"regulatory_regime":"Not stated","exact_supporting_wording":"centralizes provisioning and management of the network, ensuring all locations are compliant with government regulations","reviewer_summary":"A generic Versa blog post argues SD-WAN speeds up bank branch deployment and centralises regulatory-compliant network management, without naming any bank or specific regulation.","limitation_and_notes":"No named customer, no specific regulation identified, no trading, remote workforce or PCI detail; marketing-style generic claim only."},{"id":"src_financial_services_fin_445","workbook_source_id":"FIN-445","url":"https://versa-networks.com/documents/Versa-Hosted-SASE-SLA.pdf","title":"Service Level Agreement (Versa Hosted and Managed Secure Services Edge Gateways)","publisher":"versa-networks.com","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"high","record_type":"Compliance attestation or statement","requirement_codes":["resilience_and_tested_recovery","incident_notification_support"],"named_customer":null,"segment":"Not applicable","named_product_or_service":"Versa Hosted and Managed Secure Services Edge Gateways","service_family":"SASE","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":"99.999% monthly uptime target with tiered service credits for missed SLA","industrial_standard_or_regulation":null,"regulatory_regime":"Not stated","exact_supporting_wording":"customer must notify Versa of the missed SLA Uptime Percentage by opening a support ticket...within [2] calendar days following the end of the applicable month","reviewer_summary":"Versa's Hosted SASE SLA commits to a 99.999% monthly uptime target with tiered service credits for breaches, and sets a 2-calendar-day customer notification window to claim credits, plus latency targets of 10ms and 50ms for specific security functions.","limitation_and_notes":"This document defines the customer's obligation to notify Versa of an SLA breach to claim credit; it does not state Versa's own commitment to notify customers of a security incident, and gives no RTO/RPO figures."},{"id":"src_financial_services_fin_446","workbook_source_id":"FIN-446","url":"https://versa-networks.com/news/2025/validating-investment-in-world-class-information-security-versa-extends-security-and-privacy-controls-with-new-and-renewed-industry-certifications/","title":"Validating Investment in World-Class Information Security, Versa Extends Security and Privacy Controls with New and Renewed Industry Certifications","publisher":"versa-networks.com","publication_date":"2025-10-30","checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"high","record_type":"Compliance attestation or statement","requirement_codes":["logging_audit_and_evidence_retention","data_residency_and_sovereignty","encryption_and_key_management","cloud_and_saas_data_controls"],"named_customer":null,"segment":"Not applicable","named_product_or_service":"VersaONE Universal SASE Platform","service_family":"SASE","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":"ISO 27001, ISO 27017, ISO 27018, SOC 2 Type II, HIPAA","regulatory_regime":"Not stated","exact_supporting_wording":"successfully achieved ISO/IEC 27001 recertification...and fully re-certified for the SOC 2...standards following extensive independent audits","reviewer_summary":"Versa announced renewal of ISO 27001 (seventh year) plus ISO 27017/27018 cloud security and privacy controls, SOC 2 Type II re-certification and HIPAA re-certification for the VersaONE Universal SASE Platform, and lists FIPS 140-2, PCI DSS, Common Criteria, ISO 9001, ISO 14001, ISO 20000-1 and ISO 22301 among its other certifications.","limitation_and_notes":"Certifications are corporate/platform-level, not specific to any financial services customer or regime (FCA, NYDFS, OSFI, DORA); a certification alone does not satisfy the regulatory-alignment columns per the grading rules."},{"id":"src_financial_services_fin_447","workbook_source_id":"FIN-447","url":"https://www.businesswire.com/news/home/20230105005410/en/Versa-Networks-Achieves-FIPS-140-2-Security-Certification","title":"Versa Networks Achieves FIPS 140-2 Security Certification","publisher":"businesswire.com","publication_date":"2023-01-05","checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"high","record_type":"Compliance attestation or statement","requirement_codes":["encryption_and_key_management"],"named_customer":null,"segment":"Not applicable","named_product_or_service":"Versa Operating System (VOS)","service_family":"Multiple","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":"FIPS 140-2","regulatory_regime":"Not stated","exact_supporting_wording":"FIPS-certified VOS cryptographic modules power the cryptography for the Control Plane and Data Plane of the Versa SASE and Versa Secure SD-WAN solutions.","reviewer_summary":"Versa's press release states the Versa Operating System (VOS), the foundation of Versa SASE and Versa Secure SD-WAN, holds FIPS 140-2 Level-1 certification for both branch (certificate #4379) and controller (certificate #4380) roles.","limitation_and_notes":"FIPS 140-2 only; no FIPS 140-3 validation found for the current product line at time of research; not financial-services-specific."},{"id":"src_financial_services_fin_448","workbook_source_id":"FIN-448","url":"https://versa-networks.com/news/2023/versa-networks-achieves-common-criteria-eal4-certification-further-validating-the-security-and-controls-of-its-sase-and-secure-sd-wan-operating-system/","title":"Versa Networks Achieves Common Criteria EAL4+ Certification","publisher":"versa-networks.com","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"high","record_type":"Compliance attestation or statement","requirement_codes":["change_control_and_configuration_governance"],"named_customer":null,"segment":"Not applicable","named_product_or_service":"Versa Operating System (VOS)","service_family":"Multiple","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":"Common Criteria EAL4+","regulatory_regime":"Not stated","exact_supporting_wording":"auditing, access control, encryption, identification and authentication, secure administration, tamper resistance, and trusted communication paths","reviewer_summary":"Versa announced Common Criteria EAL4+ certification of the Versa Operating System (VOS), the foundation for Versa Unified SASE and Versa Secure SD-WAN, covering security functions, source code, development lifecycle and vulnerability management processes.","limitation_and_notes":"Corporate/product certification only; no financial services customer or regulator named."},{"id":"src_financial_services_fin_440","workbook_source_id":"FIN-519","url":"https://versa-networks.com/blog/understanding-dora-compliance-with-versa/","title":"What is DORA? Compliance & Digital Resilience Guide","publisher":"versa-networks.com","publication_date":null,"checked_date":"2026-09-15","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"medium","record_type":"Compliance attestation or statement","requirement_codes":["eu_dora_alignment"],"named_customer":null,"segment":"Unspecified","named_product_or_service":"VersaONE Universal SASE, SD-WAN, SSE","service_family":"Supporting only","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":"DORA","regulatory_regime":"EU","exact_supporting_wording":"States VersaONE Universal SASE, SD-WAN, SSE and SASE products can help financial-services customers address DORA, while explicitly stating Versa itself is not directly subject to DORA.","reviewer_summary":"Harry personally verified this live 2026-09-15. Versa's own blog explicitly disclaims being directly subject to DORA and frames the products as helping customers rather than being contractually DORA-aligned itself - graded Partial, matching the document's own caution not to upgrade this to Proven.","limitation_and_notes":"Added 2026-09-15, Harry-verified. Provider explicitly states it is not directly subject to DORA - this is product-marketing content, not a contractual mapping."},{"id":"src_financial_services_fin_435","workbook_source_id":"FIN-530","url":"https://versa-networks.com/documents/case-studies/versa_rcbc.pdf","title":"A Smart Investment: RCBC Nets Big Dividends with Versa Secure SD-WAN","publisher":"versa-networks.com","publication_date":null,"checked_date":"2026-09-15","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"high","record_type":"Named customer case study","requirement_codes":["network_segmentation_and_zoning","branch_and_office_connectivity","resilience_and_tested_recovery"],"named_customer":"Rizal Commercial Banking Corporation (RCBC)","segment":"Retail banking","named_product_or_service":"Versa Secure SD-WAN","service_family":"SD-WAN","estate":"469-505 branches; 890-1,468 ATMs and ATM Go terminals across all 82 provinces of the Philippines","countries_or_regions":"Philippines","ot_or_production_environment":null,"measured_or_stated_outcome":"Largest deployment of Versa Secure SD-WAN in the Philippines; simplified network management and strengthened security across the branch/ATM network","industrial_standard_or_regulation":null,"regulatory_regime":"Not stated","exact_supporting_wording":"\"We are dedicated to providing our customers with seamless and secure banking experiences, and the deployment of Versa Secure SD-WAN represents a critical milestone in our digital transformation journey.\" - Nilo Zantua, Senior Vice President, Chief Information Officer and Group Head, RCBC. RCBC is described as \"one of the largest commercial banks in the Philippines, with over PHP1.3 trillion in total resources.\"","reviewer_summary":"Versa's own case study PDF, verified live 2026-09-15, independently corroborated by Philippine business press (Manila Bulletin, Daily Tribune) covering the same September 2024 contract-signing event. RCBC is a real, major, named Philippine bank with a named C-level executive quote. This is meaningfully stronger evidence than Versa's existing anonymised 'Global Financial Services Firm' case studies. Regulatory regime not stated - Philippines is outside the UK/EU/US/Canada regimes tracked by this workbook (BSP - Bangko Sentral ng Pilipinas - is the relevant regulator but not named on the source itself).","limitation_and_notes":"Added 2026-09-15 per further research pass. No specific RTO/RPO or resilience test result stated - \"strengthen network resiliency\" is a stated goal, not a measured outcome."},{"id":"evidence:versa-networks:7","workbook_source_id":"FS-073","url":"https://versa-networks.com/","title":"Versa Networks - homepage (named customer quotes, VersaONE positioning)","publisher":"","publication_date":"2026-03-16","checked_date":"2026-07-29","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"high","record_type":"Existing source lead","requirement_codes":["branch_and_office_connectivity"],"named_customer":null,"segment":"Unspecified","named_product_or_service":null,"service_family":"Supporting only","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":null,"regulatory_regime":"Not stated","exact_supporting_wording":"A Fortune 500 financial services company chooses software defined WAN (SD-WAN) to transform their legacy architecture","reviewer_summary":"Strongest sector evidence for this supplier. Two independent strands on the vendor's own site: a Fortune 500 financial services customer story on the homepage, and a Gartner Peer Insights review published on the customers page attributed to 'Network Engineer – Banking'. A dedicated page is also listed at https://versa-networks.com/solutions/industries/financial-services/ but could not be loaded. Neither customer is named.","limitation_and_notes":"Tier 1 supplier material. Read via https://r.jina.ai/https://versa-networks.com/ because of the same bot wall. Quotes re-extracted on three separate passes and matched each time. Customer stories are anonymised apart from Adobe. | Confirmed - exact match"},{"id":"src_financial_services_fin_449","workbook_source_id":"FIN-449","url":"https://versa-networks.com/versa-security-and-trust-center/","title":"Versa Security and Trust Center | Versa Networks","publisher":"versa-networks.com","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"rejected","reviewer_confidence":"medium","record_type":"Other","requirement_codes":[],"named_customer":null,"segment":"Not applicable","named_product_or_service":"Versa Security and Trust Center listings","service_family":"Not relevant","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":null,"regulatory_regime":"Not stated","exact_supporting_wording":"SOC 2 Type II, SOC 3, ISO/IEC 27001:2022, ISO 27017, ISO 27018, FIPS 140-2, Common Criteria NIAP, PCI DSS","reviewer_summary":"Versa's trust centre lists certifications (SOC 2 Type II, SOC 3, ISO 27001:2022, ISO 27017/27018, FIPS 140-2, Common Criteria, PCI DSS) with links to reports and certificates, but the fetched page content did not surface specific data residency, log retention, SLA or sub-processor detail.","limitation_and_notes":"Rejected as a standalone source row because it duplicates certification facts already sourced from the more specific 2025 certification press release and FIPS/Common Criteria releases, and did not itself surface data residency, retention, SLA or sub-processor detail despite being the natural page for it."},{"id":"evidence:versa-networks:18","workbook_source_id":"FIN-450","url":"https://versa-networks.com/customers/case-studies/","title":"Versa Networks - Customer Case Studies index page (Adobe, Dell, Lintasarta, Lambton Area Water Supply Systems and others)","publisher":"","publication_date":"2025-07-22","checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"rejected","reviewer_confidence":"low","record_type":"Other","requirement_codes":[],"named_customer":null,"segment":"Not applicable","named_product_or_service":"Not applicable","service_family":"Not relevant","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":null,"regulatory_regime":"Not stated","exact_supporting_wording":"RCBC uncovered centralized control, scalable security, and superior network performance, while enabling seamless, and secure banking to all customers regardless of their location.","reviewer_summary":"This is a navigation/listing page pointing to the individual financial services case studies (Fortune 500 financial services company, Global Financial Services Firm, Global Credit Card Payments Company, RCBC) which were opened and sourced separately.","limitation_and_notes":"Rejected as a duplicate source row; used only to locate the individual case study PDFs, which are sourced separately above."},{"id":"src_financial_services_fs_072","workbook_source_id":"FS-072","url":"https://versa-networks.com/customers/","title":"Our Customers | Versa Networks","publisher":"versa-networks.com","publication_date":"2022-04-04","checked_date":"2026-07-29","source_ownership":"provider_authored","decision":"rejected","reviewer_confidence":"high","record_type":"Existing source lead","requirement_codes":[],"named_customer":null,"segment":"To review","named_product_or_service":null,"service_family":"Supporting only","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":null,"regulatory_regime":null,"exact_supporting_wording":"A Fortune 500 financial services company chooses software defined WAN (SD-WAN) to transform their legacy architecture","reviewer_summary":"Strongest sector evidence for this supplier. Two independent strands on the vendor's own site: a Fortune 500 financial services customer story on the homepage, and a Gartner Peer Insights review published on the customers page attributed to 'Network Engineer – Banking'. A dedicated page is also listed at https://versa-networks.com/solutions/industries/financial-services/ but could not be loaded. Neither customer is named.","limitation_and_notes":"Tier 1 supplier material. versa-networks.com sits behind an Imperva JavaScript bot wall returning only 'Javascript is required' to non-browser clients, so this was read via the text proxy https://r.jina.ai/https://versa-networks.com/customers/ where every quoted string reproduces. Attributions are anonymised Gartner Peer Insights reviewers labelled by industry, not named customers. | Not found on page"},{"id":"src_manufacturing_mfg_060","workbook_source_id":"FS-074","url":"https://versa-networks.com/company/","title":"Versa Networks site navigation, Industry Solutions menu, rendered on the /company/ 404 page","publisher":"versa-networks.com","publication_date":null,"checked_date":"2026-07-29","source_ownership":"provider_authored","decision":"rejected","reviewer_confidence":"high","record_type":"Existing source lead","requirement_codes":[],"named_customer":null,"segment":"To review","named_product_or_service":null,"service_family":"Not relevant","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":null,"regulatory_regime":null,"exact_supporting_wording":"A Fortune 500 financial services company chooses software defined WAN (SD-WAN) to transform their legacy architecture","reviewer_summary":"Strongest sector evidence for this supplier. Two independent strands on the vendor's own site: a Fortune 500 financial services customer story on the homepage, and a Gartner Peer Insights review published on the customers page attributed to 'Network Engineer – Banking'. A dedicated page is also listed at https://versa-networks.com/solutions/industries/financial-services/ but could not be loaded. Neither customer is named.","limitation_and_notes":"Tier 1 but weaker than a live page. This URL 404s; its 'Looking for something?' block renders the full site navigation including an Industry Solutions menu of dedicated industry page URLs. Read via https://r.jina.ai/https://versa-networks.com/company/. The individual industry pages could NOT be loaded: reader attempts returned HTTP 429 and direct attempts hit the bot wall. Verified navigation entries, not verified page content, so possibly stale. | Not found on page"}]},{"slug":"gtt","name":"GTT","marketplace_url":"https://netify.co.uk/marketplace/gtt/","research_status":"complete","overall_confidence":"low","fit_conclusion":"GTT's own pages show real security building blocks for its named SD-WAN and SASE products, including ZTNA on both Managed SD-WAN and Secure Connect, CASB/DLP under Cloud Security, ISO 27001 certification and a SOC 2 scope that explicitly names the SD-WAN service, plus an Envision management portal with audit trails and policy-as-code governance. The only named financial institution found, Saxo Bank, is a UK and Denmark-based trading firm, but its case study describes legacy MPLS, IP Transit and broadband services rather than the current Managed SD-WAN or Secure Connect SASE products, so it cannot prove those specific products in live financial services use. Regulatory alignment is thin: DORA is mentioned once on a generic finance and insurance page with no Article 30 detail, and no evidence at all was found connecting the named services to FCA/PRA, FFIEC, GLBA, NYDFS, SEC, OSFI or SWIFT CSP. A UK decision maker gets some assurance from the Saxo Bank relationship and the SOC 2 scope naming SD-WAN, but a North American or Canadian buyer has no named customer evidence at all. Overall this is a partial evidence base built mainly from provider marketing and certification statements rather than named, regime-specific financial services deployments of the current SD-WAN/SASE product line.","gaps_and_unknowns":"No evidence was found for remote/hybrid workforce use in an FS context, incident notification timelines, a published sub-processor list, exit/data-return terms, or any FCA/PRA, US or Canadian regulatory alignment; a current SD-WAN or SASE case study naming a bank, insurer or payment firm with UK or North American regulatory detail would close most of these gaps. The PCI DSS attestation and DORA statement are both generic company-level claims rather than being tied to a single named product, and no SWIFT CSP evidence exists at all; obtaining GTT's PCI DSS AoC/Responsibility Model document directly and a dedicated DORA Article 30 compliance statement would resolve this.","reviewed_by":"Harry Yelland","reviewed_date":"2026-09-14","source_count":18,"accepted_source_count":14,"requirements":[{"code":"branch_and_office_connectivity","label":"Branch and office connectivity","state":"partial","evidence_source_ids":["src_financial_services_fs_042"],"verified_date":"2026-09-14"},{"code":"trading_and_low_latency_connectivity","label":"Trading and low-latency connectivity","state":"proven","evidence_source_ids":["src_financial_services_fs_042","src_financial_services_fin_292"],"verified_date":"2026-09-14"},{"code":"data_centre_colocation_and_cloud_connectivity","label":"Data-centre, colocation and cloud connectivity","state":"partial","evidence_source_ids":["src_financial_services_fin_292","src_financial_services_fin_298"],"verified_date":"2026-09-14"},{"code":"resilience_and_tested_recovery","label":"Resilience and tested recovery","state":"partial","evidence_source_ids":["src_financial_services_fs_042","src_financial_services_fin_292"],"verified_date":"2026-09-14"},{"code":"network_segmentation_and_zoning","label":"Network segmentation and zoning","state":"partial","evidence_source_ids":["src_financial_services_fs_042"],"verified_date":"2026-09-14"},{"code":"payment_and_cardholder_data_segmentation","label":"Payment and cardholder data segmentation","state":"partial","evidence_source_ids":["src_financial_services_fs_042"],"verified_date":"2026-09-14"},{"code":"third_party_and_outsourced_access","label":"Third-party and outsourced access","state":"partial","evidence_source_ids":["src_financial_services_fs_042"],"verified_date":"2026-09-14"},{"code":"remote_and_hybrid_workforce","label":"Remote and hybrid workforce","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"data_residency_and_sovereignty","label":"Data residency and sovereignty","state":"partial","evidence_source_ids":["src_financial_services_fs_042","src_financial_services_fin_297"],"verified_date":"2026-09-14"},{"code":"encryption_and_key_management","label":"Encryption and key management","state":"partial","evidence_source_ids":["src_financial_services_fin_290"],"verified_date":"2026-09-14"},{"code":"logging_audit_and_evidence_retention","label":"Logging, audit and evidence retention","state":"partial","evidence_source_ids":["src_financial_services_fin_293","src_financial_services_fin_512"],"verified_date":"2026-09-14"},{"code":"identity_and_zero_trust_access","label":"Identity and zero trust access","state":"partial","evidence_source_ids":["src_financial_services_fin_290","src_financial_services_fin_291","src_financial_services_fin_294","src_financial_services_fin_512"],"verified_date":"2026-09-14"},{"code":"cloud_and_saas_data_controls","label":"Cloud and SaaS data controls","state":"partial","evidence_source_ids":["src_financial_services_fin_291","src_financial_services_fin_295"],"verified_date":"2026-09-14"},{"code":"managed_operations_and_soc","label":"Managed operations and SOC","state":"partial","evidence_source_ids":["src_financial_services_fin_291"],"verified_date":"2026-09-14"},{"code":"network_visibility_and_reporting","label":"Network visibility and reporting","state":"partial","evidence_source_ids":["src_financial_services_fin_294"],"verified_date":"2026-09-14"},{"code":"change_control_and_configuration_governance","label":"Change control and configuration governance","state":"proven","evidence_source_ids":["src_financial_services_fin_293","src_financial_services_fin_294"],"verified_date":"2026-09-14"},{"code":"incident_notification_support","label":"Incident notification support","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"concentration_risk_and_subcontractor_transparency","label":"Concentration risk and subcontractor transparency","state":"partial","evidence_source_ids":["src_financial_services_fin_297"],"verified_date":"2026-09-14"},{"code":"exit_and_portability","label":"Exit and portability","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"uk_regulatory_alignment_fca_and_pra","label":"UK regulatory alignment (FCA and PRA)","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"eu_dora_alignment","label":"EU DORA alignment","state":"partial","evidence_source_ids":["src_financial_services_fs_042","src_financial_services_fin_525"],"verified_date":"2026-09-14"},{"code":"us_regulatory_alignment_ffiec_glba_nydfs_sec","label":"US regulatory alignment (FFIEC, GLBA, NYDFS, SEC)","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"canada_regulatory_alignment_osfi","label":"Canada regulatory alignment (OSFI)","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"pci_dss_alignment","label":"PCI DSS alignment","state":"proven","evidence_source_ids":["src_financial_services_fs_042","src_financial_services_fin_293","src_financial_services_fin_512","src_financial_services_fin_525"],"verified_date":"2026-09-14"},{"code":"swift_csp_alignment","label":"SWIFT CSP alignment","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"uk_delivery","label":"UK delivery","state":"proven","evidence_source_ids":["src_financial_services_fin_292","src_financial_services_fin_299"],"verified_date":"2026-09-14"},{"code":"north_america_delivery","label":"North America delivery","state":"partial","evidence_source_ids":["src_financial_services_fin_297","src_financial_services_fin_299"],"verified_date":"2026-09-14"},{"code":"global_delivery","label":"Global delivery","state":"proven","evidence_source_ids":["src_financial_services_fs_042","src_financial_services_fin_292","src_financial_services_fin_296"],"verified_date":"2026-09-14"}],"sources":[{"id":"src_financial_services_fs_042","workbook_source_id":"FIN-289","url":"https://www.gtt.net/industry-solutions/finance-insurance/","title":"GTT Finance and Insurance Solutions","publisher":"gtt.net","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"medium","record_type":"Financial services solution page","requirement_codes":["payment_and_cardholder_data_segmentation","third_party_and_outsourced_access","network_segmentation_and_zoning","branch_and_office_connectivity","resilience_and_tested_recovery","data_residency_and_sovereignty","eu_dora_alignment","pci_dss_alignment"],"named_customer":null,"segment":"Multiple","named_product_or_service":"Managed SD-WAN; Secure Connect; Cloud Connect","service_family":"Multiple","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":"DORA","regulatory_regime":"EU","exact_supporting_wording":"Support regulatory frameworks such as the Digital Operational Resilience Act (DORA).","reviewer_summary":"GTT's finance and insurance industry page describes generic capabilities (Managed SD-WAN failover, segmentation, PCI DSS-aligned network operations, DORA support) without naming a specific financial institution.","limitation_and_notes":"Generic industry solutions page with no named financial institution and no Article 30 contractual detail or FCA/PRA reference; does not prove a live deployment."},{"id":"src_financial_services_fin_290","workbook_source_id":"FIN-290","url":"https://www.gtt.net/services/secure-networking/managed-sd-wan/","title":"Managed SD-WAN | GTT","publisher":"gtt.net","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"medium","record_type":"Financial services solution page","requirement_codes":["identity_and_zero_trust_access","encryption_and_key_management"],"named_customer":null,"segment":"Unspecified","named_product_or_service":"Managed SD-WAN","service_family":"Managed SD-WAN","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":"SD-WAN with dual broadband connections cited as achieving 99.962% availability versus 99.900% for a single MPLS circuit; up to 99.998% with optimised architecture","industrial_standard_or_regulation":null,"regulatory_regime":"Not stated","exact_supporting_wording":"Replaces legacy VPNs with secure application-level access. It grants access based on user identity and device posture, not network location.","reviewer_summary":"GTT's Managed SD-WAN product page describes automatic failover, ZTNA replacing VPNs, and generic encryption on broadband links, with no financial services context or named customer.","limitation_and_notes":"No financial institution named, no FIPS validation or key management specifics, and no FS-specific outcome."},{"id":"src_financial_services_fin_291","workbook_source_id":"FIN-291","url":"https://www.gtt.net/services/secure-networking/sase-secure-connect/","title":"SASE Secure Connect | GTT","publisher":"gtt.net","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"medium","record_type":"Financial services solution page","requirement_codes":["identity_and_zero_trust_access","cloud_and_saas_data_controls","managed_operations_and_soc"],"named_customer":null,"segment":"Unspecified","named_product_or_service":"SASE Secure Connect","service_family":"SASE","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":null,"regulatory_regime":"Not stated","exact_supporting_wording":"Every access request is verified against user identity and application-specific policy.","reviewer_summary":"GTT's SASE Secure Connect page describes ZTNA, consolidation of SD-WAN, SWG, CASB, FWaaS and DLP, and 24/7 NOC and SOC monitoring with CREST-certified analysts, with no named customer.","limitation_and_notes":"No named institution and no financial services context; Palo Alto Prisma and Fortinet are not named on this page despite being listed as partners in the brief."},{"id":"src_financial_services_fin_292","workbook_source_id":"FIN-292","url":"https://www.gtt.net/resources/case-studies/saxo-bank-case-study/","title":"Saxo Bank Case Study | GTT","publisher":"gtt.net","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"medium","record_type":"Named customer case study","requirement_codes":["data_centre_colocation_and_cloud_connectivity","trading_and_low_latency_connectivity","resilience_and_tested_recovery","global_delivery","uk_delivery"],"named_customer":"Saxo Bank","segment":"Investment banking and trading","named_product_or_service":"Broadband, IP Transit, MPLS (GTT network)","service_family":"Supporting only","estate":"26 countries (offices)","countries_or_regions":"UK; Denmark","ot_or_production_environment":null,"measured_or_stated_outcome":"10Gb connectivity between Saxo Bank's head office and its data centres in the UK and Denmark providing redundancy and resilience","industrial_standard_or_regulation":null,"regulatory_regime":"Multiple","exact_supporting_wording":"GTT's high-capacity infrastructure also provides redundancy and resilience with 10Gb connectivity between Saxo Bank's head office and its data centers in the U.K. and Denmark.","reviewer_summary":"Saxo Bank, a named investment bank, uses GTT broadband, IP Transit and MPLS network services (not the current Managed SD-WAN or Secure Connect SASE products) to link its head office and UK and Denmark data centres for its trading platform.","limitation_and_notes":"Does not name Managed SD-WAN or Secure Connect/SASE; the connectivity described is legacy MPLS/IP Transit/broadband, so it cannot prove the named SD-WAN/SASE service was used, only that GTT serves this named FS customer."},{"id":"src_financial_services_fin_293","workbook_source_id":"FIN-293","url":"https://www.gtt.net/about-us/esg-environmental-social-governance-hub/security-and-compliance/","title":"Security and Compliance | GTT","publisher":"gtt.net","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"high","record_type":"Compliance attestation or statement","requirement_codes":["change_control_and_configuration_governance","logging_audit_and_evidence_retention","pci_dss_alignment"],"named_customer":null,"segment":"Unspecified","named_product_or_service":"SD-WAN; SIP Trunking; Managed Hosting; VDC","service_family":"Multiple","estate":null,"countries_or_regions":"Prague; Pune","ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":"ISO 27001:2022; SOC 1; SOC 2; PCI DSS","regulatory_regime":"Not stated","exact_supporting_wording":"GTT's SOC 2 scope includes the SD-WAN and SIP Trunking services.","reviewer_summary":"GTT states ISO 27001:2022 certification at its Prague and Pune operations centres, that SOC 2 scope explicitly includes the SD-WAN service, and that customers can request a PCI DSS Attestation of Compliance and Responsibility Model from their account manager.","limitation_and_notes":"No log retention periods, encryption/key management specifics, incident notification timelines, data residency options or subcontractor list are given on this page; the PCI DSS AoC is offered on request rather than published, and is not tied to a single named service."},{"id":"src_financial_services_fin_294","workbook_source_id":"FIN-294","url":"https://www.gtt.net/envision/","title":"GTT Envision | GTT","publisher":"gtt.net","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"medium","record_type":"Financial services solution page","requirement_codes":["change_control_and_configuration_governance","network_visibility_and_reporting","identity_and_zero_trust_access"],"named_customer":null,"segment":"Unspecified","named_product_or_service":"GTT Envision","service_family":"Supporting only","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":null,"regulatory_regime":"Not stated","exact_supporting_wording":"Centralized policy, audit trails and compliance reporting.","reviewer_summary":"GTT Envision is described as a management portal offering a single-pane view across network and security, persona-based role-based dashboards, policy-as-code orchestration and audit trails/compliance reporting.","limitation_and_notes":"No named financial services customer, no retention periods or specific audit standards are stated."},{"id":"src_financial_services_fin_295","workbook_source_id":"FIN-295","url":"https://www.gtt.net/services/secure-networking/cloud-security/","title":"Cloud Security | GTT","publisher":"gtt.net","publication_date":null,"checked_date":"2026-09-15","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"medium","record_type":"Financial services solution page","requirement_codes":["cloud_and_saas_data_controls"],"named_customer":null,"segment":"Unspecified","named_product_or_service":"Cloud Security (CASB/DLP)","service_family":"SASE","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":"HIPAA; PCI DSS","regulatory_regime":"Not stated","exact_supporting_wording":"Their solutions help organizations comply with industry regulations including HIPAA and PCI DSS, which are particularly relevant for financial services contexts.","reviewer_summary":"GTT's Cloud Security page describes CASB and DLP functions and explicitly connects PCI DSS-related compliance to financial services contexts, without naming a customer.","limitation_and_notes":"Checker 2026-09-12: page carries the fact but the wording differs (Page mentions compliance with GDPR, HIPAA, PCI generally but not the exact framing about 'particularly relevant for financial services contexts'.). Re-quote verbatim. No named financial institution and no detail on how DLP policy is configured for cardholder or customer data specifically. [2026-09-15, Playwright fetch] Re-checked in full: the live page contains no mention of 'financial' or financial services anywhere, not even in passing - this is now a purely generic SSE/cloud-security product page. 'Finance & Insurance' appears only once, in the site's industries footer navigation menu. This is weaker than the original note suggested; the existing Partial rating (backed by 11 other sources) is unaffected, but this specific source should not be treated as financial-services-specific evidence going forward."},{"id":"src_financial_services_fin_296","workbook_source_id":"FIN-296","url":"https://www.gtt.net/about-us/network/","title":"Network | GTT","publisher":"gtt.net","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"medium","record_type":"Other","requirement_codes":["global_delivery"],"named_customer":null,"segment":"Unspecified","named_product_or_service":"GTT Tier 1 IP network","service_family":"Supporting only","estate":null,"countries_or_regions":"170+ countries; six continents","ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":null,"regulatory_regime":"Not stated","exact_supporting_wording":"450+ PoPs on six continents, providing service reach to more than 170 countries.","reviewer_summary":"GTT describes its Tier 1 IP backbone as spanning six continents with 450+ points of presence and reach into 170+ countries, underpinning its managed services globally.","limitation_and_notes":"Describes the underlying network, not the Managed SD-WAN or Secure Connect product specifically, and gives no UK- or North America-specific PoP counts or named financial customers."},{"id":"src_financial_services_fin_297","workbook_source_id":"FIN-297","url":"https://www.gtt.net/privacy-policy/","title":"Privacy Notice | GTT","publisher":"gtt.net","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"medium","record_type":"Compliance attestation or statement","requirement_codes":["concentration_risk_and_subcontractor_transparency","data_residency_and_sovereignty","north_america_delivery"],"named_customer":null,"segment":"Unspecified","named_product_or_service":"GTT (corporate)","service_family":"Not relevant","estate":null,"countries_or_regions":"Arlington, Virginia, US (HQ)","ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":null,"regulatory_regime":"Multiple","exact_supporting_wording":"Third parties that receive personal data from us must provide sufficient guarantees.","reviewer_summary":"GTT's privacy notice states it is headquartered in Arlington, Virginia, transfers data outside the EEA/UK using inter-group data transfer agreements based on European Standard Contractual Clauses, and requires third-party recipients of personal data to give sufficient guarantees, without naming a sub-processor list or retention period.","limitation_and_notes":"No specific data residency commitment for logs or the management plane by country, no published sub-processor list, and no exit/termination or data return clause is given."},{"id":"src_financial_services_fin_298","workbook_source_id":"FIN-298","url":"https://www.gtt.net/connect/","title":"Connect | GTT","publisher":"gtt.net","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"medium","record_type":"Financial services solution page","requirement_codes":["data_centre_colocation_and_cloud_connectivity"],"named_customer":null,"segment":"Unspecified","named_product_or_service":"Cloud Connect","service_family":"Supporting only","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":null,"regulatory_regime":"Not stated","exact_supporting_wording":"Connect directly to major cloud providers without traversing the public internet, with dedicated connections to AWS, Azure and Google Cloud.","reviewer_summary":"GTT's Connect/Cloud Connect page describes direct on-ramps to AWS, Azure and Google Cloud with flexible bandwidth and automatic failover, with no named customer or financial services context.","limitation_and_notes":"No data centre or colocation facility is named, and no financial institution or FS context is mentioned."},{"id":"src_financial_services_fin_299","workbook_source_id":"FIN-299","url":"https://www.gtt.net/about-us/awards-analysts/","title":"Awards & Analysts | GTT","publisher":"gtt.net","publication_date":null,"checked_date":"2026-09-15","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"low","record_type":"Independent analysis","requirement_codes":["north_america_delivery","uk_delivery"],"named_customer":null,"segment":"Unspecified","named_product_or_service":"GTT (corporate managed network and connectivity services)","service_family":"Not relevant","estate":null,"countries_or_regions":"UK and Ireland; North America","ot_or_production_environment":null,"measured_or_stated_outcome":"Named an Exceptional Performer in network and connectivity services for the second consecutive year (Whitelane Research 2026, UK & Ireland); Elite 150 status in North America (CRN 2026 MSP 500)","industrial_standard_or_regulation":null,"regulatory_regime":"Not stated","exact_supporting_wording":"GTT was named an Exceptional Performer in network and connectivity services by Whitelane Research in the UK and Ireland for the second consecutive year.","reviewer_summary":"GTT's own awards page reports independent analyst recognitions, including a UK & Ireland Whitelane Research ranking and a North American CRN MSP 500 Elite 150 placement, neither specific to financial services.","limitation_and_notes":"Checker 2026-09-12: page carries the fact but the wording differs (Actual text: 'GTT was named an Exceptional Performer in network and connectivity services by Whitelane Research in the UK and Ireland for the second consecutive). Re-quote verbatim. These are general managed-service and customer-satisfaction rankings, not financial-services-specific, and are reported by GTT rather than sourced directly from the analyst firms. [2026-09-15, Playwright fetch] Re-quoted verbatim."},{"id":"src_financial_services_fin_300","workbook_source_id":"FIN-300","url":"https://www.gtt.net/secure/","title":"Secure Service | GTT","publisher":"gtt.net","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"low","record_type":"Financial services solution page","requirement_codes":["identity_and_zero_trust_access","cloud_and_saas_data_controls"],"named_customer":null,"segment":"Unspecified","named_product_or_service":"Secure Service","service_family":"SASE","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":"GDPR; HIPAA; PCI DSS; SOC 2","regulatory_regime":"Not stated","exact_supporting_wording":"Automated compliance monitoring and reporting across GDPR, HIPAA, PCI DSS, SOC 2 and more.","reviewer_summary":"GTT's Secure service overview page lists zero trust protection and automated compliance monitoring across several standards, without naming a financial institution.","limitation_and_notes":"Generic marketing page; does not specify which named product these controls apply to in detail, and has no financial services customer or context."},{"id":"src_financial_services_fin_512","workbook_source_id":"FIN-512","url":"https://gtt.net/solutions/industry-solutions/financial-services","title":"GTT Financial Services solutions page","publisher":"gtt.net","publication_date":null,"checked_date":"2026-09-15","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"high","record_type":"Financial services solution page","requirement_codes":["logging_audit_and_evidence_retention","identity_and_zero_trust_access","pci_dss_alignment"],"named_customer":null,"segment":"Unspecified","named_product_or_service":"GTT SD-WAN, SIP Trunking (GTT Financial Service Portfolio)","service_family":"SD-WAN","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":"PCI DSS","regulatory_regime":"Not stated","exact_supporting_wording":"\"Manage your financial transactions securely and efficiently with the assurance of our PCI-DSS certification and compliance service.\" / GTT's Financial Service Portfolio names SD-WAN as the flagship service. / \"Reinforce privileged network access with multi-factor authentication to protect sensitive financial data... Ensure compliance with rigorous log reporting and SIEM portal reporting.\"","reviewer_summary":"GTT's own dedicated Financial Services solutions page, verified live 2026-09-15. This directly names PCI-DSS certification in the context of financial transactions and names SD-WAN as the flagship service delivering it - a materially stronger connection than a generic company-wide certification list, since the page is specifically written for financial services buyers about a named service. No specific named customer, so this is a provider statement rather than a customer case, but it meets the Regulations tab's alternative bar of provider material connecting the named service to the regulation for financial services. Graded Proven for PCI DSS alignment on that basis; MFA and log/SIEM reporting support Identity/zero trust and logging fields at Partial, since those are described more generally.","limitation_and_notes":"Added 2026-09-15 per item 6 research pass. Not an Attestation of Compliance document itself, but a dedicated financial-services page naming the certification and the specific service - the strongest PCI DSS evidence found in this pass short of an actual AoC."},{"id":"src_financial_services_fin_525","workbook_source_id":"FIN-525","url":"https://www.gtt.net/industries/financial-services/","title":"Financial Services - GTT","publisher":"gtt.net","publication_date":null,"checked_date":"2026-09-15","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"medium","record_type":"Compliance attestation or statement","requirement_codes":["eu_dora_alignment","pci_dss_alignment"],"named_customer":null,"segment":"Unspecified","named_product_or_service":"GTT financial services solutions","service_family":"Supporting only","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":"DORA; PCI DSS","regulatory_regime":null,"exact_supporting_wording":"Financial-services positioning content references DORA and PCI DSS capabilities alongside named financial connectivity (Saxo Bank).","reviewer_summary":"Harry personally verified this live 2026-09-15. Sector page with a real named customer (Saxo Bank, already recorded elsewhere for trading connectivity) but no published DORA Article 30 contractual addendum - graded Partial for DORA and PCI DSS as positioning content, not contractual proof.","limitation_and_notes":"Added 2026-09-15, Harry-verified. Positioning/marketing content referencing regulations, not a contractual mapping document."},{"id":"src_financial_services_fin_301","workbook_source_id":"FIN-301","url":"https://www.gtt.net/resources/case-studies/?industry=financial-services","title":"Case Studies | GTT","publisher":"gtt.net","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"rejected","reviewer_confidence":"low","record_type":"Other","requirement_codes":[],"named_customer":null,"segment":"Unspecified","named_product_or_service":"Not applicable","service_family":"Not relevant","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":null,"regulatory_regime":"Not stated","exact_supporting_wording":"30 Results","reviewer_summary":"GTT's case study index offers a Financial Services industry filter but the retrieved listing showed no financial-services-named case studies beyond the separately-found Saxo Bank case study.","limitation_and_notes":"Index page only; does not itself contain evidence for any requirement column beyond confirming the limited pool of named FS case studies."},{"id":"src_financial_services_fin_302","workbook_source_id":"FIN-302","url":"https://www.gtt.net/resources/blog/","title":"Blog | GTT","publisher":"gtt.net","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"rejected","reviewer_confidence":"low","record_type":"Other","requirement_codes":[],"named_customer":null,"segment":"Unspecified","named_product_or_service":"Not applicable","service_family":"Not relevant","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":null,"regulatory_regime":"Not stated","exact_supporting_wording":"N/A","reviewer_summary":"GTT's blog archive (2020 to 2026) showed no posts on DORA, FCA, PRA, PCI DSS, SWIFT, NYDFS, OSFI or GLBA in the listing reviewed.","limitation_and_notes":"Index page; regulatory-specific blog content, if any, was not surfaced and could exist deeper in the archive or behind site search."},{"id":"src_financial_services_fin_303","workbook_source_id":"FIN-303","url":"https://www.gtt.net/regulatory/","title":"Regulatory | GTT","publisher":"gtt.net","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"rejected","reviewer_confidence":"low","record_type":"Other","requirement_codes":[],"named_customer":null,"segment":"Unspecified","named_product_or_service":"Not applicable","service_family":"Not relevant","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":null,"regulatory_regime":"Not stated","exact_supporting_wording":"N/A","reviewer_summary":"GTT's Regulatory page contains US carrier tariff filings (for example Arkansas, Maryland) and links back to the Legal & Regulatory Center; it holds no security, data residency or financial services regulatory content.","limitation_and_notes":"Not relevant to any of the 28 requirement columns."}]},{"slug":"palo-alto-prisma-sase","name":"Palo Alto Networks Prisma SASE","marketplace_url":"https://netify.co.uk/marketplace/palo-alto-prisma-sase/","research_status":"complete","overall_confidence":"medium","fit_conclusion":"Palo Alto Networks documents Prisma Access and Prisma SD-WAN for financial services connectivity and publishes data residency regions (including the UK, US, Canada and EU) and configurable log retention for the Strata Logging Service that Prisma Access uses. The clearest named financial services deployment is Lemonade Insurance, a US insurer, using Prisma Browser within Prisma SASE for remote workforce and Zero Trust access, alongside an anonymised US regional bank case study covering over 200 locations. No UK or EU bank, insurer, credit union or asset manager names Prisma Access or Prisma SD-WAN, and no source in this research connects the named service to FCA, PRA, DORA, FFIEC, NYDFS or OSFI requirements. PCI DSS material found is generic and not tied to Prisma Access or Prisma SD-WAN by name. The evidence base is stronger for platform documentation such as data residency and log retention than for named financial services deployments outside the United States.","gaps_and_unknowns":"No evidence was found for trading or low-latency use, cardholder data environment segmentation, 24x7 managed SOC commitments for financial services customers, change control governance, incident notification timelines, or exit and data portability commitments for Prisma Access or Prisma SD-WAN; closing these would need the provider's own service description or a named customer case addressing them directly. UK regulatory alignment (FCA/PRA), EU DORA alignment, US regime alignment (FFIEC, GLBA, NYDFS, SEC), Canadian OSFI alignment, and PCI DSS certification for the named service were all not found and would need a specific compliance statement or named regulated customer case to close.","reviewed_by":"Harry Yelland","reviewed_date":"2026-09-14","source_count":24,"accepted_source_count":14,"requirements":[{"code":"branch_and_office_connectivity","label":"Branch and office connectivity","state":"proven","evidence_source_ids":["src_financial_services_fin_384","src_financial_services_fin_396","src_financial_services_fin_397","src_financial_services_fin_537"],"verified_date":"2026-09-14"},{"code":"trading_and_low_latency_connectivity","label":"Trading and low-latency connectivity","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"data_centre_colocation_and_cloud_connectivity","label":"Data-centre, colocation and cloud connectivity","state":"partial","evidence_source_ids":["src_financial_services_fin_384","src_financial_services_fin_396"],"verified_date":"2026-09-14"},{"code":"resilience_and_tested_recovery","label":"Resilience and tested recovery","state":"proven","evidence_source_ids":["src_financial_services_fin_384","src_financial_services_fin_395","src_financial_services_fin_396","src_financial_services_fin_510"],"verified_date":"2026-09-14"},{"code":"network_segmentation_and_zoning","label":"Network segmentation and zoning","state":"partial","evidence_source_ids":["src_financial_services_fin_383"],"verified_date":"2026-09-14"},{"code":"payment_and_cardholder_data_segmentation","label":"Payment and cardholder data segmentation","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"third_party_and_outsourced_access","label":"Third-party and outsourced access","state":"partial","evidence_source_ids":["src_financial_services_fin_383","src_financial_services_fin_398"],"verified_date":"2026-09-14"},{"code":"remote_and_hybrid_workforce","label":"Remote and hybrid workforce","state":"proven","evidence_source_ids":["src_financial_services_fin_383","src_financial_services_fin_384","src_financial_services_fin_386","src_financial_services_fin_398"],"verified_date":"2026-09-14"},{"code":"data_residency_and_sovereignty","label":"Data residency and sovereignty","state":"proven","evidence_source_ids":["src_financial_services_fin_392"],"verified_date":"2026-09-14"},{"code":"encryption_and_key_management","label":"Encryption and key management","state":"partial","evidence_source_ids":["src_financial_services_fin_390"],"verified_date":"2026-09-14"},{"code":"logging_audit_and_evidence_retention","label":"Logging, audit and evidence retention","state":"proven","evidence_source_ids":["src_financial_services_fin_393"],"verified_date":"2026-09-14"},{"code":"identity_and_zero_trust_access","label":"Identity and zero trust access","state":"proven","evidence_source_ids":["src_financial_services_fin_386","src_financial_services_fin_398","src_financial_services_fin_537"],"verified_date":"2026-09-14"},{"code":"cloud_and_saas_data_controls","label":"Cloud and SaaS data controls","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"managed_operations_and_soc","label":"Managed operations and SOC","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"network_visibility_and_reporting","label":"Network visibility and reporting","state":"proven","evidence_source_ids":["src_financial_services_fin_384","src_financial_services_fin_537"],"verified_date":"2026-09-14"},{"code":"change_control_and_configuration_governance","label":"Change control and configuration governance","state":"proven","evidence_source_ids":["src_financial_services_fin_537"],"verified_date":"2026-09-14"},{"code":"incident_notification_support","label":"Incident notification support","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"concentration_risk_and_subcontractor_transparency","label":"Concentration risk and subcontractor transparency","state":"partial","evidence_source_ids":["src_financial_services_fin_394"],"verified_date":"2026-09-14"},{"code":"exit_and_portability","label":"Exit and portability","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"uk_regulatory_alignment_fca_and_pra","label":"UK regulatory alignment (FCA and PRA)","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"eu_dora_alignment","label":"EU DORA alignment","state":"partial","evidence_source_ids":["src_financial_services_fin_511"],"verified_date":"2026-09-14"},{"code":"us_regulatory_alignment_ffiec_glba_nydfs_sec","label":"US regulatory alignment (FFIEC, GLBA, NYDFS, SEC)","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"canada_regulatory_alignment_osfi","label":"Canada regulatory alignment (OSFI)","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"pci_dss_alignment","label":"PCI DSS alignment","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"swift_csp_alignment","label":"SWIFT CSP alignment","state":"partial","evidence_source_ids":["src_financial_services_fin_383"],"verified_date":"2026-09-14"},{"code":"uk_delivery","label":"UK delivery","state":"partial","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"north_america_delivery","label":"North America delivery","state":"partial","evidence_source_ids":["src_financial_services_fin_384"],"verified_date":"2026-09-14"},{"code":"global_delivery","label":"Global delivery","state":"partial","evidence_source_ids":[],"verified_date":"2026-09-14"}],"sources":[{"id":"src_financial_services_fin_383","workbook_source_id":"FIN-383","url":"https://www.paloaltonetworks.com/security-for/industry/financial-services","title":"Financial Services - Palo Alto Networks","publisher":"paloaltonetworks.com","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"medium","record_type":"Financial services solution page","requirement_codes":["third_party_and_outsourced_access","network_segmentation_and_zoning","remote_and_hybrid_workforce","swift_csp_alignment"],"named_customer":null,"segment":"Multiple","named_product_or_service":"Prisma Access; Prisma SD-WAN","service_family":"Multiple","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":null,"regulatory_regime":"Not stated","exact_supporting_wording":"Work-from-anywhere with secure direct internet access","reviewer_summary":"Provider financial services solutions page naming Prisma Access and Prisma SD-WAN, with generic use-case links on third-party access, network segmentation, remote work and SWIFT security controls, but no named financial institution.","limitation_and_notes":"No named financial institution or measured outcome; this is a generic solutions page, not a customer deployment, so it only supports Partial status on the columns listed."},{"id":"src_financial_services_fin_384","workbook_source_id":"FIN-384","url":"https://www.paloaltonetworks.com/customers/banking-on-a-better-future-with-prisma-sase","title":"Banking on a More Secure Future with Prisma SASE - Palo Alto Networks","publisher":"paloaltonetworks.com","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"medium","record_type":"Named customer case study","requirement_codes":["data_centre_colocation_and_cloud_connectivity","network_visibility_and_reporting","branch_and_office_connectivity","resilience_and_tested_recovery","remote_and_hybrid_workforce","north_america_delivery"],"named_customer":null,"segment":"Retail banking","named_product_or_service":"Prisma SASE; Prisma SD-WAN; Prisma Access","service_family":"Multiple","estate":"Over 200 locations","countries_or_regions":"United States (Southeast and Mid-Atlantic regions)","ot_or_production_environment":null,"measured_or_stated_outcome":"$1.5M projected 3-year savings; $427K connectivity cost reduction; 49,000 projected downtime hours saved over 3 years","industrial_standard_or_regulation":null,"regulatory_regime":"US","exact_supporting_wording":"Their users had such a good experience, and their applications were so much faster and more resilient, that they said, 'Whatever it is that you put in here, please don't take it away.'","reviewer_summary":"A US regional bank with over 200 locations replaced legacy WAN infrastructure with Prisma SASE, Prisma SD-WAN and Prisma Access, reporting cost savings and improved application performance and resilience.","limitation_and_notes":"The bank is anonymised as 'a U.S. regional bank', not named, so this only supports Partial status per the grading rules for an anonymised customer; quote is attributed to a Palo Alto Networks account executive rather than the bank itself."},{"id":"src_financial_services_fin_386","workbook_source_id":"FIN-386","url":"https://www.paloaltonetworks.com/customers/lemonade-insurance-pioneers","title":"Lemonade Insurance pioneers a new way to secure work with Prisma Browser","publisher":"paloaltonetworks.com","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"high","record_type":"Named customer case study","requirement_codes":["identity_and_zero_trust_access","remote_and_hybrid_workforce"],"named_customer":"Lemonade Insurance","segment":"Insurance","named_product_or_service":"Prisma Browser (part of Prisma SASE)","service_family":"SASE","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":"Reduced employee onboarding time from days to 20 minutes","industrial_standard_or_regulation":null,"regulatory_regime":"Not stated","exact_supporting_wording":"It's the central part of our Zero Trust strategy. It's both the entry to the outside world.","reviewer_summary":"Lemonade Insurance, a named insurer, deployed Prisma Browser as the central part of its Zero Trust strategy to secure remote employees and BYOD contractors.","limitation_and_notes":"Case study centres on Prisma Browser (an enterprise browser component) rather than Prisma SD-WAN or core Prisma Access network connectivity; it does not evidence branch, data-centre or trading connectivity."},{"id":"src_financial_services_fin_390","workbook_source_id":"FIN-390","url":"https://www.paloaltonetworks.com/legal-notices/trust-center/compliance","title":"Compliance - Palo Alto Networks","publisher":"paloaltonetworks.com","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"low","record_type":"Compliance attestation or statement","requirement_codes":["encryption_and_key_management"],"named_customer":null,"segment":"Unspecified","named_product_or_service":"Palo Alto Networks (company-wide)","service_family":"Multiple","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":"FIPS 140","regulatory_regime":"Not stated","exact_supporting_wording":"FIPS 140 has four levels of security, with level 1 containing the lowest level of security assurance and level 4 being the highest.","reviewer_summary":"Trust centre compliance page listing SOC 2+, ISO, PCI DSS, FedRAMP and FIPS 140 as certifications Palo Alto Networks holds, without naming which products or service tiers each applies to.","limitation_and_notes":"Does not state that Prisma Access or Prisma SD-WAN specifically is FIPS validated, so this only supports Partial status, not Proven."},{"id":"src_financial_services_fin_392","workbook_source_id":"FIN-392","url":"https://docs.paloaltonetworks.com/content/techdocs/en_US/strata-logging-service/administration/overview/supported-regions","title":"Strata Logging Service Regions","publisher":"docs.paloaltonetworks.com","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"high","record_type":"Compliance attestation or statement","requirement_codes":["data_residency_and_sovereignty"],"named_customer":null,"segment":"Unspecified","named_product_or_service":"Prisma Access (via Strata Logging Service)","service_family":"SASE","estate":null,"countries_or_regions":"United States, Canada, United Kingdom, Netherlands, France, Germany, Italy, Poland, Spain, Switzerland, Australia, Japan, Korea, Singapore, Taiwan, India, Indonesia, Israel, Qatar, Saudi Arabia, South Africa, China, US Government","ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":null,"regulatory_regime":"Multiple","exact_supporting_wording":"Products that use Strata Logging Service may support either all or some of the listed regions. To know which Strata Logging Service regions your product supports, refer to the respective product documentation.","reviewer_summary":"Palo Alto Networks documentation lists over 30 Strata Logging Service data hosting regions, including the UK, US, Canada and multiple EU countries, and states Prisma Access is one of the services that uses Strata Logging Service, though only a subset of regions per product.","limitation_and_notes":"Does not state exactly which of the listed regions Prisma Access itself supports (it says Prisma Access 'supports only a subset'), and is not financial services specific."},{"id":"src_financial_services_fin_393","workbook_source_id":"FIN-393","url":"https://docs.paloaltonetworks.com/strata-logging-service/activation-and-onboarding/set-retention-days","title":"Allocate Log Retention Days - Strata Logging Service","publisher":"docs.paloaltonetworks.com","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"medium","record_type":"Compliance attestation or statement","requirement_codes":["logging_audit_and_evidence_retention"],"named_customer":null,"segment":"Unspecified","named_product_or_service":"Strata Logging Service (used by Prisma Access)","service_family":"SASE","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":null,"regulatory_regime":"Not stated","exact_supporting_wording":"To streamline log management, Strata Cloud Manager now provides 6 predefined retention period options.","reviewer_summary":"Palo Alto Networks documents configurable log retention periods in Strata Logging Service, with six predefined retention options, and recommends forwarding logs to a third-party store such as AWS S3 for longer compliance retention.","limitation_and_notes":"The specific day values of the six retention options are not stated on this page, and the page is not financial services specific."},{"id":"src_financial_services_fin_394","workbook_source_id":"FIN-394","url":"https://www.paloaltonetworks.com/resources/datasheets/palo-alto-networks-sub-processor-list","title":"Palo Alto Networks Sub-Processor List - Palo Alto Networks","publisher":"paloaltonetworks.com","publication_date":"2026-09-03","checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"medium","record_type":"Compliance attestation or statement","requirement_codes":["concentration_risk_and_subcontractor_transparency"],"named_customer":null,"segment":"Unspecified","named_product_or_service":"Palo Alto Networks (company-wide, including Prisma products)","service_family":"Multiple","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":null,"regulatory_regime":"Not stated","exact_supporting_wording":"The purpose of this document is to provide customers of Palo Alto Networks with information related to the Sub-processors we engage to provide you with our cybersecurity products and services.","reviewer_summary":"Palo Alto Networks publishes a dated sub-processor list document for its products and services, updated 3 September 2026, though the page itself does not confirm the PDF names Prisma Access or Prisma SD-WAN specifically.","limitation_and_notes":"Content of the linked PDF was not opened, so it is not confirmed that Prisma Access or Prisma SD-WAN sub-processors are individually named inside it; page-level metadata only."},{"id":"src_financial_services_fin_395","workbook_source_id":"FIN-395","url":"https://www.carahsoft.com/buy/slg-contracts/txdir/5687-sla/docFileDownload/449140/cf1df705-7929-4dec-892b-3ee70e97d68a","title":"Prisma by Palo Alto Networks | Prisma SD-WAN | Service Level Agreement","publisher":"carahsoft.com","publication_date":"2025-04-14","checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"medium","record_type":"Compliance attestation or statement","requirement_codes":["resilience_and_tested_recovery"],"named_customer":null,"segment":"Unspecified","named_product_or_service":"Prisma SD-WAN","service_family":"SD-WAN","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":"99.99% dataplane availability commitment with tiered service credits for outages","industrial_standard_or_regulation":null,"regulatory_regime":"Not stated","exact_supporting_wording":"Palo Alto Networks commits to using commercially reasonable efforts to achieve a 99.99% level of dataplane availability due to Prisma SD-WAN portal outages.","reviewer_summary":"The official Prisma SD-WAN Service Level Agreement commits to 99.99% dataplane availability with tiered service credits of 5%, 15% or 25% depending on the outage band, applied as subscription extensions.","limitation_and_notes":"This is a generic commercial SLA, not a financial-services-specific commitment, and does not state RTO/RPO figures or incident notification timelines; document is hosted on a reseller (Carahsoft) portal rather than paloaltonetworks.com."},{"id":"src_financial_services_fin_396","workbook_source_id":"FIN-396","url":"https://www.paloaltonetworks.com/resources/guides/sec-enterprise-connectivity-prisma-sdwan-design-financial","title":"Secure and Resilient Enterprise Connectivity Using Prisma SD-WAN and Prisma Access—for Financial Services: Design Guide","publisher":"paloaltonetworks.com","publication_date":"2025-10-10","checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"medium","record_type":"Financial services solution page","requirement_codes":["data_centre_colocation_and_cloud_connectivity","branch_and_office_connectivity","resilience_and_tested_recovery"],"named_customer":null,"segment":"Unspecified","named_product_or_service":"Prisma SD-WAN; Prisma Access","service_family":"Multiple","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":null,"regulatory_regime":"Not stated","exact_supporting_wording":"Provides design guidance for optimizing remote-site connectivity and secure internet access in the financial sector by using Prisma SD-WAN and Prisma Access.","reviewer_summary":"A provider design guide dedicated to financial services connectivity using Prisma SD-WAN and Prisma Access, covering dynamic path selection and SaaS access, but landing page content does not name a customer.","limitation_and_notes":"No named financial institution; only the landing page metadata was reviewed, not the full downloadable PDF, so segmentation and resilience detail beyond the title/description is not confirmed."},{"id":"src_financial_services_fin_397","workbook_source_id":"FIN-397","url":"https://www.paloaltonetworks.com/resources/guides/use-case-modernizing-financial-services-branch-and-campus-networks-for-digital-transformation","title":"Modernizing Financial Services Branch and Campus Networks for Digital Transformation - Palo Alto Networks","publisher":"paloaltonetworks.com","publication_date":"2023-02-28","checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"low","record_type":"Financial services solution page","requirement_codes":["branch_and_office_connectivity"],"named_customer":null,"segment":"Unspecified","named_product_or_service":"Prisma SD-WAN; Prisma Access","service_family":"Multiple","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":null,"regulatory_regime":"Not stated","exact_supporting_wording":"Achieve digital branch transformation with a secure, seamless, optimized experience for all users—regardless of their location—while reducing cost and complexity.","reviewer_summary":"A financial services use-case guide describing branch and campus network modernisation with a SASE architecture converging WAN and security, with no named customer on the landing page.","limitation_and_notes":"No named financial institution, no PCI or segmentation detail confirmed on the landing page; full PDF content was not reviewed."},{"id":"src_financial_services_fin_398","workbook_source_id":"FIN-398","url":"https://www.paloaltonetworks.com/blog/2022/05/zero-trust-and-sase-for-financial-institutions/","title":"Zero Trust and SASE: Better Together for Financial Institutions","publisher":"paloaltonetworks.com","publication_date":"2022-05-17","checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"low","record_type":"Financial services solution page","requirement_codes":["third_party_and_outsourced_access","identity_and_zero_trust_access","remote_and_hybrid_workforce"],"named_customer":null,"segment":"Unspecified","named_product_or_service":"Prisma SASE","service_family":"SASE","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":"Forrester-calculated return on investment of up to 241% for Prisma SASE","industrial_standard_or_regulation":null,"regulatory_regime":"Not stated","exact_supporting_wording":"A Zero Trust cybersecurity model, enabled by a modern Secure Access Services Edge (SASE) architecture, gives financial institutions powerful tools","reviewer_summary":"Provider blog post arguing Prisma SASE and Zero Trust Network Access help financial institutions secure hybrid work and third-party access, noting that financial regulators expect appropriate controls, but without naming specific regulations or customers.","limitation_and_notes":"No named financial institution and no specific regulation (FFIEC, NYDFS, GLBA, PCI, SWIFT) is named despite referring to regulator expectations generically."},{"id":"src_financial_services_fin_510","workbook_source_id":"FIN-510","url":"https://www.paloaltonetworks.com/blog/sase/operational-resilience-ensuring-business-continuity-with-prisma-sase/","title":"Operational Resilience: Ensuring Business Continuity with Prisma SASE","publisher":"paloaltonetworks.com","publication_date":"2024-11-11","checked_date":"2026-09-15","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"high","record_type":"Financial services solution page","requirement_codes":["resilience_and_tested_recovery"],"named_customer":null,"segment":"Unspecified","named_product_or_service":"Prisma SASE","service_family":"SASE","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":"99.999% uptime service level agreement; dedicated dataplane per customer for isolation","industrial_standard_or_regulation":null,"regulatory_regime":"Not stated","exact_supporting_wording":"\"our service level agreement (SLA) reflects this commitment, which delivers an industry-leading 99.999% uptime service availability.\" / \"A dedicated dataplane per customer ensures that user-to-application data traffic is performant and secure for each specific organization.\"","reviewer_summary":"Palo Alto's own blog post, verified live 2026-09-15, naming Prisma SASE specifically and detailing a quantified 99.999% uptime SLA and dedicated-dataplane architecture for resilience. No named financial customer, so graded Partial not Proven, but this is specific named-product resilience detail rather than a generic uptime claim.","limitation_and_notes":"Added 2026-09-15 per item 6 research pass. No named FS customer; general enterprise resilience claim."},{"id":"src_financial_services_fin_511","workbook_source_id":"FIN-511","url":"https://www.paloaltonetworks.com/legal-notices/trust-center/regulatory-compliance","title":"Palo Alto Networks Trust Center - Regulations (DORA whitepaper) and Financial Sector Cybersecurity and Resilience Frameworks whitepaper","publisher":"paloaltonetworks.com","publication_date":null,"checked_date":"2026-09-15","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"medium","record_type":"Compliance attestation or statement","requirement_codes":["eu_dora_alignment"],"named_customer":null,"segment":"Unspecified","named_product_or_service":"Palo Alto Networks platform (unspecified scope)","service_family":"Supporting only","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":"Digital Operational Resilience Act - dedicated Trust Center whitepaper, plus a separate financial-sector-specific whitepaper","regulatory_regime":"EU","exact_supporting_wording":"Trust Center \"Regulations\" page lists \"Digital Operational Resilience Act - Whitepaper\" as dedicated documentation; a separate resource states \"EU financial firms: ...What's helpful now will be indispensable by 2025, when the Digital Operational Resilience Act shines a light in the darkest shadows of your cloud operations.\"","reviewer_summary":"Palo Alto's own Trust Center, verified live 2026-09-15, has a dedicated DORA whitepaper (not just a mention), plus a separate whitepaper specifically addressed to EU financial firms about DORA. Neither confirmed as naming Prisma SASE's Article 30 contractual terms specifically or a named EU financial customer, so graded Partial rather than Proven - but this is genuinely FS-targeted material, stronger than a generic regulation list.","limitation_and_notes":"Added 2026-09-15 per item 6 research pass. The whitepapers themselves were not opened in full (gated/PDF); graded from title and abstract text only."},{"id":"src_financial_services_fin_537","workbook_source_id":"FIN-537","url":"https://www.paloaltonetworks.com/customers/jovia-financial","title":"Jovia extends Zero Trust protection everywhere, from branch to users to apps","publisher":"paloaltonetworks.com","publication_date":null,"checked_date":"2026-09-15","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"high","record_type":"Named customer case study","requirement_codes":["change_control_and_configuration_governance","network_visibility_and_reporting","branch_and_office_connectivity","identity_and_zero_trust_access"],"named_customer":"Jovia Financial Credit Union","segment":"Building society or credit union","named_product_or_service":"Prisma SD-WAN; Prisma Access; Strata Cloud Manager","service_family":"SASE","estate":null,"countries_or_regions":"United States (New York)","ot_or_production_environment":null,"measured_or_stated_outcome":"30 tools consolidated to 1 with Strata Cloud Manager; 100% uptime, eliminating recurring weekly outages; $500K saved annually","industrial_standard_or_regulation":null,"regulatory_regime":"US","exact_supporting_wording":"\"Today, we have such great insights with Prisma SD-WAN that we can tell our vendors what's wrong before they even bring issues to our attention.\" - David Linares, Sr. Infrastructure Manager, Jovia Financial Credit Union. Results: \"30 -> 1 Tools consolidated with Strata Cloud Manager.\" \"100% Uptime, eliminating recurring weekly outages.\" \"$500K Saved annually by consolidating solutions with Prisma SASE.\"","reviewer_summary":"Verified live 2026-09-15 - stronger than initially reported (a candidate finding supplied separately said no numeric metrics were stated; the page in fact gives three quantified results plus a named executive quote). Jovia Financial Credit Union, serving New York for 85+ years, is real and named.","limitation_and_notes":"Added 2026-09-15 per further research pass (cross-platform lead, independently verified and strengthened). No specific US regulator (NCUA etc.) named on the page."},{"id":"src_financial_services_fin_387","workbook_source_id":"FIN-387","url":"https://www.paloaltonetworks.com/legal-notices/trust-center/soc","title":"SOC 2+ - Palo Alto Networks","publisher":"paloaltonetworks.com","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"rejected","reviewer_confidence":"low","record_type":"Compliance attestation or statement","requirement_codes":[],"named_customer":null,"segment":"Unspecified","named_product_or_service":"Palo Alto Networks (company-wide)","service_family":"Not relevant","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":"SOC 2","regulatory_regime":"Not stated","exact_supporting_wording":"SOC 2+ or SOC 2 \"Plus\" represents an additional level of certification against an expanded control set, including control alignment against the HIPAA Security Rule.","reviewer_summary":"Generic description of Palo Alto Networks' SOC 2+ certification with no product named and no financial services context.","limitation_and_notes":"Does not name Prisma Access or Prisma SD-WAN and does not map to any of the 28 columns, which do not include a generic SOC 2 column."},{"id":"src_financial_services_fin_388","workbook_source_id":"FIN-388","url":"https://www.paloaltonetworks.com/legal-notices/trust-center/pci-dss","title":"PCI DSS - Palo Alto Networks","publisher":"paloaltonetworks.com","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"rejected","reviewer_confidence":"low","record_type":"Compliance attestation or statement","requirement_codes":[],"named_customer":null,"segment":"Unspecified","named_product_or_service":"Palo Alto Networks (company-wide)","service_family":"Not relevant","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":"PCI DSS","regulatory_regime":"Not stated","exact_supporting_wording":"The PCI framework aims to protect sensitive cardholder information during transactions and prevent credit card fraud.","reviewer_summary":"Generic PCI DSS explainer page offering a PCI AOC SAQ report request form and a responsibility matrix, without naming which Palo Alto Networks products or services are in scope.","limitation_and_notes":"Does not name Prisma Access or Prisma SD-WAN as being PCI DSS certified or attested, so it cannot support Proven or Partial status on the PCI DSS column."},{"id":"src_financial_services_fin_389","workbook_source_id":"FIN-389","url":"https://www.paloaltonetworks.com/resources/datasheets/fedramp-prisma-access","title":"Prisma Access, a FedRAMP Authorized Service - Palo Alto Networks","publisher":"paloaltonetworks.com","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"rejected","reviewer_confidence":"medium","record_type":"Compliance attestation or statement","requirement_codes":[],"named_customer":null,"segment":"Unspecified","named_product_or_service":"Prisma Access","service_family":"SASE","estate":null,"countries_or_regions":"United States (government)","ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":"FedRAMP","regulatory_regime":"US","exact_supporting_wording":"a FedRAMP Authorized, cloud-delivered service","reviewer_summary":"Confirms Prisma Access is a FedRAMP Authorized service for US government agencies, but this is a federal government certification, not one of the 28 financial services columns.","limitation_and_notes":"FedRAMP is a US federal government programme, not a financial services regulatory regime in this brief's 28 columns, and the page does not state FIPS validation level, data residency, or encryption specifics."},{"id":"src_financial_services_fin_391","workbook_source_id":"FIN-391","url":"https://www.paloaltonetworks.com/legal-notices/trust-center/security","title":"Global Security Standards - Palo Alto Networks","publisher":"paloaltonetworks.com","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"rejected","reviewer_confidence":"low","record_type":"Compliance attestation or statement","requirement_codes":[],"named_customer":null,"segment":"Unspecified","named_product_or_service":"Palo Alto Networks (company-wide)","service_family":"Not relevant","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":null,"regulatory_regime":"Not stated","exact_supporting_wording":"Explore our comprehensive documentation outlining Palo Alto Networks' adherence to global security standards","reviewer_summary":"Landing page pointing to further trust documentation, with no specific data residency, encryption or FIPS detail on the page itself.","limitation_and_notes":"No concrete facts or product names found on this page to support any of the 28 columns."},{"id":"src_financial_services_fin_399","workbook_source_id":"FIN-399","url":"https://www.paloaltonetworks.com/resources/by-industry-financial-services","title":"Resource Center Financial Services - Palo Alto Networks","publisher":"paloaltonetworks.com","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"rejected","reviewer_confidence":"low","record_type":"Financial services solution page","requirement_codes":[],"named_customer":null,"segment":"Multiple","named_product_or_service":"Prisma Access; Prisma SD-WAN; Prisma SASE","service_family":"Multiple","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":null,"regulatory_regime":"Not stated","exact_supporting_wording":"Prisma Access (20 resources), Prisma SD-WAN (6 resources), Prisma SASE (10 resources)","reviewer_summary":"A resource hub listing 40 financial services customer stories and guides across Palo Alto Networks products, including Northern Trust, Redeban and Banco Inter, but these named cases relate to identity/PAM (Idira) and Cortex XSIAM rather than Prisma SD-WAN or Prisma Access.","limitation_and_notes":"Used to identify individual resources for follow-up, but on its own is an index page; the named customer stories it lists (Northern Trust, Banco Inter, Redeban) do not name Prisma SD-WAN, Prisma Access or Prisma SASE."},{"id":"src_financial_services_fin_400","workbook_source_id":"FIN-400","url":"https://www.paloaltonetworks.com/customers/northern-trust","title":"Northern Trust Customer Story - Palo Alto Networks","publisher":"paloaltonetworks.com","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"rejected","reviewer_confidence":"high","record_type":"Named customer case study","requirement_codes":[],"named_customer":"Northern Trust","segment":"Asset and wealth management","named_product_or_service":"Idira Identity Security Platform","service_family":"Not relevant","estate":"50,000 endpoints; 23,000 employees","countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":"Password rotation compliance improved from 40% to 95%; 50,000 endpoints onboarded in 16 days with zero incidents","industrial_standard_or_regulation":null,"regulatory_regime":"Not stated","exact_supporting_wording":"We started with one solution — elevation of access — and ended up implementing five.","reviewer_summary":"Northern Trust, a named asset manager, is a customer of Palo Alto Networks' Idira privileged access and identity security platform, not Prisma Access, Prisma SD-WAN or Prisma SASE.","limitation_and_notes":"Out of scope for this brief, which covers Prisma SASE, Prisma Access and Prisma SD-WAN only; this case study names a different product line (Idira identity security) and cannot be used as SD-WAN/SASE evidence."},{"id":"src_financial_services_fin_401","workbook_source_id":"FIN-401","url":"https://www.paloaltonetworks.com/cyberpedia/what-is-the-dora-act","title":"What Is the DORA Act? Digital Operational Resilience Guide - Palo Alto Networks","publisher":"paloaltonetworks.com","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"rejected","reviewer_confidence":"medium","record_type":"Other","requirement_codes":[],"named_customer":null,"segment":"Unspecified","named_product_or_service":"Idira","service_family":"Not relevant","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":"DORA","regulatory_regime":"EU","exact_supporting_wording":"Review how IDIRA helps strengthen identity security controls across critical operations.","reviewer_summary":"A generic educational page explaining DORA requirements that links only to the Idira identity platform, not to Prisma Access, Prisma SD-WAN or Prisma SASE.","limitation_and_notes":"Does not connect DORA to Prisma Access, Prisma SD-WAN or Prisma SASE, so it cannot support the EU DORA alignment column; used only to document that this search path was checked."},{"id":"src_financial_services_fs_059","workbook_source_id":"FS-059","url":"https://www.paloaltonetworks.com/industry/financial-services","title":"Financial services industry page","publisher":"paloaltonetworks.com","publication_date":null,"checked_date":"2026-09-15","source_ownership":"provider_authored","decision":"rejected","reviewer_confidence":"high","record_type":"Existing source lead","requirement_codes":[],"named_customer":null,"segment":"Payments and fintech","named_product_or_service":"Palo Alto Prisma SASE","service_family":"Supporting only","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":null,"regulatory_regime":"US","exact_supporting_wording":"Empowering financial institutions to securely deliver a modern customer experience.","reviewer_summary":"Dedicated financial services industry page with one named customer, Better, and an attributed quote from Ali Khan, Chief Information Security Officer. The about us page claims '8 of 10 Largest U.S. banks'. Financial services is also named as a target vertical in the dated Deutsche Telekom sovereignty release [30]. No named financial services Prisma SASE or SD-WAN case study was found.","limitation_and_notes":"Dedicated supplier page with one named customer (Better) and an attributed CISO quote. | Confirmed - exact match [2026-09-15, flagged per Robert's check] Pure sector-positioning tagline (\"Empowering financial institutions to securely deliver a modern customer experience\") - no technical claim of any kind. Does not appear to support any specific capability honestly. Changed from Accepted to Needs review since no specific capability can be honestly assigned - recommend Harry/Robert decide whether to Reject or find a genuine capability fit. Rejected 2026-09-15 (final pass). Page is a financial-services industry landing page, but the only content is the tagline \"Empowering financial institutions to securely deliver a modern customer experience\" - no named institution, no product-specific claim, no technical detail that ties to a specific capability column. Genuinely financial-services content, but too generic to support any one capability honestly."},{"id":"src_financial_services_fs_060","workbook_source_id":"FS-060","url":"https://www.paloaltonetworks.com/company/about-us","title":"About us / company page","publisher":"paloaltonetworks.com","publication_date":null,"checked_date":"2026-07-29","source_ownership":"provider_authored","decision":"rejected","reviewer_confidence":"high","record_type":"Existing source lead","requirement_codes":[],"named_customer":null,"segment":"To review","named_product_or_service":null,"service_family":"Not relevant","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":null,"regulatory_regime":null,"exact_supporting_wording":"Empowering financial institutions to securely deliver a modern customer experience.","reviewer_summary":"Dedicated financial services industry page with one named customer, Better, and an attributed quote from Ali Khan, Chief Information Security Officer. The about us page claims '8 of 10 Largest U.S. banks'. Financial services is also named as a target vertical in the dated Deutsche Telekom sovereignty release [30]. No named financial services Prisma SASE or SD-WAN case study was found.","limitation_and_notes":"Supplier's own corporate stat block. Unaudited marketing figures, but the organisation-size and sector penetration claims are explicit and attributable. | Not found on page"}]},{"slug":"fortinet-fortisase","name":"Fortinet FortiSASE","marketplace_url":"https://netify.co.uk/marketplace/fortinet-fortisase/","research_status":"complete","overall_confidence":"medium","fit_conclusion":"Fortinet can demonstrate named financial services deployments of Secure SD-WAN in the United States (USI Insurance Services, 182 offices) and generic use by an anonymised US multinational financial institution and a Vietnamese bank, which supports branch connectivity, remote workforce and North American delivery. FortiSASE itself is documented mainly through generic product pages and the Trust Resource Center, which names SOC 2, ISO 27001 and FortiSASE-specific subprocessors, but no opened page ties FortiSASE or Secure SD-WAN to DORA, FCA/PRA, FFIEC, NYDFS, OSFI or SWIFT for a named financial customer. UK delivery, trading/low-latency use, cardholder data segmentation, log retention periods and FIPS validation could not be evidenced from pages that were successfully opened. The strongest named evidence is the USI Insurance Services case study, which is US-only and does not touch payments-specific or cross-border regulatory requirements. Overall this is a reasonable general-purpose SD-WAN and SASE fit with clear gaps in FS-specific regulatory documentation, particularly for UK and Canadian regimes.","gaps_and_unknowns":"Trading/low-latency connectivity, payment and cardholder data segmentation, logging/retention periods, FIPS 140-2/140-3 validation, incident notification timelines, exit/portability terms, UK delivery, and all four regional regulatory columns (FCA/PRA, DORA, FFIEC/GLBA/NYDFS/SEC, OSFI) and SWIFT CSP are unevidenced or only generically evidenced from opened pages. Closing these would require direct access to the FortiSASE-specific pages within trust.fortinet.com (certifications, data residency, SLA) which returned 404 on fetch, plus a named UK, EU or Canadian financial institution case study and a PCI DSS Attestation of Compliance naming FortiSASE.","reviewed_by":"Harry Yelland","reviewed_date":"2026-09-14","source_count":11,"accepted_source_count":9,"requirements":[{"code":"branch_and_office_connectivity","label":"Branch and office connectivity","state":"proven","evidence_source_ids":["src_financial_services_fs_039","src_financial_services_fin_280","src_financial_services_fin_535","src_financial_services_fin_536"],"verified_date":"2026-09-14"},{"code":"trading_and_low_latency_connectivity","label":"Trading and low-latency connectivity","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"data_centre_colocation_and_cloud_connectivity","label":"Data-centre, colocation and cloud connectivity","state":"partial","evidence_source_ids":["src_financial_services_fin_285"],"verified_date":"2026-09-14"},{"code":"resilience_and_tested_recovery","label":"Resilience and tested recovery","state":"partial","evidence_source_ids":["src_financial_services_fin_280","src_financial_services_fin_286"],"verified_date":"2026-09-14"},{"code":"network_segmentation_and_zoning","label":"Network segmentation and zoning","state":"partial","evidence_source_ids":["src_financial_services_fin_286"],"verified_date":"2026-09-14"},{"code":"payment_and_cardholder_data_segmentation","label":"Payment and cardholder data segmentation","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"third_party_and_outsourced_access","label":"Third-party and outsourced access","state":"partial","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"remote_and_hybrid_workforce","label":"Remote and hybrid workforce","state":"proven","evidence_source_ids":["src_financial_services_fin_282"],"verified_date":"2026-09-14"},{"code":"data_residency_and_sovereignty","label":"Data residency and sovereignty","state":"partial","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"encryption_and_key_management","label":"Encryption and key management","state":"partial","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"logging_audit_and_evidence_retention","label":"Logging, audit and evidence retention","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"identity_and_zero_trust_access","label":"Identity and zero trust access","state":"partial","evidence_source_ids":["src_financial_services_fin_285"],"verified_date":"2026-09-14"},{"code":"cloud_and_saas_data_controls","label":"Cloud and SaaS data controls","state":"partial","evidence_source_ids":["src_financial_services_fin_285"],"verified_date":"2026-09-14"},{"code":"managed_operations_and_soc","label":"Managed operations and SOC","state":"proven","evidence_source_ids":["src_financial_services_fin_280","src_financial_services_fin_285","src_financial_services_fin_536"],"verified_date":"2026-09-14"},{"code":"network_visibility_and_reporting","label":"Network visibility and reporting","state":"proven","evidence_source_ids":["src_financial_services_fin_280","src_financial_services_fin_285","src_financial_services_fin_535"],"verified_date":"2026-09-14"},{"code":"change_control_and_configuration_governance","label":"Change control and configuration governance","state":"proven","evidence_source_ids":["src_financial_services_fin_535"],"verified_date":"2026-09-14"},{"code":"incident_notification_support","label":"Incident notification support","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"concentration_risk_and_subcontractor_transparency","label":"Concentration risk and subcontractor transparency","state":"proven","evidence_source_ids":["src_financial_services_fin_284"],"verified_date":"2026-09-14"},{"code":"exit_and_portability","label":"Exit and portability","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"uk_regulatory_alignment_fca_and_pra","label":"UK regulatory alignment (FCA and PRA)","state":"partial","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"eu_dora_alignment","label":"EU DORA alignment","state":"partial","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"us_regulatory_alignment_ffiec_glba_nydfs_sec","label":"US regulatory alignment (FFIEC, GLBA, NYDFS, SEC)","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"canada_regulatory_alignment_osfi","label":"Canada regulatory alignment (OSFI)","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"pci_dss_alignment","label":"PCI DSS alignment","state":"partial","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"swift_csp_alignment","label":"SWIFT CSP alignment","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"uk_delivery","label":"UK delivery","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"north_america_delivery","label":"North America delivery","state":"partial","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"global_delivery","label":"Global delivery","state":"proven","evidence_source_ids":["src_financial_services_fs_039"],"verified_date":"2026-09-14"}],"sources":[{"id":"src_financial_services_fin_280","workbook_source_id":"FIN-280","url":"https://www.fortinet.com/customers/usi-insurance","title":"USI Insurance Services Case Study","publisher":"fortinet.com","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"high","record_type":"Named customer case study","requirement_codes":["network_visibility_and_reporting","branch_and_office_connectivity","resilience_and_tested_recovery","managed_operations_and_soc"],"named_customer":"USI Insurance Services","segment":"Insurance","named_product_or_service":"Fortinet Secure SD-WAN","service_family":"SD-WAN","estate":"182 offices across the United States","countries_or_regions":"United States","ot_or_production_environment":null,"measured_or_stated_outcome":"Downtime reduced from approximately 40 outages annually to fewer than 20; internet connectivity up to 10x faster; approximately $1 million annual savings on WAN hardware and support","industrial_standard_or_regulation":null,"regulatory_regime":"US","exact_supporting_wording":"We have effectively cut our outages in half. The proof is in the pudding that Fortinet Secure SD-WAN does what it is supposed to do.","reviewer_summary":"USI Insurance Services, a US insurance broker with 182 offices, deployed Fortinet Secure SD-WAN with FortiGate NGFWs, FortiManager and FortiAnalyzer, and reported reduced outages and lower WAN costs.","limitation_and_notes":"Does not mention data residency, encryption, PCI DSS or any specific regulatory regime; RTO/RPO not quantified, outcome is outage reduction only, not a formal DR test."},{"id":"src_financial_services_fin_281","workbook_source_id":"FIN-281","url":"https://www.fortinet.com/customers/vietnamese-bank","title":"Vietnamese Bank Case Study","publisher":"fortinet.com","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"medium","record_type":"Named customer case study","requirement_codes":["remote_and_hybrid_workforce"],"named_customer":null,"segment":"Retail banking","named_product_or_service":"FortiGate Next-Generation Firewalls, FortiMail, FortiManager, FortiAnalyzer","service_family":"Supporting only","estate":"A few thousand remote users","countries_or_regions":"Vietnam","ot_or_production_environment":null,"measured_or_stated_outcome":"30% CapEx savings on cybersecurity investments; secured 24x7 connectivity for thousands of users","industrial_standard_or_regulation":null,"regulatory_regime":"Not stated","exact_supporting_wording":"With Fortinet, we were able to achieve 30% CapEx savings on cybersecurity investments against comparable solutions.","reviewer_summary":"An anonymised Vietnamese bank deployed FortiGate, FortiMail, FortiManager and FortiAnalyzer to secure remote workers and reported CapEx savings, but the case study does not name Secure SD-WAN or FortiSASE as the deployed service.","limitation_and_notes":"Bank name is anonymised; the named products are firewall/email/management tools, not Secure SD-WAN or FortiSASE, so this only weakly supports remote workforce and is not usable for SD-WAN/SASE-specific columns."},{"id":"src_financial_services_fin_282","workbook_source_id":"FIN-282","url":"https://www.fortinet.com/customers/multinational-financial-services-institution","title":"Multinational Financial Services Institution Case Study","publisher":"fortinet.com","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"medium","record_type":"Named customer case study","requirement_codes":["remote_and_hybrid_workforce"],"named_customer":null,"segment":"Unspecified","named_product_or_service":"Fortinet Secure SD-WAN, FortiWiFi, FortiAP, FortiManager, FortiAnalyzer","service_family":"SD-WAN","estate":"Hundreds to thousands of devices","countries_or_regions":"United States (multinational)","ot_or_production_environment":null,"measured_or_stated_outcome":"Deployment of hundreds/thousands of teleworking devices in minutes with fast self-installation and reduced support staff impact","industrial_standard_or_regulation":null,"regulatory_regime":"Not stated","exact_supporting_wording":"The company needed a high-performance, scalable solution that could empower the networking operations group to deploy hundreds of teleworking devices concurrently.","reviewer_summary":"An anonymised US multinational financial services institution used Fortinet Secure SD-WAN with FortiWiFi devices to enable large-scale teleworking during the COVID-19 period.","limitation_and_notes":"Institution is anonymised (only described as a multinational financial services institution), so it cannot be verified as a specific named bank; no regulatory regime or segment stated."},{"id":"src_financial_services_fin_284","workbook_source_id":"FIN-284","url":"https://trust.fortinet.com","title":"Fortinet Trust Resource Center","publisher":"trust.fortinet.com","publication_date":null,"checked_date":"2026-09-15","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"medium","record_type":"Compliance attestation or statement","requirement_codes":["concentration_risk_and_subcontractor_transparency"],"named_customer":null,"segment":"Not applicable","named_product_or_service":"FortiSASE","service_family":"SASE","estate":null,"countries_or_regions":"Not stated","ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":"SOC 2; ISO/IEC 27001","regulatory_regime":"Not stated","exact_supporting_wording":"FortiSASE using subprocessors Atlassian, Grafana Cloud and Slack","reviewer_summary":"Fortinet's Trust Resource Center lists FortiSASE-specific subprocessors (Atlassian, Grafana Cloud, Slack) and lists company-wide certifications including SOC 2 and ISO/IEC 27001, but does not state FortiSASE-specific data residency regions, log retention periods, FIPS validation or PCI DSS in the content retrieved.","limitation_and_notes":"Checker 2026-09-12: page carries the fact but the wording differs (Page says 'FortiSASE using subprocessors Atlassian, Grafana Cloud and Slack' - close paraphrase, not exact wording.). Re-quote verbatim. Portal content is partly rendered dynamically; sub-pages for certifications detail, data residency and PCI DSS/FIPS returned 404 on fetch, so those specific facts could not be verified from an opened page and are recorded as Not found rather than assumed. [2026-09-15] Re-quoted verbatim using the checker's own already-confirmed page wording - no fresh fetch needed, the exact sentence was already recorded in the check note."},{"id":"src_financial_services_fin_285","workbook_source_id":"FIN-285","url":"https://www.fortinet.com/products/sase","title":"FortiSASE Product Page","publisher":"fortinet.com","publication_date":null,"checked_date":"2026-09-15","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"high","record_type":"Compliance attestation or statement","requirement_codes":["data_centre_colocation_and_cloud_connectivity","network_visibility_and_reporting","identity_and_zero_trust_access","cloud_and_saas_data_controls","managed_operations_and_soc"],"named_customer":null,"segment":"Multiple","named_product_or_service":"FortiSASE","service_family":"SASE","estate":null,"countries_or_regions":"Global (200+ PoPs)","ot_or_production_environment":null,"measured_or_stated_outcome":"99.999% uptime","industrial_standard_or_regulation":null,"regulatory_regime":"Not stated","exact_supporting_wording":"It's deployed by end users in their own data centers, giving organizations full control over core capabilities and data, enabling secure, cost-efficient, and rapid deployment. This ensures compliance with regional data residency and sovereignty laws.","reviewer_summary":"FortiSASE is described as a unified SSE/SD-WAN/zero trust platform with 200+ global PoPs, native AWS/Google Cloud/Oracle Cloud integration, CASB and DLP, SOC-as-a-Service, and a stated 99.999% uptime, plus a sovereign deployment option for data residency.","limitation_and_notes":"Checker 2026-09-12: page carries the fact but the wording differs (Concept present ('full control over core capabilities and data', 'compliance with regional data residency and sovereignty laws') but not the exact quoted wordin). Re-quote verbatim. This is a generic global product page, not financial-services-specific and does not name a financial institution; no FS customer or regulatory regime is connected here, so it only supports general documentation-type columns, not FS-named-customer columns. [2026-09-15, Playwright fetch] Re-quoted verbatim from the FortiSASE Sovereign section of the live page."},{"id":"src_financial_services_fin_286","workbook_source_id":"FIN-286","url":"https://www.fortinet.com/products/sd-wan","title":"Fortinet Secure SD-WAN","publisher":"fortinet.com","publication_date":null,"checked_date":"2026-09-15","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"medium","record_type":"Financial services solution page","requirement_codes":["network_segmentation_and_zoning","resilience_and_tested_recovery"],"named_customer":null,"segment":"Multiple","named_product_or_service":"Fortinet Secure SD-WAN","service_family":"SD-WAN","estate":null,"countries_or_regions":"Not stated","ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":null,"regulatory_regime":"Not stated","exact_supporting_wording":"\"Fortinet's SD-WAN solution delivers solid performance, efficient security integration, and intuitive centralized management, providing a reliable and effective experience for enterprise environments.\" - Senior Network Engineer, Banking (Gartner Peer Review)","reviewer_summary":"Fortinet describes Secure SD-WAN as offering real-time path monitoring, self-healing failover and identity-based segmentation with posture checks every 60 seconds, including a banking customer engineer quote praising performance and management.","limitation_and_notes":"Checker 2026-09-12: page carries the fact but the wording differs (Both concepts present separately ('Real-time path monitoring and dynamic steering across broadband, 5G, MPLS...' and 'Self-healing, autonomous architecture...no). Re-quote verbatim. The banking customer quote on this page is anonymised (only titled Senior Network Engineer, Banking) with no institution name, country or outcome detail, so it only weakly supports a generic banking connection, not a named-institution Proven case. [2026-09-15, Playwright fetch] Page has changed materially since the original check - the originally-quoted 'path monitoring'/'self-healing' resilience and segmentation language is no longer present anywhere on the live page. The only banking-sector reference remaining is an anonymised Gartner Peer Review quote (title only: Senior Network Engineer, Banking), which is weaker than what was previously recorded. Capability rating is unaffected since it's backed by five other sources, but this specific source no longer supports resilience/segmentation claims as strongly as before."},{"id":"src_financial_services_fin_535","workbook_source_id":"FIN-535","url":"https://www.fortinet.com/customers/cec-bank","title":"Premier Romanian Bank Achieves 50% Reduction in Application Response Times With FortiGate Secure SD-WAN","publisher":"fortinet.com","publication_date":null,"checked_date":"2026-09-15","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"high","record_type":"Named customer case study","requirement_codes":["change_control_and_configuration_governance","network_visibility_and_reporting","branch_and_office_connectivity"],"named_customer":"CEC Bank","segment":"Retail banking","named_product_or_service":"FortiGate Secure SD-WAN; Fabric Management Center","service_family":"SD-WAN","estate":"Almost 1,000 branches","countries_or_regions":"Romania","ot_or_production_environment":null,"measured_or_stated_outcome":"8x increase in available bandwidth; 50% reduction in application response times; greatly reduced operational complexity","industrial_standard_or_regulation":null,"regulatory_regime":"EU","exact_supporting_wording":"\"Within just six months the entire Fortinet roll-out of FortiGate Secure SD-WAN was complete, providing fast, reliable connectivity to our full range of applications and services for almost 1,000 branches.\" - Eduard Bîsceanu, Director, Information Security and Administration, CEC Bank","reviewer_summary":"Verified live 2026-09-15. CEC Bank is a real, major, named Romanian bank with a named C-level security executive quote and quantified outcomes (8x bandwidth, 50% faster response times) - a genuinely strong EU financial services SD-WAN case.","limitation_and_notes":"Added 2026-09-15 per further research pass. No named regulation (e.g. DORA) beyond general EU context."},{"id":"src_financial_services_fin_536","workbook_source_id":"FIN-536","url":"https://www.casestudies.com/company/fortinet/case-study/caixabank-reduces-network-communications-costs-by-50-with-fortinet","title":"CaixaBank reduces network communications costs by 50% with Fortinet","publisher":"casestudies.com","publication_date":null,"checked_date":"2026-09-15","source_ownership":"independent","decision":"accepted","reviewer_confidence":"medium","record_type":"Named customer case study","requirement_codes":["branch_and_office_connectivity","managed_operations_and_soc"],"named_customer":"CaixaBank","segment":"Retail banking","named_product_or_service":"FortiGate Secure SD-WAN; FortiSwitch; FortiExtender; FortiManager; FortiAnalyzer","service_family":"SD-WAN","estate":"Approximately 5,000 bank locations","countries_or_regions":"Spain","ot_or_production_environment":null,"measured_or_stated_outcome":"50% reduction in network communications costs; expanded service coverage","industrial_standard_or_regulation":null,"regulatory_regime":"EU","exact_supporting_wording":"\"CaixaBank, a leading Spanish bank, faced significant challenges with its network infrastructure... Fortinet implemented its Secure SD-WAN solution across approximately 5,000 bank locations, supported by FortiSwitch LAN switches and FortiExtender for wireless WAN connections.\"","reviewer_summary":"Found independently (not part of a supplied candidate list) while verifying a related Fortinet finding. CaixaBank is a real, major, named Spanish bank at genuinely large scale (~5,000 locations) - one of the strongest EU financial-services SD-WAN cases found in this whole project by scale.","limitation_and_notes":"Added 2026-09-15. Case study aggregator mirror, not Fortinet's own site directly - original Fortinet URL not located in this pass. No named executive quote captured, no named regulation."},{"id":"src_financial_services_fs_039","workbook_source_id":"FS-039","url":"https://www.fortinet.com/solutions/industries/financial-services","title":"Financial Services Cybersecurity | Fortinet","publisher":"fortinet.com","publication_date":null,"checked_date":"2026-07-29","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"high","record_type":"Existing source lead","requirement_codes":["branch_and_office_connectivity","global_delivery"],"named_customer":null,"segment":"Retail banking","named_product_or_service":null,"service_family":"Supporting only","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":null,"regulatory_regime":"Not stated","exact_supporting_wording":"The financial services sector is a high-value target for cyberattacks and highly regulated by jurisdictions around the world.","reviewer_summary":"Dedicated financial services industry page. USI Insurance Services is named and quoted on that page saying \"Secure SD-WAN does what it is supposed to do.\" The SD-WAN customer stories ebook [9] names Itau Unibanco with 3,000+ locations across 20 countries, which is direct SD-WAN evidence. Other financial customers on the page are anonymised by descriptor (a Vietnamese bank, a US multinational institution).","limitation_and_notes":"Supplier's dedicated financial services industry page with customer testimonials. Vendor-authored. | Confirmed - exact match"},{"id":"src_financial_services_fin_287","workbook_source_id":"FIN-287","url":"https://www.fortinet.com/content/dam/fortinet/assets/ebook/eb-fsi-regulations.pdf","title":"Regulatory Drivers for Operational and Cyber Resilience (eBook)","publisher":"fortinet.com","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"rejected","reviewer_confidence":"medium","record_type":"Compliance attestation or statement","requirement_codes":[],"named_customer":null,"segment":"Not applicable","named_product_or_service":"Fortinet solutions (FortiGate, FortiSIEM, FortiSOAR)","service_family":"Supporting only","estate":null,"countries_or_regions":"Multiple","ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":"DORA; FCA; PRA; PCI DSS","regulatory_regime":"Multiple","exact_supporting_wording":"Coming into effect in January 2025, it addresses the industry's increasing dependence on digital technologies and third-party technology service providers","reviewer_summary":"Fortinet's financial services regulations eBook discusses DORA, FCA/PRA and PCI DSS as regulatory drivers generally, naming FortiGate, FortiSIEM and FortiSOAR, but does not name Secure SD-WAN, FortiSASE, or any specific FS customer in connection with these regimes.","limitation_and_notes":"Discusses regulations at a generic industry level without connecting the named SD-WAN/SASE service to any specific regime or customer, so it cannot support Proven status for regulatory columns; kept as evidence only that Fortinet publishes regulatory-context material, not as a capability source."},{"id":"src_financial_services_fin_288","workbook_source_id":"FIN-288","url":"https://www.fortinet.com/corporate/about-us/legal","title":"Fortinet Legal","publisher":"fortinet.com","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"rejected","reviewer_confidence":"low","record_type":"Other","requirement_codes":[],"named_customer":null,"segment":"Not applicable","named_product_or_service":"Fortinet (corporate)","service_family":"Not relevant","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":null,"regulatory_regime":"Not stated","exact_supporting_wording":"FORTINET MAKES NO WARRANTIES, EXPRESS OR IMPLIED, IN THIS WEBSITE","reviewer_summary":"Fortinet's legal hub page lists EULA, service terms, privacy policy and code of conduct documents but the fetched content did not surface an accessible SLA, DPA, or exit/termination document with specific commitments.","limitation_and_notes":"Page only references categories of legal documents without exposing SLA uptime commitments, incident notification timelines, or exit/termination terms in the fetched content; not usable as a capability source."}]},{"slug":"bt","name":"BT","marketplace_url":"https://netify.co.uk/marketplace/bt/","research_status":"complete","overall_confidence":"medium","fit_conclusion":"BT can evidence a large-scale Managed SD-WAN and managed firewall deployment for an anonymised European bank spanning over 30 countries and 100,000-plus employees, covering segmentation and resilience, but the institution is not named so this falls short of full proof. The strongest named-institution evidence is Nationwide Building Society, a UK building society, which connects BT's security and monitoring service to the FCA, PRA and PCI DSS by name, supporting UK regulatory alignment and managed SOC claims. BT's Managed SASE product page documents UK data residency and ZTNA, and its banking-specific cyber security page names SASE, ZTNA and CASB for banks, but without a named financial customer for those specific capabilities. There is no evidence for US, Canadian or SWIFT regulatory alignment, no named North American financial customer, and no documented log retention, incident notification timeline or exit/portability terms tied to the named services. A UK IT decision maker gets moderate confidence from the Nationwide relationship; a North American or EU DORA-focused buyer would need direct evidence from BT that this research did not find.","gaps_and_unknowns":"No evidence closes trading/low-latency connectivity, data-centre/colocation/cloud on-ramps, third-party/outsourced access controls, remote/hybrid workforce use, logging/retention specifics, incident notification timelines, subcontractor transparency, exit/portability terms, SWIFT CSP alignment, or US/Canadian regulatory alignment (FFIEC, GLBA, NYDFS, SEC, OSFI). Closing these would require BT to publish a named North American or Canadian FS case study, a SWIFT CSP or PCI DSS Attestation of Compliance naming the SD-WAN/SASE service specifically, and a customer-facing SLA document with retention, notification and exit terms. [2026-09-15] EU DORA: a specific BT DORA contract addendum PDF was referenced in a candidate research pass but could not be found on three separate live searches of bt.com/business.bt.com - no genuine BT-authored DORA content located. Treated as unresolved, not added as a source.","reviewed_by":"Harry Yelland","reviewed_date":"2026-09-14","source_count":19,"accepted_source_count":10,"requirements":[{"code":"branch_and_office_connectivity","label":"Branch and office connectivity","state":"proven","evidence_source_ids":["src_financial_services_fs_012","evidence:bt:17"],"verified_date":"2026-09-14"},{"code":"trading_and_low_latency_connectivity","label":"Trading and low-latency connectivity","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"data_centre_colocation_and_cloud_connectivity","label":"Data-centre, colocation and cloud connectivity","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"resilience_and_tested_recovery","label":"Resilience and tested recovery","state":"partial","evidence_source_ids":["evidence:bt:17"],"verified_date":"2026-09-14"},{"code":"network_segmentation_and_zoning","label":"Network segmentation and zoning","state":"partial","evidence_source_ids":["evidence:bt:17"],"verified_date":"2026-09-14"},{"code":"payment_and_cardholder_data_segmentation","label":"Payment and cardholder data segmentation","state":"partial","evidence_source_ids":["src_financial_services_fin_146"],"verified_date":"2026-09-14"},{"code":"third_party_and_outsourced_access","label":"Third-party and outsourced access","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"remote_and_hybrid_workforce","label":"Remote and hybrid workforce","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"data_residency_and_sovereignty","label":"Data residency and sovereignty","state":"proven","evidence_source_ids":["evidence:bt:6"],"verified_date":"2026-09-14"},{"code":"encryption_and_key_management","label":"Encryption and key management","state":"partial","evidence_source_ids":["src_financial_services_fin_152"],"verified_date":"2026-09-14"},{"code":"logging_audit_and_evidence_retention","label":"Logging, audit and evidence retention","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"identity_and_zero_trust_access","label":"Identity and zero trust access","state":"partial","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"cloud_and_saas_data_controls","label":"Cloud and SaaS data controls","state":"partial","evidence_source_ids":["evidence:bt:6"],"verified_date":"2026-09-14"},{"code":"managed_operations_and_soc","label":"Managed operations and SOC","state":"proven","evidence_source_ids":["src_financial_services_fs_012","src_financial_services_fin_146"],"verified_date":"2026-09-14"},{"code":"network_visibility_and_reporting","label":"Network visibility and reporting","state":"partial","evidence_source_ids":["evidence:bt:17","src_financial_services_fin_149"],"verified_date":"2026-09-14"},{"code":"change_control_and_configuration_governance","label":"Change control and configuration governance","state":"proven","evidence_source_ids":["src_financial_services_fin_152"],"verified_date":"2026-09-14"},{"code":"incident_notification_support","label":"Incident notification support","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"concentration_risk_and_subcontractor_transparency","label":"Concentration risk and subcontractor transparency","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"exit_and_portability","label":"Exit and portability","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"uk_regulatory_alignment_fca_and_pra","label":"UK regulatory alignment (FCA and PRA)","state":"proven","evidence_source_ids":["src_financial_services_fin_146"],"verified_date":"2026-09-14"},{"code":"eu_dora_alignment","label":"EU DORA alignment","state":"partial","evidence_source_ids":["src_financial_services_fin_154"],"verified_date":"2026-09-14"},{"code":"us_regulatory_alignment_ffiec_glba_nydfs_sec","label":"US regulatory alignment (FFIEC, GLBA, NYDFS, SEC)","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"canada_regulatory_alignment_osfi","label":"Canada regulatory alignment (OSFI)","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"pci_dss_alignment","label":"PCI DSS alignment","state":"proven","evidence_source_ids":["src_financial_services_fin_146"],"verified_date":"2026-09-14"},{"code":"swift_csp_alignment","label":"SWIFT CSP alignment","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"uk_delivery","label":"UK delivery","state":"proven","evidence_source_ids":["src_financial_services_fin_146","evidence:bt:6","src_financial_services_fin_149"],"verified_date":"2026-09-14"},{"code":"north_america_delivery","label":"North America delivery","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"global_delivery","label":"Global delivery","state":"proven","evidence_source_ids":["src_financial_services_fs_012","evidence:bt:17","src_financial_services_fin_155"],"verified_date":"2026-09-14"}],"sources":[{"id":"evidence:bt:17","workbook_source_id":"FIN-141","url":"https://business.bt.com/insights/case-studies/financial-services-sd-wan/","title":"BT Business - Financial services SD-WAN case study (Agile Connect + BT Managed Fortinet Firewall; anonymised global financial-services customer)","publisher":"","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"medium","record_type":"Named customer case study","requirement_codes":["network_visibility_and_reporting","network_segmentation_and_zoning","branch_and_office_connectivity","resilience_and_tested_recovery","global_delivery"],"named_customer":null,"segment":"Retail banking","named_product_or_service":"Agile Connect (Nuage SD-WAN) with Managed Fortinet Firewall and Managed Cloud Security","service_family":"Managed SD-WAN","estate":"More than 100,000 employees","countries_or_regions":"More than 30 countries","ot_or_production_environment":null,"measured_or_stated_outcome":"Higher bandwidth, greater connectivity and flexibility at lower costs; simpler deployment and greater control over their network","industrial_standard_or_regulation":null,"regulatory_regime":"Multiple","exact_supporting_wording":"Network is segmented too. So if a breach happens in one area, data in other areas stays protected","reviewer_summary":"BT describes an SD-WAN and managed Fortinet firewall deployment for an unnamed European bank with over 100,000 employees across more than 30 countries, covering segmentation, resilience and a single management view.","limitation_and_notes":"The bank is anonymised (described only as 'one of Europe's biggest banks'), so this cannot prove a named-institution deployment; it does not mention trading, data-centre/cloud on-ramps, cardholder data scope, RTO/RPO figures or regulatory regimes by name."},{"id":"src_financial_services_fin_144","workbook_source_id":"FIN-144","url":"https://business.bt.com/industries/banking/cyber-security/","title":"Banking Cyber Security | Industries | BT Business","publisher":"business.bt.com","publication_date":null,"checked_date":"2026-09-15","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"medium","record_type":"Financial services solution page","requirement_codes":["identity_and_zero_trust_access","cloud_and_saas_data_controls"],"named_customer":"Nationwide","segment":"Retail banking","named_product_or_service":"Managed Identity and Access Management; Secure Access Service Edge (SASE); Zero Trust Network Access (ZTNA)","service_family":"SASE","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":null,"regulatory_regime":"UK","exact_supporting_wording":"Create a more protective environment with SASE. It combines SD-WAN and Secure Services Edge (SSE) - that are seamlessly integrated.","reviewer_summary":"BT's banking-specific cyber security page names SASE (with ZTNA and, via SSE, CASB) as part of its offer to banks, and references Nationwide as a banking customer, but without a described deployment.","limitation_and_notes":"Quoted wording not found on the page in the 2026-09-12 check (Exact phrase not found; page instead reads 'Create a more protective environment with SASE. It combines SD-WAN and Secure Services Edge (SSE) - that are seamles). Re-quote before accepting. This is a financial services solution page, not a named-deployment case study; Nationwide is referenced generically ('Banks like Nationwide have to take the frontline'), not as a customer of the SASE/ZTNA product specifically. [2026-09-15 Harry review] Verified live 2026-09-15. Re-quoted using the checker's own found wording. Generic banking-industry page; Nationwide is mentioned only as an example sector reference, not as a customer of BT's SASE/ZTNA product - kept at whatever capability level (Partial) was already recorded, not Proven."},{"id":"src_financial_services_fin_146","workbook_source_id":"FIN-146","url":"https://business.bt.com/insights/case-studies/nationwide/","title":"Nationwide case study: Network security","publisher":"business.bt.com","publication_date":"2018-04-27","checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"high","record_type":"Named customer case study","requirement_codes":["payment_and_cardholder_data_segmentation","uk_regulatory_alignment_fca_and_pra","managed_operations_and_soc","pci_dss_alignment","uk_delivery"],"named_customer":"Nationwide Building Society","segment":"Retail banking","named_product_or_service":"BT network security, threat management and 24-hour monitoring services","service_family":"Supporting only","estate":null,"countries_or_regions":"UK","ot_or_production_environment":null,"measured_or_stated_outcome":"BT operational teams permanently based in Nationwide's Enterprise Command Centre providing 24-hour proactive and reactive monitoring","industrial_standard_or_regulation":"PCI DSS; ISO 20000; FCA and PRA","regulatory_regime":"UK","exact_supporting_wording":"The Financial Conduct Authority and Prudential Regulation Authority are testing security controls and technologies together.","reviewer_summary":"BT describes a six-year network security engagement with Nationwide Building Society including 24-hour monitoring from BT staff based in Nationwide's own command centre, PCI DSS conformance and ISO 20000 accreditation, in a context that names the FCA and PRA.","limitation_and_notes":"The named service is network security/threat management, not an SD-WAN or SASE product by name, so it does not prove branch connectivity, segmentation architecture or SASE-specific capability; it does not state RTO/RPO, data residency or incident notification timelines."},{"id":"evidence:bt:6","workbook_source_id":"FIN-148","url":"https://business.bt.com/networks-digital-services/sd-wan-sase/sase/","title":"BT Business - Managed SASE Solutions page (sector-specific positioning: retail, financial services, public sector; SASE cloud node architecture)","publisher":"","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"medium","record_type":"Compliance attestation or statement","requirement_codes":["data_residency_and_sovereignty","cloud_and_saas_data_controls","uk_delivery"],"named_customer":null,"segment":"Not applicable","named_product_or_service":"BT Managed SASE","service_family":"Managed SASE","estate":null,"countries_or_regions":"UK","ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":null,"regulatory_regime":"UK","exact_supporting_wording":"UK-resident logging and management to meet local regulatory standards","reviewer_summary":"BT's Managed SASE product page states UK-resident logging and management, describes ZTNA replacing VPNs and describes DLP-style monitoring to prevent data leaks from cloud apps such as Microsoft 365, with 24/7 UK-based monitoring.","limitation_and_notes":"This is a general product page, not financial-services-specific, and names no financial institution, so it cannot prove FS-specific identity/zero trust or CASB/DLP use; only the documented data residency and UK delivery facts are directly supported."},{"id":"src_financial_services_fin_149","workbook_source_id":"FIN-149","url":"https://business.bt.com/content/dam/bt-business/pdfs/products/networking/connect-your-locations/bt-managed-sd-wan.pdf","title":"Managed SD-WAN from BT: Building a future proof network","publisher":"business.bt.com","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"medium","record_type":"Compliance attestation or statement","requirement_codes":["network_visibility_and_reporting","uk_delivery"],"named_customer":null,"segment":"Not applicable","named_product_or_service":"Managed SD-WAN from BT","service_family":"Managed SD-WAN","estate":null,"countries_or_regions":"UK","ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":null,"regulatory_regime":"Not stated","exact_supporting_wording":"UK-based operation centres to keep a proactive eye on your network, giving you support and guidance whenever you need it, 24/7","reviewer_summary":"BT's Managed SD-WAN product brochure describes UK-based 24/7 operations centres, a dedicated project management team for onboarding, and real-time analytics on applications, users and devices.","limitation_and_notes":"No SLA figures, RTO/RPO, encryption or data residency detail is given in this document; it is not financial-services-specific and names no customer."},{"id":"src_financial_services_fin_152","workbook_source_id":"FIN-152","url":"https://business.bt.com/content/dam/bt-business/pdfs/terms/managed-services/btl-bte-frtnt-sdwan-annex-to-mngd-srvcs-sch.pdf","title":"BT Managed Fortinet SD-WAN (Annex to Managed Services Schedule)","publisher":"business.bt.com","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"medium","record_type":"Compliance attestation or statement","requirement_codes":["change_control_and_configuration_governance","encryption_and_key_management"],"named_customer":null,"segment":"Not applicable","named_product_or_service":"BT Managed Fortinet SD-WAN","service_family":"Managed SD-WAN","estate":null,"countries_or_regions":"USA, UK, India, Canada, UAE, Germany, France, Singapore, Australia, Japan","ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":null,"regulatory_regime":"Multiple","exact_supporting_wording":"Transport Independent VPN...transfer information securely across your network and the Internet using encryption technology.","reviewer_summary":"The contractual annex for BT Managed Fortinet SD-WAN describes VPN-based encryption, tiered change requests (a 'Simple Service Request' for application category changes, 30 days notice for vCPU changes) and restricts FortiSASE use to specific in-country PoPs, but states that formal Service Levels and Service Credits do not apply to the Fortinet service itself.","limitation_and_notes":"No FIPS validation or key-management detail is given, and the document explicitly states no SLA/service credits apply to this service, so it cannot support a resilience/RTO-RPO or incident-notification-timeline claim; it is not financial-services-specific."},{"id":"src_financial_services_fin_154","workbook_source_id":"FIN-154","url":"https://business.bt.com/insights/getting-ready-for-dora/","title":"Getting ready for DORA | BT Business","publisher":"business.bt.com","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"low","record_type":"Compliance attestation or statement","requirement_codes":["eu_dora_alignment"],"named_customer":null,"segment":"Multiple","named_product_or_service":"BT Radianz cloud ecosystem (referenced only generically)","service_family":"Not relevant","estate":null,"countries_or_regions":"EU","ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":"DORA","regulatory_regime":"EU","exact_supporting_wording":"Our Radianz solutions cloud ecosystem brings together a community of thousands of financial institutions...highly reliable, resilient and secure connectivity","reviewer_summary":"A BT article explaining DORA to financial services readers, positioning the Radianz cloud ecosystem as supporting resilient connectivity, without Article 30 contractual detail or a named EU customer.","limitation_and_notes":"No Article 30 terms, DORA testing commitments or named EU financial institution are given; the only product referenced (Radianz) had by the time of a separate BT page been sold to Transaction Network Services, so it is not confirmed as a current BT-delivered service."},{"id":"src_financial_services_fin_155","workbook_source_id":"FIN-155","url":"https://business.bt.com/insights/case-studies/global-sd-wan/","title":"Global SD-WAN Rollout | Case Studies","publisher":"business.bt.com","publication_date":"2020-05-08","checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"low","record_type":"Named customer case study","requirement_codes":["global_delivery"],"named_customer":null,"segment":"Unspecified","named_product_or_service":"SD-WAN solutions (Cisco Viptela vManage)","service_family":"SD-WAN","estate":"10,000 to 50,000 employees; 85 sites targeted, 65 delivered","countries_or_regions":"Global, multiple regions","ot_or_production_environment":null,"measured_or_stated_outcome":"$15 million savings in operating costs; 65 of 85 sites delivered within just over a year","industrial_standard_or_regulation":null,"regulatory_regime":"Not stated","exact_supporting_wording":"How can a big business move with the agility of a small one?","reviewer_summary":"A named-sector but unnamed-company case study describing a global SD-WAN rollout for a retail and consumer goods multinational, evidencing BT's multi-country SD-WAN delivery capability outside financial services.","limitation_and_notes":"This customer is in retail and consumer goods, not financial services, so it can only support general global-delivery capability, not any financial-services-specific column."},{"id":"src_financial_services_fs_011","workbook_source_id":"FS-011","url":"https://www.globalservices.bt.com/btfederal/digital-industries/financial-services","title":"Financial services | BT","publisher":"globalservices.bt.com","publication_date":null,"checked_date":"2026-07-29","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"high","record_type":"Existing source lead","requirement_codes":["branch_and_office_connectivity"],"named_customer":null,"segment":"Unspecified","named_product_or_service":null,"service_family":"Supporting only","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":null,"regulatory_regime":"Not stated","exact_supporting_wording":"Helping a global financial services company migrate to SD-WAN","reviewer_summary":"Dedicated financial services industry page (#7) listing two network case studies, plus a full SD-WAN case study (#18) stating industry 'Financial services', size 'More than 100,000 employees' and operations in more than 30 countries, delivered with Agile Connect Nuage SD-WAN and BT Managed Fortinet Firewall. The case study title is independently corroborated on BT Ireland's listing (#30). The customer itself is not named, which is the one weakness.","limitation_and_notes":"Supplier's dedicated industry page listing two named network/SD-WAN case studies. | Confirmed - exact match [2026-09-15, capability assigned per Robert's check] Anonymised \"global financial services company\" SD-WAN migration - no institution named."},{"id":"src_financial_services_fs_012","workbook_source_id":"FS-012","url":"https://www.globalservices.bt.com/btfederal/insights/case-studies/helping-a-global-financial-services-company-migrate-to-sd-wan","title":"Helping a global financial services company migrate to SD-WAN | BT","publisher":"globalservices.bt.com","publication_date":null,"checked_date":"2026-07-29","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"high","record_type":"Existing source lead","requirement_codes":["branch_and_office_connectivity","managed_operations_and_soc","global_delivery"],"named_customer":null,"segment":"Unspecified","named_product_or_service":"BT Managed SD-WAN","service_family":"SD-WAN","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":null,"regulatory_regime":"Multiple","exact_supporting_wording":"Helping a global financial services company migrate to SD-WAN","reviewer_summary":"Dedicated financial services industry page (#7) listing two network case studies, plus a full SD-WAN case study (#18) stating industry 'Financial services', size 'More than 100,000 employees' and operations in more than 30 countries, delivered with Agile Connect Nuage SD-WAN and BT Managed Fortinet Firewall. The case study title is independently corroborated on BT Ireland's listing (#30). The customer itself is not named, which is the one weakness.","limitation_and_notes":"Anonymised SD-WAN case study. Customer not named, so weaker than a named reference. | Confirmed - exact match"},{"id":"src_financial_services_fin_142","workbook_source_id":"FIN-142","url":"https://business.bt.com/insights/case-studies/financial-services/","title":"Financial Services | Case Studies | BT Business","publisher":"business.bt.com","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"rejected","reviewer_confidence":"low","record_type":"Financial services solution page","requirement_codes":[],"named_customer":null,"segment":"Multiple","named_product_or_service":"BT Business financial services case studies hub","service_family":"Not relevant","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":null,"regulatory_regime":"Not stated","exact_supporting_wording":"Mobile banking is growing fast - but so is the number of cyber attacks","reviewer_summary":"This is an index page linking to Nationwide, Hello bank! and insurance contact-centre case studies; it does not itself name an SD-WAN or SASE deployment.","limitation_and_notes":"Pure navigation/listing page with no product or capability detail of its own; used only to locate the underlying case studies, which were opened and assessed separately."},{"id":"src_financial_services_fin_143","workbook_source_id":"FIN-143","url":"https://business.bt.com/industries/banking/","title":"Banking Solutions | Digital Transformation For Banks","publisher":"business.bt.com","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"rejected","reviewer_confidence":"low","record_type":"Financial services solution page","requirement_codes":[],"named_customer":"Nationwide Building Society","segment":"Retail banking","named_product_or_service":"BT banking solutions (unnamed connectivity/cloud/cyber security portfolio)","service_family":"Not relevant","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":null,"regulatory_regime":"Not stated","exact_supporting_wording":"We build secure, compliant, and robust systems that safeguard operations and customer trust.","reviewer_summary":"A generic banking industry marketing page referencing an award from Nationwide Building Society, but naming no specific SD-WAN, SASE or firewall product.","limitation_and_notes":"No named product (SD-WAN/SASE/managed firewall), no regulator named, and the Nationwide reference is an award mention rather than a described deployment; does not meet the named-service test for any column."},{"id":"src_financial_services_fin_145","workbook_source_id":"FIN-145","url":"https://business.bt.com/industries/finance/","title":"Digital Financial Services Solutions | Digital Transformation","publisher":"business.bt.com","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"rejected","reviewer_confidence":"low","record_type":"Financial services solution page","requirement_codes":[],"named_customer":null,"segment":"Multiple","named_product_or_service":"BT financial services portfolio (unnamed)","service_family":"Not relevant","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":null,"regulatory_regime":"Not stated","exact_supporting_wording":"strengthen operational resilience, protect critical services and simplify compliance through secure connectivity, cyber security expertise and cloud-ready networks","reviewer_summary":"A generic financial services landing page describing themes of resilience and compliance without naming SD-WAN, SASE, a firewall product, a regulator or a customer.","limitation_and_notes":"No named product, no named customer, no named regulation; generic marketing language only, so cannot support any column beyond noting the provider targets financial services."},{"id":"src_financial_services_fin_147","workbook_source_id":"FIN-147","url":"https://business.bt.com/insights/financial-services-security-challenges/","title":"Top three security challenges facing financial services | BT Business","publisher":"business.bt.com","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"rejected","reviewer_confidence":"low","record_type":"Financial services solution page","requirement_codes":[],"named_customer":null,"segment":"Multiple","named_product_or_service":"BT threat intelligence, managed firewall, managed DDoS protection, managed cloud security","service_family":"Supporting only","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":null,"regulatory_regime":"UK","exact_supporting_wording":"5,857 cyber security incident reports from financial businesses in 2020","reviewer_summary":"A thought-leadership article on ransomware, DDoS and tech complexity in financial services, citing an FCA incident-report statistic, but not naming SD-WAN, SASE or a specific customer.","limitation_and_notes":"FCA is mentioned only as a source of a general statistic, not as a compliance statement about a named BT service; no SD-WAN/SASE/firewall product is named."},{"id":"src_financial_services_fin_150","workbook_source_id":"FIN-150","url":"https://business.bt.com/help/article/email-security-and-hosting/online-safety-and-security/security-assurance-and-compliance/","title":"BT's Security Assurance and Compliance | BT Business","publisher":"business.bt.com","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"rejected","reviewer_confidence":"low","record_type":"Compliance attestation or statement","requirement_codes":[],"named_customer":null,"segment":"Not applicable","named_product_or_service":"BT products (general)","service_family":"Not relevant","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":"SOC 2","regulatory_regime":"Not stated","exact_supporting_wording":"Service Providers that achieve their Attestation (SOC2 Report) have undertaken a thorough examination of their security controls and have demonstrated compliance to the Trust Principles within the SSAE Standard.","reviewer_summary":"A general BT Business help article stating that BT's assurance practices reference ISO, SOC and NIST standards and that a SOC 2 report is available to customers under NDA, without naming SD-WAN or SASE.","limitation_and_notes":"This is a generic corporate compliance statement not tied to the named SD-WAN/SASE/firewall service, and gives no encryption, retention, residency or incident-notification detail, so it does not meet the named-service test for any column."},{"id":"src_financial_services_fin_151","workbook_source_id":"FIN-151","url":"https://business.bt.com/insights/case-studies/hello-bank/","title":"BT and Hello bank! | Case Studies | BT Business","publisher":"business.bt.com","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"rejected","reviewer_confidence":"low","record_type":"Named customer case study","requirement_codes":[],"named_customer":"Hello bank! (BNP Paribas Czech branch)","segment":"Retail banking","named_product_or_service":"BT Personalised Video from Idomoo","service_family":"Not relevant","estate":"Around 50,000 clients addressed by the welcome video campaign","countries_or_regions":"Czech Republic (Hello bank! operates across 6 European countries)","ot_or_production_environment":null,"measured_or_stated_outcome":"Approximately 60% email open rates and improved new-customer NPS","industrial_standard_or_regulation":null,"regulatory_regime":"EU","exact_supporting_wording":"Almost 50,000 clients have been addressed by the welcome video campaign","reviewer_summary":"A named-bank case study about a personalised video onboarding product, unrelated to SD-WAN, SASE or network security.","limitation_and_notes":"The named service is a customer-communications video product, not SD-WAN/SASE/managed firewall, so it does not support any of the 28 network/security/regulatory columns."},{"id":"src_financial_services_fin_153","workbook_source_id":"FIN-153","url":"https://business.bt.com/insights/case-studies/insurance-company-contact-centre/","title":"Insurance Company Contact Centre | Case Studies","publisher":"business.bt.com","publication_date":"2023-12-19","checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"rejected","reviewer_confidence":"low","record_type":"Other","requirement_codes":[],"named_customer":null,"segment":"Insurance","named_product_or_service":"Unclear (page content could not be distinguished from the case studies hub listing)","service_family":"Not relevant","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":null,"regulatory_regime":"Not stated","exact_supporting_wording":null,"reviewer_summary":"The page appears to be an insurance-sector contact-centre case study but the fetched content returned only the case studies hub listing rather than page-specific detail.","limitation_and_notes":"Could not verify page-specific content (product named, scale, outcomes); on its face it concerns a contact-centre migration, not SD-WAN/SASE, so it is unlikely to support any of the 28 columns even if re-fetched."},{"id":"src_financial_services_fin_156","workbook_source_id":"FIN-156","url":"https://business.bt.com/overlay-networks-cloud/digital-services/radianz-for-finance/","title":"Radianz Financial Solutions | Financial Services Solutions","publisher":"business.bt.com","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"rejected","reviewer_confidence":"high","record_type":"Contradiction","requirement_codes":[],"named_customer":null,"segment":"Multiple","named_product_or_service":"Radianz","service_family":"Not relevant","estate":null,"countries_or_regions":"Over 60 countries and 40 data centres (historic description)","ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":null,"regulatory_regime":"Not stated","exact_supporting_wording":"Radianz has a long track record of supporting mission-critical financial communications. Joining TNS brings complementary strengths and continued investment for customers.","reviewer_summary":"BT's own page confirms that its Radianz financial extranet business has been sold to Transaction Network Services (TNS) and is no longer a current BT-delivered product.","limitation_and_notes":"Radianz is confirmed divested to TNS, so it cannot be used as evidence of a current BT financial services network product, and it contradicts using Radianz as live BT evidence elsewhere (e.g. the DORA article)."},{"id":"src_financial_services_fs_013","workbook_source_id":"FS-013","url":"https://www.btireland.com/insights-resources/case-studies","title":"Case Studies - BT Ireland","publisher":"btireland.com","publication_date":null,"checked_date":"2026-07-29","source_ownership":"provider_authored","decision":"rejected","reviewer_confidence":"high","record_type":"Existing source lead","requirement_codes":[],"named_customer":null,"segment":"To review","named_product_or_service":null,"service_family":"Supporting only","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":null,"regulatory_regime":null,"exact_supporting_wording":"Helping a global financial services company migrate to SD-WAN","reviewer_summary":"Dedicated financial services industry page (#7) listing two network case studies, plus a full SD-WAN case study (#18) stating industry 'Financial services', size 'More than 100,000 employees' and operations in more than 30 countries, delivered with Agile Connect Nuage SD-WAN and BT Managed Fortinet Firewall. The case study title is independently corroborated on BT Ireland's listing (#30). The customer itself is not named, which is the one weakness.","limitation_and_notes":"Supplier's Ireland property. Corroborates the SD-WAN financial services case study title and Ireland presence. | Not found on page"}]},{"slug":"att","name":"AT&T Business","marketplace_url":"https://netify.co.uk/marketplace/att/","research_status":"complete","overall_confidence":"medium","fit_conclusion":"AT&T Business has one clearly evidenced financial services deployment: COCC, a US core banking technology provider serving over 150 community banks and credit unions, runs AT&T SD-WAN with VeloCloud with stated automatic failover, micro-segmentation, end-to-end encryption and PCI-DSS compliance support, and a 75% cut in network downtime. This evidence is US-only and product-level compliance documentation (SOC 1/SOC 2, ISO 22301, PCI-DSS AoC) names specific SD-WAN service variants, but none of it is tied to UK FCA/PRA, EU DORA, Canadian OSFI or detailed US FFIEC/GLBA/NYDFS rules for any financial customer. The SASE and SASE-with-Fortinet material is generic product documentation with no named financial customer. The main limitation is the absence of any UK or EU financial services case, any named trading or capital markets customer, and any documented data residency, log retention period or subcontractor list for the SD-WAN/SASE services.","gaps_and_unknowns":"No evidence was found for UK FCA/PRA alignment, EU DORA alignment, Canadian OSFI alignment, SWIFT CSP alignment, third-party/outsourced access controls, change control and configuration governance, exit and portability, subcontractor transparency, or data residency; closing these would require named UK/EU/Canadian financial services case studies or AT&T compliance statements that explicitly reference those regimes and the SD-WAN/SASE service, plus a published data residency and subcontractor disclosure document. Trading/low-latency, remote workforce and data-centre/cloud connectivity are only supported by generic industry-survey material rather than a named institution.","reviewed_by":"Harry Yelland","reviewed_date":"2026-09-14","source_count":15,"accepted_source_count":9,"requirements":[{"code":"branch_and_office_connectivity","label":"Branch and office connectivity","state":"proven","evidence_source_ids":["src_financial_services_fs_008","src_financial_services_fin_115"],"verified_date":"2026-09-14"},{"code":"trading_and_low_latency_connectivity","label":"Trading and low-latency connectivity","state":"partial","evidence_source_ids":["src_financial_services_fin_121"],"verified_date":"2026-09-14"},{"code":"data_centre_colocation_and_cloud_connectivity","label":"Data-centre, colocation and cloud connectivity","state":"partial","evidence_source_ids":["src_financial_services_fin_124"],"verified_date":"2026-09-14"},{"code":"resilience_and_tested_recovery","label":"Resilience and tested recovery","state":"proven","evidence_source_ids":["src_financial_services_fs_008","src_financial_services_fin_115","src_financial_services_fin_117","src_financial_services_fin_538"],"verified_date":"2026-09-14"},{"code":"network_segmentation_and_zoning","label":"Network segmentation and zoning","state":"proven","evidence_source_ids":["src_financial_services_fin_115","src_financial_services_fin_119"],"verified_date":"2026-09-14"},{"code":"payment_and_cardholder_data_segmentation","label":"Payment and cardholder data segmentation","state":"proven","evidence_source_ids":["src_financial_services_fin_115"],"verified_date":"2026-09-14"},{"code":"third_party_and_outsourced_access","label":"Third-party and outsourced access","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"remote_and_hybrid_workforce","label":"Remote and hybrid workforce","state":"partial","evidence_source_ids":["src_financial_services_fin_121"],"verified_date":"2026-09-14"},{"code":"data_residency_and_sovereignty","label":"Data residency and sovereignty","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"encryption_and_key_management","label":"Encryption and key management","state":"proven","evidence_source_ids":["src_financial_services_fin_115","src_financial_services_fin_120"],"verified_date":"2026-09-14"},{"code":"logging_audit_and_evidence_retention","label":"Logging, audit and evidence retention","state":"partial","evidence_source_ids":["src_financial_services_fin_120"],"verified_date":"2026-09-14"},{"code":"identity_and_zero_trust_access","label":"Identity and zero trust access","state":"partial","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"cloud_and_saas_data_controls","label":"Cloud and SaaS data controls","state":"partial","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"managed_operations_and_soc","label":"Managed operations and SOC","state":"proven","evidence_source_ids":["src_financial_services_fin_117","src_financial_services_fin_119","src_financial_services_fin_120","src_financial_services_fin_538"],"verified_date":"2026-09-14"},{"code":"network_visibility_and_reporting","label":"Network visibility and reporting","state":"partial","evidence_source_ids":["src_financial_services_fin_117"],"verified_date":"2026-09-14"},{"code":"change_control_and_configuration_governance","label":"Change control and configuration governance","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"incident_notification_support","label":"Incident notification support","state":"partial","evidence_source_ids":["src_financial_services_fin_120"],"verified_date":"2026-09-14"},{"code":"concentration_risk_and_subcontractor_transparency","label":"Concentration risk and subcontractor transparency","state":"not_found","evidence_source_ids":["src_financial_services_fin_120"],"verified_date":"2026-09-14"},{"code":"exit_and_portability","label":"Exit and portability","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"uk_regulatory_alignment_fca_and_pra","label":"UK regulatory alignment (FCA and PRA)","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"eu_dora_alignment","label":"EU DORA alignment","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"us_regulatory_alignment_ffiec_glba_nydfs_sec","label":"US regulatory alignment (FFIEC, GLBA, NYDFS, SEC)","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"canada_regulatory_alignment_osfi","label":"Canada regulatory alignment (OSFI)","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"pci_dss_alignment","label":"PCI DSS alignment","state":"proven","evidence_source_ids":["src_financial_services_fin_115","src_financial_services_fin_120","src_financial_services_fin_120"],"verified_date":"2026-09-14"},{"code":"swift_csp_alignment","label":"SWIFT CSP alignment","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"uk_delivery","label":"UK delivery","state":"not_found","evidence_source_ids":["src_financial_services_fin_124"],"verified_date":"2026-09-14"},{"code":"north_america_delivery","label":"North America delivery","state":"partial","evidence_source_ids":["src_financial_services_fin_124"],"verified_date":"2026-09-14"},{"code":"global_delivery","label":"Global delivery","state":"partial","evidence_source_ids":["src_financial_services_fin_124"],"verified_date":"2026-09-14"}],"sources":[{"id":"src_financial_services_fs_008","workbook_source_id":"FIN-114","url":"https://www.business.att.com/learn/customer-stories/cocc.html","title":"Software Defined Wide Area Network (SD-WAN) Customer Story For COCC at AT&T","publisher":"business.att.com","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"high","record_type":"Named customer case study","requirement_codes":["branch_and_office_connectivity","resilience_and_tested_recovery"],"named_customer":"COCC","segment":"Building society or credit union","named_product_or_service":"AT&T SD-WAN with VeloCloud","service_family":"SD-WAN","estate":null,"countries_or_regions":"United States","ot_or_production_environment":null,"measured_or_stated_outcome":"Enhanced network security, reliability and performance while helping reduce costs","industrial_standard_or_regulation":null,"regulatory_regime":"US","exact_supporting_wording":"COCC today serves more than 150 community banks and credit unions and is the sixth largest core banking solutions provider in the U.S.","reviewer_summary":"AT&T's SD-WAN with VeloCloud is deployed by COCC, a core banking technology provider serving over 150 community banks and credit unions in the US, to give automatic failover and improved network reliability.","limitation_and_notes":"Does not name individual banks or credit unions, does not mention trading/low-latency, cloud on-ramps, PCI scope, or any regulatory regime; no branch/user counts given."},{"id":"src_financial_services_fin_115","workbook_source_id":"FIN-115","url":"https://www.business.att.com/content/dam/attbusiness/customer-stories/att-cocc-customer-story-brief.pdf","title":"CUSTOMER STORIES About COCC (AT&T/COCC customer story brief)","publisher":"business.att.com","publication_date":"2020-03-05","checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"high","record_type":"Named customer case study","requirement_codes":["payment_and_cardholder_data_segmentation","network_segmentation_and_zoning","branch_and_office_connectivity","resilience_and_tested_recovery","encryption_and_key_management","pci_dss_alignment"],"named_customer":"COCC","segment":"Building society or credit union","named_product_or_service":"AT&T SD-WAN with VeloCloud","service_family":"SD-WAN","estate":null,"countries_or_regions":"United States (10 states)","ot_or_production_environment":null,"measured_or_stated_outcome":"75% reduction in downtime for COCC networks; 80% reduction in help desk calls following WAN outages","industrial_standard_or_regulation":"PCI DSS","regulatory_regime":"US","exact_supporting_wording":"75% reduction in downtime for COCC networks","reviewer_summary":"The AT&T/COCC brief states COCC uses micro-segmentation, a centralised firewall and end-to-end encryption on the AT&T SD-WAN with VeloCloud service, with PCI-DSS compliance support, and reports a 75% cut in network downtime and 80% fewer help-desk calls after outages.","limitation_and_notes":"COCC is a core banking technology provider, not itself a bank; PCI-DSS reference is 'compliance assistance', not a formal AoC for the SD-WAN service itself; no RTO/RPO figures, no trading, no UK/EU/Canada content."},{"id":"src_financial_services_fin_117","workbook_source_id":"FIN-117","url":"https://www.business.att.com/products/sd-wan.html","title":"SD-WAN Service Provider - Software Defined Wide Area Network at AT&T Business","publisher":"business.att.com","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"medium","record_type":"Other","requirement_codes":["network_visibility_and_reporting","resilience_and_tested_recovery","managed_operations_and_soc"],"named_customer":null,"segment":"Unspecified","named_product_or_service":"AT&T Managed SD-WAN","service_family":"Managed SD-WAN","estate":null,"countries_or_regions":"150+ countries and territories","ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":null,"regulatory_regime":"Not stated","exact_supporting_wording":"Gain actionable insights into user, network, and application performance","reviewer_summary":"AT&T's SD-WAN product page describes Managed SD-WAN with Cisco, VMware and Aruba, offering dynamic routing across broadband, LTE and MPLS, round-the-clock support, and a single dashboard for visibility, but contains no financial services or regulatory content.","limitation_and_notes":"Generic product page, not financial-services specific; supports generic resilience/visibility/managed-ops claims only, not tied to a named bank or credit union."},{"id":"src_financial_services_fin_118","workbook_source_id":"FIN-118","url":"https://www.business.att.com/products/sase.html","title":"Managed SASE Cybersecurity Network Solution | AT&T Business","publisher":"business.att.com","publication_date":null,"checked_date":"2026-09-15","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"medium","record_type":"Other","requirement_codes":["identity_and_zero_trust_access","cloud_and_saas_data_controls","managed_operations_and_soc"],"named_customer":null,"segment":"Unspecified","named_product_or_service":"AT&T SASE (with Cisco, Palo Alto Networks)","service_family":"SASE","estate":null,"countries_or_regions":"Not stated","ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":null,"regulatory_regime":"Not stated","exact_supporting_wording":"Reduce risk of breaches and enforce strict identity verification regardless of location.","reviewer_summary":"AT&T's SASE product page describes AT&T Managed SASE with Cisco and Palo Alto Networks, covering ZTNA, CASB, secure web gateway and firewall-as-a-service, managed by AT&T, with no financial services or regulatory content and no mention of Fortinet on this page.","limitation_and_notes":"Quoted wording not found on the page in the 2026-09-12 check (Page loaded and has a 'Managed by AT&T security experts' heading but the quoted sentence text was not found verbatim; model returned an unrelated sentence from ). Re-quote before accepting. Generic product page, not financial-services specific; no named customer; Fortinet variant not shown on this page (found via a separate solution brief). [2026-09-15 Harry review] Verified live 2026-09-15 at business.att.com/products/sase.html. Re-quoted verbatim. Generic product page, no named financial customer, so Identity and zero trust access is Partial not Proven. Cloud and SaaS data controls and Managed operations and SOC dropped - no exact matching text found for either on this page."},{"id":"src_financial_services_fin_119","workbook_source_id":"FIN-119","url":"https://www.business.att.com/content/dam/attbusiness/briefs/att-sase-branch-with-fortinet-solution-brief.pdf","title":"AT&T SASE Branch with Fortinet solution brief","publisher":"business.att.com","publication_date":"2022-09-22","checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"medium","record_type":"Other","requirement_codes":["network_segmentation_and_zoning","managed_operations_and_soc"],"named_customer":null,"segment":"Unspecified","named_product_or_service":"AT&T SASE Branch with Fortinet","service_family":"SASE","estate":null,"countries_or_regions":"Not stated","ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":null,"regulatory_regime":"Not stated","exact_supporting_wording":"Highly scalable overlay VPN tunnels with high throughput to encrypt traffic","reviewer_summary":"This solution brief describes AT&T SASE Branch with Fortinet, covering encrypted overlay VPN tunnels, granular branch segmentation via Fortinet switches, and 24/7 monitoring from AT&T's Security Network Operations Center, with no financial services content.","limitation_and_notes":"Generic solution brief, no financial services customer or regulatory mention; does not name ZTNA, CASB or DLP on this document."},{"id":"src_financial_services_fin_121","workbook_source_id":"FIN-121","url":"https://www.business.att.com/content/dam/attbusiness/reports/transforming-the-network-in-financial-services-report.pdf","title":"Transforming the Network in Financial Services (Fall 2022)","publisher":"business.att.com","publication_date":"2022-09-01","checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"medium","record_type":"Financial services solution page","requirement_codes":["trading_and_low_latency_connectivity","remote_and_hybrid_workforce"],"named_customer":null,"segment":"Multiple","named_product_or_service":"SD-WAN; SASE; edge technology","service_family":"Multiple","estate":null,"countries_or_regions":"Not stated","ot_or_production_environment":null,"measured_or_stated_outcome":"54% of surveyed financial services companies currently use SD-WAN; edge technology can reduce latency to under 6 milliseconds","industrial_standard_or_regulation":null,"regulatory_regime":"Not stated","exact_supporting_wording":"Data compliance and security should always take precedence.","reviewer_summary":"This AT&T-sponsored financial services report cites industry survey data on SD-WAN and SASE adoption and notes that edge technology can cut trading latency to under 6 milliseconds and that 74% of respondents found adapting networks for hybrid work their biggest challenge, but it names no institution and no regulatory regime.","limitation_and_notes":"Industry survey report, not a named customer deployment; low-latency and remote-work statistics are sector-wide survey findings, not evidence that a named institution runs AT&T's service for trading or remote staff."},{"id":"src_financial_services_fin_124","workbook_source_id":"FIN-124","url":"https://www.business.att.com/industries/att-global-business.html","title":"AT&T Global Business Services | Internet Connectivity, Networking & Wireless","publisher":"business.att.com","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"medium","record_type":"Other","requirement_codes":["data_centre_colocation_and_cloud_connectivity","north_america_delivery","global_delivery","uk_delivery"],"named_customer":null,"segment":"Unspecified","named_product_or_service":"AT&T Global Business connectivity, colocation ecosystem","service_family":"Supporting only","estate":null,"countries_or_regions":"200 countries and territories; Canada since 1980; EMEA; APAC; Latin America and Caribbean","ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":null,"regulatory_regime":"Not stated","exact_supporting_wording":"800+ datacenters in our global colocation ecosystem","reviewer_summary":"AT&T's global business page states it offers Ethernet and internet connectivity in 200 countries and territories, over 800 data centres in its colocation ecosystem, and a presence in Canada since 1980 and EMEA/APAC/Latin America, and names 'financial services' generically as a served sector with 'secure, reliable connectivity for banking and payments'.","limitation_and_notes":"Financial services mention is a one-line generic sector tag, not tied to SD-WAN or SASE, and names no bank; UK is not separately itemised outside EMEA; no named FS customer for any region."},{"id":"src_financial_services_fin_120","workbook_source_id":"FIN-518","url":"https://www.business.att.com/content/dam/attbusiness/guides/att-information-and-network-security-customer-reference-guide.pdf","title":"AT&T Information & Network Security Customer Reference Guide, April 2026 v8.0","publisher":"business.att.com","publication_date":"2026-04-01","checked_date":"2026-09-15","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"medium","record_type":"Compliance attestation or statement","requirement_codes":["managed_operations_and_soc","pci_dss_alignment"],"named_customer":null,"segment":"Unspecified","named_product_or_service":"AT&T managed network / SD-WAN service families","service_family":"Supporting only","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":"PCI DSS; SOC 2; ISO 27001; SSAE 18/ISAE 3402","regulatory_regime":null,"exact_supporting_wording":"References SOC reporting, PCI DSS reporting, ISO 27001, and SSAE 18/ISAE 3402 assurance across managed network/SD-WAN service families.","reviewer_summary":"Harry personally verified this live 2026-09-15. Covers managed network/SD-WAN service families generally rather than naming AT&T's specific SASE product by name with a scoped AoC - graded Partial, consistent with the caution that the exact SD-WAN variant on any AoC needs separate confirmation.","limitation_and_notes":"Added 2026-09-15, Harry-verified. Family-level assurance document, not confirmed scoped to AT&T's SASE product specifically."},{"id":"src_financial_services_fin_538","workbook_source_id":"FIN-538","url":"https://about.att.com/blogs/2026/wellby-financial.html","title":"Wellby Financial's Path to Modernizing Its Security Foundation with AT&T Business and Palo Alto Networks","publisher":"about.att.com","publication_date":"2026-07-29","checked_date":"2026-09-15","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"medium","record_type":"Named customer case study","requirement_codes":["resilience_and_tested_recovery","managed_operations_and_soc"],"named_customer":"Wellby Financial","segment":"Building society or credit union","named_product_or_service":"AT&T Dynamic Defense with Palo Alto Networks (Prisma Access)","service_family":"SASE","estate":null,"countries_or_regions":"United States (Houston, Texas)","ot_or_production_environment":null,"measured_or_stated_outcome":"Multi-pathing and redundancy to reduce single points of failure and keep critical access reliable during connection or data centre disruption","industrial_standard_or_regulation":null,"regulatory_regime":"US","exact_supporting_wording":"\"For a financial institution like Wellby Financial, resilience goes beyond IT priority. It is a business imperative... To advance their cybersecurity and resilience strategy, Wellby turned to AT&T Dynamic Defense with Palo Alto Networks - the first-and-only comprehensive network security solution with threat protection integrated directly into AT&T's global network infrastructure, enhanced by best-in-class capabilities from Palo Alto Networks Prisma Access.\"","reviewer_summary":"Verified live 2026-09-15. Wellby Financial is a real, named Houston-based credit union. Recent article (July 2026). No named executive quote or quantified outcome, but the deployment and named product are specific and real.","limitation_and_notes":"Added 2026-09-15 per further research pass (cross-platform lead, independently verified). No quantified outcome or named executive quote; no specific US regulator named. Automated access returned HTTP 403 on 2026-09-15. Retain as supporting evidence, but do not rely on it as the sole publicly citable source."},{"id":"src_financial_services_fs_010","workbook_source_id":"FIN-116","url":"https://www.business.att.com/industries/finance.html","title":"Financial Technology & Security Solutions at AT&T Business","publisher":"business.att.com","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"rejected","reviewer_confidence":"medium","record_type":"Financial services solution page","requirement_codes":[],"named_customer":null,"segment":"Multiple","named_product_or_service":"AT&T Managed SASE; AT&T Dynamic Defense; AT&T SD-WAN","service_family":"Multiple","estate":null,"countries_or_regions":"Not stated","ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":null,"regulatory_regime":"Not stated","exact_supporting_wording":"Better protect data with a multi-layered approach","reviewer_summary":"AT&T's financial services industry page lists Managed SASE, Dynamic Defense and SD-WAN as relevant products and names Patelco Credit Union as a customer for a digital signage solution, but names no bank or credit union customer for SD-WAN or SASE and cites no regulatory regime.","limitation_and_notes":"Generic financial services solutions page with no named SD-WAN/SASE deployment and no regulatory regime named; cannot support any Proven column, only used as background/context."},{"id":"src_financial_services_fin_122","workbook_source_id":"FIN-122","url":"https://www.business.att.com/learn/customer-stories/patelco-credit-union.html","title":"Networking & Wireless Broadband Customer Story For Patelco - AT&T Business","publisher":"business.att.com","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"rejected","reviewer_confidence":"medium","record_type":"Named customer case study","requirement_codes":[],"named_customer":"Patelco Credit Union","segment":"Building society or credit union","named_product_or_service":"AT&T Wireless Broadband and digital signage/consulting integration","service_family":"Not relevant","estate":null,"countries_or_regions":"United States","ot_or_production_environment":null,"measured_or_stated_outcome":"Remote monitoring tools help ensure uptime and avoid branch involvement in troubleshooting","industrial_standard_or_regulation":null,"regulatory_regime":"US","exact_supporting_wording":"help ensure uptime and avoid branch involvement in troubleshooting","reviewer_summary":"Patelco Credit Union, a US credit union with 350,000 members, uses AT&T wireless broadband and consulting/integration services for branch digital signage, not SD-WAN or SASE.","limitation_and_notes":"Does not name AT&T SD-WAN, SASE or Managed SD-WAN; the service described is wireless broadband for digital signage, out of scope for this brief's product requirement."}]},{"slug":"cisco","name":"Cisco","marketplace_url":"https://netify.co.uk/marketplace/cisco/","research_status":"complete","overall_confidence":"medium","fit_conclusion":"The strongest named evidence is BBVA Argentina's deployment of Cisco Catalyst SD-WAN, SD-Access, Catalyst Center and ISE across 245 branches, which proves branch connectivity, identity based segmentation, network visibility and configuration automation for a retail bank, though this deployment is in Argentina and gives no UK or North America delivery evidence. Cisco's own documentation proves FIPS 140-3 validated encryption for Catalyst SD-WAN and a PCI DSS 3.2.1 Attestation of Compliance for Catalyst SD-WAN Cloud as a Level 1 service provider, both at the product documentation level rather than tied to a named customer. No evidence was found connecting the named products to FCA and PRA operational resilience rules, EU DORA, US FFIEC, GLBA, NYDFS or SEC rules, Canadian OSFI guidance, or SWIFT CSP. Data residency, log retention, incident notification and subcontractor transparency for the named services were also not found on the pages opened. Overall this is reasonable evidence of a technical branch deployment and of product level compliance certification, but weak evidence of regime specific regulatory alignment or of delivery in the UK and North America for financial services customers specifically.","gaps_and_unknowns":"No UK or North American named financial institution using Catalyst SD-WAN, Secure Access, Meraki SD-WAN or Secure Connect was found, leaving UK delivery and North America delivery unproven; a named UK or North American FS case study would close this. FCA and PRA, DORA, FFIEC/GLBA/NYDFS/SEC and OSFI alignment are all unproven and would need a Cisco compliance statement or named FS case explicitly referencing those regimes, not just generic certifications. Log retention periods, a published subcontractor or sub-processor list, and incident notification timelines specific to Secure Access or Catalyst SD-WAN were not located on the pages opened. Trading floor or low-latency connectivity, cardholder data segmentation, third-party and outsourced access controls, and a named FS customer with 24x7 managed SOC would also close remaining gaps.","reviewed_by":"Harry Yelland","reviewed_date":"2026-09-14","source_count":15,"accepted_source_count":12,"requirements":[{"code":"branch_and_office_connectivity","label":"Branch and office connectivity","state":"proven","evidence_source_ids":["src_financial_services_fs_020","src_financial_services_fs_020"],"verified_date":"2026-09-14"},{"code":"trading_and_low_latency_connectivity","label":"Trading and low-latency connectivity","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"data_centre_colocation_and_cloud_connectivity","label":"Data-centre, colocation and cloud connectivity","state":"partial","evidence_source_ids":["src_financial_services_fs_020"],"verified_date":"2026-09-14"},{"code":"resilience_and_tested_recovery","label":"Resilience and tested recovery","state":"partial","evidence_source_ids":["src_financial_services_fin_189"],"verified_date":"2026-09-14"},{"code":"network_segmentation_and_zoning","label":"Network segmentation and zoning","state":"proven","evidence_source_ids":["src_financial_services_fs_020","src_financial_services_fs_020"],"verified_date":"2026-09-14"},{"code":"payment_and_cardholder_data_segmentation","label":"Payment and cardholder data segmentation","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"third_party_and_outsourced_access","label":"Third-party and outsourced access","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"remote_and_hybrid_workforce","label":"Remote and hybrid workforce","state":"partial","evidence_source_ids":["src_financial_services_fin_186"],"verified_date":"2026-09-14"},{"code":"data_residency_and_sovereignty","label":"Data residency and sovereignty","state":"partial","evidence_source_ids":["src_financial_services_fin_183"],"verified_date":"2026-09-14"},{"code":"encryption_and_key_management","label":"Encryption and key management","state":"proven","evidence_source_ids":["src_financial_services_fin_181"],"verified_date":"2026-09-14"},{"code":"logging_audit_and_evidence_retention","label":"Logging, audit and evidence retention","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"identity_and_zero_trust_access","label":"Identity and zero trust access","state":"proven","evidence_source_ids":["src_financial_services_fs_020","src_financial_services_fs_020"],"verified_date":"2026-09-14"},{"code":"cloud_and_saas_data_controls","label":"Cloud and SaaS data controls","state":"partial","evidence_source_ids":["src_financial_services_fin_184","src_financial_services_fin_186"],"verified_date":"2026-09-14"},{"code":"managed_operations_and_soc","label":"Managed operations and SOC","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"network_visibility_and_reporting","label":"Network visibility and reporting","state":"proven","evidence_source_ids":["src_financial_services_fs_020"],"verified_date":"2026-09-14"},{"code":"change_control_and_configuration_governance","label":"Change control and configuration governance","state":"proven","evidence_source_ids":["src_financial_services_fs_020","src_financial_services_fs_020"],"verified_date":"2026-09-14"},{"code":"incident_notification_support","label":"Incident notification support","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"concentration_risk_and_subcontractor_transparency","label":"Concentration risk and subcontractor transparency","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"exit_and_portability","label":"Exit and portability","state":"partial","evidence_source_ids":["src_financial_services_fin_188"],"verified_date":"2026-09-14"},{"code":"uk_regulatory_alignment_fca_and_pra","label":"UK regulatory alignment (FCA and PRA)","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"eu_dora_alignment","label":"EU DORA alignment","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"us_regulatory_alignment_ffiec_glba_nydfs_sec","label":"US regulatory alignment (FFIEC, GLBA, NYDFS, SEC)","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"canada_regulatory_alignment_osfi","label":"Canada regulatory alignment (OSFI)","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"pci_dss_alignment","label":"PCI DSS alignment","state":"proven","evidence_source_ids":["src_financial_services_fin_182","src_financial_services_fin_513"],"verified_date":"2026-09-14"},{"code":"swift_csp_alignment","label":"SWIFT CSP alignment","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"uk_delivery","label":"UK delivery","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"north_america_delivery","label":"North America delivery","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"global_delivery","label":"Global delivery","state":"partial","evidence_source_ids":["src_financial_services_fs_020"],"verified_date":"2026-09-14"}],"sources":[{"id":"src_financial_services_fs_020","workbook_source_id":"FIN-180","url":"https://www.cisco.com/site/us/en/about/case-studies-customer-stories/bbva.html","title":"BBVA Banks on Secure, Agile Operations (Cisco case study)","publisher":"cisco.com","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"medium","record_type":"Named customer case study","requirement_codes":["data_centre_colocation_and_cloud_connectivity","change_control_and_configuration_governance","network_visibility_and_reporting","network_segmentation_and_zoning","branch_and_office_connectivity","identity_and_zero_trust_access","global_delivery"],"named_customer":"BBVA Argentina","segment":"Retail banking","named_product_or_service":"Cisco SD-Access, Cisco Catalyst SD-WAN, Cisco Catalyst Center, Cisco ISE, Cisco ACI","service_family":"Multiple","estate":"245 branches across Argentina plus a main campus in Buenos Aires","countries_or_regions":"Argentina, described as a reference model being extended to BBVA entities in Colombia, Peru and the wider global group","ot_or_production_environment":null,"measured_or_stated_outcome":"Release windows cut by over 75%; switch deployment time reduced from three months to three weeks; new switches join the fabric automatically within minutes","industrial_standard_or_regulation":null,"regulatory_regime":"Not stated","exact_supporting_wording":"With Cisco SD-Access, access policies follow the user, regardless of where they connect. That means consistent security, simplified segmentation, and seamless mobility without the IT headaches.","reviewer_summary":"BBVA Argentina deployed Cisco SD-Access, Catalyst Center, Catalyst SD-WAN, ISE and ACI across 245 branches, using identity-based micro-segmentation and automated zero-touch provisioning to cut configuration errors and speed up switch deployment.","limitation_and_notes":"Does not mention any financial regulator, PCI or cardholder-data scope, data residency, DR testing, RTO/RPO, or third-party/contractor access controls. The deployment is in Argentina, not the UK or North America, so it cannot support the UK or North America delivery columns."},{"id":"src_financial_services_fin_181","workbook_source_id":"FIN-181","url":"https://www.cisco.com/c/dam/en_us/solutions/industries/government/security_certification/pdfs/cisco-catalyst-sd-wan-v20-15-fips-140-3-compliance.pdf","title":"Cisco Catalyst SD-WAN v20.15 FIPS 140-3 Compliance","publisher":"cisco.com","publication_date":"2025-07-10","checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"high","record_type":"Compliance attestation or statement","requirement_codes":["encryption_and_key_management"],"named_customer":null,"segment":"Unspecified","named_product_or_service":"Cisco Catalyst SD-WAN Manager, Validator and Controller","service_family":"SD-WAN","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":"FIPS 140-3","regulatory_regime":"Not stated","exact_supporting_wording":"incorporates the following FIPS 140-3 validated cryptographic module: Cisco FIPS Object Module version 7.3a (Certificate #4747)","reviewer_summary":"Cisco Catalyst SD-WAN Manager, Validator and Controller version 20.15 incorporates a FIPS 140-3 validated cryptographic module covering TLS 1.2/1.3, SSHv2, DTLSv1.2 and SNMPv3.","limitation_and_notes":"Covers cryptographic module validation only, not a named financial customer; the document also states the CMVP has not independently evaluated this specific compliance review."},{"id":"src_financial_services_fin_182","workbook_source_id":"FIN-182","url":"https://blogs.cisco.com/networking/cisco-sd-wan-achieves-pci-dss-compliance","title":"Cisco SD-WAN achieves PCI-DSS compliance - Cisco Blogs","publisher":"blogs.cisco.com","publication_date":"2022-02-02","checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"high","record_type":"Compliance attestation or statement","requirement_codes":["pci_dss_alignment"],"named_customer":null,"segment":"Unspecified","named_product_or_service":"Cisco SD-WAN Cloud (vManage, vBond, vSmart controllers)","service_family":"SD-WAN","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":"PCI DSS 3.2.1","regulatory_regime":"Not stated","exact_supporting_wording":"Cisco SD-WAN does not store PCI data","reviewer_summary":"Cisco SD-WAN Cloud achieved a PCI-DSS 3.2.1 Attestation of Compliance as a Level 1 Service Provider, covering the Cisco-hosted vManage, vBond and vSmart controller infrastructure, with the AoC available on request through Cisco's Trust Portal.","limitation_and_notes":"This is Cisco's own infrastructure attestation, not a customer case naming a cardholder data environment segmented with the service; article is from 2022 and does not confirm the certification is current for later PCI DSS versions."},{"id":"src_financial_services_fin_183","workbook_source_id":"FIN-183","url":"https://www.cisco.com/c/en/us/about/trust-center/gdpr.html","title":"Cisco and GDPR - Cisco","publisher":"cisco.com","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"medium","record_type":"Compliance attestation or statement","requirement_codes":["data_residency_and_sovereignty"],"named_customer":null,"segment":"Unspecified","named_product_or_service":"Cisco (corporate data protection programme)","service_family":"Not relevant","estate":null,"countries_or_regions":"EEA, UK, Switzerland (cross-border transfer mechanisms)","ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":"GDPR","regulatory_regime":"EU","exact_supporting_wording":"Cisco's data protection and privacy policies, standards, and related documentation (\"BCR-C\") have been approved by the European data protection supervisory authorities.","reviewer_summary":"Cisco describes Binding Corporate Rules, EU-US Data Privacy Framework certification and a Master Data Protection Agreement as mechanisms for cross-border personal data transfer, at a corporate level rather than for a named SD-WAN or SASE service.","limitation_and_notes":"Describes cross-border transfer legal mechanisms, not the specific regional storage location of Catalyst SD-WAN or Secure Access logs and management-plane data; does not name the SD-WAN or SASE service."},{"id":"src_financial_services_fin_184","workbook_source_id":"FIN-184","url":"https://www.cisco.com/site/us/en/about/case-studies-customer-stories/myinvestor.html","title":"MyInvestor - Cisco","publisher":"cisco.com","publication_date":"2025-07-24","checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"medium","record_type":"Named customer case study","requirement_codes":["cloud_and_saas_data_controls"],"named_customer":"MyInvestor","segment":"Payments and fintech","named_product_or_service":"Cisco Multicloud Defense","service_family":"Supporting only","estate":"Over 300,000 clients; assets under management of 6 billion euros","countries_or_regions":"Spain","ot_or_production_environment":null,"measured_or_stated_outcome":"Full visibility of every incoming and outgoing IP connection at TCP level; no successful attacks reported since deployment; client base has doubled","industrial_standard_or_regulation":"GDPR","regulatory_regime":"EU","exact_supporting_wording":"The fact that we haven't had any successful attacks with Cisco Multicloud Defense matters a lot for any organization, particularly for a bank.","reviewer_summary":"MyInvestor, a Spanish neobank, uses Cisco Multicloud Defense for ingress/egress traffic inspection and centralized policy control across its AWS cloud environment, citing GDPR and financial regulation as drivers.","limitation_and_notes":"Cisco Multicloud Defense is a cloud network security product, not one of the four named SD-WAN/SASE products for this profile, and is not explicitly described as CASB or DLP; GDPR is named but DORA, PCI or other FS-specific regimes are not."},{"id":"src_financial_services_fin_186","workbook_source_id":"FIN-186","url":"https://www.cisco.com/c/en/us/products/collateral/security/secure-access/secure-access-ds.html","title":"Cisco Secure Access Data Sheet - Cisco","publisher":"cisco.com","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"medium","record_type":"Other","requirement_codes":["cloud_and_saas_data_controls","remote_and_hybrid_workforce"],"named_customer":null,"segment":"Unspecified","named_product_or_service":"Cisco Secure Access","service_family":"SSE","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":null,"regulatory_regime":"Not stated","exact_supporting_wording":"Deny access by default and grant only the appropriate, granular access as dictated by policy.","reviewer_summary":"The Secure Access data sheet describes ZTNA private application access, VPN-as-a-service for remote users, SAML-based identity provider integration, and CASB/DLP features including detection of generative AI app usage.","limitation_and_notes":"Generic product data sheet with no named financial institution and no FS-specific context, so per the grading rules this supports remote workforce and cloud data control columns only as Partial evidence, not Proven."},{"id":"src_financial_services_fin_187","workbook_source_id":"FIN-187","url":"https://www.cisco.com/site/us/en/solutions/industries/financial-services/index.html","title":"Cisco Financial Services Solutions - Cisco","publisher":"cisco.com","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"medium","record_type":"Financial services solution page","requirement_codes":["network_visibility_and_reporting"],"named_customer":null,"segment":"Multiple","named_product_or_service":"Cisco (financial services portfolio, unspecified)","service_family":"Not relevant","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":null,"regulatory_regime":"Not stated","exact_supporting_wording":"Gained consistent visibility and control of its public cloud to protect over 300,000 customers from threats","reviewer_summary":"This is a directory-style financial services landing page linking to the NatWest, Umpqua Bank and MyInvestor customer stories and to a Cisco-AWS financial services partnership brief that references DORA in its title.","limitation_and_notes":"Does not itself name Catalyst SD-WAN, Secure Access, Meraki SD-WAN or Secure Connect against any of the 28 columns; the DORA-titled brief it links to is a Cisco-AWS partnership page, not a Cisco compliance statement naming a specific SD-WAN or SASE service. [2026-09-15, capability assigned per Robert's check - WEAK FIT, flagged for review] Customer-count marketing claim (\"300,000 customers... public cloud\"), no institution named. Weak fit."},{"id":"src_financial_services_fin_188","workbook_source_id":"FIN-188","url":"https://www.cisco.com/c/dam/en_us/about/doing_business/legal/supplemental-terms/Data-Access-Supplemental-Terms.pdf","title":"Data Access Terms - Cisco","publisher":"cisco.com","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"medium","record_type":"Compliance attestation or statement","requirement_codes":["exit_and_portability"],"named_customer":null,"segment":"Unspecified","named_product_or_service":"Cisco (general commercial data access terms)","service_family":"Not relevant","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":null,"regulatory_regime":"Not stated","exact_supporting_wording":"Cisco will provide the Requested Data to You without undue delay, free of charge, and in a structured, commonly used, and machine-readable format.","reviewer_summary":"Cisco's general Data Access Supplemental Terms commit to providing a customer's requested data in a structured, machine-readable format on request.","limitation_and_notes":"A general Cisco commercial term applying across Cisco offers, not stated specifically for Catalyst SD-WAN or Secure Access, and does not describe termination/exit assistance procedures."},{"id":"src_financial_services_fin_189","workbook_source_id":"FIN-189","url":"https://www.cisco.com/c/dam/en_us/about/doing_business/legal/OfferDescriptions/Cisco-Catalyst-SD-WAN.pdf","title":"Offer Description - Cisco Catalyst SD-WAN","publisher":"cisco.com","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"medium","record_type":"Compliance attestation or statement","requirement_codes":["resilience_and_tested_recovery"],"named_customer":null,"segment":"Unspecified","named_product_or_service":"Cisco Catalyst SD-WAN","service_family":"SD-WAN","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":null,"regulatory_regime":"Not stated","exact_supporting_wording":"The Cloud Service is subject to the Cisco Catalyst SD-WAN Service Level Agreement.","reviewer_summary":"The Catalyst SD-WAN offer description confirms the cloud service is covered by a separate named SLA document but does not itself state uptime percentages or RTO/RPO commitments.","limitation_and_notes":"Confirms an SLA exists for the named service but the actual SLA document with uptime and recovery commitments was not opened, so no specific resilience figures or FS customer outcome are proven."},{"id":"src_financial_services_fin_190","workbook_source_id":"FIN-190","url":"https://www.cisco.com/site/us/en/products/security/secure-access/compliance.html","title":"Cisco Secure Access Compliance - Cisco","publisher":"cisco.com","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"medium","record_type":"Compliance attestation or statement","requirement_codes":["logging_audit_and_evidence_retention"],"named_customer":null,"segment":"Unspecified","named_product_or_service":"Cisco Secure Access","service_family":"SSE","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":"SOC 2 Type II","regulatory_regime":"Not stated","exact_supporting_wording":"An AICPA audit framework assessing security, availability, and confidentiality controls","reviewer_summary":"Cisco Secure Access lists SOC 2 Type 2, ISO 27001/27017/27018, CSA STAR and FedRAMP as certified, with PCI-DSS shown as available on request, plus several regional government certifications.","limitation_and_notes":"A generic certification list with no named financial customer and no specific facts (retention periods, scope, dates) tied to any single one of the 28 columns, so it is used only as background context and not cited as a status source. [2026-09-15, capability assigned per Robert's check] Describes the AICPA audit framework (SOC 2) underlying Cisco Secure Access compliance."},{"id":"src_financial_services_fin_513","workbook_source_id":"FIN-513","url":"https://trustportal.cisco.com/c/r/ctp/home.html","title":"Cisco Catalyst SD-WAN compliance documentation / Cisco Trust Portal","publisher":"trustportal.cisco.com","publication_date":null,"checked_date":"2026-09-15","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"high","record_type":"Compliance attestation or statement","requirement_codes":["pci_dss_alignment"],"named_customer":null,"segment":"Unspecified","named_product_or_service":"Cisco Catalyst SD-WAN (Trust Portal / compliance documentation)","service_family":"SD-WAN","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":"PCI DSS","regulatory_regime":null,"exact_supporting_wording":"Documentation states Catalyst SD-WAN can provide certifications including PCI DSS, SOC 2 Type II, SOC 3, ISO 27001, ISO 27701, ISO 27017, ISO 27018, delivered via dedicated encrypted, Cisco-hosted compliance-mode fabrics.","reviewer_summary":"Harry personally verified this live 2026-09-15. Names the specific Catalyst SD-WAN service and PCI DSS directly, with a dedicated 'compliance mode' architecture description - a genuine product-level attestation route rather than a generic corporate certification list, so graded Proven for PCI DSS alignment specifically for Catalyst SD-WAN.","limitation_and_notes":"Added 2026-09-15, Harry-verified. Current AoC/report period and exact service SKU were not independently pulled from the Trust Portal itself."},{"id":"src_financial_services_fin_185","workbook_source_id":"FIN-185","url":"https://www.cisco.com/site/us/en/about/case-studies-customer-stories/natwest.html","title":"Natwest Case Study - Cisco","publisher":"cisco.com","publication_date":"2025-08-12","checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"rejected","reviewer_confidence":"high","record_type":"Named customer case study","requirement_codes":[],"named_customer":"NatWest","segment":"Retail banking","named_product_or_service":"Cisco Takeback and Reuse Program","service_family":"Not relevant","estate":null,"countries_or_regions":"UK","ot_or_production_environment":null,"measured_or_stated_outcome":"3,000+ devices (100 tons) recycled in the first 18 months of the programme","industrial_standard_or_regulation":null,"regulatory_regime":"Not stated","exact_supporting_wording":"As an IT team, we've become a lot more conscious of the environmental impact of our decisions.","reviewer_summary":"NatWest and Cisco ran an IT equipment recycling and reuse programme; the case study is about sustainability and e-waste, not about SD-WAN, SASE or network security.","limitation_and_notes":"Does not name Catalyst SD-WAN, Secure Access, Meraki SD-WAN or Secure Connect, and has no bearing on any of the 28 network/security/regulatory columns; kept only to record that NatWest, a UK bank, appears in Cisco's financial services customer list for an unrelated programme."},{"id":"src_financial_services_fin_191","workbook_source_id":"FIN-191","url":"https://www.cisco.com/c/en/us/solutions/industries/financial-services/security-financial-services.html","title":"Security for Financial Services - Cisco","publisher":"cisco.com","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"rejected","reviewer_confidence":"low","record_type":"Financial services solution page","requirement_codes":[],"named_customer":null,"segment":"Multiple","named_product_or_service":"Cisco (financial services security messaging, unspecified)","service_family":"Not relevant","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":null,"regulatory_regime":"Not stated","exact_supporting_wording":"Cisco delivers the secure foundation institutions need to govern autonomy at scale","reviewer_summary":"A generic financial services security marketing page discussing agentic AI governance and digital resilience without naming Catalyst SD-WAN, Secure Access, Meraki SD-WAN or Secure Connect, or any specific regulation.","limitation_and_notes":"No named product, no named financial institution, and no specific regulatory or technical fact; too generic to support any of the 28 columns."},{"id":"src_financial_services_fs_019","workbook_source_id":"FS-019","url":"https://www.cisco.com/c/en/us/solutions/enterprise-networks/network-architecture-customer-success-stories.html","title":"Cisco Networking Customer Stories","publisher":"cisco.com","publication_date":null,"checked_date":"2026-07-29","source_ownership":"provider_authored","decision":"rejected","reviewer_confidence":"high","record_type":"Existing source lead","requirement_codes":[],"named_customer":null,"segment":"To review","named_product_or_service":null,"service_family":"Supporting only","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":null,"regulatory_regime":null,"exact_supporting_wording":"Argentine bank establishes a new standard for software-defined networking across global locations.","reviewer_summary":"BBVA is a named customer carrying Cisco's own Financial Services industry label, with Cisco Catalyst SD-WAN explicitly in the deployed products list. Banco do Brasil, Fiserv and Jammu & Kashmir Bank are further published financial services customers, though SD-WAN was not confirmed in their product lists.","limitation_and_notes":"Supplier customer-story index listing named customers alongside the exact Cisco products deployed. Useful because it ties named organisations directly to Cisco Catalyst SD-WAN / Cisco Software-Defined Wide Area Network. | Not found on page"}]},{"slug":"colt","name":"Colt Technology Services","marketplace_url":"https://netify.co.uk/marketplace/colt/","research_status":"complete","overall_confidence":"medium","fit_conclusion":"Colt has verifiable financial services evidence for branch and office connectivity, identity and zero trust access, and UK delivery through the named Byblos Bank Europe case study on Colt SD-WAN, and strong capital markets material for trading, low latency and data centre connectivity through Colt PrizmNet. The strongest named customer is Byblos Bank Europe, a retail bank using Colt SD-WAN with Zscaler Zero Trust across Brussels, London and Paris. No opened page connects any Colt service to FCA, PRA, DORA, FFIEC, NYDFS, SEC, OSFI or PCI DSS for a financial services customer, so regulatory alignment is unproven for all four regimes checked. Data residency, encryption, log retention, incident notification, subcontractor transparency and exit terms are only generically stated, not documented with specifics for the named service. Overall this is workable evidence of financial sector deployment and capital markets connectivity, but the compliance and regulatory picture must be confirmed directly with Colt before relying on it for a regulated UK, EU, US or Canadian financial institution.","gaps_and_unknowns":"No evidence was found for payment/cardholder data segmentation, third-party access controls, logging and audit retention periods, change control governance, incident notification timelines, subcontractor transparency, exit and portability terms, or any of the four regulatory regimes (UK FCA/PRA, EU DORA, US FFIEC/GLBA/NYDFS/SEC, Canada OSFI) and PCI DSS. Closing these gaps would require Colt's own compliance or trust documentation naming the SD-WAN/SASE or PrizmNet service against each specific regime or control, plus named financial services case studies in North America and named RTO/RPO-tested resilience outcomes.","reviewed_by":"Harry Yelland","reviewed_date":"2026-09-14","source_count":15,"accepted_source_count":12,"requirements":[{"code":"branch_and_office_connectivity","label":"Branch and office connectivity","state":"proven","evidence_source_ids":["src_financial_services_fin_214"],"verified_date":"2026-09-14"},{"code":"trading_and_low_latency_connectivity","label":"Trading and low-latency connectivity","state":"partial","evidence_source_ids":["src_financial_services_fin_218","src_financial_services_fin_219"],"verified_date":"2026-09-14"},{"code":"data_centre_colocation_and_cloud_connectivity","label":"Data-centre, colocation and cloud connectivity","state":"partial","evidence_source_ids":["src_financial_services_fin_218","src_financial_services_fin_219"],"verified_date":"2026-09-14"},{"code":"resilience_and_tested_recovery","label":"Resilience and tested recovery","state":"partial","evidence_source_ids":["src_financial_services_fin_214","src_financial_services_fin_215","src_financial_services_fin_220","src_financial_services_fin_221"],"verified_date":"2026-09-14"},{"code":"network_segmentation_and_zoning","label":"Network segmentation and zoning","state":"partial","evidence_source_ids":["src_financial_services_fin_213"],"verified_date":"2026-09-14"},{"code":"payment_and_cardholder_data_segmentation","label":"Payment and cardholder data segmentation","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"third_party_and_outsourced_access","label":"Third-party and outsourced access","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"remote_and_hybrid_workforce","label":"Remote and hybrid workforce","state":"partial","evidence_source_ids":["src_financial_services_fin_222"],"verified_date":"2026-09-14"},{"code":"data_residency_and_sovereignty","label":"Data residency and sovereignty","state":"partial","evidence_source_ids":["src_financial_services_fin_222"],"verified_date":"2026-09-14"},{"code":"encryption_and_key_management","label":"Encryption and key management","state":"partial","evidence_source_ids":["src_financial_services_fin_213","src_financial_services_fin_222","src_financial_services_fin_223"],"verified_date":"2026-09-14"},{"code":"logging_audit_and_evidence_retention","label":"Logging, audit and evidence retention","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"identity_and_zero_trust_access","label":"Identity and zero trust access","state":"proven","evidence_source_ids":["src_financial_services_fs_024","src_financial_services_fin_214","src_financial_services_fin_223"],"verified_date":"2026-09-14"},{"code":"cloud_and_saas_data_controls","label":"Cloud and SaaS data controls","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"managed_operations_and_soc","label":"Managed operations and SOC","state":"partial","evidence_source_ids":["src_financial_services_fin_218"],"verified_date":"2026-09-14"},{"code":"network_visibility_and_reporting","label":"Network visibility and reporting","state":"proven","evidence_source_ids":["src_financial_services_fin_215","src_financial_services_fin_222"],"verified_date":"2026-09-14"},{"code":"change_control_and_configuration_governance","label":"Change control and configuration governance","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"incident_notification_support","label":"Incident notification support","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"concentration_risk_and_subcontractor_transparency","label":"Concentration risk and subcontractor transparency","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"exit_and_portability","label":"Exit and portability","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"uk_regulatory_alignment_fca_and_pra","label":"UK regulatory alignment (FCA and PRA)","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"eu_dora_alignment","label":"EU DORA alignment","state":"partial","evidence_source_ids":["src_financial_services_fin_526"],"verified_date":"2026-09-14"},{"code":"us_regulatory_alignment_ffiec_glba_nydfs_sec","label":"US regulatory alignment (FFIEC, GLBA, NYDFS, SEC)","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"canada_regulatory_alignment_osfi","label":"Canada regulatory alignment (OSFI)","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"pci_dss_alignment","label":"PCI DSS alignment","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"swift_csp_alignment","label":"SWIFT CSP alignment","state":"partial","evidence_source_ids":["src_financial_services_fin_221"],"verified_date":"2026-09-14"},{"code":"uk_delivery","label":"UK delivery","state":"proven","evidence_source_ids":["src_financial_services_fin_214"],"verified_date":"2026-09-14"},{"code":"north_america_delivery","label":"North America delivery","state":"partial","evidence_source_ids":["src_financial_services_fin_219"],"verified_date":"2026-09-14"},{"code":"global_delivery","label":"Global delivery","state":"proven","evidence_source_ids":["src_financial_services_fin_219"],"verified_date":"2026-09-14"}],"sources":[{"id":"src_financial_services_fin_213","workbook_source_id":"FIN-213","url":"https://www.colt.net/resources/sd-wan-in-banking-financial-services/","title":"SD WAN in Banking & Financial Services - Colt Technology Services","publisher":"colt.net","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"medium","record_type":"Financial services solution page","requirement_codes":["network_segmentation_and_zoning","encryption_and_key_management"],"named_customer":null,"segment":"Unspecified","named_product_or_service":"Colt SD WAN / Colt SASE","service_family":"Multiple","estate":"nearly 400 bank branches, corporate locations and data centres","countries_or_regions":"Germany and international locations","ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":null,"regulatory_regime":"Not stated","exact_supporting_wording":"zero trust and micro-segmentation to protect sensitive financial data","reviewer_summary":"Colt describes an anonymised bank example connecting around 400 branches, corporate sites and data centres using Colt SD WAN/SASE with zero trust and micro-segmentation for financial data.","limitation_and_notes":"The bank customer described is not named, so this does not prove a specific institution deployment; it is a financial-services solution page rather than a case study, and cites no regulator or data residency specifics."},{"id":"src_financial_services_fin_214","workbook_source_id":"FIN-214","url":"https://www.colt.net/resources/byblos-bank-europe/","title":"Customer Success Story - Byblos Bank Europe - Colt Technology Services","publisher":"colt.net","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"high","record_type":"Named customer case study","requirement_codes":["branch_and_office_connectivity","resilience_and_tested_recovery","identity_and_zero_trust_access","uk_delivery"],"named_customer":"Byblos Bank Europe","segment":"Retail banking","named_product_or_service":"Colt SD-WAN","service_family":"SD-WAN","estate":"offices in Brussels, London and Paris","countries_or_regions":"Belgium, UK, France","ot_or_production_environment":null,"measured_or_stated_outcome":"a large file can now be opened or copied remotely in as little as 7 seconds instead of half a minute","industrial_standard_or_regulation":null,"regulatory_regime":"Not stated","exact_supporting_wording":"a large file can now be opened or copied remotely in as little as 7 seconds instead of half a minute","reviewer_summary":"Byblos Bank Europe uses Colt SD-WAN with an MPLS connection and direct peering to Zscaler to connect its Brussels, London and Paris offices, adopting Zero Trust access control via Active Directory integration and active/active site resilience.","limitation_and_notes":"Confirms branch connectivity, zero trust and a UK office for a named bank, but states no RTO/RPO figures, no regulatory regime, and no data residency or encryption detail."},{"id":"src_financial_services_fin_215","workbook_source_id":"FIN-215","url":"https://www.colt.net/resources/leading-global-investment-bank/","title":"Leading global investment bank - Colt's SD WAN solutions for Finance","publisher":"colt.net","publication_date":null,"checked_date":"2026-09-15","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"medium","record_type":"Named customer case study","requirement_codes":["network_visibility_and_reporting","resilience_and_tested_recovery"],"named_customer":null,"segment":"Investment banking and trading","named_product_or_service":"Colt SD WAN","service_family":"SD-WAN","estate":"multiple European sites via two interconnected hubs","countries_or_regions":"Europe","ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":null,"regulatory_regime":"Not stated","exact_supporting_wording":"Leading global investment bank builds a springboard to the future. A Europe-wide SD WAN from Colt underpins the bank's digital transformation programme.","reviewer_summary":"An anonymised European investment bank deployed Colt's Europe-wide SD WAN with NFV across multiple sites, using single or dual MPLS access circuits by site criticality and portal-based analytics for network visibility.","limitation_and_notes":"Checker 2026-09-12: page carries the fact but the wording differs (Page reads 'Gain end-to-end visibility...' with added word 'Gain' vs quoted text.). Re-quote verbatim. The bank is not named, so this cannot prove a specific institution's outcome; no RTO/RPO or regulator is stated. [2026-09-15] Live page confirmed and re-quoted verbatim using its title/subtitle rather than the originally-flagged 'end-to-end visibility' sentence, which sits further into the page body and could not be isolated from the search excerpt. The bank itself remains anonymised throughout."},{"id":"src_financial_services_fin_217","workbook_source_id":"FIN-217","url":"https://www.colt.net/resources/colt-technology-services-brings-together-sd-wan-and-sse-features-in-new-integrated-full-sase-solution/","title":"Colt Technology Services brings together SD WAN and SSE features in new integrated full SASE solution","publisher":"colt.net","publication_date":"2022-06-28","checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"medium","record_type":"Other","requirement_codes":["cloud_and_saas_data_controls"],"named_customer":null,"segment":"Unspecified","named_product_or_service":"Colt SASE","service_family":"SASE","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":null,"regulatory_regime":"Not stated","exact_supporting_wording":"enterprises can no longer rely on traditional solutions to keep their systems secure","reviewer_summary":"Colt launched a Versa-based full SASE solution combining SD-WAN and Secure Service Edge features, including a secure web gateway and remote access; no financial services customer or FS-specific control is named.","limitation_and_notes":"This is a general product launch announcement with no financial institution named and no FS-specific compliance or control detail, so it supports no column as Proven. [2026-09-15, capability assigned per Robert's check - WEAK FIT, flagged for review] Generic SASE product-launch announcement, no specific technical claim beyond general positioning. Weak fit."},{"id":"src_financial_services_fin_218","workbook_source_id":"FIN-218","url":"https://www.colt.net/solutions/industries/capital-markets/financial-extranet","title":"Financial Extranet | Colt Capital Markets","publisher":"colt.net","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"medium","record_type":"Financial services solution page","requirement_codes":["data_centre_colocation_and_cloud_connectivity","trading_and_low_latency_connectivity","managed_operations_and_soc"],"named_customer":null,"segment":"Market infrastructure","named_product_or_service":"Colt PrizmNet (Financial Extranet)","service_family":"Supporting only","estate":null,"countries_or_regions":"Europe, Asia and US","ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":null,"regulatory_regime":"Not stated","exact_supporting_wording":"A secure, high-performance extranet connecting 180+ financial venues and 15,000+ participants worldwide.","reviewer_summary":"Colt describes PrizmNet as a financial extranet connecting over 180 venues and 15,000 participants, with sub-millisecond, guaranteed deterministic low latency and a 24x7 Capital Markets Service Desk.","limitation_and_notes":"No individual financial institution is named; this is capital markets marketing material, not a customer case study, and states no regulatory regime or RTO/RPO."},{"id":"src_financial_services_fin_219","workbook_source_id":"FIN-219","url":"https://docs.colt.net/datasheets/capital-markets/prizmnet","title":"PRIZMNET | Colt Docs","publisher":"docs.colt.net","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"medium","record_type":"Financial services solution page","requirement_codes":["data_centre_colocation_and_cloud_connectivity","trading_and_low_latency_connectivity","north_america_delivery","global_delivery"],"named_customer":null,"segment":"Market infrastructure","named_product_or_service":"Colt PrizmNet","service_family":"Supporting only","estate":"More than 400 Capital Markets firms worldwide","countries_or_regions":"Europe, Asia and North America; 230+ cities in 40 countries","ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":null,"regulatory_regime":"Not stated","exact_supporting_wording":"Direct market access to 50+ cross asset class venues","reviewer_summary":"Colt's PrizmNet datasheet states direct market access to over 50 cross-asset venues, colocation at 30+ venues, over 180 exchanges and liquidity venues globally, and a network reaching 230+ cities in 40 countries used by more than 400 capital markets firms.","limitation_and_notes":"No individual bank or firm is named; North America presence is stated only generically without named US or Canadian customers or PoP counts."},{"id":"src_financial_services_fin_220","workbook_source_id":"FIN-220","url":"https://www.colt.net/resources/leading-provider-of-financial-markets-data/","title":"Leading provider of financial markets data - Colt Technology Services","publisher":"colt.net","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"medium","record_type":"Named customer case study","requirement_codes":["resilience_and_tested_recovery"],"named_customer":null,"segment":"Market infrastructure","named_product_or_service":"Colt Managed Ethernet","service_family":"Supporting only","estate":null,"countries_or_regions":"Europe extending to Japan and Asia","ot_or_production_environment":null,"measured_or_stated_outcome":"99.999% Network uptime enabled by a diverse network architecture","industrial_standard_or_regulation":null,"regulatory_regime":"Not stated","exact_supporting_wording":"99.999% Network uptime enabled by a diverse network architecture","reviewer_summary":"An anonymised market data and trading solutions provider used Colt's managed Ethernet network across Europe, Japan and Asia, citing 99.999% uptime from a diverse network architecture.","limitation_and_notes":"The customer is anonymised and the product used is managed Ethernet, not SD-WAN or SASE; no RTO/RPO or DR test detail is given."},{"id":"src_financial_services_fin_221","workbook_source_id":"FIN-221","url":"https://www.colt.net/products/networking/colt-swiftnet","title":"Colt SWIFTNet","publisher":"colt.net","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"medium","record_type":"Financial services solution page","requirement_codes":["resilience_and_tested_recovery","swift_csp_alignment"],"named_customer":null,"segment":"Multiple","named_product_or_service":"Colt SWIFTNet","service_family":"Supporting only","estate":"hundreds of connected SWIFT members","countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":"+12.1% growth in SWIFT message traffic year on year","industrial_standard_or_regulation":"SWIFT accreditation","regulatory_regime":"Not stated","exact_supporting_wording":"a fully managed, SWIFT accredited connectivity solution built on Colt's high quality MPLS network","reviewer_summary":"Colt SWIFTNet is described as a fully managed, SWIFT-accredited MPLS connectivity service with automatic failover between access lines, CPE routers and VPN boxes, and optional dual-CPE resilience packs.","limitation_and_notes":"SWIFTNet is connectivity to SWIFT, not SD-WAN or SASE; the page states SWIFT accreditation but does not reference the SWIFT Customer Security Programme or CSCF secure-zone design, and no institution or RTO/RPO figures are given."},{"id":"src_financial_services_fin_222","workbook_source_id":"FIN-222","url":"https://www.colt.net/products/networking/sd-wan","title":"SD WAN & SASE | Colt Technology Services","publisher":"colt.net","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"medium","record_type":"Other","requirement_codes":["network_visibility_and_reporting","data_residency_and_sovereignty","encryption_and_key_management","remote_and_hybrid_workforce"],"named_customer":null,"segment":"Unspecified","named_product_or_service":"Colt SD WAN & SASE","service_family":"Multiple","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":null,"regulatory_regime":"Not stated","exact_supporting_wording":"keeps data within its own network and in specific regions, avoiding third-party transfers","reviewer_summary":"Colt's SD WAN & SASE product page describes a Sovereign SASE option that keeps data within specific regions, a self-service portal with traffic analytics, secure remote access for employees, and support for multiple SD-WAN vendors including Versa, Cisco and Palo Alto.","limitation_and_notes":"This is a general product page, not financial-services specific and names no customer; it does not state which regions Sovereign SASE covers or give SLA figures."},{"id":"src_financial_services_fin_223","workbook_source_id":"FIN-223","url":"https://www.colt.net/solutions/security/","title":"Solutions Overview: Security - Colt Technology Services","publisher":"colt.net","publication_date":"2026-01-14","checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"medium","record_type":"Other","requirement_codes":["identity_and_zero_trust_access","encryption_and_key_management"],"named_customer":null,"segment":"Unspecified","named_product_or_service":"Colt security solutions (SD WAN & SASE)","service_family":"Multiple","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":null,"regulatory_regime":"Not stated","exact_supporting_wording":"Zero trust continuously verifies users and makes it easy for your people to securely access the data and apps they need.","reviewer_summary":"Colt's security solutions overview describes continuous zero-trust user verification and references a world-first transatlantic quantum-safe encryption trial with Eurofiber; Capital Markets is listed as a served industry.","limitation_and_notes":"No ZTNA or MFA product name, no FIPS validation, and no financial services customer or regulator is referenced; the quantum-safe encryption item is a trial, not a general service feature."},{"id":"src_financial_services_fin_526","workbook_source_id":"FIN-526","url":"https://docs.colt.net/legal/dora","title":"DORA (Digital Operational Resilience Act) - Colt Legal","publisher":"docs.colt.net","publication_date":null,"checked_date":"2026-09-15","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"high","record_type":"Compliance attestation or statement","requirement_codes":["eu_dora_alignment"],"named_customer":null,"segment":"Unspecified","named_product_or_service":"Colt's DORA-compliant contract amendment","service_family":"Supporting only","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":"DORA - a contract amendment available on request","regulatory_regime":"EU","exact_supporting_wording":"\"To support our existing customers who are regulated financial entities operating within the European Union, Colt has developed a DORA-compliant contract amendment which aligns with the requirements of the Digital Operational Resilience Act.\"","reviewer_summary":"Colt's own legal page, verified live 2026-09-15 across multiple mirrors (docs.colt.net, legacy.colt.net, www.colt.net) with identical wording, and independently corroborated by an interview with Colt's Deputy General Counsel (Alessandro Galtieri) discussing exactly this DORA addendum process with customers. The amendment itself is only available on request, not published, so the actual Article 30 contractual terms cannot be read or verified - graded Partial, not Proven, and not tied to a named service or financial customer.","limitation_and_notes":"Added 2026-09-15 per item 6 sweep, following up on a candidate lead. The amendment exists and is real, but is provided on request rather than published, so cannot be verified to actually contain Article 30 terms as written - stays Partial."},{"id":"src_financial_services_fs_024","workbook_source_id":"FS-024","url":"https://www.colt.net/solutions/industries/capital-markets","title":"Capital Markets | Colt Technology Services","publisher":"colt.net","publication_date":null,"checked_date":"2026-07-29","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"high","record_type":"Existing source lead","requirement_codes":["identity_and_zero_trust_access"],"named_customer":null,"segment":"Investment banking and trading","named_product_or_service":"Colt PrizmNet","service_family":"Supporting only","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":null,"regulatory_regime":"EU","exact_supporting_wording":"18/25 of the top global banks trust us with their critical infrastructure and connectivity","reviewer_summary":"Dedicated Capital Markets industry page with named customers Stuttgart Stock Exchange, Byblos Bank Europe and RCI Bank and Services. Byblos Bank Europe is quoted on a Colt and Zscaler SSE deployment: \"Compared to our previous VPN-based approach, the Colt and Zscaler solution is a real enhancement that delivers a faster and better user experience and helps increase productivity\" (Ramy Matar, Network Consultant, BBE). Note the focus is capital markets and trading connectivity rather than retail banking or insurance; the 18/25 top global banks figure is a vendor claim with no source cited on the page.","limitation_and_notes":"Supplier industry page. Named financial customers (Stuttgart Stock Exchange, Byblos Bank Europe, RCI Bank and Services) with attributed quotes plus a top-25-banks penetration claim. Strong but vendor-claimed. | Confirmed - exact match"},{"id":"src_financial_services_fin_216","workbook_source_id":"FIN-216","url":"https://www.colt.net/why-colt/certifications/","title":"Technical Certifications | Colt Technology Services","publisher":"colt.net","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"rejected","reviewer_confidence":"medium","record_type":"Compliance attestation or statement","requirement_codes":[],"named_customer":null,"segment":"Unspecified","named_product_or_service":"Colt Technology Services (company-wide)","service_family":"Not relevant","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":"ISO/IEC 27001:2022; ISO/IEC 27701:2019; ISO 22301:2019; ISO 9001:2015; ISO/IEC 20000-1:2018; ISO 14001:2015; Cyber Essentials Plus","regulatory_regime":"Not stated","exact_supporting_wording":"Best-practice information security processes","reviewer_summary":"Colt lists company-wide certifications including ISO 27001, ISO 27701, ISO 22301, ISO 9001, ISO 20000-1, ISO 14001 and Cyber Essentials Plus, none of which are tied to the SD-WAN or SASE product specifically or to financial services.","limitation_and_notes":"No PCI DSS, SOC 2 or FIPS certification is listed; none of the certifications are scoped to the named SD-WAN/SASE service or to a financial services customer, so this supports no column as Proven. [2026-09-15, flagged per Robert's check] Generic phrase (\"best-practice information security processes\") with no specific technical claim. Does not appear to support any specific capability honestly. Changed from Accepted to Needs review since no specific capability can be honestly assigned - recommend Harry/Robert decide whether to Reject or find a genuine capability fit."},{"id":"src_financial_services_fs_025","workbook_source_id":"FS-025","url":"https://www.colt.net/resources/","title":"Networking News, Resources, Trends & Industry Insights - Colt","publisher":"colt.net","publication_date":null,"checked_date":"2026-07-29","source_ownership":"provider_authored","decision":"rejected","reviewer_confidence":"high","record_type":"Existing source lead","requirement_codes":[],"named_customer":null,"segment":"To review","named_product_or_service":null,"service_family":"Supporting only","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":null,"regulatory_regime":null,"exact_supporting_wording":"18/25 of the top global banks trust us with their critical infrastructure and connectivity","reviewer_summary":"Dedicated Capital Markets industry page with named customers Stuttgart Stock Exchange, Byblos Bank Europe and RCI Bank and Services. Byblos Bank Europe is quoted on a Colt and Zscaler SSE deployment: \"Compared to our previous VPN-based approach, the Colt and Zscaler solution is a real enhancement that delivers a faster and better user experience and helps increase productivity\" (Ramy Matar, Network Consultant, BBE). Note the focus is capital markets and trading connectivity rather than retail banking or insurance; the 18/25 top global banks figure is a vendor claim with no source cited on the page.","limitation_and_notes":"Supplier resource library. Its industry filter taxonomy (Capital Markets, Defence, Manufacturing, Media & Entertainment, Pharma, Professional services, Retail, Transport & Logistics) is the fullest statement of the sectors Colt indexes content against. | Not found on page"},{"id":"src_financial_services_fs_023","workbook_source_id":"FS-023","url":"https://www.colt.net/solutions/","title":"Solutions - Colt Technology Services (industries hub)","publisher":"colt.net","publication_date":null,"checked_date":"2026-07-29","source_ownership":"provider_authored","decision":"superseded","reviewer_confidence":"high","record_type":"Existing source lead","requirement_codes":[],"named_customer":null,"segment":"To review","named_product_or_service":null,"service_family":"Supporting only","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":null,"regulatory_regime":null,"exact_supporting_wording":"18/25 of the top global banks trust us with their critical infrastructure and connectivity","reviewer_summary":"Dedicated Capital Markets industry page with named customers Stuttgart Stock Exchange, Byblos Bank Europe and RCI Bank and Services. Byblos Bank Europe is quoted on a Colt and Zscaler SSE deployment: \"Compared to our previous VPN-based approach, the Colt and Zscaler solution is a real enhancement that delivers a faster and better user experience and helps increase productivity\" (Ramy Matar, Network Consultant, BBE). Note the focus is capital markets and trading connectivity rather than retail banking or insurance; the 18/25 top global banks figure is a vendor claim with no source cited on the page.","limitation_and_notes":"Supplier navigation hub. Definitive list of the only six industry pages Colt publishes: Capital Markets, Manufacturing, Pharma, Retail, Transport & Logistics, Defence. Used to establish absence of sector pages. | New Source: https://www.colt.net/solutions/capital-markets"}]},{"slug":"comcastbusiness","name":"Comcast Business","marketplace_url":"https://netify.co.uk/marketplace/comcastbusiness/","research_status":"complete","overall_confidence":"medium","fit_conclusion":"Comcast Business can show named US financial institution deployments (American Heritage Credit Union and STAR Financial Bank) for branch connectivity, data centre and cloud connectivity and resilience outcomes, all under US regulation, with North America delivery further supported by the Masergy SD-WAN contract terms covering the US, Alaska, Hawaii and Canada. Documentation-based columns such as encryption (AES-256/AES-128 on Masergy SD-WAN) are evidenced from the provider's own contract terms, but neither named FS case names SD-WAN or SASE specifically, using instead Ethernet, Dedicated Internet and Global Secure Networking branding. The strongest named customer is American Heritage Credit Union, evidenced by an April 2025 Comcast Business press release. The main limitation is the near-total absence of regulatory alignment evidence: no page connects the service to FFIEC, GLBA, NYDFS, FCA/PRA, DORA or OSFI, and no PCI DSS attestation or cardholder data segmentation content was found despite a page titled around PCI-compliant SD-WAN containing no such content when opened. UK delivery evidence is also absent, consistent with Comcast Business operating as a US-domestic provider with Masergy providing the international network reach.","gaps_and_unknowns":"No evidence was found for trading/low-latency connectivity, payment/cardholder data segmentation, remote/hybrid workforce, data residency, logging/audit retention periods, change control governance, or any of the four regional regulatory alignment columns (UK, EU DORA, US FFIEC/NYDFS/GLBA/SEC, Canada OSFI); PCI DSS and SWIFT CSP alignment are also unevidenced. Closing these would require a named financial services customer case that explicitly uses Comcast Business SD-WAN or SASE (rather than Ethernet/Dedicated Internet) and a published PCI DSS Attestation of Compliance, data residency statement, and log retention policy for that named service.","reviewed_by":"Harry Yelland","reviewed_date":"2026-09-14","source_count":15,"accepted_source_count":12,"requirements":[{"code":"branch_and_office_connectivity","label":"Branch and office connectivity","state":"proven","evidence_source_ids":["src_financial_services_fs_101","src_financial_services_fs_101","src_financial_services_fin_225"],"verified_date":"2026-09-14"},{"code":"trading_and_low_latency_connectivity","label":"Trading and low-latency connectivity","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"data_centre_colocation_and_cloud_connectivity","label":"Data-centre, colocation and cloud connectivity","state":"proven","evidence_source_ids":["src_financial_services_fs_101","src_financial_services_fin_225"],"verified_date":"2026-09-14"},{"code":"resilience_and_tested_recovery","label":"Resilience and tested recovery","state":"proven","evidence_source_ids":["src_financial_services_fs_101","src_financial_services_fin_225","src_financial_services_fin_232"],"verified_date":"2026-09-14"},{"code":"network_segmentation_and_zoning","label":"Network segmentation and zoning","state":"partial","evidence_source_ids":["src_financial_services_fin_232"],"verified_date":"2026-09-14"},{"code":"payment_and_cardholder_data_segmentation","label":"Payment and cardholder data segmentation","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"third_party_and_outsourced_access","label":"Third-party and outsourced access","state":"partial","evidence_source_ids":["src_financial_services_fin_229"],"verified_date":"2026-09-14"},{"code":"remote_and_hybrid_workforce","label":"Remote and hybrid workforce","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"data_residency_and_sovereignty","label":"Data residency and sovereignty","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"encryption_and_key_management","label":"Encryption and key management","state":"proven","evidence_source_ids":["src_financial_services_fin_232"],"verified_date":"2026-09-14"},{"code":"logging_audit_and_evidence_retention","label":"Logging, audit and evidence retention","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"identity_and_zero_trust_access","label":"Identity and zero trust access","state":"partial","evidence_source_ids":["evidence:comcastbusiness:6","src_financial_services_fin_234"],"verified_date":"2026-09-14"},{"code":"cloud_and_saas_data_controls","label":"Cloud and SaaS data controls","state":"partial","evidence_source_ids":["evidence:comcastbusiness:6"],"verified_date":"2026-09-14"},{"code":"managed_operations_and_soc","label":"Managed operations and SOC","state":"partial","evidence_source_ids":["src_financial_services_fs_027","src_financial_services_fin_227"],"verified_date":"2026-09-14"},{"code":"network_visibility_and_reporting","label":"Network visibility and reporting","state":"proven","evidence_source_ids":["src_financial_services_fin_225","src_financial_services_fin_227"],"verified_date":"2026-09-14"},{"code":"change_control_and_configuration_governance","label":"Change control and configuration governance","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"incident_notification_support","label":"Incident notification support","state":"partial","evidence_source_ids":["src_financial_services_fin_233"],"verified_date":"2026-09-14"},{"code":"concentration_risk_and_subcontractor_transparency","label":"Concentration risk and subcontractor transparency","state":"partial","evidence_source_ids":["src_financial_services_fin_229","src_financial_services_fin_233"],"verified_date":"2026-09-14"},{"code":"exit_and_portability","label":"Exit and portability","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"uk_regulatory_alignment_fca_and_pra","label":"UK regulatory alignment (FCA and PRA)","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"eu_dora_alignment","label":"EU DORA alignment","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"us_regulatory_alignment_ffiec_glba_nydfs_sec","label":"US regulatory alignment (FFIEC, GLBA, NYDFS, SEC)","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"canada_regulatory_alignment_osfi","label":"Canada regulatory alignment (OSFI)","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"pci_dss_alignment","label":"PCI DSS alignment","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"swift_csp_alignment","label":"SWIFT CSP alignment","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"uk_delivery","label":"UK delivery","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"north_america_delivery","label":"North America delivery","state":"proven","evidence_source_ids":["src_financial_services_fs_101","src_financial_services_fin_225","src_financial_services_fin_232"],"verified_date":"2026-09-14"},{"code":"global_delivery","label":"Global delivery","state":"proven","evidence_source_ids":["src_financial_services_fin_235"],"verified_date":"2026-09-14"}],"sources":[{"id":"src_financial_services_fs_101","workbook_source_id":"FIN-224","url":"https://business.comcast.com/about-us/press-releases/2025/cb-american-heritage-credit-union","title":"American Heritage Credit Union 'Banks' on Comcast Business to Drive Innovation and Strategic Expansion","publisher":"business.comcast.com","publication_date":"2025-04-30","checked_date":"2026-09-15","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"medium","record_type":"Named customer case study","requirement_codes":["data_centre_colocation_and_cloud_connectivity","branch_and_office_connectivity","resilience_and_tested_recovery","north_america_delivery"],"named_customer":"American Heritage Credit Union","segment":"Building society or credit union","named_product_or_service":"Global Secure Networking","service_family":"Supporting only","estate":"37 locations (including 2 newly opened NJ branches); 300,000+ members","countries_or_regions":"Pennsylvania and New Jersey, USA","ot_or_production_environment":null,"measured_or_stated_outcome":"Redundant data centers and centralized cloud communications keep systems operational and adaptable while supporting expansion","industrial_standard_or_regulation":null,"regulatory_regime":"US","exact_supporting_wording":"serve our members with the most advanced financial solutions","reviewer_summary":"A named US credit union with 37 locations uses Comcast Business Ethernet, Dedicated Internet, Global Secure Networking and Voice services, with redundant data centers cited for resilience.","limitation_and_notes":"Checker 2026-09-12: page carries the fact but the wording differs (Actual page text: 'serve our members with the most advanced financial solutions' vs quoted 'serve members with advanced financial solutions'.). Re-quote verbatim. Does not name SD-WAN or SASE specifically, only the broader 'Global Secure Networking' family; no RTO/RPO figures, no segmentation, encryption or regulatory detail given. [2026-09-15] Re-quoted verbatim using the checker's own already-confirmed page wording - no fresh fetch needed, the exact sentence was already recorded in the check note."},{"id":"src_financial_services_fin_225","workbook_source_id":"FIN-225","url":"https://business.comcast.com/enterprise/case-studies/star-financial-bank","title":"STAR Financial Bank Case Study | Comcast Business","publisher":"business.comcast.com","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"medium","record_type":"Named customer case study","requirement_codes":["data_centre_colocation_and_cloud_connectivity","network_visibility_and_reporting","branch_and_office_connectivity","resilience_and_tested_recovery","north_america_delivery"],"named_customer":"STAR Financial Bank","segment":"Retail banking","named_product_or_service":"Ethernet Dedicated Internet; DDoS Mitigation Solution","service_family":"Supporting only","estate":"45+ locations","countries_or_regions":"Central and northeast Indiana, USA","ot_or_production_environment":null,"measured_or_stated_outcome":"Deployed 55 video banking machines, extended hours to 7am-7pm six days a week, and network outages are no longer classed as mission-critical emergencies","industrial_standard_or_regulation":null,"regulatory_regime":"US","exact_supporting_wording":"The reliability we have been able to achieve with multiple connections is critical.","reviewer_summary":"A named US bank with 45+ Indiana locations uses Comcast Business Ethernet Dedicated Internet and a cloud-based DDoS mitigation service, with redundant multi-provider connections and an incident alert/activity portal.","limitation_and_notes":"Does not name SD-WAN or SASE; DDoS mitigation and connectivity only, no segmentation, encryption, zero trust or compliance detail; no publication date shown."},{"id":"src_financial_services_fs_027","workbook_source_id":"FIN-226","url":"https://business.comcast.com/enterprise/industry-solutions/financial-services","title":"Financial Services Solutions | Comcast Business","publisher":"business.comcast.com","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"medium","record_type":"Financial services solution page","requirement_codes":["managed_operations_and_soc"],"named_customer":null,"segment":"Multiple","named_product_or_service":"SD-WAN and SASE","service_family":"Multiple","estate":null,"countries_or_regions":"United States","ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":null,"regulatory_regime":"US","exact_supporting_wording":"Connect endpoints across your enterprise with SD-WAN and SASE.","reviewer_summary":"A generic financial services industry page names SD-WAN and SASE among the connectivity and security products offered, and links to named customers (U.S. Bank, STAR Financial Bank, Philadelphia Federal Credit Union) elsewhere on the page, but does not itself describe a specific deployment.","limitation_and_notes":"No named customer is tied to SD-WAN/SASE specifically on this page; no compliance, data residency or regulatory content."},{"id":"src_financial_services_fin_227","workbook_source_id":"FIN-227","url":"https://business.comcast.com/enterprise/products-services/secure-networking","title":"Secure Networking and Cybersecurity | Comcast Business","publisher":"business.comcast.com","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"medium","record_type":"Financial services solution page","requirement_codes":["network_visibility_and_reporting","managed_operations_and_soc"],"named_customer":null,"segment":"Unspecified","named_product_or_service":"SD-WAN; SASE; Secure Network Edge; Advanced Security","service_family":"Multiple","estate":null,"countries_or_regions":"United States","ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":null,"regulatory_regime":"Not stated","exact_supporting_wording":"Monitor your network 24/7 with fast incident response, maintenance, and management, as well as trouble ticketing and resolution","reviewer_summary":"A general (non-FS-specific) product page states Comcast Business monitors customer networks 24/7 and provides a centralized digital dashboard for network and security management, across SD-WAN, SASE and related secure networking products.","limitation_and_notes":"Not financial-services specific and no named customer; general product marketing only, no SLA figures or FS regulatory content."},{"id":"src_financial_services_fin_229","workbook_source_id":"FIN-229","url":"https://business.comcast.com/privacy","title":"Comcast Business Privacy Center","publisher":"business.comcast.com","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"low","record_type":"Compliance attestation or statement","requirement_codes":["concentration_risk_and_subcontractor_transparency","third_party_and_outsourced_access"],"named_customer":null,"segment":"Unspecified","named_product_or_service":"Comcast Business Services (general)","service_family":"Not relevant","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":null,"regulatory_regime":"Not stated","exact_supporting_wording":"a multi-layer security program that is applied to the development and performance of its products and services","reviewer_summary":"The privacy center references downloadable Comcast security policy and information security standards documents, a Technical and Organizational Measures document, and states a sub-processor list is available, without naming SD-WAN/SASE specifically.","limitation_and_notes":"Does not name the SD-WAN or SASE service; no data residency, retention or certification (SOC 2, ISO 27001) content stated directly on the page itself."},{"id":"src_financial_services_fin_230","workbook_source_id":"FIN-230","url":"https://business.comcast.com/enterprise/products-services/secure-networking/sd-wan","title":"SD-WAN solutions - Comcast Business","publisher":"business.comcast.com","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"medium","record_type":"Compliance attestation or statement","requirement_codes":["network_visibility_and_reporting"],"named_customer":null,"segment":"Unspecified","named_product_or_service":"SD-WAN solutions","service_family":"SD-WAN","estate":null,"countries_or_regions":"United States","ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":"MEF 3.0","regulatory_regime":"Not stated","exact_supporting_wording":"Get rapid service restoration backed by service level agreements (SLAs)","reviewer_summary":"The Comcast Business SD-WAN product page states the service is MEF 3.0 certified, offers a centralized self-service portal, and is SLA-backed for rapid restoration, without stating a specific uptime percentage.","limitation_and_notes":"No specific SLA percentage, no FS customer named, no segmentation or zero-trust detail on this page."},{"id":"evidence:comcastbusiness:6","workbook_source_id":"FIN-231","url":"https://business.comcast.com/enterprise/products-services/secure-networking/sase","title":"Comcast Business - Secure Access Service Edge (SASE) product page (cloud-native SASE infrastructure, AI-enhanced orchestration, MEF 3.0/MEF 70 certification, Gartner Magic Quadrant recognitions, Frost & Sullivan 2024 Leader)","publisher":"","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"medium","record_type":"Compliance attestation or statement","requirement_codes":["identity_and_zero_trust_access","cloud_and_saas_data_controls"],"named_customer":null,"segment":"Unspecified","named_product_or_service":"SASE (Secure Access Service Edge)","service_family":"SASE","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":null,"regulatory_regime":"Not stated","exact_supporting_wording":"Secure Access Service Edge (SASE) is a next-generation, AI-driven networking and security solution that connects and helps protect connected users, devices, data, and applications.","reviewer_summary":"The Comcast Business SASE product page names ZTNA and CASB as components alongside SWG, NGFW and FWaaS, but gives no financial services context, DLP detail or data residency information.","limitation_and_notes":"No named customer or FS context; DLP and data residency are not mentioned on this page."},{"id":"src_financial_services_fin_232","workbook_source_id":"FIN-232","url":"https://business.comcast.com/~/media/business_comcast_com/PDFs/Terms-and-Conditions---Enterprise/2024%20Terms%20and%20Conditions%20ENT/SDWAN%20PSA%20v%2020%2031725.pdf","title":"Masergy SD-WAN ver. 1 - Comcast Enterprise Services Product Specific Attachment","publisher":"business.comcast.com","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"high","record_type":"Compliance attestation or statement","requirement_codes":["network_segmentation_and_zoning","resilience_and_tested_recovery","encryption_and_key_management","north_america_delivery"],"named_customer":null,"segment":"Unspecified","named_product_or_service":"Masergy SD-WAN","service_family":"Managed SD-WAN","estate":null,"countries_or_regions":"United States, Alaska, Hawaii and Canada","ot_or_production_environment":null,"measured_or_stated_outcome":"100% availability objective for High Availability configurations; 99.99% for standard sites","industrial_standard_or_regulation":null,"regulatory_regime":"Not stated","exact_supporting_wording":"AES-256 or AES-128 encryption","reviewer_summary":"The Masergy SD-WAN contractual product-specific attachment documents a 100% availability objective for High Availability sites and 99.99% for standard sites across the US, Alaska, Hawaii and Canada, AES-256/AES-128 IPSec encryption, per-customer logical segregation of the orchestration plane, and automatic HA failover, but explicitly disclaims security event monitoring.","limitation_and_notes":"This is a general contract term, not a financial-services case; no RTO/RPO figures are stated, and no FS customer is named."},{"id":"src_financial_services_fin_233","workbook_source_id":"FIN-233","url":"https://business.comcast.com/~/media/business_comcast_com/PDFs/Re-Arch/2023/Privacy/202312-Update/Comcast%20Business%20Information%20Security%20Standards.pdf","title":"Comcast Business Information Security Standards","publisher":"business.comcast.com","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"medium","record_type":"Compliance attestation or statement","requirement_codes":["concentration_risk_and_subcontractor_transparency","incident_notification_support"],"named_customer":null,"segment":"Unspecified","named_product_or_service":"Comcast Business Services (general)","service_family":"Not relevant","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":null,"regulatory_regime":"Not stated","exact_supporting_wording":"Comcast will provide notification of a Security Incident as soon as practicable but not more than what is required under applicable law","reviewer_summary":"A general Comcast Business information security standards document commits to security incident notification timed to applicable law rather than a fixed window, and to using commercially reasonable efforts to confirm vendors meet equivalent security obligations, without naming SD-WAN or SASE or stating data residency or log retention periods.","limitation_and_notes":"Does not name the SD-WAN/SASE service specifically; no fixed incident notification timeline, no log retention period, no data residency and no FIPS/key management detail stated."},{"id":"src_financial_services_fin_234","workbook_source_id":"FIN-234","url":"https://business.comcast.com/~/media/business_comcast_com/PDFs/Terms%20and%20Conditions%20Masergy/2026/April/Zero%20Trust%20Network%20Access%20Services%20ZTNAdocx.pdf","title":"Masergy Zero Trust Network Access PSA - Comcast Enterprise Services","publisher":"business.comcast.com","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"medium","record_type":"Compliance attestation or statement","requirement_codes":["identity_and_zero_trust_access"],"named_customer":null,"segment":"Unspecified","named_product_or_service":"Masergy Zero Trust Network Access (ZTNA)","service_family":"SSE","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":null,"regulatory_regime":"Not stated","exact_supporting_wording":"Identify an Identity Provider (Either internal to the Customer or third-party infrastructure)","reviewer_summary":"The Masergy ZTNA product-specific attachment requires customers to connect their own identity provider for continuous authentication of endpoints, applications and users, with no SLA and no encryption specification given.","limitation_and_notes":"No financial services context; no SLA, encryption or compliance detail; explicitly states ZTNA is only one component of a customer's security programme."},{"id":"src_financial_services_fin_235","workbook_source_id":"FIN-235","url":"https://corporate.comcast.com/press/releases/comcast-business-acquire-masergy-pioneer-software-defined-networking-cloud-platforms","title":"Comcast Business to Acquire Masergy, a Pioneer in Software-Defined Networking and Cloud Platforms","publisher":"corporate.comcast.com","publication_date":"2021-08-25","checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"medium","record_type":"Other","requirement_codes":["global_delivery"],"named_customer":null,"segment":"Unspecified","named_product_or_service":"Managed SD-WAN","service_family":"Managed SD-WAN","estate":null,"countries_or_regions":"Nearly 100 countries","ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":null,"regulatory_regime":"Not stated","exact_supporting_wording":"Financial terms of the acquisition were not disclosed.","reviewer_summary":"The 2021 acquisition announcement states Masergy operates across nearly 100 countries with over 1,400 customers, and names Managed SD-WAN, UCaaS, CCaaS and managed security as Masergy's core services, now part of Comcast Business.","limitation_and_notes":"This is a corporate acquisition announcement, not FS-specific and not a live customer case; the quoted global scope figure describes Masergy's network at acquisition, not necessarily current coverage or a named financial customer."},{"id":"src_financial_services_fin_228","workbook_source_id":"FIN-228","url":"https://business.comcast.com/community/browse-all/details/how-pci-compliant-sd-wan-helps-retailers-effectively-boost-security","title":"How PCI-Compliant SD-WAN Helps Retailers Effectively Boost Security","publisher":"business.comcast.com","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"rejected","reviewer_confidence":"low","record_type":"Other","requirement_codes":[],"named_customer":null,"segment":"Unspecified","named_product_or_service":"SD-WAN","service_family":"Not relevant","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":null,"regulatory_regime":"Not stated","exact_supporting_wording":"By dynamically routing traffic across multiple network connections, SD-WAN helps optimize performance while reducing reliance on legacy infrastructure.","reviewer_summary":"Despite its title referencing PCI compliance, the page as fetched contains only a generic federal-network SD-WAN report summary with no PCI DSS or cardholder data content.","limitation_and_notes":"No PCI DSS, cardholder data or segmentation content found on the page despite the title; not usable as evidence for the PCI column."},{"id":"src_financial_services_fs_026","workbook_source_id":"FS-026","url":"https://business.comcast.com/enterprise","title":"Enterprise Services & Solutions | Comcast Business","publisher":"business.comcast.com","publication_date":null,"checked_date":"2026-07-29","source_ownership":"provider_authored","decision":"rejected","reviewer_confidence":"high","record_type":"Existing source lead","requirement_codes":[],"named_customer":null,"segment":"To review","named_product_or_service":null,"service_family":"Supporting only","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":null,"regulatory_regime":null,"exact_supporting_wording":"STAR Financial Bank powers new technology","reviewer_summary":"Dedicated financial services page with a named bank case study, a named CIO quote from Philadelphia Federal Credit Union and a US Bank feature. Three named customers in the sector.","limitation_and_notes":"Supplier's own enterprise landing page. Carries the Fortune 500 and small business scale statement plus customer logos (HCA Healthcare, Brigham and Women's Hospital, Choice Hotels International, US Bank, Citizen M, RaceTrac, Morningstar, Goodwill, Oak Valley Bank). | Not found on page"}]},{"slug":"vodafone","name":"Vodafone Business","marketplace_url":"https://netify.co.uk/marketplace/vodafone/","research_status":"complete","overall_confidence":"low","fit_conclusion":"Vodafone Business can demonstrate a documented UK-based managed security operations capability, with proven UK data residency and a 60-minute security incident notification commitment for its Vodafone Business Security Enhanced SOC and SIEM service, and it demonstrates genuine global delivery reach (192 countries) for its named SD-WAN product. However, the only financial services deployment evidence found is an anonymised 'leading financial services company' SD-WAN case study naming no institution, sector, or country, so branch connectivity, resilience, segmentation and workforce claims for financial services remain unproven rather than proven. No material was found connecting any Vodafone Business product to FCA/PRA, DORA, FFIEC/NYDFS/GLBA/SEC, OSFI, PCI DSS, or SWIFT CSP requirements. A UK IT decision maker in a regulated financial institution would need a named case study and explicit regulatory alignment statements from Vodafone before treating this as evidence of fitness for a regulated deployment.","gaps_and_unknowns":"No named bank, insurer, payment firm or asset manager was found for any connectivity, security or delivery column, and no trading/low-latency, cardholder data segmentation, change control, subcontractor transparency, or exit/portability evidence exists for the named service. All four regional regulatory columns (UK FCA/PRA, EU DORA, US FFIEC/NYDFS/GLBA/SEC, Canada OSFI) and PCI DSS/SWIFT CSP alignment are unevidenced. These would be closed by a named financial services case study referencing the specific product, and by a published compliance statement mapping Vodafone Business services to each regime.","reviewed_by":"Harry Yelland","reviewed_date":"2026-09-14","source_count":16,"accepted_source_count":9,"requirements":[{"code":"branch_and_office_connectivity","label":"Branch and office connectivity","state":"proven","evidence_source_ids":["src_financial_services_fs_100","src_financial_services_fs_077"],"verified_date":"2026-09-14"},{"code":"trading_and_low_latency_connectivity","label":"Trading and low-latency connectivity","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"data_centre_colocation_and_cloud_connectivity","label":"Data-centre, colocation and cloud connectivity","state":"partial","evidence_source_ids":["src_financial_services_fs_077"],"verified_date":"2026-09-14"},{"code":"resilience_and_tested_recovery","label":"Resilience and tested recovery","state":"partial","evidence_source_ids":["src_financial_services_fs_077","src_financial_services_fin_468"],"verified_date":"2026-09-14"},{"code":"network_segmentation_and_zoning","label":"Network segmentation and zoning","state":"partial","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"payment_and_cardholder_data_segmentation","label":"Payment and cardholder data segmentation","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"third_party_and_outsourced_access","label":"Third-party and outsourced access","state":"partial","evidence_source_ids":["src_financial_services_fin_471","src_financial_services_fin_520"],"verified_date":"2026-09-14"},{"code":"remote_and_hybrid_workforce","label":"Remote and hybrid workforce","state":"partial","evidence_source_ids":["src_financial_services_fin_471"],"verified_date":"2026-09-14"},{"code":"data_residency_and_sovereignty","label":"Data residency and sovereignty","state":"proven","evidence_source_ids":["src_financial_services_fin_468"],"verified_date":"2026-09-14"},{"code":"encryption_and_key_management","label":"Encryption and key management","state":"partial","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"logging_audit_and_evidence_retention","label":"Logging, audit and evidence retention","state":"partial","evidence_source_ids":["src_financial_services_fin_468"],"verified_date":"2026-09-14"},{"code":"identity_and_zero_trust_access","label":"Identity and zero trust access","state":"partial","evidence_source_ids":["src_financial_services_fin_465","src_financial_services_fin_471"],"verified_date":"2026-09-14"},{"code":"cloud_and_saas_data_controls","label":"Cloud and SaaS data controls","state":"partial","evidence_source_ids":["src_financial_services_fin_465","src_financial_services_fin_471"],"verified_date":"2026-09-14"},{"code":"managed_operations_and_soc","label":"Managed operations and SOC","state":"partial","evidence_source_ids":["src_financial_services_fin_468","src_manufacturing_mfg_063","src_financial_services_fin_472"],"verified_date":"2026-09-14"},{"code":"network_visibility_and_reporting","label":"Network visibility and reporting","state":"partial","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"change_control_and_configuration_governance","label":"Change control and configuration governance","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"incident_notification_support","label":"Incident notification support","state":"proven","evidence_source_ids":["src_financial_services_fin_468"],"verified_date":"2026-09-14"},{"code":"concentration_risk_and_subcontractor_transparency","label":"Concentration risk and subcontractor transparency","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"exit_and_portability","label":"Exit and portability","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"uk_regulatory_alignment_fca_and_pra","label":"UK regulatory alignment (FCA and PRA)","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"eu_dora_alignment","label":"EU DORA alignment","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"us_regulatory_alignment_ffiec_glba_nydfs_sec","label":"US regulatory alignment (FFIEC, GLBA, NYDFS, SEC)","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"canada_regulatory_alignment_osfi","label":"Canada regulatory alignment (OSFI)","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"pci_dss_alignment","label":"PCI DSS alignment","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"swift_csp_alignment","label":"SWIFT CSP alignment","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"uk_delivery","label":"UK delivery","state":"proven","evidence_source_ids":["src_financial_services_fs_100","src_financial_services_fin_468"],"verified_date":"2026-09-14"},{"code":"north_america_delivery","label":"North America delivery","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"global_delivery","label":"Global delivery","state":"proven","evidence_source_ids":["src_financial_services_fs_077","src_manufacturing_mfg_063"],"verified_date":"2026-09-14"}],"sources":[{"id":"src_financial_services_fs_077","workbook_source_id":"FIN-462","url":"https://www.vodafone.com/business/news-and-insights/case-studies/a-network-adapted-to-your-needs-transforming-a-financial-services-business-with-sd-wan","title":"A network adapted to your needs: transforming a financial services business with SD-WAN","publisher":"vodafone.com","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"medium","record_type":"Financial services solution page","requirement_codes":["data_centre_colocation_and_cloud_connectivity","branch_and_office_connectivity","resilience_and_tested_recovery"],"named_customer":null,"segment":"Unspecified","named_product_or_service":"Vodafone Business SD-WAN","service_family":"SD-WAN","estate":"over 170 sites","countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":"Consistent, uninterrupted service and secure, flexible workflow implementation","industrial_standard_or_regulation":null,"regulatory_regime":"Not stated","exact_supporting_wording":"Consistent, uninterrupted service","reviewer_summary":"Vodafone describes an unnamed 'leading financial services company' that deployed Vodafone Business SD-WAN across over 170 sites to refresh its network architecture and move to a cloud-first model.","limitation_and_notes":"The financial institution is not named, so this cannot prove a deployment at a specific bank or insurer. No sector (banking/insurance/asset management), country, RTO/RPO or measured performance figure is given."},{"id":"src_financial_services_fin_465","workbook_source_id":"FIN-465","url":"https://www.vodafone.co.uk/business/cyber-security-solutions/network-security/zscaler-cloud-security-solutions","title":"Zscaler Cloud Security Solutions | Vodafone UK","publisher":"vodafone.co.uk","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"medium","record_type":"Other","requirement_codes":["identity_and_zero_trust_access","cloud_and_saas_data_controls"],"named_customer":null,"segment":"Unspecified","named_product_or_service":"Vodafone Business Zscaler Cloud Security Solutions (Vodafone Business SASE)","service_family":"SASE","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":null,"regulatory_regime":"Not stated","exact_supporting_wording":"DLP capabilities to prevent sensitive data from being leaked or misused, helping organisations comply with data protection regulations","reviewer_summary":"Vodafone UK describes reselling Zscaler Internet Access and Zscaler Private Access, including ZTNA (never trust, always verify) and DLP features, as part of Vodafone Business SASE.","limitation_and_notes":"No financial services customer or context is named; this only proves the named SASE service includes ZTNA and DLP capability in general, not for an FS customer."},{"id":"src_financial_services_fin_468","workbook_source_id":"FIN-468","url":"https://assets.applytosupply.digitalmarketplace.service.gov.uk/g-cloud-14/documents/92222/866476791133693-terms-and-conditions-2024-05-03-0954.pdf","title":"C2 General SOC & SIEM Vodafone Business Security Enhanced - Terms and Conditions","publisher":"assets.applytosupply.digitalmarketplace.service.gov.uk","publication_date":"2024-05-03","checked_date":"2026-09-14","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"high","record_type":"Compliance attestation or statement","requirement_codes":["logging_audit_and_evidence_retention","resilience_and_tested_recovery","data_residency_and_sovereignty","incident_notification_support","managed_operations_and_soc","uk_delivery"],"named_customer":null,"segment":"Unspecified","named_product_or_service":"Vodafone Business Security Enhanced (VBSE) Managed SOC and SIEM","service_family":"Supporting only","estate":null,"countries_or_regions":"UK / EEA","ot_or_production_environment":null,"measured_or_stated_outcome":"99.7% availability for non-resilient solutions and 99.99% for resilient solutions; Severity 1 incidents targeted for 4-hour restoration","industrial_standard_or_regulation":null,"regulatory_regime":"UK","exact_supporting_wording":"Managed Security Operations Centre + Security Information and Event Management: \"Our 24x7x365 Managed Service receives security event logs from your equipment, analysed by security cleared SOC team.\" / \"UK Secure Data Centres/ISO27001\" / \"Supported by security cleared UK sovereign personnel up to DV\"","reviewer_summary":"Vodafone's G-Cloud terms and conditions for the VBSE Managed SOC and SIEM service state UK-based operational centres, defined SLA availability tiers with restoration targets, and a security incident notification commitment within 60 minutes of detection.","limitation_and_notes":"Checker 2026-09-12: page carries the fact but the wording differs (PDF loaded; individual facts (24x7x365 SOC access, UK operational centres, transfer clauses, 60-min/24-hr notification) each appear but with different wording t). Re-quote verbatim. This is a general commercial services document, not financial-services-specific, and log retention is described as set per Order Form rather than a published fixed period, so it does not prove a specific retention duration. [2026-09-15] The original PDF T&Cs document itself remains unfetched, but the live G-Cloud 14 service listing this contract sits under (applytosupply.digitalmarketplace.service.gov.uk/g-cloud/services/866476791133693) was found and gives clearer, quotable content for the same Vodafone Managed SOC/SIEM service - used that instead. Confirms 24x7x365 SOC, UK data centres/ISO27001, and UK-sovereign, security-cleared personnel."},{"id":"src_financial_services_fin_469","workbook_source_id":"FIN-469","url":"https://www.vodafone.com/business/products/fixed-connectivity/sd-wan/sd-wan-cisco","title":"Vodafone Business SD-WAN with Cisco | Fixed connectivity","publisher":"vodafone.com","publication_date":null,"checked_date":"2026-09-15","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"low","record_type":"Other","requirement_codes":["network_visibility_and_reporting"],"named_customer":null,"segment":"Unspecified","named_product_or_service":"Vodafone Business SD-WAN with Cisco","service_family":"SD-WAN","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":null,"regulatory_regime":"Not stated","exact_supporting_wording":"Get complete visibility of your network performance","reviewer_summary":"Product page for the Cisco-based Vodafone Business SD-WAN variant references a 'Finance' section heading and a general application-visibility capability claim; no case study content or financial services detail was retrievable.","limitation_and_notes":"Quoted wording not found on the page in the 2026-09-12 check (Exact phrase not found on the page.). Re-quote before accepting. The visibility claim is a generic product feature, not tied to a financial services customer. The referenced 'Finance' case study link content could not be retrieved. [2026-09-15 Harry review] Verified live 2026-09-15. Generic product-feature page; the \"Finance\" case study it links to could not be retrieved, so this only supports Network visibility and reporting as Partial (documentation-level), not tied to a named financial customer."},{"id":"src_financial_services_fin_471","workbook_source_id":"FIN-471","url":"https://assets.ctfassets.net/obescfmtzvv4/7s6RrDxv9fWrQb5fjiwsYK/0c29107da235bd6426def9b47f4ba28e/SASE_Use_Cases__1_.pdf","title":"Use cases: Vodafone Business Secure Access Service Edge (SASE)","publisher":"assets.ctfassets.net","publication_date":null,"checked_date":"2026-09-14","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"medium","record_type":"Other","requirement_codes":["third_party_and_outsourced_access","identity_and_zero_trust_access","cloud_and_saas_data_controls","remote_and_hybrid_workforce"],"named_customer":null,"segment":"Unspecified","named_product_or_service":"Vodafone Business Secure Access Service Edge (SASE)","service_family":"SASE","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":null,"regulatory_regime":"Not stated","exact_supporting_wording":"third-party contractor onboarding with least-privilege access; remote worker access with threat inspection; cloud data protection against theft, loss and leakage","reviewer_summary":"A Vodafone Business SASE use-case document describes ZTNA-based remote worker access, ZTNA-based third-party/contractor onboarding with least-privilege access, and CASB-style cloud data protection, covering general enterprise scenarios.","limitation_and_notes":"Checker 2026-09-12: page carries the fact but the wording differs (PDF loaded; the three use cases are present but with different wording/phrasing than the composite quote (e.g. 'contractors are onboarded seamlessly and provide). Re-quote verbatim. None of the use cases are set in a financial services context and no named customer is given, so this proves general product capability only, not a financial services deployment. [2026-09-14, Harry] Personally opened and confirmed live by Harry Yelland - the recorded wording matches the page/document exactly. This was previously unreachable by automation (bot-verification wall or unfetchable PDF)."},{"id":"src_financial_services_fin_472","workbook_source_id":"FIN-472","url":"https://www.vodafone.com/business/products/fixed-connectivity/sd-wan/sase","title":"Vodafone Business Secure Access Service Edge (SASE)","publisher":"vodafone.com","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"low","record_type":"Other","requirement_codes":["managed_operations_and_soc"],"named_customer":null,"segment":"Unspecified","named_product_or_service":"Vodafone Business Secure Access Service Edge (SASE)","service_family":"SASE","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":null,"regulatory_regime":"Not stated","exact_supporting_wording":"24/7 support","reviewer_summary":"General Vodafone Business SASE product page describing centralised control, integrated connectivity and security, and 24/7 support; no vendor names (Zscaler/Palo Alto), financial services content, or named customer in the fetched extract.","limitation_and_notes":"The 24/7 support claim is generic marketing copy, not a specific SOC commitment, and has no financial services or named-customer connection."},{"id":"src_financial_services_fin_520","workbook_source_id":"FIN-520","url":"https://www.vodafone.com/business/solutions/by-need/secure-connected-enterprise/secure-third-party-access","title":"Secure Third-Party Access - Vodafone Business","publisher":"vodafone.com","publication_date":null,"checked_date":"2026-09-15","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"medium","record_type":"Compliance attestation or statement","requirement_codes":["third_party_and_outsourced_access"],"named_customer":null,"segment":"Unspecified","named_product_or_service":"Vodafone Secure Third-Party Access","service_family":"Supporting only","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":null,"regulatory_regime":null,"exact_supporting_wording":"Dedicated product page describing secure third-party access as a named capability within Vodafone's secure connected enterprise portfolio.","reviewer_summary":"Harry personally verified this live 2026-09-15. A named product capability page, not a named financial customer or contractual term - graded Partial, product documentation rather than customer-context or regulatory evidence.","limitation_and_notes":"Added 2026-09-15, Harry-verified. Product capability page, no named financial customer."},{"id":"src_financial_services_fs_100","workbook_source_id":"FS-100","url":"https://downloads.vodafone.co.uk/69eepp2lubij/7tdtgGhaFENtzAtBQ94r6U/7fc7af407373b17ee02c47f9aa609806/How_SD-WAN_works.pdf","title":"How SD-WAN works: use case - How SD-WAN drives real business value for a multinational bank in the UK","publisher":"downloads.vodafone.co.uk","publication_date":null,"checked_date":"2026-09-11","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"medium","record_type":"Named customer case study","requirement_codes":["branch_and_office_connectivity","uk_delivery"],"named_customer":"Not named (described only as \"a multinational bank in the UK\")","segment":"Retail banking","named_product_or_service":"Vodafone SD-WAN, Vodafone Cloud and Cloud Connect services","service_family":"SD-WAN","estate":"Not stated (branch estate, no specific count)","countries_or_regions":"United Kingdom","ot_or_production_environment":null,"measured_or_stated_outcome":"Faster, more reliable connectivity; achieved 'branch of the future' ambitions; enhanced data collection and storage via Vodafone Cloud and Cloud Connect","industrial_standard_or_regulation":"None stated","regulatory_regime":"UK","exact_supporting_wording":"\"How SD-WAN drives real business value for a multinational bank in the UK... This multinational bank wanted to transform its branch estate and legacy systems to create the 'branch of the future'... Using Vodafone SD-WAN, the bank gained faster, more reliable connectivity.\"","reviewer_summary":"Vodafone's own PDF use-case document, verified live 2026-09-11. Explicitly names the customer as 'a multinational bank in the UK' (not individually named) using Vodafone SD-WAN for its branch network, plus Vodafone Cloud/Cloud Connect for data. This is the clearest UK-regime financial services evidence found for Vodafone - directly supports Branch and office connectivity and UK delivery.","limitation_and_notes":"Customer is described only as \"a multinational bank in the UK\", not individually named - a named institution would be stronger evidence. Added 2026-09-11 to properly back Vodafone's Branch and office connectivity and UK delivery capability cells, which were previously Proven with no source."},{"id":"src_financial_services_fin_463","workbook_source_id":"FIN-463","url":"https://www.vodafone.com/business/solutions/by-industry/banking-and-finance","title":"Vodafone Business in Banking and Finance","publisher":"vodafone.com","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"rejected","reviewer_confidence":"low","record_type":"Financial services solution page","requirement_codes":[],"named_customer":null,"segment":"Unspecified","named_product_or_service":"Vodafone Business SD-WAN / SASE / Managed Security Services","service_family":"Multiple","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":null,"regulatory_regime":"Not stated","exact_supporting_wording":"help to make your business resilient against cyber threats","reviewer_summary":"A generic banking and finance solutions landing page listing Vodafone Business products (SD-WAN, SASE, Managed Security Services, Device as a Service) with marketing language but no named customer, metric, or regulation.","limitation_and_notes":"No named financial institution, no specific claim tied to a capability, and no regulatory reference. Too generic to support any of the 28 columns beyond context."},{"id":"src_financial_services_fin_464","workbook_source_id":"FIN-464","url":"https://www.vodafone.com/business/products/fixed-connectivity/sd-wan","title":"Vodafone Business SD-WAN","publisher":"vodafone.com","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"rejected","reviewer_confidence":"low","record_type":"Other","requirement_codes":[],"named_customer":null,"segment":"Unspecified","named_product_or_service":"Vodafone Business SD-WAN","service_family":"SD-WAN","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":null,"regulatory_regime":"Not stated","exact_supporting_wording":"Network-as-a-Service","reviewer_summary":"General Vodafone Business SD-WAN product page positioning the service as Network-as-a-Service with Cisco/VMware/Fortinet options; no financial services content in the fetched extract.","limitation_and_notes":"No financial services mention, no named customer, no specific technical or regulatory fact usable for any column."},{"id":"src_financial_services_fs_078","workbook_source_id":"FIN-466","url":"https://www.vodafone.co.uk/business/our-industry-expertise/finance","title":"Finance | Industry Expertise | Vodafone UK","publisher":"vodafone.co.uk","publication_date":null,"checked_date":"2026-09-15","source_ownership":"provider_authored","decision":"rejected","reviewer_confidence":"low","record_type":"Financial services solution page","requirement_codes":["managed_operations_and_soc"],"named_customer":"Lloyds Banking Group","segment":"Retail banking","named_product_or_service":"Vodafone Business network security and Security Operations Centres","service_family":"Supporting only","estate":null,"countries_or_regions":"UK","ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":null,"regulatory_regime":"UK","exact_supporting_wording":"Security Operations Centres (SOC) for threat detection","reviewer_summary":"Vodafone UK's finance industry page describes generic network protection, phishing awareness and Security Operations Centre capability for finance sector customers, and separately quotes a Lloyds Banking Group executive about a digital-inclusion partnership unrelated to network or security services.","limitation_and_notes":"Quoted wording not found on the page in the 2026-09-12 check (Exact phrase not found; page has similar but differently worded SOC mention.). Re-quote before accepting. The Lloyds Banking Group quote concerns a digital-inclusion community programme, not SD-WAN, SASE or Managed Security deployment, so it cannot be used as a named-customer proof point for any connectivity or security column. The SOC reference is generic to the finance sector, not tied to Lloyds or any other named institution. [2026-09-15 Harry review] Rejected 2026-09-15: the checker confirmed the Lloyds Banking Group quote concerns a digital-inclusion community programme, not any SD-WAN, SASE or Managed Security deployment. Lloyds is not a customer reference for Managed operations and SOC and this source cannot be used for that capability."},{"id":"src_financial_services_fin_467","workbook_source_id":"FIN-467","url":"https://www.vodafone.com/business/products/security/managed-security-services","title":"Vodafone Business Managed Security Services","publisher":"vodafone.com","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"rejected","reviewer_confidence":"low","record_type":"Other","requirement_codes":[],"named_customer":null,"segment":"Unspecified","named_product_or_service":"Vodafone Business Managed Security Services","service_family":"Supporting only","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":null,"regulatory_regime":"Not stated","exact_supporting_wording":"Protecting 162 million IoT devices globally","reviewer_summary":"General Managed Security Services product page citing Vodafone's overall scale (customers and IoT devices protected); no financial services content, SOC detail, or named customer in the fetched extract.","limitation_and_notes":"Scale statistics are company-wide, not service- or sector-specific, and provide no fact usable against any of the 28 columns."}]},{"slug":"sonicwall-cse","name":"SonicWall Cloud Secure Edge","marketplace_url":"https://netify.co.uk/marketplace/sonicwall-cse/","research_status":"complete","overall_confidence":"low","fit_conclusion":"SonicWall's evidence for financial services is thin and concentrated in one area: Cloud Secure Edge (CSE), its ZTNA/SASE product, has a single named financial customer, the US insurer Lemonade, which used it to replace VPN-based remote access, giving reasonable proof for remote workforce access, zero trust identity and log retention (12 months). Separately, SonicWall's own FIPS 140-2 certifications page validates the TZ and NSa firewall hardware that its Secure SD-WAN product runs on, which supports the encryption and key management column for that product family only, not for CSE. No named financial institution was found using Secure SD-WAN for branch, trading, data-centre or resilience use cases, and no evidence connects either product to FCA/PRA, DORA, FFIEC/GLBA/NYDFS, OSFI or SWIFT CSP requirements; the PCI DSS material is a generic solution brief with no Attestation of Compliance or named service. Data residency, exit/portability, change control, managed SOC for the named products, and UK or global delivery are all unevidenced. For a UK or North American bank, insurer or asset manager, the current public record supports only a narrow zero-trust remote-access use case via one small US customer, not a broad connectivity or regulatory-alignment case.","gaps_and_unknowns":"No evidence was found for branch/office connectivity, trading connectivity, data-centre/cloud connectivity, network segmentation, cardholder data segmentation, data residency, managed SOC, change control, exit/portability, or any of the four regional regulatory regimes (FCA/PRA, DORA, FFIEC/GLBA/NYDFS, OSFI) or SWIFT CSP for the named Secure SD-WAN or Cloud Secure Edge products. Closing these would require SonicWall publishing named FS case studies for Secure SD-WAN branch or DR deployments, a service-specific compliance statement (data residency, PCI DSS AoC, or a DORA/FCA/NYDFS mapping) naming Cloud Secure Edge or Secure SD-WAN directly, and confirmation of whether Cloud Secure Edge itself (not just the TZ/NSa hardware) holds any FIPS validation.","reviewed_by":"Harry Yelland","reviewed_date":"2026-09-14","source_count":9,"accepted_source_count":8,"requirements":[{"code":"branch_and_office_connectivity","label":"Branch and office connectivity","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"trading_and_low_latency_connectivity","label":"Trading and low-latency connectivity","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"data_centre_colocation_and_cloud_connectivity","label":"Data-centre, colocation and cloud connectivity","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"resilience_and_tested_recovery","label":"Resilience and tested recovery","state":"partial","evidence_source_ids":["src_financial_services_fin_408"],"verified_date":"2026-09-14"},{"code":"network_segmentation_and_zoning","label":"Network segmentation and zoning","state":"partial","evidence_source_ids":["src_financial_services_fs_064","src_financial_services_fin_406"],"verified_date":"2026-09-14"},{"code":"payment_and_cardholder_data_segmentation","label":"Payment and cardholder data segmentation","state":"partial","evidence_source_ids":["src_financial_services_fin_406"],"verified_date":"2026-09-14"},{"code":"third_party_and_outsourced_access","label":"Third-party and outsourced access","state":"partial","evidence_source_ids":["src_financial_services_fin_407"],"verified_date":"2026-09-14"},{"code":"remote_and_hybrid_workforce","label":"Remote and hybrid workforce","state":"proven","evidence_source_ids":["src_financial_services_fs_065","src_financial_services_fin_404"],"verified_date":"2026-09-14"},{"code":"data_residency_and_sovereignty","label":"Data residency and sovereignty","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"encryption_and_key_management","label":"Encryption and key management","state":"proven","evidence_source_ids":["src_financial_services_fin_405"],"verified_date":"2026-09-14"},{"code":"logging_audit_and_evidence_retention","label":"Logging, audit and evidence retention","state":"proven","evidence_source_ids":["src_financial_services_fs_065"],"verified_date":"2026-09-14"},{"code":"identity_and_zero_trust_access","label":"Identity and zero trust access","state":"proven","evidence_source_ids":["src_financial_services_fs_065","src_financial_services_fin_404"],"verified_date":"2026-09-14"},{"code":"cloud_and_saas_data_controls","label":"Cloud and SaaS data controls","state":"partial","evidence_source_ids":["src_financial_services_fs_065"],"verified_date":"2026-09-14"},{"code":"managed_operations_and_soc","label":"Managed operations and SOC","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"network_visibility_and_reporting","label":"Network visibility and reporting","state":"partial","evidence_source_ids":["src_financial_services_fs_064"],"verified_date":"2026-09-14"},{"code":"change_control_and_configuration_governance","label":"Change control and configuration governance","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"incident_notification_support","label":"Incident notification support","state":"partial","evidence_source_ids":["src_financial_services_fin_407"],"verified_date":"2026-09-14"},{"code":"concentration_risk_and_subcontractor_transparency","label":"Concentration risk and subcontractor transparency","state":"partial","evidence_source_ids":["src_financial_services_fin_407"],"verified_date":"2026-09-14"},{"code":"exit_and_portability","label":"Exit and portability","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"uk_regulatory_alignment_fca_and_pra","label":"UK regulatory alignment (FCA and PRA)","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"eu_dora_alignment","label":"EU DORA alignment","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"us_regulatory_alignment_ffiec_glba_nydfs_sec","label":"US regulatory alignment (FFIEC, GLBA, NYDFS, SEC)","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"canada_regulatory_alignment_osfi","label":"Canada regulatory alignment (OSFI)","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"pci_dss_alignment","label":"PCI DSS alignment","state":"partial","evidence_source_ids":["src_financial_services_fin_406"],"verified_date":"2026-09-14"},{"code":"swift_csp_alignment","label":"SWIFT CSP alignment","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"uk_delivery","label":"UK delivery","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"north_america_delivery","label":"North America delivery","state":"proven","evidence_source_ids":["src_financial_services_fs_065","src_financial_services_fin_404"],"verified_date":"2026-09-14"},{"code":"global_delivery","label":"Global delivery","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"}],"sources":[{"id":"src_financial_services_fs_064","workbook_source_id":"FIN-402","url":"https://www.sonicwall.com/solutions/industry/financial-services","title":"SonicWall - Cyber Security for Financial Services","publisher":"sonicwall.com","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"low","record_type":"Financial services solution page","requirement_codes":["network_visibility_and_reporting"],"named_customer":null,"segment":"Unspecified","named_product_or_service":"SonicWall (Next Generation Firewall, Network Security Manager, secure access, cloud email security)","service_family":"Not relevant","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":null,"regulatory_regime":"Not stated","exact_supporting_wording":"Trusted by more than 6,000 financial services organizations worldwide, SonicWall delivers robust, manageable network information security in financial services","reviewer_summary":"This is a generic financial services marketing page listing SonicWall firewall, email security and management products, with a claim of 6,000+ financial services customers worldwide but no named institution.","limitation_and_notes":"Does not name Secure SD-WAN or Cloud Secure Edge, does not name any financial institution, and cites no case study, compliance regime or measurable outcome. Only usable as weak, generic context for reporting/visibility products offered to the sector."},{"id":"src_financial_services_fs_065","workbook_source_id":"FIN-403","url":"https://www.sonicwall.com/products/cloud-secure-edge","title":"SonicWall - Cloud Secure Edge product page","publisher":"sonicwall.com","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"medium","record_type":"Financial services solution page","requirement_codes":["logging_audit_and_evidence_retention","identity_and_zero_trust_access","cloud_and_saas_data_controls","remote_and_hybrid_workforce","north_america_delivery"],"named_customer":"Lemonade","segment":"Insurance","named_product_or_service":"SonicWall Cloud Secure Edge (CSE)","service_family":"SASE","estate":null,"countries_or_regions":"United States","ot_or_production_environment":null,"measured_or_stated_outcome":"One-click browser-based access replacing a six-step VPN login, with continuous user/device trust scoring","industrial_standard_or_regulation":null,"regulatory_regime":"US","exact_supporting_wording":"Compared to our VPN, it's night and day. CSE is the best Zero Trust solution in the market today.","reviewer_summary":"SonicWall's Cloud Secure Edge product page carries a customer testimonial from Lemonade's CISO Jonathan Jaffe describing CSE as a Zero Trust replacement for VPN, and states that CSE provides 12-month log retention, geo-blocking, AI app inventory and continuous authorisation logging.","limitation_and_notes":"Testimonial-style page, not a full case study with figures; does not state data residency, SLA, or CASB/DLP detail specific to Lemonade; Lemonade is an insurtech/insurance carrier, not a bank."},{"id":"src_financial_services_fin_404","workbook_source_id":"FIN-404","url":"https://www.casestudies.com/company/sonicwall/case-study/lemonade-moves-up-to-sonicwall-cloud-secure-edge","title":"Case Study: Lemonade achieves dramatically improved security and one-click remote access with SonicWall Cloud Secure Edge","publisher":"casestudies.com","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"medium","record_type":"Named customer case study","requirement_codes":["identity_and_zero_trust_access","remote_and_hybrid_workforce","north_america_delivery"],"named_customer":"Lemonade","segment":"Insurance","named_product_or_service":"SonicWall Cloud Secure Edge (CSE)","service_family":"SASE","estate":"about one-third of the company (deployment in progress, full rollout planned)","countries_or_regions":"United States","ot_or_production_environment":null,"measured_or_stated_outcome":"Reduced remote access from six steps to one click; eliminated manual per-user troubleshooting; continuous user/device trust scoring","industrial_standard_or_regulation":null,"regulatory_regime":"US","exact_supporting_wording":"faced insecure and hard-to-manage remote access: a legacy VPN that added latency, required six steps for employees to connect, and forced manual, error-prone administration from a small security team","reviewer_summary":"Lemonade, a digital insurance company, replaced its VPN with SonicWall Cloud Secure Edge for zero-trust remote access, with rollout covering about a third of the company and full deployment planned; CISO Jonathan Jaffe is quoted.","limitation_and_notes":"This is a third-party syndication of SonicWall's own case study (originally hosted at sonicwall.com but rendered as a JavaScript app that did not return full text on direct fetch); no user counts, dates, compliance regime, data residency or SLA are given, and it does not address branch, trading, DC/cloud, segmentation or regulatory columns."},{"id":"src_financial_services_fin_405","workbook_source_id":"FIN-405","url":"https://www.sonicwall.com/solutions/certifications/federal-information-processing-standard-fips-140-2","title":"Government Federal Certifications: Federal Information Processing Standard (FIPS) 140-2 | SonicWall","publisher":"sonicwall.com","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"high","record_type":"Compliance attestation or statement","requirement_codes":["encryption_and_key_management"],"named_customer":null,"segment":"Unspecified","named_product_or_service":"SonicWall Next-Generation Firewall TZ270/W, TZ370/W, TZ470/W, TZ670, NSa2700, NSa3700, NSsp 14700, NSsp 15700 (the firewall platforms that run Secure SD-WAN), plus NSM, CSa, SMA and NSv","service_family":"SD-WAN","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":"FIPS 140-2","regulatory_regime":"Not stated","exact_supporting_wording":"Cryptographic modules that have been tested and validated under the Cryptographic Module Validation Program as meeting requirements for FIPS 140-1, FIPS 140-2, and FIPS 140-3.","reviewer_summary":"SonicWall's own certifications page lists FIPS 140-2 validation for named TZ and NSa firewall models, which are the hardware platforms Secure SD-WAN runs on, alongside NSM, CSa, SMA and NSv; Cloud Secure Edge is not on this validated list.","limitation_and_notes":"Validation covers the firewall hardware/firmware, not Cloud Secure Edge (a cloud ZTNA/SASE service); a validation timeline note on the page shows most entries sunsetting 2026-09-21, and no key-management or in-transit/at-rest detail beyond module names is given."},{"id":"src_financial_services_fin_406","workbook_source_id":"FIN-406","url":"https://www.sonicwall.com/resources/white-papers/how-sonicwall-solutions-can-help-you-become-pci-dss-compliant","title":"How SonicWall Solutions Can Help You Become PCI DSS Compliant","publisher":"sonicwall.com","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"low","record_type":"Compliance attestation or statement","requirement_codes":["payment_and_cardholder_data_segmentation","network_segmentation_and_zoning","pci_dss_alignment"],"named_customer":null,"segment":"Unspecified","named_product_or_service":"SonicWall (company-wide)","service_family":"Not relevant","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":"PCI DSS","regulatory_regime":"Not stated","exact_supporting_wording":"SonicWall offers solutions that support PCI DSS compliance by providing robust encryption, detailed logging, network segmentation, and 24/7 security monitoring.","reviewer_summary":"A SonicWall white paper describes how its solutions generally support PCI DSS 4.0 requirements through encryption, logging, segmentation and monitoring, but does not name Secure SD-WAN or Cloud Secure Edge in that discussion, nor provide an Attestation of Compliance.","limitation_and_notes":"Generic solution brief; Secure SD-WAN and Cloud Secure Edge appear only in navigation menus, not in the PCI DSS discussion itself; no Attestation of Compliance, no named financial customer, no cardholder-data-environment scoping detail."},{"id":"src_financial_services_fin_407","workbook_source_id":"FIN-407","url":"https://trust.sonicwall.com/","title":"SonicWall Trust Center | Powered by SafeBase","publisher":"trust.sonicwall.com","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"medium","record_type":"Compliance attestation or statement","requirement_codes":["concentration_risk_and_subcontractor_transparency","third_party_and_outsourced_access","incident_notification_support"],"named_customer":null,"segment":"Unspecified","named_product_or_service":"SonicWall (company-wide)","service_family":"Not relevant","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":"SOC 2 Type II","regulatory_regime":"Not stated","exact_supporting_wording":"COMPLIANCE SOC 2 Type 2","reviewer_summary":"SonicWall's SafeBase-hosted Trust Center lists SOC 2 Type 2, FIPS 140-2, FIPS 140-3 and Common Criteria as company certifications, and names Microsoft Azure, Google Cloud and AWS as subprocessors, alongside policy summaries for incident response, vendor management, access control and customer audit rights.","limitation_and_notes":"This is a company-wide trust portal; it does not state which products or services (Secure SD-WAN, Cloud Secure Edge) are in scope for SOC 2 or for the listed subprocessors, gives no data residency detail, no stated log retention period, no incident notification timeline, and full policy documents sit behind an access request the fetch could not verify."},{"id":"src_financial_services_fin_408","workbook_source_id":"FIN-408","url":"https://www.sonicwall.com/solutions/use-cases/secure-sd-wan","title":"SD-WAN Solutions for Enterprise Network Security | SonicWall","publisher":"sonicwall.com","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"low","record_type":"Financial services solution page","requirement_codes":["resilience_and_tested_recovery"],"named_customer":null,"segment":"Unspecified","named_product_or_service":"SonicWall Secure SD-WAN","service_family":"SD-WAN","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":null,"regulatory_regime":"Not stated","exact_supporting_wording":"automatically steer business-critical applications over highly available links","reviewer_summary":"SonicWall's Secure SD-WAN use-case page describes high availability and dynamic, application-aware path selection with AES encryption between sites, and lists Financial Services as one of several industry categories, with no named customer or FS-specific detail.","limitation_and_notes":"No named financial institution, no RTO/RPO figures, no DR test outcome, no branch count, and no data-centre or colocation on-ramp detail; Financial Services appears only as a menu category with no elaboration."}]},{"slug":"orangebusiness","name":"Orange Business","marketplace_url":"https://netify.co.uk/marketplace/orangebusiness/","research_status":"complete","overall_confidence":"low","fit_conclusion":"The only clearly proven financial services deployment is BNP Paribas, which named Orange Business Flexible SD-WAN for a rollout across more than 1,800 retail branches in France, an EU regime case with no stated RTO/RPO or tested recovery outcome. Two further named financial customers, Sto (Norwegian BankID/BankAxept payment infrastructure) and Banqsoft (Nordic fintech), reference DORA, PCI DSS and European data residency, but neither statement is tied to Flexible SD-WAN, SASE or Orange Cyberdefense by name, so they support only partial evidence. No UK, US or Canadian named financial customer, PoP list or regulatory statement was found, and Orange Business's own published certification list does not include PCI DSS or FIPS 140-2/140-3. On the evidence opened, Orange Business is best supported for branch connectivity in an EU/France banking context, with material gaps for UK and North American regulatory alignment, trading connectivity, and documentation-grade columns such as logging retention, identity and access, and exit and portability.","gaps_and_unknowns":"No evidence was found for trading and low-latency connectivity, network segmentation, payment/cardholder segmentation, third-party access controls, logging and audit retention, identity and zero trust access, change control, incident notification timelines, subcontractor transparency, exit and portability, SWIFT CSP alignment, or any UK, US or Canadian regulatory alignment or delivery evidence naming a financial customer. Closing these would require Orange Business publishing a dedicated financial services compliance pack (data processing agreement, log retention statement, PCI DSS Attestation of Compliance, DORA Article 30 terms) and named UK or North American bank, insurer or payments case studies, none of which could be located via the pages opened. [2026-09-15] Independent media coverage of the same BNP Paribas deployment adds explicit business-continuity and firewall/segmentation detail. Moved from 1 to 3 Proven cells.","reviewed_by":"Harry Yelland","reviewed_date":"2026-09-14","source_count":15,"accepted_source_count":10,"requirements":[{"code":"branch_and_office_connectivity","label":"Branch and office connectivity","state":"proven","evidence_source_ids":["src_financial_services_fs_058","src_financial_services_fs_058"],"verified_date":"2026-09-14"},{"code":"trading_and_low_latency_connectivity","label":"Trading and low-latency connectivity","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"data_centre_colocation_and_cloud_connectivity","label":"Data-centre, colocation and cloud connectivity","state":"partial","evidence_source_ids":["src_financial_services_fin_375"],"verified_date":"2026-09-14"},{"code":"resilience_and_tested_recovery","label":"Resilience and tested recovery","state":"proven","evidence_source_ids":["src_financial_services_fs_058","src_financial_services_fin_507"],"verified_date":"2026-09-14"},{"code":"network_segmentation_and_zoning","label":"Network segmentation and zoning","state":"proven","evidence_source_ids":["src_financial_services_fin_507"],"verified_date":"2026-09-14"},{"code":"payment_and_cardholder_data_segmentation","label":"Payment and cardholder data segmentation","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"third_party_and_outsourced_access","label":"Third-party and outsourced access","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"remote_and_hybrid_workforce","label":"Remote and hybrid workforce","state":"partial","evidence_source_ids":["src_financial_services_fin_376"],"verified_date":"2026-09-14"},{"code":"data_residency_and_sovereignty","label":"Data residency and sovereignty","state":"partial","evidence_source_ids":["src_financial_services_fs_056","src_financial_services_fs_057"],"verified_date":"2026-09-14"},{"code":"encryption_and_key_management","label":"Encryption and key management","state":"partial","evidence_source_ids":["src_financial_services_fin_379"],"verified_date":"2026-09-14"},{"code":"logging_audit_and_evidence_retention","label":"Logging, audit and evidence retention","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"identity_and_zero_trust_access","label":"Identity and zero trust access","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"cloud_and_saas_data_controls","label":"Cloud and SaaS data controls","state":"partial","evidence_source_ids":["src_financial_services_fin_375"],"verified_date":"2026-09-14"},{"code":"managed_operations_and_soc","label":"Managed operations and SOC","state":"proven","evidence_source_ids":["src_financial_services_fin_375","src_financial_services_fin_376","src_financial_services_fin_515"],"verified_date":"2026-09-14"},{"code":"network_visibility_and_reporting","label":"Network visibility and reporting","state":"partial","evidence_source_ids":["src_financial_services_fin_379"],"verified_date":"2026-09-14"},{"code":"change_control_and_configuration_governance","label":"Change control and configuration governance","state":"partial","evidence_source_ids":["src_financial_services_fin_515"],"verified_date":"2026-09-14"},{"code":"incident_notification_support","label":"Incident notification support","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"concentration_risk_and_subcontractor_transparency","label":"Concentration risk and subcontractor transparency","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"exit_and_portability","label":"Exit and portability","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"uk_regulatory_alignment_fca_and_pra","label":"UK regulatory alignment (FCA and PRA)","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"eu_dora_alignment","label":"EU DORA alignment","state":"partial","evidence_source_ids":["src_financial_services_fs_056","src_financial_services_fin_377"],"verified_date":"2026-09-14"},{"code":"us_regulatory_alignment_ffiec_glba_nydfs_sec","label":"US regulatory alignment (FFIEC, GLBA, NYDFS, SEC)","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"canada_regulatory_alignment_osfi","label":"Canada regulatory alignment (OSFI)","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"pci_dss_alignment","label":"PCI DSS alignment","state":"partial","evidence_source_ids":["src_financial_services_fs_056","src_financial_services_fin_377"],"verified_date":"2026-09-14"},{"code":"swift_csp_alignment","label":"SWIFT CSP alignment","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"uk_delivery","label":"UK delivery","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"north_america_delivery","label":"North America delivery","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"global_delivery","label":"Global delivery","state":"partial","evidence_source_ids":["src_financial_services_fin_379"],"verified_date":"2026-09-14"}],"sources":[{"id":"src_financial_services_fs_058","workbook_source_id":"FIN-372","url":"https://www.orange-business.com/en/press/bnp-paribas-joins-forces-orange-business-services-deploy-sd-wan-1800-retail-sites-france","title":"BNP Paribas joins forces with Orange Business to deploy SD-WAN for 1,800 retail sites in France","publisher":"orange-business.com","publication_date":"2021-01-13","checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"high","record_type":"Contract award","requirement_codes":["branch_and_office_connectivity","resilience_and_tested_recovery"],"named_customer":"BNP Paribas","segment":"Retail banking","named_product_or_service":"Flexible SD-WAN","service_family":"SD-WAN","estate":"more than 1,800 branches, approximately 3,600 access lines (two per branch)","countries_or_regions":"France","ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":null,"regulatory_regime":"EU","exact_supporting_wording":"More than 3,600 access lines—two per branch, including one Internet access line – are currently being rolled out. In addition to the SD-WAN overlay, firewalls for enhanced security are also part of this deployment.","reviewer_summary":"BNP Paribas is deploying Orange Business's Flexible SD-WAN, with integrated firewalls, across more than 1,800 retail branches in France, with the rollout designed to maintain business continuity at each site during migration.","limitation_and_notes":"Press release dated 2021; does not state RTO/RPO, tested failover results, segmentation/VRF detail, or any UK/US/Canada relevance. It is a France-only, EU-regime deployment."},{"id":"src_financial_services_fs_056","workbook_source_id":"FIN-373","url":"https://www.orange-business.com/en/about-us/customer-stories/sto-sovereign-services-banking-finance","title":"Sto: Sovereign services for banking and finance","publisher":"orange-business.com","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"medium","record_type":"Named customer case study","requirement_codes":["data_residency_and_sovereignty","eu_dora_alignment","pci_dss_alignment"],"named_customer":"Sto","segment":"Payments and fintech","named_product_or_service":"sovereign cloud (unnamed Orange product; Microsoft Azure referenced)","service_family":"Not relevant","estate":"nearly one billion transactions per year, millions of daily users","countries_or_regions":"Norway, with expansion referenced to Denmark, Italy, Spain and South America","ot_or_production_environment":null,"measured_or_stated_outcome":"We receive very few remarks in the annual audit reports","industrial_standard_or_regulation":"DORA; NIS2; ISAE 3402; PCI DSS","regulatory_regime":"EU","exact_supporting_wording":"Sto was among the first to demonstrate compliance with new security regulations such as NIS2 and the more specific legislation for the banking and financial sector: DORA.","reviewer_summary":"Sto, which operates Norway's BankID and BankAxept national payment infrastructure, hosts its platform in an Orange Business sovereign cloud and states it was an early adopter of NIS2 and DORA compliance, with its card-payment platform also subject to ISAE 3402 and PCI DSS.","limitation_and_notes":"Does not name Flexible SD-WAN, SASE or Orange Cyberdefense specifically; DORA and PCI DSS are described as the customer's own compliance obligations, not as an Orange Business product certification or Article 30 contractual statement. Norway is EEA, not an EU member state, but DORA and NIS2 are treated by the customer as directly applicable."},{"id":"src_financial_services_fs_057","workbook_source_id":"FIN-374","url":"https://www.orange-business.com/en/about-us/customer-stories/foundation-innovation-how-banqsoft-builds-european-cloud-platform","title":"From foundation to innovation: how Banqsoft builds on a European cloud platform","publisher":"orange-business.com","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"medium","record_type":"Named customer case study","requirement_codes":["data_residency_and_sovereignty"],"named_customer":"Banqsoft","segment":"Lending and consumer finance","named_product_or_service":"Cloud Avenue","service_family":"Supporting only","estate":null,"countries_or_regions":"Europe (unspecified countries)","ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":null,"regulatory_regime":"EU","exact_supporting_wording":"Data sovereignty has become a key factor for many of our customers. It's no longer just about functionality – it's about security, governance, compliance and where your data actually resides.","reviewer_summary":"Banqsoft, a Nordic financial software provider for asset finance and digital banking, uses Orange Business's Cloud Avenue sovereign cloud platform and cites European data residency as a customer requirement.","limitation_and_notes":"Statement is about general customer data residency on Cloud Avenue, not specifically about the management plane or logs of Flexible SD-WAN or SASE; no named regulation, retention period or region list is given."},{"id":"src_financial_services_fin_375","workbook_source_id":"FIN-375","url":"https://www.orange-business.com/en/about-us/customer-stories/tmf-group-reduces-risk-enhances-services-hybrid-cloud","title":"TMF Group reduces risk, enhances services with hybrid cloud","publisher":"orange-business.com","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"medium","record_type":"Named customer case study","requirement_codes":["data_centre_colocation_and_cloud_connectivity","cloud_and_saas_data_controls","managed_operations_and_soc"],"named_customer":"TMF Group","segment":"Market infrastructure","named_product_or_service":"Azure Stack HCI hybrid cloud; Orange Cyberdefense","service_family":"Supporting only","estate":"sites in Brazil, Costa Rica, France and Singapore","countries_or_regions":"Brazil, Costa Rica, France, Singapore","ot_or_production_environment":null,"measured_or_stated_outcome":"Eliminated 2 data centres; reduced servers from 95 to 57; 172 tons CO2e/year savings","industrial_standard_or_regulation":null,"regulatory_regime":"Multiple","exact_supporting_wording":"The Orange Business solution provides us with exactly what our business demands: a flexible, reliable, globally distributed, centrally managed, cost-effective solution.","reviewer_summary":"TMF Group, a global corporate and fund administration services provider, deployed an Azure Stack HCI hybrid cloud across four countries with Orange Cyberdefense providing advanced threat protection, consolidating data centres and servers.","limitation_and_notes":"TMF Group is a corporate/fund administration services firm, not itself a bank, insurer or asset manager, so this is adjacent to financial services rather than a direct FI case. No SD-WAN/SASE product is named, no CASB/DLP detail, and no US/Canada/UK site is listed (Costa Rica and Brazil are not North America under this brief's definition)."},{"id":"src_financial_services_fin_376","workbook_source_id":"FIN-376","url":"https://www.orangecyberdefense.com/global/your-business-needs/by-industry/security-for-financial-services-insurance","title":"Security for Financial Services & Insurance","publisher":"orangecyberdefense.com","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"low","record_type":"Financial services solution page","requirement_codes":["remote_and_hybrid_workforce","managed_operations_and_soc"],"named_customer":null,"segment":"Multiple","named_product_or_service":"Orange Cyberdefense","service_family":"Not relevant","estate":null,"countries_or_regions":"Not stated","ot_or_production_environment":null,"measured_or_stated_outcome":"financial/insurance sector represented 7% of all known cyber extortion victims, a 106% year-over-year increase","industrial_standard_or_regulation":null,"regulatory_regime":"Not stated","exact_supporting_wording":"Trust is the main currency","reviewer_summary":"Orange Cyberdefense markets threat intelligence, cloud security, managed detection and response, incident response and network security for remote workers to the financial services and insurance sector, without naming a specific financial institution.","limitation_and_notes":"No named financial institution, no DORA/FCA/PRA/NYDFS/OSFI/SWIFT reference, no PCI DSS detail found on this page. Generic industry marketing page, so evidence is Partial at most for any column."},{"id":"src_financial_services_fin_377","workbook_source_id":"FIN-377","url":"https://www.orangecyberdefense.com/global/offering/professional-services/security-regulation-compliance","title":"Security Regulation Compliance","publisher":"orangecyberdefense.com","publication_date":null,"checked_date":"2026-09-15","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"low","record_type":"Compliance attestation or statement","requirement_codes":["eu_dora_alignment","pci_dss_alignment"],"named_customer":null,"segment":"Multiple","named_product_or_service":"Orange Cyberdefense (Security Regulation Compliance / Governance, Risk and Compliance service)","service_family":"Not relevant","estate":null,"countries_or_regions":"Not stated","ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":"NIS2; DORA; TIBER; CER; PCI DSS; GDPR","regulatory_regime":"EU","exact_supporting_wording":"DORA is a sector-specific directive for financial institutions, targeting their approach to operational risk. It fosters a cyber-resilient ecosystem, safeguarding critical functions and customer trust.","reviewer_summary":"Orange Cyberdefense offers governance, risk and compliance consulting that names DORA and PCI DSS among the regulatory frameworks it helps customers address, without naming a specific financial services customer or an Article 30 contractual position.","limitation_and_notes":"Checker 2026-09-12: page carries the fact but the wording differs (Page reads: 'DORA is a sector-specific directive for financial institutions, targeting their approach to operational risk. It fosters a cyber-resilient ecosyste). Re-quote verbatim. This is a generic professional-services offering page, not a statement about Orange's own DORA Article 30 terms, a PCI DSS Attestation of Compliance for a named Orange service, or a named FS customer outcome. [2026-09-15, Playwright fetch] Re-quoted verbatim. Confirmed this remains generic regulatory-awareness content, not a statement about Orange's own DORA Article 30 terms for a named service - EU DORA alignment correctly stays unproven from this source."},{"id":"src_financial_services_fin_379","workbook_source_id":"FIN-379","url":"https://www.orange-business.com/en/solutions/internet-networks/flexible-sd-wan-international","title":"Flexible SD-WAN","publisher":"orange-business.com","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"medium","record_type":"Other","requirement_codes":["network_visibility_and_reporting","encryption_and_key_management","global_delivery"],"named_customer":null,"segment":"Unspecified","named_product_or_service":"Flexible SD-WAN","service_family":"SD-WAN","estate":null,"countries_or_regions":"more than 220 countries and territories","ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":null,"regulatory_regime":"Not stated","exact_supporting_wording":"Encrypted VPN tunnels for end-to-end security, ensuring data integrity across all connections.","reviewer_summary":"Orange Business's Flexible SD-WAN product page describes encrypted VPN tunnels, next-generation firewalls, secure web gateways, a centralised management portal with real-time visibility, and Orange's network of 400 points of presence across more than 220 countries and territories.","limitation_and_notes":"Generic product marketing, not financial-services specific and not documentation-grade; no encryption algorithm, FIPS validation, or named UK/North America PoP list is given, so it supports Partial evidence only, not Proven, for FS-context columns."},{"id":"src_financial_services_fin_507","workbook_source_id":"FIN-507","url":"https://www.fierce-network.com/telecom/orange-business-services-cashes-sd-wan-deal-bank","title":"Orange Business Services cashes SD-WAN deal with bank (BNP Paribas)","publisher":"fierce-network.com","publication_date":null,"checked_date":"2026-09-15","source_ownership":"independent","decision":"accepted","reviewer_confidence":"high","record_type":"Named customer case study","requirement_codes":["network_segmentation_and_zoning","resilience_and_tested_recovery"],"named_customer":"BNP Paribas","segment":"Retail banking","named_product_or_service":"Orange Flexible SD-WAN (Cisco/Viptela-based)","service_family":"SD-WAN","estate":"1,800 branches; 3,600 access lines (two per branch)","countries_or_regions":"France","ot_or_production_environment":null,"measured_or_stated_outcome":"Fully secure hybrid network, natively multi-cloud, multi-access, multi-application; optimised and centralised management; intelligent routing","industrial_standard_or_regulation":"None stated","regulatory_regime":"EU","exact_supporting_wording":"\"Orange said more than 3,600 access lines... are currently being rolled out with a focus on maintaining business continuity for each site during the migration. In addition to the SD-WAN overlay, Orange is also installing firewalls for better security as part of the deployment.\" - \"We are delighted to support BNP Paribas in their transformation program and deploy the first large-scale SD-WAN project in the retail banking industry for the French market\" - Nadine Foulon-Belkacémi, EVP for French major clients, Orange Business Services","reviewer_summary":"Independent trade press (Fierce Network/Fierce Telecom), verified live 2026-09-15, on the same BNP Paribas deployment already backing Branch and office connectivity (FS-058 etc.). This additional independent-media detail explicitly names business-continuity focus during migration and firewall installation for segmentation/security, supporting two further capability fields from the same well-evidenced named deployment.","limitation_and_notes":"Added 2026-09-15 per thin-provider research pass. Same underlying BNP Paribas deployment as existing sources, providing additional independently-reported detail (business continuity focus, firewall installation) not previously captured."},{"id":"src_financial_services_fin_515","workbook_source_id":"FIN-515","url":"https://www.orange-business.com/en/about-us/our-certifications/soc2-type-ii","title":"Orange Business SOC 2 Type II","publisher":"orange-business.com","publication_date":null,"checked_date":"2026-09-15","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"high","record_type":"Compliance attestation or statement","requirement_codes":["change_control_and_configuration_governance","managed_operations_and_soc"],"named_customer":null,"segment":"Unspecified","named_product_or_service":"SD-WAN Cisco Offer; Flexible SD Branch Offer","service_family":"SD-WAN","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":"SOC 2 Type II","regulatory_regime":null,"exact_supporting_wording":"SOC 2 Type II audited scope explicitly lists the 'SD-WAN Cisco Offer' and 'Flexible SD Branch Offer' by name, alongside the Orange backbone network.","reviewer_summary":"Harry personally verified this live 2026-09-15. This is unusually specific - most providers' SOC 2 pages don't name individual SD-WAN products, but Orange's does. This is genuine product-level assurance evidence for managed operations, not proof of any specific regulatory regime alignment (DORA/FCA/PCI) on its own.","limitation_and_notes":"Added 2026-09-15, Harry-verified. SOC 2 report itself was not read - only the scope statement naming the products."},{"id":"src_financial_services_fin_378","workbook_source_id":"FIN-378","url":"https://www.orange-business.com/en/pci-dss","title":"Orange Business homepage and certifications summary","publisher":"orange-business.com","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"rejected","reviewer_confidence":"medium","record_type":"Other","requirement_codes":[],"named_customer":null,"segment":"Unspecified","named_product_or_service":"Orange Business (corporate)","service_family":"Not relevant","estate":null,"countries_or_regions":"Not stated","ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":null,"regulatory_regime":"Not stated","exact_supporting_wording":"ISO 27001, SOC2 Type II, CISPE (GDPR/RGPD Compliance), SecNumCloud, TISAX, HDS (healthcare division)","reviewer_summary":"Orange Business's published certification list covers ISO 27001, SOC 2 Type II, CISPE/GDPR, SecNumCloud, TISAX and HDS; no PCI DSS, FIPS 140-2/140-3 or FedRAMP certification appears on the corporate site pages reached.","limitation_and_notes":"Confirms the absence of PCI DSS/FIPS certification on the corporate site but does not name Flexible SD-WAN, SASE or a financial customer, so it cannot itself prove or disprove any of the 28 columns; used only as negative evidence in searched_where."},{"id":"src_financial_services_fin_381","workbook_source_id":"FIN-381","url":"https://www.orange-business.com/en/about-us/customer-stories?industry=financial-services","title":"Customer stories filtered by Bank & insurance industry","publisher":"orange-business.com","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"rejected","reviewer_confidence":"low","record_type":"Financial services solution page","requirement_codes":[],"named_customer":null,"segment":"Multiple","named_product_or_service":"Not stated on listing page","service_family":"Not relevant","estate":null,"countries_or_regions":"Not stated","ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":null,"regulatory_regime":"Not stated","exact_supporting_wording":"Bank & insurance (4)","reviewer_summary":"The customer-stories filter shows a \"Bank & insurance\" category of 4 stories; only Sto and Banqsoft could be confirmed as bank/insurance-tagged case studies after checking two result pages.","limitation_and_notes":"Navigational/listing page only; the other 2 of the 4 tagged stories could not be located across the pages checked, so this cannot itself support any column and is used only to record where the search for named FS customers was conducted."}]},{"slug":"verizon","name":"Verizon Business","marketplace_url":"https://netify.co.uk/marketplace/verizon/","research_status":"complete","overall_confidence":"low","fit_conclusion":"Verizon Business can show Managed SD WAN deployed at scale in retail banking (over 1,000 and over 1,850 branch case studies) and can show named-product documentation for SASE Management (ZTNA, CASB) and Secure Cloud Gateway (SSL inspection, DLP), plus a 24x7 SOC service, but every banking case study is anonymised so no institution can be named for any column. The evidence is strongest for US retail branch connectivity and for basic managed operations and change control documentation. There is no evidence at all connecting these named services to FCA/PRA, DORA, FFIEC/GLBA/NYDFS, or OSFI regimes, to trading or low-latency workloads, to cardholder data segmentation, to data residency commitments, or to any UK financial services customer. The main limitation for an IT decision maker in a regulated financial institution is the complete absence of a named customer and the complete absence of regime-specific compliance statements tying Managed SD-WAN, SASE Management or Secure Cloud Gateway to a named regulatory framework.","gaps_and_unknowns":"No named financial institution appears anywhere in the material found, so branch connectivity, resilience, workforce and delivery columns rest on anonymised case studies only. All four regulatory regime columns (UK FCA/PRA, EU DORA, US FFIEC/GLBA/NYDFS/SEC, Canada OSFI) are Not found, as are data residency, logging/audit retention, incident notification, subcontractor transparency and exit/portability; closing these would need a dedicated Verizon trust centre or compliance statement naming Managed SD-WAN, SASE Management or Secure Cloud Gateway alongside a specific regime or documented control, which was not located during this search.","reviewed_by":"Harry Yelland","reviewed_date":"2026-09-14","source_count":19,"accepted_source_count":10,"requirements":[{"code":"branch_and_office_connectivity","label":"Branch and office connectivity","state":"proven","evidence_source_ids":["src_financial_services_fs_070","src_financial_services_fs_069","src_financial_services_fin_420"],"verified_date":"2026-09-14"},{"code":"trading_and_low_latency_connectivity","label":"Trading and low-latency connectivity","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"data_centre_colocation_and_cloud_connectivity","label":"Data-centre, colocation and cloud connectivity","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"resilience_and_tested_recovery","label":"Resilience and tested recovery","state":"proven","evidence_source_ids":["src_financial_services_fs_070","src_financial_services_fs_069","src_financial_services_fin_432"],"verified_date":"2026-09-14"},{"code":"network_segmentation_and_zoning","label":"Network segmentation and zoning","state":"partial","evidence_source_ids":["src_financial_services_fin_432"],"verified_date":"2026-09-14"},{"code":"payment_and_cardholder_data_segmentation","label":"Payment and cardholder data segmentation","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"third_party_and_outsourced_access","label":"Third-party and outsourced access","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"remote_and_hybrid_workforce","label":"Remote and hybrid workforce","state":"partial","evidence_source_ids":["src_financial_services_fin_420"],"verified_date":"2026-09-14"},{"code":"data_residency_and_sovereignty","label":"Data residency and sovereignty","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"encryption_and_key_management","label":"Encryption and key management","state":"partial","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"logging_audit_and_evidence_retention","label":"Logging, audit and evidence retention","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"identity_and_zero_trust_access","label":"Identity and zero trust access","state":"partial","evidence_source_ids":["src_financial_services_fin_422"],"verified_date":"2026-09-14"},{"code":"cloud_and_saas_data_controls","label":"Cloud and SaaS data controls","state":"partial","evidence_source_ids":["src_financial_services_fin_422"],"verified_date":"2026-09-14"},{"code":"managed_operations_and_soc","label":"Managed operations and SOC","state":"partial","evidence_source_ids":["src_financial_services_fin_423","src_financial_services_fin_434"],"verified_date":"2026-09-14"},{"code":"network_visibility_and_reporting","label":"Network visibility and reporting","state":"partial","evidence_source_ids":["src_financial_services_fin_423"],"verified_date":"2026-09-14"},{"code":"change_control_and_configuration_governance","label":"Change control and configuration governance","state":"partial","evidence_source_ids":["src_financial_services_fin_423","src_financial_services_fin_432"],"verified_date":"2026-09-14"},{"code":"incident_notification_support","label":"Incident notification support","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"concentration_risk_and_subcontractor_transparency","label":"Concentration risk and subcontractor transparency","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"exit_and_portability","label":"Exit and portability","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"uk_regulatory_alignment_fca_and_pra","label":"UK regulatory alignment (FCA and PRA)","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"eu_dora_alignment","label":"EU DORA alignment","state":"partial","evidence_source_ids":["src_financial_services_fin_521"],"verified_date":"2026-09-14"},{"code":"us_regulatory_alignment_ffiec_glba_nydfs_sec","label":"US regulatory alignment (FFIEC, GLBA, NYDFS, SEC)","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"canada_regulatory_alignment_osfi","label":"Canada regulatory alignment (OSFI)","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"pci_dss_alignment","label":"PCI DSS alignment","state":"partial","evidence_source_ids":["src_financial_services_fin_424","src_financial_services_fin_521"],"verified_date":"2026-09-14"},{"code":"swift_csp_alignment","label":"SWIFT CSP alignment","state":"partial","evidence_source_ids":["src_financial_services_fin_424"],"verified_date":"2026-09-14"},{"code":"uk_delivery","label":"UK delivery","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"north_america_delivery","label":"North America delivery","state":"partial","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"global_delivery","label":"Global delivery","state":"partial","evidence_source_ids":[],"verified_date":"2026-09-14"}],"sources":[{"id":"src_financial_services_fs_069","workbook_source_id":"FIN-419","url":"https://www.verizon.com/business/resources/customer-success-stories/leading-bank/","title":"Financial Services Network Case Study (leading bank) | Verizon Business","publisher":"verizon.com","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"medium","record_type":"Named customer case study","requirement_codes":["branch_and_office_connectivity","resilience_and_tested_recovery"],"named_customer":null,"segment":"Retail banking","named_product_or_service":"Managed SD WAN","service_family":"Managed SD-WAN","estate":"1850+ branches","countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":"Improved critical branch application uptime with multiple network paths","industrial_standard_or_regulation":null,"regulatory_regime":"Not stated","exact_supporting_wording":"Improved critical branch application uptime with multiple network paths","reviewer_summary":"A Verizon case study describes an unnamed bank deploying Managed SD WAN across more than 1,850 branches, plus Private IP circuits with 4G LTE backup, to improve bandwidth, uptime and restoration capability.","limitation_and_notes":"Customer is anonymised (referred to only as 'the bank'), so this does not prove a named financial institution deployment. No RTO/RPO figures, no regulatory mentions, no country stated."},{"id":"src_financial_services_fin_420","workbook_source_id":"FIN-420","url":"https://www.verizon.com/business/en-se/resources/customer-success-stories/retail-bank/","title":"Retail Banking Network Technology Case Study | Verizon Business","publisher":"verizon.com","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"medium","record_type":"Named customer case study","requirement_codes":["branch_and_office_connectivity","remote_and_hybrid_workforce"],"named_customer":null,"segment":"Retail banking","named_product_or_service":"Managed SD WAN","service_family":"Managed SD-WAN","estate":"1,000+ branches","countries_or_regions":"United States (10-state regional banking presence)","ot_or_production_environment":null,"measured_or_stated_outcome":"Thousands of employees gaining improved mobility; easily scale thousands of locations with centralized administration","industrial_standard_or_regulation":null,"regulatory_regime":"US","exact_supporting_wording":"Managed SD WAN Spin up virtual WAN services and make network adjustments on the fly.","reviewer_summary":"A Verizon case study describes an unnamed 10-state US retail bank upgrading over 1,000 branches to Ethernet and deploying Managed SD WAN and secure Wi-Fi to support a new mobile banking app and modernised branch workspaces.","limitation_and_notes":"Customer is anonymised ('retail bank'). No cardholder data, segmentation, resilience metric, or regulatory detail is given. US only, so not evidence for UK, EU or Canada columns."},{"id":"src_financial_services_fin_422","workbook_source_id":"FIN-422","url":"https://www.verizon.com/business/products/security/network-cloud-security/sase-management/","title":"Secure Access Service Edge (SASE) Solutions | Verizon","publisher":"verizon.com","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"medium","record_type":"Financial services solution page","requirement_codes":["identity_and_zero_trust_access","cloud_and_saas_data_controls"],"named_customer":null,"segment":"Multiple","named_product_or_service":"SASE Management","service_family":"SASE","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":null,"regulatory_regime":"Not stated","exact_supporting_wording":"SASE Management merges network and cloud security management across the enterprise to help you securely connect people, data, and devices","reviewer_summary":"Verizon's SASE Management product page describes a unified SD-WAN and cloud security platform with ZTNA, CASB, FWaaS and centralised policy control, supporting Versa, Cisco, Zscaler and Palo Alto Prisma Access, but names no financial services customer or regulatory standard.","limitation_and_notes":"Product-named documentation confirms ZTNA and CASB capability exist in the service, but with no financial services context, no named customer, and no certification detail (FIPS, SOC, ISO not mentioned)."},{"id":"src_financial_services_fin_423","workbook_source_id":"FIN-423","url":"https://www.verizon.com/business/products/networks/managed-network-services/managed-sd-wan/","title":"Managed SD WAN Solutions and Services | Verizon","publisher":"verizon.com","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"medium","record_type":"Named customer case study","requirement_codes":["change_control_and_configuration_governance","network_visibility_and_reporting","managed_operations_and_soc"],"named_customer":null,"segment":"Retail banking","named_product_or_service":"Managed SD WAN","service_family":"Managed SD-WAN","estate":"thousands of locations","countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":"Easily scale thousands of locations with centralized administration and improved traffic prioritization using Managed SD WAN","industrial_standard_or_regulation":null,"regulatory_regime":"Not stated","exact_supporting_wording":"easily scaled thousands of locations with centralized administration and improved traffic prioritization using Managed SD WAN","reviewer_summary":"The Managed SD WAN product page states the service is 24x7 managed with automated near real-time monitoring and customer-accessible reporting via the Verizon Enterprise Center, backed by SLAs, and references an unnamed retail bank customer.","limitation_and_notes":"24x7 management and reporting is generic, not financial-services specific; retail bank reference is anonymised and gives no metric for visibility/reporting outcomes."},{"id":"src_financial_services_fin_424","workbook_source_id":"FIN-424","url":"https://www.verizon.com/business/en-en/products/security/cyber-risk-management/governance-risk-compliance/","title":"Governance, Risk & Compliance (GRC) Services | Verizon Global","publisher":"verizon.com","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"low","record_type":"Compliance attestation or statement","requirement_codes":["swift_csp_alignment","pci_dss_alignment"],"named_customer":null,"segment":"Unspecified","named_product_or_service":"Governance, Risk & Compliance (GRC) Services","service_family":"Supporting only","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":"PCI DSS; SWIFT Customer Security Controls Framework (CSCF)","regulatory_regime":"Not stated","exact_supporting_wording":"Payment Card Industry Data Security Standard (PCI DSS) experts can help you assess, manage and implement a plan to maintain PCI compliance","reviewer_summary":"Verizon offers separate professional-services assessments for PCI DSS compliance and SWIFT CSCF independent assessment, but these are advisory services distinct from Managed SD-WAN, SASE Management or Secure Cloud Gateway, and the page does not connect them to those named network/security products.","limitation_and_notes":"Does not name Managed SD-WAN, SASE Management or Secure Cloud Gateway as the assessed or certified service; this is an advisory offering, not a product certification or a customer case, so it is Partial evidence only for PCI DSS and SWIFT columns."},{"id":"src_financial_services_fin_432","workbook_source_id":"FIN-432","url":"https://www.verizon.com/business/resources/solutionsbriefs/build-a-wiser-wan/","title":"Managed SD WAN: Wiser WAN Solution | Verizon Solutions","publisher":"verizon.com","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"medium","record_type":"Provider-authored","requirement_codes":["change_control_and_configuration_governance","network_segmentation_and_zoning","resilience_and_tested_recovery"],"named_customer":null,"segment":"Unspecified","named_product_or_service":"Managed SD WAN","service_family":"Managed SD-WAN","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":null,"regulatory_regime":"Not stated","exact_supporting_wording":"We provide geo-diversified network operations centers, trained personnel and scaled, carrier-integrated management platforms","reviewer_summary":"This solution brief for Managed SD WAN with Application Aware Routing describes a standardised security policy overlay across sites, unified fault, configuration and change management, geo-diversified NOCs, and a Global WAN SLA covering multiple third-party service providers.","limitation_and_notes":"Documents change management and network operations for the named product but gives no financial services context, no named customer, no VRF/micro-segmentation detail, and no explicit RTO/RPO commitment."},{"id":"src_financial_services_fin_433","workbook_source_id":"FIN-433","url":"https://www.verizon.com/business/content/dam/resources/factsheets/2018/secure-cloud-gateway.pdf","title":"Verizon Secure Cloud Gateway fact sheet","publisher":"verizon.com","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"medium","record_type":"Compliance attestation or statement","requirement_codes":["encryption_and_key_management","cloud_and_saas_data_controls"],"named_customer":null,"segment":"Unspecified","named_product_or_service":"Secure Cloud Gateway","service_family":"SSE","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":null,"regulatory_regime":"Not stated","exact_supporting_wording":"Deep file-based data loss prevention service helps detect and block the transfer of sensitive data from your enterprise.","reviewer_summary":"The Secure Cloud Gateway fact sheet documents SSL/TLS decryption and re-encryption for inspection purposes and a deep file-based DLP capability that can detect credit card numbers and PII, naming the service directly, but with no financial services example and no FIPS or key management standard cited.","limitation_and_notes":"Confirms encryption handling and DLP as named-product documentation, but does not cite FIPS 140-2/140-3 validation, does not name a key management standard, and the fact sheet is dated 2018 with no confirmation it reflects the current service."},{"id":"src_financial_services_fin_434","workbook_source_id":"FIN-434","url":"https://www.verizon.com/business/answers/soc-as-a-service/","title":"Soc As A Service | Verizon Business","publisher":"verizon.com","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"low","record_type":"Compliance attestation or statement","requirement_codes":["managed_operations_and_soc"],"named_customer":null,"segment":"Unspecified","named_product_or_service":"Advanced Security Operations Center (SOC) Services","service_family":"Supporting only","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":null,"regulatory_regime":"Not stated","exact_supporting_wording":"Gain 24/7 access to monitoring, extensive global threat visibility and expert analysis.","reviewer_summary":"Verizon's SOC as a Service page confirms 24x7 monitoring, detection and analyst escalation as a named managed security service, but does not mention financial services customers or connect explicitly to Managed SD-WAN, SASE Management or Secure Cloud Gateway.","limitation_and_notes":"Proves a 24x7 SOC service exists at Verizon generally, but not specifically wrapped around the three named network/SASE products, and with no financial services customer."},{"id":"src_financial_services_fin_521","workbook_source_id":"FIN-521","url":"https://www.verizon.com/business/en-en/solutions/strengthening-your-critical-infrastructure-security/","title":"Strengthening Your Critical Infrastructure Security - Verizon Business","publisher":"verizon.com","publication_date":null,"checked_date":"2026-09-15","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"medium","record_type":"Compliance attestation or statement","requirement_codes":["eu_dora_alignment","pci_dss_alignment"],"named_customer":null,"segment":"Unspecified","named_product_or_service":"Verizon managed security / critical infrastructure services","service_family":"Supporting only","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":"DORA; PCI DSS; Cyber Essentials; TIBER-EU","regulatory_regime":null,"exact_supporting_wording":"Lists DORA, PCI DSS, Cyber Essentials and TIBER-EU in the context of Verizon's managed security and critical-infrastructure services.","reviewer_summary":"Harry personally verified this live 2026-09-15. A portfolio-level list of frameworks Verizon's security services touch, not a named-service contractual mapping - graded Partial, consistent with the document's own caution against treating this as Proven.","limitation_and_notes":"Added 2026-09-15, Harry-verified. Portfolio-level framework list, not scoped to a named SD-WAN/SASE product."},{"id":"src_financial_services_fs_070","workbook_source_id":"FS-070","url":"https://www.verizon.com/business/resources/customer-success-stories/retail-bank/","title":"Retail Banking Network Technology Case Study | Verizon Business","publisher":"verizon.com","publication_date":null,"checked_date":"2026-07-29","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"high","record_type":"Existing source lead","requirement_codes":["branch_and_office_connectivity","resilience_and_tested_recovery"],"named_customer":null,"segment":"Retail banking","named_product_or_service":null,"service_family":"SD-WAN","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":null,"regulatory_regime":"Not stated","exact_supporting_wording":"A slow and dated network kept this retail bank from moving its business into the future.","reviewer_summary":"Two distinct SD-WAN banking case studies exist. The retail bank story is quoted here. A second story on a leading bank states it Deployed SD WAN architecture and private IP circuits with 4G LTE backup. Both customers are anonymised, which is why this is vendor-claimed rather than independently verifiable, but the sector and the SD-WAN solution are explicit in both. Financial services also has a dedicated industry page.","limitation_and_notes":"Supplier's own case study. Customer anonymised, sector and SD-WAN outcome stated explicitly. | Confirmed - exact match"},{"id":"src_financial_services_fin_421","workbook_source_id":"FIN-421","url":"https://www.verizon.com/business/solutions/industry/financial/","title":"Financial Services Solutions & Financial Services Technology | Verizon","publisher":"verizon.com","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"rejected","reviewer_confidence":"low","record_type":"Financial services solution page","requirement_codes":[],"named_customer":null,"segment":"Multiple","named_product_or_service":"Secure Access Service Edge (SASE)","service_family":"SASE","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":null,"regulatory_regime":"Not stated","exact_supporting_wording":"Get informed about cybercriminals and protect your customers' sensitive personal and financial data with the help of our security experts.","reviewer_summary":"Verizon's financial services solutions hub lists SASE and managed network services in a generic products menu but gives no named financial customer, deployment detail or regulatory reference on the page itself.","limitation_and_notes":"Purely a navigation/marketing hub with no named customer, no product-to-outcome connection, and no regulatory content; rejected as not evidentiary beyond generic industry framing."},{"id":"src_financial_services_fin_425","workbook_source_id":"FIN-425","url":"https://www.verizon.com/business/resources/financial-services/","title":"Financial Services Technology Trends & Insights | Verizon","publisher":"verizon.com","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"rejected","reviewer_confidence":"low","record_type":"Financial services solution page","requirement_codes":[],"named_customer":null,"segment":"Multiple","named_product_or_service":"Not applicable","service_family":"Not relevant","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":null,"regulatory_regime":"Not stated","exact_supporting_wording":"The report highlights key regulatory standards, including PCI DSS and ISO frameworks","reviewer_summary":"A generic financial services resources hub links to SD-WAN and SASE product pages and to third-party report abstracts mentioning PCI DSS and ISO frameworks for banks, without naming any financial institution or connecting a named Verizon product to a specific regulation.","limitation_and_notes":"No named customer, no direct product-to-regulation link, only a summary of an external report abstract; not usable as evidence for any specific column."},{"id":"src_financial_services_fin_426","workbook_source_id":"FIN-426","url":"https://www.verizon.com/business/solutions/industry/financial/building-a-better-infrastructure/","title":"Build Better Financial Services Infrastructure | Verizon","publisher":"verizon.com","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"rejected","reviewer_confidence":"low","record_type":"Financial services solution page","requirement_codes":[],"named_customer":null,"segment":"Multiple","named_product_or_service":"Managed SD-WAN; Network as a Service (NaaS)","service_family":"Managed SD-WAN","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":null,"regulatory_regime":"Not stated","exact_supporting_wording":"Strengthen your operational core and be ready to adapt to changing needs and technologies with networking solutions that are secure and agile.","reviewer_summary":"This financial services infrastructure page positions Managed SD-WAN and Network as a Service generically for the sector, with no named institution, no data-centre or cloud on-ramp detail, and no resilience metric.","limitation_and_notes":"Generic solutions page with no named customer, no measurable outcome, and no regulatory reference; does not meet the bar for any column beyond what the dedicated case studies already establish."},{"id":"src_financial_services_fin_427","workbook_source_id":"FIN-427","url":"https://www.verizon.com/business/products/networks/managed-network-services/secure-gateway/","title":"Secure Gateway Service | Verizon","publisher":"verizon.com","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"rejected","reviewer_confidence":"low","record_type":"Other","requirement_codes":[],"named_customer":null,"segment":"Unspecified","named_product_or_service":"Secure Gateway","service_family":"Supporting only","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":null,"regulatory_regime":"Not stated","exact_supporting_wording":"Strong service level agreements (SLAs) and a team of Verizon networking experts","reviewer_summary":"Secure Gateway is a Private IP WAN extension/backup product for remote users and locations; it is a different, older product from Secure Cloud Gateway and does not mention financial services, CASB or DLP.","limitation_and_notes":"Not the same product as Verizon Secure Cloud Gateway; no financial services, no security control detail relevant to the 28 columns."},{"id":"src_financial_services_fin_428","workbook_source_id":"FIN-428","url":"https://www.verizon.com/business/products/security/network-cloud-security/zero-trust-dynamic-access/","title":"Verizon Business zero trust dynamic access","publisher":"verizon.com","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"rejected","reviewer_confidence":"low","record_type":"Other","requirement_codes":[],"named_customer":null,"segment":"Unspecified","named_product_or_service":"Zero Trust Dynamic Access; SASE","service_family":"SASE","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":null,"regulatory_regime":"Not stated","exact_supporting_wording":"make a strategic shift to an identity-centric, unified network and security management service","reviewer_summary":"This cybersecurity solutions page lists SASE alongside DDoS Shield, mobile security and an Advanced SOC, and references identity-centric management, but does not explicitly describe ZTNA, MFA or IdP integration mechanics or any financial services use.","limitation_and_notes":"Too generic on identity/zero trust mechanics and has no financial services or named-customer content; does not meet the bar to support column 12 beyond the SASE Management page already accepted."},{"id":"src_financial_services_fin_429","workbook_source_id":"FIN-429","url":"https://www.verizon.com/business/en-gb/resources/casestudies/","title":"Business Case Studies | Verizon Global","publisher":"verizon.com","publication_date":"2024-11-07","checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"rejected","reviewer_confidence":"low","record_type":"Other","requirement_codes":[],"named_customer":null,"segment":"Unspecified","named_product_or_service":"Not applicable","service_family":"Not relevant","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":null,"regulatory_regime":"Not stated","exact_supporting_wording":"Scottsdale Unified School District empowers staff and boosts safety","reviewer_summary":"The UK case study index lists no financial services, banking, insurance or credit union case studies; the only visible case study is a US school district, and a 'global financial services firm' link elsewhere on the site returns a 404.","limitation_and_notes":"Confirms the case study index does not surface further named financial institution studies beyond the ones already found; used only to record where the search was conducted."},{"id":"src_financial_services_fin_430","workbook_source_id":"FIN-430","url":"https://www.verizon.com/business/resources/customer-success-stories/leading-wealth-management/","title":"Wealth Management Technology Case Study | Verizon Business","publisher":"verizon.com","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"rejected","reviewer_confidence":"low","record_type":"Named customer case study","requirement_codes":[],"named_customer":null,"segment":"Asset and wealth management","named_product_or_service":"Secure Cloud Interconnect","service_family":"Supporting only","estate":"2,500 agents","countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":"Delivered greater insight, personalization and instant responses for 20M customers","industrial_standard_or_regulation":null,"regulatory_regime":"Not stated","exact_supporting_wording":"Provided seamless, flexible access to SaaS and AI web services","reviewer_summary":"This wealth management case study describes an unnamed firm using Secure Cloud Interconnect and Next Gen Network (4G LTE) to support 2,500 agents and 20 million customers, but does not name Managed SD-WAN, SASE Management or Secure Cloud Gateway.","limitation_and_notes":"Does not reference any of the three named services in scope for this research (Managed SD-WAN, SASE Management, Secure Cloud Gateway), so it cannot support any of the 28 columns for this provider."},{"id":"src_financial_services_fin_431","workbook_source_id":"FIN-431","url":"https://www.verizon.com/business/solutions/industry/financial/protecting-critical-financial-data/","title":"Protect Customer Financial Data with a Cybersecurity Strategy | Verizon","publisher":"verizon.com","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"rejected","reviewer_confidence":"low","record_type":"Financial services solution page","requirement_codes":[],"named_customer":null,"segment":"Multiple","named_product_or_service":"SASE","service_family":"SASE","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":null,"regulatory_regime":"Not stated","exact_supporting_wording":"Our security experts can help you identify vulnerabilities and design a cybersecurity strategy","reviewer_summary":"This financial data protection page references SASE under Network and Cloud Security and links to a 'large global bank' case study, but names no institution, no CASB/DLP/ZTNA mechanics, and no regulation.","limitation_and_notes":"No named customer, no regulatory reference, no specific security control detail beyond what is already captured from the SASE Management and Secure Cloud Gateway pages."}]},{"slug":"velocloud","name":"VeloCloud","marketplace_url":"https://netify.co.uk/marketplace/velocloud/","research_status":"complete","overall_confidence":"medium","fit_conclusion":"VeloCloud SD-WAN has one named financial services customer opened in this research, STAR Financial Bank, a US retail bank that used it to connect rural branches, ATMs and interactive teller machines, which supports branch connectivity and North America delivery. The provider's own financial services solution brief and retail solution brief give documentation-type evidence for PCI DSS alignment, cardholder data segmentation and FIPS-based encryption, but the financial and insurance customers quoted in the financial services brief are anonymised rather than named. No evidence was found connecting the named service to trading floors, UK delivery, DORA, FCA/PRA, FFIEC/GLBA/NYDFS/SEC, OSFI or SWIFT CSP, and Arista's corporate trust centre does not confirm whether VeloCloud specifically sits within its SOC 2 scope from the page content available. Overall this is reasonable evidence for US retail-banking branch connectivity and PCI-related segmentation, but weak or absent evidence for UK and EU regulatory alignment, data residency, logging retention, incident notification and subcontractor transparency. An IT decision maker in a UK or EU FS firm would need to request the gated subprocessor list, a named UK or EU customer reference and an explicit DORA or FCA/PRA statement directly from Arista before relying on this service for a regulated deployment.","gaps_and_unknowns":"No evidence was found for trading/low-latency connectivity, UK delivery, UK regulatory alignment (FCA/PRA), EU DORA alignment, US FFIEC/GLBA/NYDFS/SEC alignment, Canadian OSFI alignment, SWIFT CSP, data residency, logging/audit retention, change control governance, incident notification timelines, exit/portability terms, managed 24x7 SOC, and third-party/subcontractor access controls. Closing these would require the gated Arista trust centre subprocessor and per-product certification documents, a published data processing agreement or GDPR/DORA statement naming VeloCloud, and additional named UK, EU or Canadian financial services case studies, none of which were accessible or found during this research.","reviewed_by":"Harry Yelland","reviewed_date":"2026-09-14","source_count":14,"accepted_source_count":7,"requirements":[{"code":"branch_and_office_connectivity","label":"Branch and office connectivity","state":"proven","evidence_source_ids":["src_financial_services_fs_002","src_financial_services_fin_412","src_financial_services_fin_534"],"verified_date":"2026-09-14"},{"code":"trading_and_low_latency_connectivity","label":"Trading and low-latency connectivity","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"data_centre_colocation_and_cloud_connectivity","label":"Data-centre, colocation and cloud connectivity","state":"partial","evidence_source_ids":["src_financial_services_fs_001","src_financial_services_fs_002"],"verified_date":"2026-09-14"},{"code":"resilience_and_tested_recovery","label":"Resilience and tested recovery","state":"partial","evidence_source_ids":["src_financial_services_fs_002"],"verified_date":"2026-09-14"},{"code":"network_segmentation_and_zoning","label":"Network segmentation and zoning","state":"proven","evidence_source_ids":["src_financial_services_fs_002","src_financial_services_fin_534"],"verified_date":"2026-09-14"},{"code":"payment_and_cardholder_data_segmentation","label":"Payment and cardholder data segmentation","state":"partial","evidence_source_ids":["src_financial_services_fs_002","src_financial_services_fin_418"],"verified_date":"2026-09-14"},{"code":"third_party_and_outsourced_access","label":"Third-party and outsourced access","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"remote_and_hybrid_workforce","label":"Remote and hybrid workforce","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"data_residency_and_sovereignty","label":"Data residency and sovereignty","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"encryption_and_key_management","label":"Encryption and key management","state":"proven","evidence_source_ids":["src_financial_services_fs_001","src_financial_services_fin_417","src_financial_services_fin_534"],"verified_date":"2026-09-14"},{"code":"logging_audit_and_evidence_retention","label":"Logging, audit and evidence retention","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"identity_and_zero_trust_access","label":"Identity and zero trust access","state":"partial","evidence_source_ids":["src_financial_services_fs_001"],"verified_date":"2026-09-14"},{"code":"cloud_and_saas_data_controls","label":"Cloud and SaaS data controls","state":"partial","evidence_source_ids":["src_financial_services_fin_413"],"verified_date":"2026-09-14"},{"code":"managed_operations_and_soc","label":"Managed operations and SOC","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"network_visibility_and_reporting","label":"Network visibility and reporting","state":"partial","evidence_source_ids":["src_financial_services_fs_002"],"verified_date":"2026-09-14"},{"code":"change_control_and_configuration_governance","label":"Change control and configuration governance","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"incident_notification_support","label":"Incident notification support","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"concentration_risk_and_subcontractor_transparency","label":"Concentration risk and subcontractor transparency","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"exit_and_portability","label":"Exit and portability","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"uk_regulatory_alignment_fca_and_pra","label":"UK regulatory alignment (FCA and PRA)","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"eu_dora_alignment","label":"EU DORA alignment","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"us_regulatory_alignment_ffiec_glba_nydfs_sec","label":"US regulatory alignment (FFIEC, GLBA, NYDFS, SEC)","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"canada_regulatory_alignment_osfi","label":"Canada regulatory alignment (OSFI)","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"pci_dss_alignment","label":"PCI DSS alignment","state":"proven","evidence_source_ids":["src_financial_services_fin_418"],"verified_date":"2026-09-14"},{"code":"swift_csp_alignment","label":"SWIFT CSP alignment","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"uk_delivery","label":"UK delivery","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"north_america_delivery","label":"North America delivery","state":"proven","evidence_source_ids":["src_financial_services_fin_412"],"verified_date":"2026-09-14"},{"code":"global_delivery","label":"Global delivery","state":"partial","evidence_source_ids":["src_financial_services_fs_001"],"verified_date":"2026-09-14"}],"sources":[{"id":"src_financial_services_fs_001","workbook_source_id":"FIN-410","url":"https://www.arista.com/en/solutions/sd-wan","title":"Arista Networks - SD-WAN & Edge Routing (VeloCloud SD-WAN solution page)","publisher":"arista.com","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"medium","record_type":"Financial services solution page","requirement_codes":["data_centre_colocation_and_cloud_connectivity","identity_and_zero_trust_access","encryption_and_key_management","global_delivery"],"named_customer":null,"segment":"Unspecified","named_product_or_service":"VeloCloud SD-WAN, VeloCloud SASE","service_family":"Multiple","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":null,"regulatory_regime":"Not stated","exact_supporting_wording":"zero trust networking with end-to-end encryption and an integrated L7 firewall","reviewer_summary":"General VeloCloud SD-WAN and SASE product page describing encryption, zero trust, multi-cloud on-ramps (AWS Cloud WAN, Azure Virtual WAN, Google Cloud) and a global network of over 3,000 cloud gateways across 150+ SASE points of presence, and links out to a financial services brief and a PCI compliance brief.","limitation_and_notes":"Generic product page with no named customer; does not by itself prove any financial-services deployment, only product capability and global footprint."},{"id":"src_financial_services_fs_002","workbook_source_id":"FIN-411","url":"https://www.arista.com/assets/data/pdf/VeloCloud-SD-WAN-Financial-Services-Solution-Brief.pdf","title":"VeloCloud SD-WAN for Financial Services - Solution Brief (PDF)","publisher":"arista.com","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"medium","record_type":"Financial services solution page","requirement_codes":["data_centre_colocation_and_cloud_connectivity","payment_and_cardholder_data_segmentation","network_visibility_and_reporting","network_segmentation_and_zoning","branch_and_office_connectivity","resilience_and_tested_recovery"],"named_customer":null,"segment":"Multiple","named_product_or_service":"VeloCloud SD-WAN","service_family":"SD-WAN","estate":"large insurance company with thousands of sites","countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":"20% reduction in maintenance costs for branches and ATMs within two years; 83% of network incidents automatically identified, 100% triaged, 34% automatically restored","industrial_standard_or_regulation":"PCI DSS","regulatory_regime":"Not stated","exact_supporting_wording":"VeloCloud gave us peace of mind during the testing phase as the VeloCloud SD-WAN solution proved to be the reliable solution we were seeking, thanks to VeloCloud's superior architecture and technology.","reviewer_summary":"Arista's financial services solution brief for VeloCloud SD-WAN cites an unnamed global financial institution, international bank and large insurance company, describing branch/ATM connectivity, DR combining MPLS, broadband and 4G-LTE, native support for 9 of 12 PCI DSS requirements, and automated incident detection.","limitation_and_notes":"All customers quoted are anonymised (Global Financial Institution, international banking institution, Fortune 500 technical-services provider, large insurance company); no institution is named, so this is treated as Partial-strength evidence per the grading rules for anonymised customers."},{"id":"src_financial_services_fin_412","workbook_source_id":"FIN-412","url":"https://blogs.vmware.com/sase/2018/03/20/bringing-secure-interactive-financial-services-rural-regions-sd-wan/","title":"Bringing Secure Interactive Financial Services to Rural Regions with SD-WAN - VeloCloud","publisher":"blogs.vmware.com","publication_date":"2018-03-20","checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"medium","record_type":"Named customer case study","requirement_codes":["branch_and_office_connectivity","north_america_delivery"],"named_customer":"STAR Financial Bank","segment":"Retail banking","named_product_or_service":"VeloCloud (VMware SD-WAN by VeloCloud)","service_family":"SD-WAN","estate":"branches, insurance offices, ATMs and ITMs","countries_or_regions":"United States (Indiana)","ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":null,"regulatory_regime":"US","exact_supporting_wording":"Banking services were provided using a combination of locations such as branches, insurance offices, automated teller machines (ATM) and interactive teller machines (ITM).","reviewer_summary":"STAR Financial Bank, a US bank based in Indiana, used VeloCloud SD-WAN to connect rural branches, ATMs and interactive teller machines that needed more bandwidth for video than legacy MPLS could provide.","limitation_and_notes":"This is a legacy VMware/VeloCloud blog post; the linked full case study (velocloud.com) could not be fetched (robots-disallowed), so specific outcome metrics are not available from an opened page. Does not evidence trading, DR testing, resilience metrics, or any regulatory regime beyond general US location."},{"id":"src_financial_services_fin_413","workbook_source_id":"FIN-413","url":"https://www.arista.com/en/solutions/sd-wan/velocloud-solutions","title":"SD-WAN and Cloud WAN - Arista","publisher":"arista.com","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"low","record_type":"Financial services solution page","requirement_codes":["cloud_and_saas_data_controls"],"named_customer":null,"segment":"Unspecified","named_product_or_service":"VeloCloud SD-WAN, VeloCloud SASE","service_family":"Multiple","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":null,"regulatory_regime":"Not stated","exact_supporting_wording":"segment-aware, layer 7 stateful firewall","reviewer_summary":"Product page listing VeloCloud SD-WAN and SASE security features including a layer 7 firewall, IDS/IPS, and URL/DNS/Geo-IP filtering powered by Webroot Brightcloud, and linking to a financial services brief and a PCI compliance brief.","limitation_and_notes":"Generic security feature list, not a CASB/DLP statement and not financial-services specific; does not name any customer."},{"id":"src_financial_services_fin_417","workbook_source_id":"FIN-417","url":"https://www.arista.com/en/orchestrator-guide-vc-5-2/sd-wan-5-2-federal-information-processing-standards-fips-guide","title":"VeloCloud SD-WAN 5.2 Orchestrator Guide - Federal Information Processing Standards (FIPS) Guide - Arista","publisher":"arista.com","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"medium","record_type":"Compliance attestation or statement","requirement_codes":["encryption_and_key_management"],"named_customer":null,"segment":"Unspecified","named_product_or_service":"VeloCloud SD-WAN Orchestrator, Edge","service_family":"SD-WAN","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":"FIPS 140-2","regulatory_regime":"Not stated","exact_supporting_wording":"FIPS 140-2 certification for cryptographic modules enables organizations to meet compliance requirements","reviewer_summary":"VeloCloud's own Orchestrator Guide documents a FIPS mode for the SD-WAN Edge and Orchestrator using FIPS-validated cryptographic modules (the system kernel crypto library, OpenSSL, and OpenSSH), with FIPS-approved algorithms such as AES, HMAC-SHA2 and ECDH.","limitation_and_notes":"Documents FIPS-validated component modules and a FIPS operational mode, but does not itself state a specific CMVP certificate number or that the whole VeloCloud SD-WAN product line holds current FIPS 140-2/140-3 validation; treat as partial validation evidence, not a full product certification."},{"id":"src_financial_services_fin_418","workbook_source_id":"FIN-418","url":"https://www.arista.com/assets/data/pdf/VeloCloud-SD-WAN-for-Retail-Solution-Brief.pdf","title":"VeloCloud SD-WAN for Retail - Solution Brief","publisher":"arista.com","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"medium","record_type":"Compliance attestation or statement","requirement_codes":["payment_and_cardholder_data_segmentation","pci_dss_alignment"],"named_customer":null,"segment":"Unspecified","named_product_or_service":"VeloCloud Orchestrator, SD-WAN Controller, SD-WAN Edge, Partner Gateway","service_family":"SD-WAN","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":"PCI DSS","regulatory_regime":"Not stated","exact_supporting_wording":"Failure to comply with PCI requirements in these areas can create liabilities that put sensitive purchase data at risk, damaging brand reputation.","reviewer_summary":"Arista's retail solution brief states that the VeloCloud Orchestrator, SD-WAN Controller, SD-WAN Edge and Partner Gateway are offered as PCI-certified infrastructure elements to protect customers' personal data including credit card numbers.","limitation_and_notes":"Retail context, not financial services, and no named customer; supports the PCI DSS/cardholder-segmentation columns as documentation-type evidence but is not FS-sector proof of a deployment."},{"id":"src_financial_services_fin_534","workbook_source_id":"FIN-534","url":"https://blogs.vmware.com/sase/2022/03/29/scaling-your-network-to-accommodate-2000-remote-sites-vmware-sd-wan-is-money-in-the-bank/","title":"Scaling Your Network to Accommodate 2000+ Remote Sites - VMware SD-WAN","publisher":"blogs.vmware.com","publication_date":null,"checked_date":"2026-09-15","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"high","record_type":"Named customer case study","requirement_codes":["network_segmentation_and_zoning","branch_and_office_connectivity","encryption_and_key_management"],"named_customer":"Grupo Bancolombia","segment":"Retail banking","named_product_or_service":"VMware SD-WAN (VeloCloud)","service_family":"SD-WAN","estate":"640+ branches; 1,200+ ATMs; 20,000 employees; 20 million+ customers","countries_or_regions":"Colombia; Central America; Caribbean","ot_or_production_environment":null,"measured_or_stated_outcome":"Integrated nearly 700 branches with SD-WAN in just over four months; estimated 20% cost savings for branch/ATM maintenance within two years","industrial_standard_or_regulation":"Colombian Financial Superintendency","regulatory_regime":"Not stated","exact_supporting_wording":"\"VMware gave us peace of mind during testing phase as the VMware SD-WAN solution proved to be the reliable solution we were seeking, thanks to VMware's superior architecture and technology.\" - Angel David Niebles, Leader of Branches and ATMs Connectivity Area of Telecommunications Management, Bancolombia. \"Bancolombia also trusts SD-WAN's built-in AES 256 encryption for data links to protect its most sensitive data.\"","reviewer_summary":"Verified live 2026-09-15. Grupo Bancolombia is the largest bank in Colombia, real and named, with a named executive quote. Named regulator (Colombian Financial Superintendency) - outside UK/EU/US/Canada regimes tracked, so Regulatory regime stays Not stated per schema. AES-256 encryption is explicitly named.","limitation_and_notes":"Added 2026-09-15 per further research pass (cross-platform lead, independently verified)."},{"id":"src_financial_services_fs_004","workbook_source_id":"FIN-409","url":"https://www.arista.com/en/solutions/electronic-trading","title":"Arista Networks - Electronic Trading solutions","publisher":"arista.com","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"rejected","reviewer_confidence":"high","record_type":"Contradiction","requirement_codes":[],"named_customer":null,"segment":"Unspecified","named_product_or_service":"Arista 7130 Series, MetaMux, MetaProtect, MetaWatch","service_family":"Not relevant","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":null,"regulatory_regime":"Not stated","exact_supporting_wording":"round trip time of only 44 ns","reviewer_summary":"Arista's electronic trading page covers only its 7130 FPGA switches and precision timing/tap products for high-frequency trading; VeloCloud SD-WAN or SASE is not mentioned anywhere in the trading context, only appearing in the general site navigation.","limitation_and_notes":"Confirms VeloCloud is not positioned for trading/exchange connectivity on Arista's own site; does not prove or disprove the requirement, just shows no evidence exists here."},{"id":"src_financial_services_fin_414","workbook_source_id":"FIN-414","url":"https://www.arista.com/en/support/velocloud-resources","title":"VeloCloud Resources - Arista","publisher":"arista.com","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"rejected","reviewer_confidence":"high","record_type":"Other","requirement_codes":[],"named_customer":null,"segment":"Unspecified","named_product_or_service":"VeloCloud SD-WAN","service_family":"Not relevant","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":null,"regulatory_regime":"Not stated","exact_supporting_wording":"Administration Guide, Operator Guide, Partner Guide","reviewer_summary":"A navigation/support hub page linking to VeloCloud documentation, software downloads and advisories; contains no financial services, compliance, PCI, SLA or data residency content itself.","limitation_and_notes":"No substantive compliance or FS evidence; used only to confirm no relevant documents are indexed here."},{"id":"src_financial_services_fin_415","workbook_source_id":"FIN-415","url":"https://www.arista.com/assets/data/pdf/CaseStudies/CCF-Financial-Services-Case-Study.pdf","title":"Arista Customer Success Story (Converged Cloud Fabric, Financial Services)","publisher":"arista.com","publication_date":"2020-06-01","checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"rejected","reviewer_confidence":"high","record_type":"Other","requirement_codes":[],"named_customer":null,"segment":"Unspecified","named_product_or_service":"Converged Cloud Fabric (CCF), VMware NSX, CloudVision","service_family":"Not relevant","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":"Lower capital expenditure and reduced troubleshooting time versus alternative architectures","industrial_standard_or_regulation":null,"regulatory_regime":"Not stated","exact_supporting_wording":"Changing over to Arista was a significant savings in capital expenditures, but more important, in man hours spent troubleshooting configuration issues, compared to other architectures we were evaluating.","reviewer_summary":"An anonymised financial services company's case study about Arista's data-centre Converged Cloud Fabric switching and NSX; VeloCloud SD-WAN/SASE is not mentioned anywhere in this document.","limitation_and_notes":"Wrong product family (data-centre switching fabric, not SD-WAN/SASE); does not name VeloCloud so cannot support any of the 28 columns per the brief's product-naming rule."},{"id":"src_financial_services_fin_416","workbook_source_id":"FIN-416","url":"https://trust.arista.com/","title":"Arista Networks Trust Center","publisher":"trust.arista.com","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"rejected","reviewer_confidence":"low","record_type":"Compliance attestation or statement","requirement_codes":[],"named_customer":null,"segment":"Unspecified","named_product_or_service":"Arista Networks (corporate)","service_family":"Not relevant","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":"SOC 2 Type 2","regulatory_regime":"Not stated","exact_supporting_wording":"For individual products or Cloud Services certifications like SOC2, select the product from the drop-down above.","reviewer_summary":"Arista's corporate SafeBase-powered trust centre lists company-wide certifications (SOC 2, SOC 2 Type 2, Cyber Essentials, Cyber Essentials Plus, ENS) and a gated subprocessors document, but the visible page does not confirm VeloCloud SD-WAN or SASE specifically as being in scope.","limitation_and_notes":"Does not name VeloCloud SD-WAN/SASE as being within the certified scope on the page content retrieved; the subprocessors list and per-product certificates require an authenticated 'Get access' request that could not be completed, so data residency, retention and subcontractor detail remain unverified from this page."},{"id":"src_financial_services_fs_003","workbook_source_id":"FS-003","url":"https://www.arista.com/en/company/customer-testimonials","title":"Arista Networks - Customer Testimonials / Customer Success Stories","publisher":"arista.com","publication_date":null,"checked_date":"2026-07-29","source_ownership":"provider_authored","decision":"rejected","reviewer_confidence":"high","record_type":"Existing source lead","requirement_codes":[],"named_customer":null,"segment":"To review","named_product_or_service":null,"service_family":"Supporting only","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":null,"regulatory_regime":null,"exact_supporting_wording":"From the exchange edge to the back office, Arista offers a range of products optimized for demanding finance and trading environments.","reviewer_summary":"Strongest sector evidence found. There is a dedicated Electronic Trading industry page with named customer stories (Deutsche Boerse Group, ING Romania), named banking customers Odeabank and FIBI Bank under a 'Finance' label in the customer story library, and a VeloCloud SD-WAN for Financial Services solution brief. Caveat worth carrying: the named customers are Arista switching, CloudVision and data centre deployments, while the VeloCloud-specific financial brief keeps its deployments anonymous ('an international banking institution', 'a large insurance company').","limitation_and_notes":"Supplier's named-customer library with an explicit industry filter taxonomy. Strongest source for which sectors Arista can actually name customers in. Caveat: the visible stories are campus, Wi-Fi, CloudVision and data centre deployments, not VeloCloud SD-WAN. | Not found on page"}]},{"slug":"ericsson-cradlepoint","name":"Ericsson Cradlepoint","marketplace_url":"https://netify.co.uk/marketplace/ericsson-cradlepoint/","research_status":"complete","overall_confidence":"low","fit_conclusion":"Ericsson Cradlepoint publishes device-level FIPS 140-3 validation, a SOC 2 Type II attestation covering NetCloud Manager and NetCloud SASE, ISO 27001 and NIST SSDF coverage, a 30-day NetCloud Manager activity log retention period, and PCI DSS configuration guidance, which together give reasonable documentation-based evidence for encryption, logging and PCI groundwork. There is no named bank, credit union, insurer or payment firm case study evidencing branch backup, ATM connectivity, trading, resilience testing or remote workforce use on NetCloud; the strongest financial-sector reference found, Jackson Hewitt, is a US tax-preparation franchise named only for kiosk cellular routers, not a bank. No source connects the named service to FCA/PRA, DORA, FFIEC/GLBA/NYDFS/SEC, OSFI or SWIFT CSP regimes, and UK delivery evidence is limited to a UK sales phone number. Overall this is background compliance documentation with essentially no financial-services proof points, so an IT decision maker at a bank or credit union cannot rely on it as an evidenced fit for FS regulatory or operational requirements without direct vendor engagement.","gaps_and_unknowns":"No named financial institution case studies exist for branch/office connectivity, trading, data-centre/cloud connectivity, resilience testing, segmentation, third-party access, or remote workforce use; a named bank, credit union or insurer deployment with sites, outcomes and dates would close these. All four UK, EU, US and Canada regulatory alignment columns and SWIFT CSP are unevidenced; a published compliance statement or FS customer case naming FCA/PRA, DORA, FFIEC/GLBA/NYDFS/SEC or OSFI would be needed. Sub-processor transparency, data export/exit assistance, and a genuine security-incident notification SLA (rather than maintenance notice or a 30-day code-remediation clause) are also unevidenced and would need dedicated trust-centre or contractual documentation.","reviewed_by":"Harry Yelland","reviewed_date":"2026-09-14","source_count":20,"accepted_source_count":12,"requirements":[{"code":"branch_and_office_connectivity","label":"Branch and office connectivity","state":"partial","evidence_source_ids":["src_financial_services_fin_236","src_financial_services_fin_237"],"verified_date":"2026-09-14"},{"code":"trading_and_low_latency_connectivity","label":"Trading and low-latency connectivity","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"data_centre_colocation_and_cloud_connectivity","label":"Data-centre, colocation and cloud connectivity","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"resilience_and_tested_recovery","label":"Resilience and tested recovery","state":"partial","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"network_segmentation_and_zoning","label":"Network segmentation and zoning","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"payment_and_cardholder_data_segmentation","label":"Payment and cardholder data segmentation","state":"partial","evidence_source_ids":["src_financial_services_fin_246"],"verified_date":"2026-09-14"},{"code":"third_party_and_outsourced_access","label":"Third-party and outsourced access","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"remote_and_hybrid_workforce","label":"Remote and hybrid workforce","state":"partial","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"data_residency_and_sovereignty","label":"Data residency and sovereignty","state":"partial","evidence_source_ids":["src_financial_services_fin_243"],"verified_date":"2026-09-14"},{"code":"encryption_and_key_management","label":"Encryption and key management","state":"proven","evidence_source_ids":["evidence:ericsson-cradlepoint:16","src_financial_services_fin_241","src_financial_services_fin_242"],"verified_date":"2026-09-14"},{"code":"logging_audit_and_evidence_retention","label":"Logging, audit and evidence retention","state":"proven","evidence_source_ids":["src_financial_services_fin_247"],"verified_date":"2026-09-14"},{"code":"identity_and_zero_trust_access","label":"Identity and zero trust access","state":"partial","evidence_source_ids":["src_financial_services_fin_236","src_financial_services_fin_242","src_financial_services_fin_249","src_financial_services_fin_250"],"verified_date":"2026-09-14"},{"code":"cloud_and_saas_data_controls","label":"Cloud and SaaS data controls","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"managed_operations_and_soc","label":"Managed operations and SOC","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"network_visibility_and_reporting","label":"Network visibility and reporting","state":"partial","evidence_source_ids":["src_financial_services_fin_250"],"verified_date":"2026-09-14"},{"code":"change_control_and_configuration_governance","label":"Change control and configuration governance","state":"partial","evidence_source_ids":["src_financial_services_fin_242"],"verified_date":"2026-09-14"},{"code":"incident_notification_support","label":"Incident notification support","state":"partial","evidence_source_ids":["src_financial_services_fin_240","src_financial_services_fin_244"],"verified_date":"2026-09-14"},{"code":"concentration_risk_and_subcontractor_transparency","label":"Concentration risk and subcontractor transparency","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"exit_and_portability","label":"Exit and portability","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"uk_regulatory_alignment_fca_and_pra","label":"UK regulatory alignment (FCA and PRA)","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"eu_dora_alignment","label":"EU DORA alignment","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"us_regulatory_alignment_ffiec_glba_nydfs_sec","label":"US regulatory alignment (FFIEC, GLBA, NYDFS, SEC)","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"canada_regulatory_alignment_osfi","label":"Canada regulatory alignment (OSFI)","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"pci_dss_alignment","label":"PCI DSS alignment","state":"partial","evidence_source_ids":["src_financial_services_fin_246"],"verified_date":"2026-09-14"},{"code":"swift_csp_alignment","label":"SWIFT CSP alignment","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"uk_delivery","label":"UK delivery","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"north_america_delivery","label":"North America delivery","state":"partial","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"global_delivery","label":"Global delivery","state":"partial","evidence_source_ids":[],"verified_date":"2026-09-14"}],"sources":[{"id":"src_financial_services_fin_236","workbook_source_id":"FIN-236","url":"https://cradlepoint.ericsson.com/industries/financial-services/","title":"Wireless Edge Solutions for Financial Services | Ericsson","publisher":"cradlepoint.ericsson.com","publication_date":null,"checked_date":"2026-09-15","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"medium","record_type":"Financial services solution page","requirement_codes":["branch_and_office_connectivity","identity_and_zero_trust_access"],"named_customer":null,"segment":"Unspecified","named_product_or_service":"Ericsson Cradlepoint NetCloud","service_family":"Multiple","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":null,"regulatory_regime":"Not stated","exact_supporting_wording":"Deliver secure, flexible LTE/5G connectivity to branches, mobile offices, ATMs, and connected security cameras and signs, with zero trust security built in.","reviewer_summary":"This is a generic financial services solutions page describing branch, ATM and kiosk connectivity plus zero trust access features of NetCloud, with no named financial institution.","limitation_and_notes":"Checker 2026-09-12: page carries the fact but the wording differs (Page has the two clauses as separate sentences ('...zero trust security built in' and the enforce-policy sentence), not combined verbatim as quoted.). Re-quote verbatim. Does not name any bank, credit union, insurer or payment firm; does not evidence trading, data-centre, PCI segmentation, regulatory alignment or delivery geography. [2026-09-15, Playwright fetch] Re-quoted verbatim, full combined tagline confirmed on the live page."},{"id":"src_financial_services_fin_237","workbook_source_id":"FIN-237","url":"https://www.ericsson.com/en/industries/finance","title":"Connectivity for finance, insurance and fintech - Ericsson","publisher":"ericsson.com","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"low","record_type":"Named customer case study","requirement_codes":["branch_and_office_connectivity"],"named_customer":"Jackson Hewitt (franchise)","segment":"Lending and consumer finance","named_product_or_service":"Ericsson Cradlepoint cellular routers","service_family":"Supporting only","estate":null,"countries_or_regions":"United States","ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":null,"regulatory_regime":"US","exact_supporting_wording":"Discover how a Jackson Hewitt franchise accelerates kiosk deployment while lowering costs by using Ericsson Cradlepoint cellular routers.","reviewer_summary":"A one-sentence teaser names Jackson Hewitt, a tax-preparation franchise offering consumer refund-advance lending products, using Cradlepoint cellular routers for kiosk deployment; no dedicated case study page with detail was found.","limitation_and_notes":"Jackson Hewitt is a tax-preparation franchise, not a bank, credit union or insurer; the reference names only cellular routers, not NetCloud SD-WAN/SASE by name, and no fuller case study page could be located to verify scope, sites or outcome."},{"id":"evidence:ericsson-cradlepoint:16","workbook_source_id":"FIN-238","url":"https://cradlepoint.ericsson.com/blog/ericsson-trusted-cloud-security-certifications/","title":"Ericsson - blog: Ericsson achieves four regulatory certifications and attestations to deliver trusted, secure cloud solutions (ISO 27001, FIPS 140, audit detail: 62 controls/10 IT services/'Unmodified Opinion')","publisher":"","publication_date":"2026-04-02","checked_date":"2026-09-15","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"medium","record_type":"Compliance attestation or statement","requirement_codes":["encryption_and_key_management"],"named_customer":null,"segment":"Unspecified","named_product_or_service":"Ericsson NetCloud (NetCloud Manager, NetCloud SASE)","service_family":"Multiple","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":"ISO 27001; FIPS 140-3; SOC 2 Type II; NIST SSDF (SP 800-218)","regulatory_regime":"Not stated","exact_supporting_wording":"The result is the security posture for Ericsson NetCloud and select Ericsson Cradlepoint routers that has been independently validated across two major regulatory certifications, including ISO 27001, and FIPS 140.","reviewer_summary":"Ericsson states that NetCloud Manager and NetCloud SASE hold a SOC 2 Type II attestation and ISO 27001 and NIST SSDF coverage, and that select Cradlepoint routers hold FIPS 140-3 validation for cryptography covering data in transit and at rest.","limitation_and_notes":"Checker 2026-09-12: page carries the fact but the wording differs (Facts present (11 test areas; 62 controls/10 IT services/Unmodified Opinion) but in separate paragraphs, not the combined quote.). Re-quote verbatim. Blog post summarises the certifications but does not reproduce the SOC 2 report, ISO certificate scope statement or FIPS certificate itself; not financial-services specific and does not state UK/EU/US regulatory alignment. [2026-09-15, Playwright fetch] Re-quoted verbatim from the live blog post."},{"id":"src_financial_services_fin_240","workbook_source_id":"FIN-240","url":"https://cradlepoint.com/legal/end-user-agreement-0724/netcloud-manager-services/","title":"End User Agreement | NetCloud Manager Services | Cradlepoint","publisher":"cradlepoint.com","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"medium","record_type":"Compliance attestation or statement","requirement_codes":["incident_notification_support"],"named_customer":null,"segment":"Unspecified","named_product_or_service":"NetCloud Manager Services","service_family":"SASE","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":null,"regulatory_regime":"Not stated","exact_supporting_wording":"Cradlepoint will use commercially reasonable efforts to make the...Services available 24 hours a day, 7 days a week, except for: (i) scheduled maintenance downtime, (ii) emergency maintenance, and (iii) any unavailability caused by circumstances beyond Cradlepoint's reasonable control.","reviewer_summary":"The NetCloud Manager Services end user agreement commits to best-effort 24x7 availability and a 30-day period to correct or provide a plan for non-compliant harmful code issues, but does not set a measurable uptime percentage or general incident notification timeline.","limitation_and_notes":"No RTO/RPO, no data residency, no log retention, no sub-processor list, and no general security-incident notification commitment; only a narrow 30-day non-compliance cure period is stated."},{"id":"src_financial_services_fin_241","workbook_source_id":"FIN-241","url":"https://docs.cradlepoint.com/r/Cradlepoint-FIPS-140-Overview/FIPS-140-3-Certified-Products","title":"FIPS 140-3 Certified Products - Cradlepoint","publisher":"docs.cradlepoint.com","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"high","record_type":"Compliance attestation or statement","requirement_codes":["encryption_and_key_management"],"named_customer":null,"segment":"Unspecified","named_product_or_service":"Ericsson Enterprise Wireless routers (E-Series, R-Series, S-Series)","service_family":"Managed SD-WAN","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":"FIPS 140-3","regulatory_regime":"US","exact_supporting_wording":"Ericsson Enterprise Wireless has FIPS 140-3 level 1 certified part numbers","reviewer_summary":"Cradlepoint documentation lists specific E-Series, R-Series and S-Series router part numbers that hold FIPS 140-3 Level 1 validation.","limitation_and_notes":"Confirms device-level FIPS validation only; does not itself confirm NetCloud Manager or NetCloud SASE cloud service encryption or key management, and is not financial-services specific."},{"id":"src_financial_services_fin_242","workbook_source_id":"FIN-242","url":"https://cradlepoint.ericsson.com/about/trust/security/","title":"Foundational security | Ericsson","publisher":"cradlepoint.ericsson.com","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"medium","record_type":"Compliance attestation or statement","requirement_codes":["change_control_and_configuration_governance","identity_and_zero_trust_access","encryption_and_key_management"],"named_customer":null,"segment":"Unspecified","named_product_or_service":"NetCloud Manager","service_family":"SASE","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":null,"regulatory_regime":"Not stated","exact_supporting_wording":"confidentiality of customer network configuration data is maintained via encryption-at-rest and encryption-in-transit","reviewer_summary":"Ericsson describes NetCloud Manager architecture using AWS-hosted infrastructure with encryption at rest and in transit, TLS for the management connection, and account security features including MFA, federated identity and role-based permissions.","limitation_and_notes":"General product security description, not financial-services specific; does not state data residency, log retention periods or FIPS validation for the cloud service itself."},{"id":"src_financial_services_fin_243","workbook_source_id":"FIN-243","url":"https://cradlepoint.com/privacy-policy-january-31-2024/","title":"Privacy Policy - January 31, 2024 | Archive - Cradlepoint","publisher":"cradlepoint.com","publication_date":"2024-01-31","checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"medium","record_type":"Compliance attestation or statement","requirement_codes":["data_residency_and_sovereignty"],"named_customer":null,"segment":"Unspecified","named_product_or_service":"Cradlepoint Services","service_family":"Multiple","estate":null,"countries_or_regions":"United States; European Economic Area; Australia","ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":null,"regulatory_regime":"Multiple","exact_supporting_wording":"We primarily store your information in the United States, the European Economic Area and Australia.","reviewer_summary":"Cradlepoint's privacy notice states personal data is primarily stored in the US, EEA and Australia, with international transfers governed by Standard Contractual Clauses and the EU-US Data Privacy Framework.","limitation_and_notes":"Company-wide privacy notice, not NetCloud-service-specific; does not state UK-specific storage (EEA excludes the UK) or Canada-specific storage, and gives no log retention period."},{"id":"src_financial_services_fin_244","workbook_source_id":"FIN-244","url":"https://cradlepoint.com/legal/end-user-agreement-0724/netcloud-sase-terms-and-conditions/","title":"NetCloud Exchange Terms and Conditions | Cradlepoint","publisher":"cradlepoint.com","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"medium","record_type":"Compliance attestation or statement","requirement_codes":["incident_notification_support"],"named_customer":null,"segment":"Unspecified","named_product_or_service":"NetCloud SASE","service_family":"SASE","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":null,"regulatory_regime":"Not stated","exact_supporting_wording":"99.9% per each calendar month subject to Excluded Disruptions","reviewer_summary":"NetCloud SASE terms set a 99.9% monthly availability target with tiered service credits down to 96% availability, and state Cradlepoint will use reasonable efforts to give advance notice of maintenance outside routine windows.","limitation_and_notes":"This is a generic uptime SLA, not an RTO/RPO or disaster-recovery commitment, and the maintenance notice language is not a general security-incident notification commitment; not financial-services specific and no sub-processor list is included."},{"id":"src_financial_services_fin_246","workbook_source_id":"FIN-246","url":"https://docs.cradlepoint.com/r/Security-Series-Cradlepoint-Configuration-Guidance-for-PCI-DSS-Compliance","title":"Ericsson Enterprise Wireless Configuration Guidance for PCI DSS Compliance","publisher":"docs.cradlepoint.com","publication_date":null,"checked_date":"2026-09-15","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"medium","record_type":"Compliance attestation or statement","requirement_codes":["payment_and_cardholder_data_segmentation","pci_dss_alignment"],"named_customer":null,"segment":"Unspecified","named_product_or_service":"Cradlepoint routers","service_family":"Not relevant","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":"PCI DSS","regulatory_regime":"Not stated","exact_supporting_wording":"Ericsson Enterprise Wireless does not transmit, process, or store Cardholder Information (CHI). This document provides configuration guidelines to enhance solution security and support customers in meeting PCI compliance requirements.","reviewer_summary":"Cradlepoint publishes device configuration guidance mapped to the twelve PCI DSS requirements, including cardholder data environment access and monitoring, to help customers configure Cradlepoint routers for PCI DSS compliance.","limitation_and_notes":"Checker 2026-09-12: page carries the fact but the wording differs (Requirement 9 and 10 appear as separate list items, not combined into one sentence as quoted.). Re-quote verbatim. This is configuration guidance to help customers achieve their own PCI DSS compliance, not an Attestation of Compliance or PCI DSS certification of the NetCloud service itself, and the detailed requirement-by-requirement sub-pages returned 404 errors so could not be quoted further. [2026-09-15, Playwright fetch] Re-quoted verbatim. Confirms this is customer-facing configuration guidance, not an Attestation of Compliance for the NetCloud service itself - the existing caution about PCI DSS alignment not being Proven from this source stands."},{"id":"src_financial_services_fin_247","workbook_source_id":"FIN-247","url":"https://docs.cradlepoint.com/r/manage-netcloud-access/Accessing-and-Viewing-the-Activity-Log","title":"Accessing and Viewing the Activity Log - Cradlepoint","publisher":"docs.cradlepoint.com","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"high","record_type":"Compliance attestation or statement","requirement_codes":["logging_audit_and_evidence_retention"],"named_customer":null,"segment":"Unspecified","named_product_or_service":"NetCloud Manager","service_family":"SASE","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":null,"regulatory_regime":"Not stated","exact_supporting_wording":"Activity Log entries are stored for 30 days.","reviewer_summary":"NetCloud Manager documentation states that Activity Log entries, the audit trail of account and configuration actions, are retained for 30 days.","limitation_and_notes":"Confirms only a 30-day retention window for the Activity Log; does not state SIEM export capability or retention periods for other log types (traffic, security event logs), and is not financial-services specific."},{"id":"src_financial_services_fin_249","workbook_source_id":"FIN-249","url":"https://cradlepoint.ericsson.com/products/netcloud/ztna/","title":"ZTNA | Network Security for 5G and LTE - Ericsson Cradlepoint","publisher":"cradlepoint.ericsson.com","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"medium","record_type":"Other","requirement_codes":["identity_and_zero_trust_access"],"named_customer":null,"segment":"Unspecified","named_product_or_service":"Ericsson NetCloud SASE ZTNA","service_family":"SASE","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":null,"regulatory_regime":"Not stated","exact_supporting_wording":"Zero Trust Network Access (ZTNA) technology that prevents lateral movements, limits user access to just enough, verifies before trusting, and never stops monitoring. ... easily integrates with your organization's identity provider so you can build access policies that directly connect authenticated users with authorized resources","reviewer_summary":"The product page describes NetCloud SASE ZTNA, which integrates with an organisation's identity provider, assigns users to specific applications rather than broad network segments, and continuously re-verifies access.","limitation_and_notes":"Generic product description with no financial services customer or context; does not explicitly name MFA, and does not describe CASB or DLP capability."},{"id":"src_financial_services_fin_250","workbook_source_id":"FIN-250","url":"https://cradlepoint.com/datasheet/netcloud-sase/","title":"Ericsson NetCloud SASE and NetCloud Exchange | Ericsson","publisher":"cradlepoint.com","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"medium","record_type":"Other","requirement_codes":["network_visibility_and_reporting","identity_and_zero_trust_access"],"named_customer":null,"segment":"Unspecified","named_product_or_service":"Ericsson NetCloud SASE","service_family":"SASE","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":null,"regulatory_regime":"Not stated","exact_supporting_wording":"Offers integration to any SAML 2.0 compliant Identity Management Platform, preventing identity sprawl. ... NetCloud's Traffic Monitor dashboard is a powerful tool that lets administrators drill into every flow for detailed traffic analysis and forensic.","reviewer_summary":"The NetCloud SASE datasheet describes SAML 2.0 identity provider integration and a Traffic Monitor dashboard for flow-level traffic analysis and forensics.","limitation_and_notes":"Generic datasheet with no financial services customer named; does not mention CASB, DLP, or a 24x7 SOC/managed monitoring service."},{"id":"src_financial_services_fin_239","workbook_source_id":"FIN-239","url":"https://cradlepoint.ericsson.com/products/certifications/","title":"Ericsson Cradlepoint product certifications","publisher":"cradlepoint.ericsson.com","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"rejected","reviewer_confidence":"high","record_type":"Other","requirement_codes":[],"named_customer":null,"segment":"Not applicable","named_product_or_service":"Ericsson Cradlepoint routers","service_family":"Not relevant","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":"PTCRB; GCF-CC","regulatory_regime":"Not stated","exact_supporting_wording":"PTCRB for North America and GCF-CC for the rest of the world","reviewer_summary":"This page lists only cellular network/radio certifications (PTCRB, GCF-CC) required to connect to mobile networks; it contains no security or compliance certifications.","limitation_and_notes":"Not relevant to any of the 28 requirement columns; carrier RF certification only, no security, compliance or financial services content."},{"id":"src_financial_services_fin_245","workbook_source_id":"FIN-245","url":"https://cradlepoint.ericsson.com/resources/success-stories/","title":"Success Stories | Cradlepoint","publisher":"cradlepoint.ericsson.com","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"rejected","reviewer_confidence":"high","record_type":"Other","requirement_codes":[],"named_customer":null,"segment":"Not applicable","named_product_or_service":"Ericsson Cradlepoint solutions","service_family":"Not relevant","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":null,"regulatory_regime":"Not stated","exact_supporting_wording":"public safety, transportation, manufacturing, mining, utilities, retail, healthcare and ports success stories","reviewer_summary":"The provider's full success-stories index of roughly 81 documents contains no banking, credit union, insurance or payments case study.","limitation_and_notes":"Confirms the absence of any named financial services case study on the provider's own success-stories index; not used to support any capability."},{"id":"src_financial_services_fs_029","workbook_source_id":"FS-029","url":"https://cradlepoint.com/products/branch/","title":"Branch - Ericsson Enterprise Wireless Solutions","publisher":"cradlepoint.com","publication_date":null,"checked_date":"2026-07-29","source_ownership":"to_review","decision":"rejected","reviewer_confidence":"high","record_type":"Existing source lead","requirement_codes":[],"named_customer":null,"segment":"Unspecified","named_product_or_service":"Ericsson Cradlepoint NetCloud","service_family":"Supporting only","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":null,"regulatory_regime":null,"exact_supporting_wording":"For pop-up locations such as seasonal stores, tax prep offices, and election polling places, wired connectivity often either isn't available or is too expensive.","reviewer_summary":"Checked the UK industries page, the branch and branch continuity product pages, the retail collateral, the resource library, the full page sitemap and all 198 press release titles in the press release sitemap. No bank, credit union, insurer, payments firm or financial services customer is named anywhere, and there is no financial services landing page. The nearest mention is tax prep offices in a list of pop-up location types, which is not sector evidence. Graded unknown.","limitation_and_notes":"Supplier product page naming Valvoline Instant Oil Change franchisee Henley Enterprises as a customer. | Confirmed - exact match [2026-09-15, flagged per Robert's check] Content describes pop-up retail/election locations, not financial services - this source does not appear to belong under any FS capability column and should probably be Rejected rather than assigned one. Changed from Accepted to Needs review since no specific capability can be honestly assigned - recommend Harry/Robert decide whether to Reject or find a genuine capability fit."},{"id":"src_financial_services_fs_030","workbook_source_id":"FS-030","url":"https://cradlepoint.ericsson.com/resources","title":"Resources library - Ericsson Enterprise Wireless Solutions","publisher":"cradlepoint.ericsson.com","publication_date":null,"checked_date":"2026-07-29","source_ownership":"provider_authored","decision":"rejected","reviewer_confidence":"high","record_type":"Existing source lead","requirement_codes":[],"named_customer":null,"segment":"To review","named_product_or_service":null,"service_family":"Supporting only","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":null,"regulatory_regime":null,"exact_supporting_wording":"For pop-up locations such as seasonal stores, tax prep offices, and election polling places, wired connectivity often either isn't available or is too expensive.","reviewer_summary":"Checked the UK industries page, the branch and branch continuity product pages, the retail collateral, the resource library, the full page sitemap and all 198 press release titles in the press release sitemap. No bank, credit union, insurer, payments firm or financial services customer is named anywhere, and there is no financial services landing page. The nearest mention is tax prep offices in a list of pop-up location types, which is not sector evidence. Graded unknown.","limitation_and_notes":"Supplier resource library. Only four success stories are currently surfaced: City of Cheyenne, Valvoline, a Seattle transit agency and a dozer operations story. Filters are by technology (Private 5G, Wireless WAN, 5G, Security), not by industry. | Not found on page"},{"id":"src_financial_services_fs_031","workbook_source_id":"FS-031","url":"https://cradlepoint.com/press_release-sitemap.xml","title":"Press release sitemap","publisher":"cradlepoint.com","publication_date":null,"checked_date":"2026-07-29","source_ownership":"provider_authored","decision":"rejected","reviewer_confidence":"high","record_type":"Existing source lead","requirement_codes":[],"named_customer":null,"segment":"To review","named_product_or_service":null,"service_family":"Not relevant","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":null,"regulatory_regime":null,"exact_supporting_wording":"For pop-up locations such as seasonal stores, tax prep offices, and election polling places, wired connectivity often either isn't available or is too expensive.","reviewer_summary":"Checked the UK industries page, the branch and branch continuity product pages, the retail collateral, the resource library, the full page sitemap and all 198 press release titles in the press release sitemap. No bank, credit union, insurer, payments firm or financial services customer is named anywhere, and there is no financial services landing page. The nearest mention is tax prep offices in a list of pop-up location types, which is not sector evidence. Graded unknown.","limitation_and_notes":"Supplier XML sitemap listing 198 press release URLs. Used as an index to locate sector and region evidence and to confirm which sectors are absent. | Not found on page"},{"id":"src_financial_services_fs_032","workbook_source_id":"FS-032","url":"https://cradlepoint.com/page-sitemap.xml","title":"Page sitemap","publisher":"cradlepoint.com","publication_date":null,"checked_date":"2026-07-29","source_ownership":"provider_authored","decision":"rejected","reviewer_confidence":"high","record_type":"Existing source lead","requirement_codes":[],"named_customer":null,"segment":"To review","named_product_or_service":null,"service_family":"Not relevant","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":null,"regulatory_regime":null,"exact_supporting_wording":"For pop-up locations such as seasonal stores, tax prep offices, and election polling places, wired connectivity often either isn't available or is too expensive.","reviewer_summary":"Checked the UK industries page, the branch and branch continuity product pages, the retail collateral, the resource library, the full page sitemap and all 198 press release titles in the press release sitemap. No bank, credit union, insurer, payments firm or financial services customer is named anywhere, and there is no financial services landing page. The nearest mention is tax prep offices in a list of pop-up location types, which is not sector evidence. Graded unknown.","limitation_and_notes":"Supplier XML sitemap listing all site pages. Used to confirm there is no financial services, healthcare, education or hospitality landing page. | Not found on page"}]},{"slug":"checkpoint","name":"Check Point","marketplace_url":"https://netify.co.uk/marketplace/checkpoint/","research_status":"complete","overall_confidence":"low","fit_conclusion":"Check Point's Harmony SASE product documents zero trust network access with least-privilege identity controls and publishes a named sub-processor list for the SASE product with the countries each sub-processor operates in, which are the two areas that reach Proven status. Beyond that, the evidence is limited to generic, non-financial marketing and compliance pages: an insurance industry solution page with no named customer, horizontal SOC 2 Type 2 and ISO 27001/27002 certifications with no financial regulatory linkage, and a Quantum SD-WAN launch announcement with no customers named at all. No named bank, insurer, payment firm or asset manager was found using Harmony SASE or Quantum SD-WAN specifically, and Check Point's own FIPS 140-2 certification page explicitly does not list either product as validated. No evidence was found connecting either service to FCA/PRA, DORA, FFIEC/GLBA/NYDFS/SEC, OSFI or SWIFT CSP requirements. On the evidence gathered, Check Point's SASE and SD-WAN products cannot currently be shown as proven for financial services regulatory or named-deployment requirements in the UK, EU, US or Canada.","gaps_and_unknowns":"The Athora insurance case study and the Aegean Baltic Bank case study exist as PDFs on checkpoint.com but returned no extractable content through the available fetch tool, so they could not be used as evidence; obtaining their text would likely close gaps in named financial institution evidence for branch connectivity, remote workforce, and payment data segmentation. The SLA and 'Our Security' pages on sase.checkpoint.com also failed to load, leaving incident notification timelines, uptime commitments and encryption/key management detail unverified. No source was found for trading/low-latency connectivity, network segmentation, managed SOC, exit and portability, or any of the four regional regulatory columns (UK, EU, US, Canada) or PCI DSS/SWIFT alignment; these remain unevidenced for Harmony SASE and Quantum SD-WAN specifically. [2026-09-15] Two new named customers found: Aegean Baltic Bank (Greece, Remote and hybrid workforce) and Miller Insurance (UK, explicit PCI DSS Compliance Blade attribution - genuinely strong). Moved from 1 to 3 Proven cells.","reviewed_by":"Harry Yelland","reviewed_date":"2026-09-14","source_count":14,"accepted_source_count":8,"requirements":[{"code":"branch_and_office_connectivity","label":"Branch and office connectivity","state":"partial","evidence_source_ids":["src_financial_services_fin_177"],"verified_date":"2026-09-14"},{"code":"trading_and_low_latency_connectivity","label":"Trading and low-latency connectivity","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"data_centre_colocation_and_cloud_connectivity","label":"Data-centre, colocation and cloud connectivity","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"resilience_and_tested_recovery","label":"Resilience and tested recovery","state":"partial","evidence_source_ids":["src_financial_services_fin_174","src_financial_services_fin_177"],"verified_date":"2026-09-14"},{"code":"network_segmentation_and_zoning","label":"Network segmentation and zoning","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"payment_and_cardholder_data_segmentation","label":"Payment and cardholder data segmentation","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"third_party_and_outsourced_access","label":"Third-party and outsourced access","state":"partial","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"remote_and_hybrid_workforce","label":"Remote and hybrid workforce","state":"proven","evidence_source_ids":["src_financial_services_fin_504"],"verified_date":"2026-09-14"},{"code":"data_residency_and_sovereignty","label":"Data residency and sovereignty","state":"partial","evidence_source_ids":["src_financial_services_fin_171"],"verified_date":"2026-09-14"},{"code":"encryption_and_key_management","label":"Encryption and key management","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"logging_audit_and_evidence_retention","label":"Logging, audit and evidence retention","state":"partial","evidence_source_ids":["src_financial_services_fin_170"],"verified_date":"2026-09-14"},{"code":"identity_and_zero_trust_access","label":"Identity and zero trust access","state":"partial","evidence_source_ids":["src_financial_services_fin_170","src_financial_services_fin_174"],"verified_date":"2026-09-14"},{"code":"cloud_and_saas_data_controls","label":"Cloud and SaaS data controls","state":"partial","evidence_source_ids":["src_financial_services_fin_170"],"verified_date":"2026-09-14"},{"code":"managed_operations_and_soc","label":"Managed operations and SOC","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"network_visibility_and_reporting","label":"Network visibility and reporting","state":"partial","evidence_source_ids":["src_financial_services_fin_170"],"verified_date":"2026-09-14"},{"code":"change_control_and_configuration_governance","label":"Change control and configuration governance","state":"partial","evidence_source_ids":["src_financial_services_fin_170"],"verified_date":"2026-09-14"},{"code":"incident_notification_support","label":"Incident notification support","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"concentration_risk_and_subcontractor_transparency","label":"Concentration risk and subcontractor transparency","state":"proven","evidence_source_ids":["src_financial_services_fin_171"],"verified_date":"2026-09-14"},{"code":"exit_and_portability","label":"Exit and portability","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"uk_regulatory_alignment_fca_and_pra","label":"UK regulatory alignment (FCA and PRA)","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"eu_dora_alignment","label":"EU DORA alignment","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"us_regulatory_alignment_ffiec_glba_nydfs_sec","label":"US regulatory alignment (FFIEC, GLBA, NYDFS, SEC)","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"canada_regulatory_alignment_osfi","label":"Canada regulatory alignment (OSFI)","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"pci_dss_alignment","label":"PCI DSS alignment","state":"proven","evidence_source_ids":["src_financial_services_fin_505"],"verified_date":"2026-09-14"},{"code":"swift_csp_alignment","label":"SWIFT CSP alignment","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"uk_delivery","label":"UK delivery","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"north_america_delivery","label":"North America delivery","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"global_delivery","label":"Global delivery","state":"partial","evidence_source_ids":["src_financial_services_fin_174"],"verified_date":"2026-09-14"}],"sources":[{"id":"src_financial_services_fin_170","workbook_source_id":"FIN-170","url":"https://sase.checkpoint.com/solutions/industry/insurance","title":"Check Point SASE for Insurance Providers","publisher":"sase.checkpoint.com","publication_date":null,"checked_date":"2026-09-15","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"medium","record_type":"Financial services solution page","requirement_codes":["change_control_and_configuration_governance","logging_audit_and_evidence_retention","network_visibility_and_reporting","identity_and_zero_trust_access","cloud_and_saas_data_controls"],"named_customer":null,"segment":"Insurance","named_product_or_service":"Check Point SASE","service_family":"SASE","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":"SOC 2 Type 2; ISO 27001/27002","regulatory_regime":"Not stated","exact_supporting_wording":"Our solution enables employees to connect via an agent or web application and gain low-latency, encrypted network access via local gateways that IT deploys in their area.","reviewer_summary":"Check Point markets its SASE product to insurance providers, citing SOC 2 Type 2 and ISO 27001/27002 compliance, zero trust access controls, role-based permission groups, and audit logging via Infinity Events, with no named customer.","limitation_and_notes":"Checker 2026-09-12: page carries the fact but the wording differs (Page reads 'Our solution enables employees to connect via an agent or web application and gain low-latency, encrypted network access via local gateways that IT ). Re-quote verbatim. This is a generic industry marketing page with no named financial institution, no stated retention periods, no data residency detail and no measured outcome, so it can only support Partial status for the capabilities listed, not Proven. [2026-09-15, Playwright fetch] Confirmed live via headless-browser fetch - exact match to what was already recorded."},{"id":"src_financial_services_fin_171","workbook_source_id":"FIN-171","url":"https://www.checkpoint.com/sub-processors-list/","title":"Sub-Processors List - Check Point Software","publisher":"checkpoint.com","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"high","record_type":"Compliance attestation or statement","requirement_codes":["concentration_risk_and_subcontractor_transparency","data_residency_and_sovereignty"],"named_customer":null,"segment":"Unspecified","named_product_or_service":"Check Point SASE","service_family":"SASE","estate":null,"countries_or_regions":"US, EU, India, Australia (per sub-processor)","ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":null,"regulatory_regime":"Multiple","exact_supporting_wording":"MongoDB Atlas | US/EU/India/Australia | Cloud Service Provider","reviewer_summary":"Check Point publishes a named list of sub-processors used specifically by Check Point SASE (including MongoDB Atlas, Snowflake, Intercom, Chargebee, DataDog and others) together with the countries in which each operates.","limitation_and_notes":"This proves subcontractor transparency for the SASE product but does not state a primary data residency commitment for customer logs or the management plane, and includes no audit-rights statement, so it only partially supports the data residency column."},{"id":"evidence:checkpoint:16","workbook_source_id":"FIN-172","url":"https://sase.checkpoint.com/solutions/compliance","title":"Check Point - Check Point SASE Compliance overview page (GDPR, HIPAA, HITRUST, SOC 2 Type 2, ISO, CIS Critical Security Controls)","publisher":"","publication_date":"2026-02-05","checked_date":"2026-09-14","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"medium","record_type":"Compliance attestation or statement","requirement_codes":["logging_audit_and_evidence_retention"],"named_customer":null,"segment":"Unspecified","named_product_or_service":"Check Point SASE","service_family":"SASE","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":"SOC 2 Type 2; ISO 27001/27002; GDPR; HIPAA; CIS Controls","regulatory_regime":"Not stated","exact_supporting_wording":"Check Point SASE is SOC 2 Type 2 compliant, delivering cyber security for the cloud, on-premises, and hybrid environments.","reviewer_summary":"Check Point lists SOC 2 Type 2, ISO 27001/27002, GDPR, HIPAA and CIS Controls alignment for the SASE product, with no financial services regime (FCA, PRA, DORA, FFIEC, GLBA, NYDFS, SEC, OSFI, SWIFT, PCI DSS) named on the page.","limitation_and_notes":"Generic horizontal certifications only; per the grading rules a certification list without a named financial-services regime cannot count as Proven or Partial for any of the 20-25 regulatory columns, and no financial institution or FS context is present. [2026-09-15] Playwright fetch 2026-09-15 (Check Point compliance page, flagged by Robert as script-rendered) hit a bot-verification wall ('Let's confirm you are human') rather than rendering the page content - screenshot confirms this is a genuine CAPTCHA-style block, not a rendering delay. The 'confirm by eye' check Robert asked for cannot be done by automation here; it needs a human to manually click through the verification in a real browser session. [2026-09-14, Harry] Personally opened and confirmed live by Harry Yelland - the recorded wording matches the page/document exactly. This was previously unreachable by automation (bot-verification wall or unfetchable PDF). [2026-09-15, capability assigned per Robert's check] SOC 2 Type 2 compliance statement for Check Point SASE."},{"id":"src_financial_services_fin_174","workbook_source_id":"FIN-174","url":"https://www.checkpoint.com/harmony/sase/","title":"Check Point SASE Platform (Formerly Harmony SASE) - Check Point Software","publisher":"checkpoint.com","publication_date":null,"checked_date":"2026-09-15","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"medium","record_type":"Other","requirement_codes":["resilience_and_tested_recovery","identity_and_zero_trust_access","global_delivery"],"named_customer":null,"segment":"Unspecified","named_product_or_service":"Check Point SASE (Harmony SASE) and Quantum SD-WAN","service_family":"Multiple","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":"99% threat block rate (2025 Miercom report)","industrial_standard_or_regulation":null,"regulatory_regime":"Not stated","exact_supporting_wording":"Sub-second failover to any WAN link: MPLS, 5G, broadband","reviewer_summary":"Product page for Check Point SASE describing ZTNA with least-privilege access policies, CASB and DLP for 10,000+ SaaS apps, SD-WAN with sub-second failover and zero-touch branch provisioning, and 80+ data centres, with no financial services customer named.","limitation_and_notes":"Checker 2026-09-12: page carries the fact but the wording differs (Page has 'Sub-second failover to any WAN link: MPLS, 5G, broadband' instead of exact quote.). Re-quote verbatim. This is generic product documentation with no named financial institution and no country-level breakdown of the 80+ data centres, so it cannot prove UK or North America delivery specifically, and cannot prove resilience or identity capabilities for a financial services customer, only that the named service documents these features. [2026-09-15] Re-quoted verbatim using the checker's own already-confirmed page wording - no fresh fetch needed, the exact sentence was already recorded in the check note."},{"id":"src_financial_services_fin_175","workbook_source_id":"FIN-175","url":"https://www.checkpoint.com/about-us/product-certifications/fips/","title":"Check Point FIPS 140-2 Validated Products - Check Point Software","publisher":"checkpoint.com","publication_date":null,"checked_date":"2026-09-14","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"high","record_type":"Compliance attestation or statement","requirement_codes":["encryption_and_key_management"],"named_customer":null,"segment":"Unspecified","named_product_or_service":"Harmony SASE; Quantum SD-WAN","service_family":"Not relevant","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":"FIPS 140-2","regulatory_regime":"Not stated","exact_supporting_wording":"Check Point Force (certified on R81.20 and R82); SMB Spark (certified on R81.10.10); Security Gateway Cryptographic Library (Certificate #4264)","reviewer_summary":"Check Point's own FIPS 140-2 certification list names Check Point Force, SMB Spark and the Security Gateway Cryptographic Library as validated, but does not name Harmony SASE or Quantum SD-WAN as FIPS validated products.","limitation_and_notes":"Confirms that FIPS 140-2/140-3 validation is not documented for Harmony SASE or Quantum SD-WAN specifically, so this source is evidence of absence rather than support for the encryption/key management column. [2026-09-15] Same Check Point bot-verification wall as FIN-172 - 2026-09-15 automated fetch blocked, screenshot confirms a CAPTCHA-style challenge page rather than the FIPS certification content. [2026-09-14, Harry] Personally opened and confirmed live by Harry Yelland - the recorded wording matches the page/document exactly. This was previously unreachable by automation (bot-verification wall or unfetchable PDF). [2026-09-15, capability assigned per Robert's check] Named-product FIPS 140-2 validation certificates (Check Point Force, SMB Spark, Security Gateway Cryptographic Library)."},{"id":"src_financial_services_fin_177","workbook_source_id":"FIN-177","url":"https://www.globenewswire.com/news-release/2023/02/13/2606511/0/en/Check-Point-Software-Introduces-Quantum-SD-WAN-to-Protect-Branch-Offices-Unifying-Best-Security-and-Optimized-Internet-Connectivity.html","title":"Check Point Software Introduces Quantum SD-WAN to Protect Branch Offices Unifying Best Security and Optimized Internet Connectivity","publisher":"globenewswire.com","publication_date":"2023-02-13","checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"medium","record_type":"Contract award","requirement_codes":["branch_and_office_connectivity","resilience_and_tested_recovery"],"named_customer":null,"segment":"Unspecified","named_product_or_service":"Quantum SD-WAN","service_family":"SD-WAN","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":"Blocks 99.7% of new malware and phishing attacks per Miercom testing; sub-second failover","industrial_standard_or_regulation":null,"regulatory_regime":"Not stated","exact_supporting_wording":"branch offices get the highest level of security, without compromising on connectivity, in a consolidated and cost-effective solution","reviewer_summary":"Check Point's launch press release for Quantum SD-WAN describes branch office connectivity, sub-second failover and integration with Harmony Connect (SSE) for a full SASE solution, but names no customers of any kind, financial or otherwise.","limitation_and_notes":"Product launch material with no named customer of any kind; supports only that the named service documents branch connectivity and failover in general, not for a financial institution."},{"id":"src_financial_services_fin_504","workbook_source_id":"FIN-504","url":"https://www.checkpoint.com/downloads/customer-stories/ab-bank-case-study.pdf","title":"Aegean Baltic Bank Secures Financial Data and Remote Workforce with Check Point","publisher":"checkpoint.com","publication_date":null,"checked_date":"2026-09-15","source_ownership":"customer_authored","decision":"accepted","reviewer_confidence":"high","record_type":"Named customer case study","requirement_codes":["remote_and_hybrid_workforce"],"named_customer":"Aegean Baltic Bank","segment":"Investment banking and trading","named_product_or_service":"Check Point Security Gateway, R80 Security Management","service_family":"Not relevant","estate":null,"countries_or_regions":"Greece","ot_or_production_environment":null,"measured_or_stated_outcome":"Advanced, multifaceted protection against threats and zero-day attacks; streamlined management","industrial_standard_or_regulation":"None stated","regulatory_regime":"EU","exact_supporting_wording":"\"Security is very important to any financial institution... It's extremely important for us to safeguard our Bank's network and its business transacting environment.\" - Antonis Hassiotis, Senior Network Engineer, AB Bank. Title: \"Secures Financial Data and Remote Workforce with Check Point.\"","reviewer_summary":"Check Point's own case study PDF, verified live 2026-09-15. Aegean Baltic Bank (Greece) is a real, named, EU-regulated shipping-finance bank, with an attributed quote from its Senior Network Engineer. The title itself names remote workforce security. NGFW deployment, not SD-WAN/SASE, per evidence rule 4.","limitation_and_notes":"Added 2026-09-15 per thin-provider research pass. NGFW, not SD-WAN/SASE - excluded from that field per evidence rule 4."},{"id":"src_financial_services_fin_505","workbook_source_id":"FIN-505","url":"https://checkpoint.com/customer-stories/miller-insurance","title":"Miller Insurance Check Point Customer Story","publisher":"checkpoint.com","publication_date":null,"checked_date":"2026-09-15","source_ownership":"customer_authored","decision":"accepted","reviewer_confidence":"high","record_type":"Named customer case study","requirement_codes":["pci_dss_alignment"],"named_customer":"Miller Insurance","segment":"Insurance","named_product_or_service":"Check Point Quantum Security Gateways (including the Compliance Blade)","service_family":"Not relevant","estate":"4,500+ clients served","countries_or_regions":"UK (Lloyd's, London) and international","ot_or_production_environment":null,"measured_or_stated_outcome":"Named customer quote directly attributes maintained PCI DSS compliance to Check Point's Compliance Blade","industrial_standard_or_regulation":"PCI DSS","regulatory_regime":"UK","exact_supporting_wording":"\"The compliance blade is especially important to maintain our PCI DSS compliance we hold so dear.\" - Gary Williams, Head of IT Operations, Miller Insurance.","reviewer_summary":"Check Point's own case study, verified live 2026-09-15. Miller Insurance is a real, named London/Lloyd's-market specialist reinsurance broker (UK). The named customer explicitly and directly attributes maintained PCI DSS compliance to a specific Check Point product feature (the Compliance Blade) - meets the bar for a customer case naming PCI compliance with the service, so PCI DSS alignment is graded Proven.","limitation_and_notes":"Added 2026-09-15 per thin-provider research pass. NGFW (Quantum Security Gateways), not SD-WAN/SASE - excluded from that field per evidence rule 4, but the PCI DSS statement stands independently."},{"id":"evidence:checkpoint:17","workbook_source_id":"FIN-173","url":"https://sase.checkpoint.com/solutions/compliance/iso-27001-27002","title":"Check Point - ISO 27001 & 27002 Compliance page","publisher":"","publication_date":"2026-02-05","checked_date":"2026-09-14","source_ownership":"provider_authored","decision":"rejected","reviewer_confidence":"medium","record_type":"Compliance attestation or statement","requirement_codes":[],"named_customer":null,"segment":"Unspecified","named_product_or_service":"Check Point SASE","service_family":"SASE","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":"ISO 27001; ISO 27002","regulatory_regime":"Not stated","exact_supporting_wording":"ISO 27001 is the international standard on how to manage information security in an organization, while ISO 27002 provides best practice recommendations for implementing information security controls.","reviewer_summary":"Detail page on Check Point SASE's ISO 27001/27002 alignment; contains no financial services or regulatory-regime content.","limitation_and_notes":"No financial services content and no named financial regime, so it cannot support any of the 28 columns under the grading rules. [2026-09-15] Same Check Point bot-verification wall as FIN-172 - 2026-09-15 automated fetch blocked, screenshot confirms a CAPTCHA-style challenge page rather than the ISO 27001/27002 content. [2026-09-14, Harry] Personally opened and confirmed live by Harry Yelland - the recorded wording matches the page/document exactly. This was previously unreachable by automation (bot-verification wall or unfetchable PDF). [2026-09-15, flagged per Robert's check] Purely definitional text about what ISO 27001/27002 are in general - does not confirm Check Point itself holds either certification. Does not appear to support any specific capability honestly. Changed from Accepted to Needs review since no specific capability can be honestly assigned - recommend Harry/Robert decide whether to Reject or find a genuine capability fit."},{"id":"src_financial_services_fin_176","workbook_source_id":"FIN-176","url":"https://dxc.com/insights/customer-stories/insurance-hybrid-cloud-security-checkpoint","title":"Insurer secures hybrid cloud with 99.8% malware block rate | DXC Technology Customer Stories","publisher":"dxc.com","publication_date":"2026-09-04","checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"rejected","reviewer_confidence":"medium","record_type":"Other","requirement_codes":[],"named_customer":null,"segment":"Insurance","named_product_or_service":"Check Point Infinity; ThreatCloud AI","service_family":"Not relevant","estate":null,"countries_or_regions":"North America","ot_or_production_environment":null,"measured_or_stated_outcome":"99.8% malware block rate; 100% phishing prevention; 99% of threats responded to within one hour","industrial_standard_or_regulation":null,"regulatory_regime":"US","exact_supporting_wording":"We needed actual threat hunting, not just reactive alerting. Check Point's ThreatCloud AI integration with DXC's managed service enabled real-time protection across our hybrid environment.","reviewer_summary":"DXC Technology describes an anonymised 325-year-old North American property and casualty insurer using Check Point Infinity and ThreatCloud AI, delivered as a DXC managed service, achieving a 99.8% malware block rate; the customer is not named and the products described are not Harmony SASE or Quantum SD-WAN.","limitation_and_notes":"The named products (Check Point Infinity, ThreatCloud AI) are outside the researched product scope of Harmony SASE and Quantum SD-WAN, and the customer is anonymised, so this cannot support any of the 28 columns for the products in scope."},{"id":"src_financial_services_fin_178","workbook_source_id":"FIN-178","url":"https://www.techzine.eu/news/security/101852/check-point-software-quantum-sd-wan-protects-branch-offices-and-optimizes-connectivity/","title":"Check Point Software Quantum SD-WAN protects branch offices and optimizes connectivity - Techzine Global","publisher":"techzine.eu","publication_date":"2023-02-14","checked_date":"2026-09-12","source_ownership":"independent","decision":"rejected","reviewer_confidence":"low","record_type":"Independent analysis","requirement_codes":[],"named_customer":null,"segment":"Unspecified","named_product_or_service":"Quantum SD-WAN","service_family":"SD-WAN","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":"Blocks approximately 99.7% of new malware and phishing attacks per Miercom testing","industrial_standard_or_regulation":null,"regulatory_regime":"Not stated","exact_supporting_wording":"prevents branch threats that include phishing","reviewer_summary":"Independent trade press summary of the Quantum SD-WAN launch, confirming the same branch security and performance claims as the press release, with no named financial customer.","limitation_and_notes":"Duplicates the press release with no additional named customer or financial services detail; adds no new evidence for any column."},{"id":"src_financial_services_fs_018","workbook_source_id":"FS-018","url":"https://www.checkpoint.com/industry/financial-services/","title":"Check Point Cyber Security for Financial Institutions","publisher":"checkpoint.com","publication_date":null,"checked_date":"2026-07-29","source_ownership":"provider_authored","decision":"rejected","reviewer_confidence":"high","record_type":"Existing source lead","requirement_codes":[],"named_customer":null,"segment":"To review","named_product_or_service":null,"service_family":"Supporting only","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":null,"regulatory_regime":null,"exact_supporting_wording":"How Insurance Giant Athora Enhanced Hybrid Cloud Security","reviewer_summary":"Three qualifying items: customer story cards for Athora and NCACPA both labelled Industry: Financial Services, a further card headlined From Dashboard Chaos to a Single Risk Score under the same label, and a dedicated financial services industry page naming Aegean Baltic Bank, Covinoc, Emaar, BBVA and Miller Insurance with BASEL, SOX, NIST and GDPR referenced. Not SASE-specific: Athora is a hybrid cloud story. SASE appears on the financial services page only as a product navigation category.","limitation_and_notes":"Supplier's dedicated financial services industry page. Names Aegean Baltic Bank, Covinoc, Emaar, BBVA and Miller Insurance, and references BASEL, SOX, NIST and GDPR. Vendor claim. | Not found on page"}]},{"slug":"opensystems","name":"Open Systems","marketplace_url":"https://netify.co.uk/marketplace/opensystems/","research_status":"complete","overall_confidence":"low","fit_conclusion":"Open Systems can show one named, FINMA-regulated Swiss asset manager (Enabling Qapital) using its Mission Control managed SOC and Advanced Email Security for cloud email protection, plus one anonymised financial services customer using SD-WAN, ZTNA and Mission Control across Switzerland, Ireland and Singapore. Regulatory alignment is thin: DORA and NIS2 are mentioned only in generic provider blog content with no Article 30 contractual statement, and no UK (FCA/PRA), US (FFIEC/GLBA/NYDFS/SEC) or Canadian (OSFI) material was found at all. Connectivity resilience, DR testing, segmentation, PCI scope and UK delivery are unevidenced. The Trust Center, which likely holds formal ISO 27001/SOC 2 certification detail, could not be read because it is JavaScript-rendered and inaccessible to automated fetch. On the evidence actually opened, Open Systems is best supported for Swiss/EU managed SOC and email security use cases and is not currently demonstrable for UK, US or Canadian regulatory alignment or for trading, DR or PCI requirements.","gaps_and_unknowns":"No evidence was found for trading/low-latency connectivity, DC/colocation connectivity, tested resilience/RTO/RPO, network segmentation, PCI/cardholder segmentation, change control, incident notification timelines, exit/portability, or any UK, US or Canadian regulatory alignment; these would need direct engagement with Open Systems or access to the JavaScript-rendered Trust Center, which was not readable via WebFetch. Data residency, encryption/key management and log retention are only partially evidenced from a generic corporate privacy statement rather than service-specific documentation, so a data processing agreement or SLA document would be needed to confirm specifics.","reviewed_by":"Harry Yelland","reviewed_date":"2026-09-14","source_count":16,"accepted_source_count":13,"requirements":[{"code":"branch_and_office_connectivity","label":"Branch and office connectivity","state":"partial","evidence_source_ids":["src_financial_services_fin_360"],"verified_date":"2026-09-14"},{"code":"trading_and_low_latency_connectivity","label":"Trading and low-latency connectivity","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"data_centre_colocation_and_cloud_connectivity","label":"Data-centre, colocation and cloud connectivity","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"resilience_and_tested_recovery","label":"Resilience and tested recovery","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"network_segmentation_and_zoning","label":"Network segmentation and zoning","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"payment_and_cardholder_data_segmentation","label":"Payment and cardholder data segmentation","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"third_party_and_outsourced_access","label":"Third-party and outsourced access","state":"partial","evidence_source_ids":["src_financial_services_fin_361","src_financial_services_fin_523"],"verified_date":"2026-09-14"},{"code":"remote_and_hybrid_workforce","label":"Remote and hybrid workforce","state":"partial","evidence_source_ids":["src_financial_services_fin_360"],"verified_date":"2026-09-14"},{"code":"data_residency_and_sovereignty","label":"Data residency and sovereignty","state":"not_found","evidence_source_ids":["src_financial_services_fin_368"],"verified_date":"2026-09-14"},{"code":"encryption_and_key_management","label":"Encryption and key management","state":"partial","evidence_source_ids":["src_financial_services_fin_363"],"verified_date":"2026-09-14"},{"code":"logging_audit_and_evidence_retention","label":"Logging, audit and evidence retention","state":"partial","evidence_source_ids":["src_financial_services_fin_365"],"verified_date":"2026-09-14"},{"code":"identity_and_zero_trust_access","label":"Identity and zero trust access","state":"partial","evidence_source_ids":["src_financial_services_fin_360","src_financial_services_fin_367"],"verified_date":"2026-09-14"},{"code":"cloud_and_saas_data_controls","label":"Cloud and SaaS data controls","state":"partial","evidence_source_ids":["src_financial_services_fin_359"],"verified_date":"2026-09-14"},{"code":"managed_operations_and_soc","label":"Managed operations and SOC","state":"proven","evidence_source_ids":["src_financial_services_fin_359","src_financial_services_fin_523"],"verified_date":"2026-09-14"},{"code":"network_visibility_and_reporting","label":"Network visibility and reporting","state":"partial","evidence_source_ids":["src_financial_services_fin_360"],"verified_date":"2026-09-14"},{"code":"change_control_and_configuration_governance","label":"Change control and configuration governance","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"incident_notification_support","label":"Incident notification support","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"concentration_risk_and_subcontractor_transparency","label":"Concentration risk and subcontractor transparency","state":"proven","evidence_source_ids":["src_financial_services_fin_361"],"verified_date":"2026-09-14"},{"code":"exit_and_portability","label":"Exit and portability","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"uk_regulatory_alignment_fca_and_pra","label":"UK regulatory alignment (FCA and PRA)","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"eu_dora_alignment","label":"EU DORA alignment","state":"partial","evidence_source_ids":["src_financial_services_fin_365","src_financial_services_fin_366","src_financial_services_fin_367"],"verified_date":"2026-09-14"},{"code":"us_regulatory_alignment_ffiec_glba_nydfs_sec","label":"US regulatory alignment (FFIEC, GLBA, NYDFS, SEC)","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"canada_regulatory_alignment_osfi","label":"Canada regulatory alignment (OSFI)","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"pci_dss_alignment","label":"PCI DSS alignment","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"swift_csp_alignment","label":"SWIFT CSP alignment","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"uk_delivery","label":"UK delivery","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"north_america_delivery","label":"North America delivery","state":"partial","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"global_delivery","label":"Global delivery","state":"partial","evidence_source_ids":["src_financial_services_fin_360"],"verified_date":"2026-09-14"}],"sources":[{"id":"src_financial_services_fin_357","workbook_source_id":"FIN-357","url":"https://open-systems.com/solutions/financialservices/","title":"Financial Services SASE solution","publisher":"open-systems.com","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"medium","record_type":"Financial services solution page","requirement_codes":["third_party_and_outsourced_access","network_visibility_and_reporting","identity_and_zero_trust_access","managed_operations_and_soc"],"named_customer":null,"segment":"Unspecified","named_product_or_service":"Open Systems SASE","service_family":"SASE","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":null,"regulatory_regime":"Not stated","exact_supporting_wording":"24/7 Level-3 operations and an audit-ready trail","reviewer_summary":"Open Systems markets its SASE platform to the financial services industry generically, listing ZTNA, CASB, SWG and 24x7 Level-3 operations, but names no financial institution or measured outcome.","limitation_and_notes":"Generic industry page with no named customer, no regulatory regime named, and no quantified outcome; does not prove any deployment."},{"id":"src_financial_services_fin_358","workbook_source_id":"FIN-358","url":"https://open-systems.com/solutions/insurance/","title":"Insurance SASE solution","publisher":"open-systems.com","publication_date":null,"checked_date":"2026-09-15","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"medium","record_type":"Financial services solution page","requirement_codes":["identity_and_zero_trust_access","managed_operations_and_soc"],"named_customer":null,"segment":"Insurance","named_product_or_service":"Open Systems SASE Platform","service_family":"SASE","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":null,"regulatory_regime":"Not stated","exact_supporting_wording":"Insurance organizations with operations spread across regions or continents rely on secure worldwide IT networks that deliver efficient, continuous access while protecting systems, end users and the brand itself.","reviewer_summary":"Open Systems markets ZTNA, SWG and CASB to insurers as a sector, but names no insurer, no regulation and no measured outcome.","limitation_and_notes":"Checker 2026-09-12: page carries the fact but the wording differs (Full quoted sentence exists only in the meta-description tag; the visible page heading is a shortened version without the trailing clauses.). Re-quote verbatim. Generic industry page, no named insurer, no regulatory regime, no quantified result. [2026-09-15, Playwright fetch] Page has been redesigned since the original check - Open Systems now presents under 'Swiss Post Group' branding. Re-quoted the current visible heading text; the original meta-description-only sentence may no longer exist. No named insurer, no regulatory regime, still."},{"id":"src_financial_services_fin_359","workbook_source_id":"FIN-359","url":"https://open-systems.com/company/customers/enabling-qapital/","title":"Enabling Qapital customer story","publisher":"open-systems.com","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"high","record_type":"Named customer case study","requirement_codes":["cloud_and_saas_data_controls","managed_operations_and_soc"],"named_customer":"Enabling Qapital Ltd.","segment":"Asset and wealth management","named_product_or_service":"Advanced Email Security / Secure Email Gateway / Mission Control","service_family":"Managed SASE","estate":"approximately 60 employees","countries_or_regions":"Switzerland (global asset base)","ot_or_production_environment":null,"measured_or_stated_outcome":"30-40% more malicious emails intercepted versus the previous setup; top 5% FINMA IT audit rating","industrial_standard_or_regulation":null,"regulatory_regime":"Not stated","exact_supporting_wording":"For us, 80-90% of attacks originate through email. It is by far our most critical attack vector.","reviewer_summary":"Enabling Qapital, a FINMA-regulated Swiss asset manager with about USD 900m under management, uses Open Systems Advanced Email Security and Mission Control for cloud (Microsoft 365) email protection and achieved a top 5% FINMA IT audit rating.","limitation_and_notes":"Covers email security and managed SOC only; does not evidence branch connectivity, trading, DR, segmentation, PCI, or any UK/US/EU regulatory regime."},{"id":"src_financial_services_fin_360","workbook_source_id":"FIN-360","url":"https://open-systems.com/company/customers/financial-services-company/","title":"Financial services company customer story (anonymised)","publisher":"open-systems.com","publication_date":null,"checked_date":"2026-09-15","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"medium","record_type":"Named customer case study","requirement_codes":["network_visibility_and_reporting","branch_and_office_connectivity","identity_and_zero_trust_access","remote_and_hybrid_workforce","global_delivery"],"named_customer":null,"segment":"Unspecified","named_product_or_service":"Zero Trust Network Access (ZTNA) / SD-WAN / cloud proxy / Mission Control","service_family":"Multiple","estate":"3 locations: Zurich HQ (4-5 core staff), Ireland (~16 employees), Singapore (~16 employees)","countries_or_regions":"Switzerland, Ireland, Singapore","ot_or_production_environment":null,"measured_or_stated_outcome":"Zero security incidents despite high threat levels; two documented malware blocking incidents; 100% cost predictability","industrial_standard_or_regulation":"BaFin, GDPR, ISO 27001","regulatory_regime":"Multiple","exact_supporting_wording":"A single major incident can be enough for a small or mid-sized company to lose customer trust","reviewer_summary":"An anonymised, internationally operating financial services provider with about 40 employees across Zurich, Ireland and Singapore uses Open Systems ZTNA, SD-WAN and Mission Control, with about half its Zurich staff working remotely, and cites BaFin, GDPR and ISO 27001 as its compliance drivers.","limitation_and_notes":"Checker 2026-09-12: page carries the fact but the wording differs (Actual sentence is 'A single major incident can be enough for a small or mid-sized company to lose customer trust' - quote omits 'for a small or mid-sized compa). Re-quote verbatim. The customer is anonymised, so it cannot fully prove any column requiring a named institution; no UK, US, DORA or Canadian regime is referenced (BaFin is German, not covered by this brief's regime columns). [2026-09-15] Re-quoted verbatim using the checker's own already-confirmed page wording - no fresh fetch needed, the exact sentence was already recorded in the check note."},{"id":"src_financial_services_fin_361","workbook_source_id":"FIN-361","url":"https://open-systems.com/subprocessor-statement/","title":"Subprocessor Statement","publisher":"open-systems.com","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"high","record_type":"Compliance attestation or statement","requirement_codes":["concentration_risk_and_subcontractor_transparency","third_party_and_outsourced_access"],"named_customer":null,"segment":"Unspecified","named_product_or_service":"Mission Control","service_family":"Managed SASE","estate":null,"countries_or_regions":"Switzerland, United States, Germany, India, Ireland (Microsoft Azure), China (Alibaba Cloud)","ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":null,"regulatory_regime":"Not stated","exact_supporting_wording":"Convotis Swiss Cloud AG - Operation of the Mission Control Web Application Firewall (WAF)","reviewer_summary":"Open Systems publishes a subprocessor statement naming its own affiliated entities (Switzerland, US, Germany, India) and third parties such as Microsoft, Sophos, Cyolo, Alibaba Cloud and AWS, and states what each does for named services including Mission Control.","limitation_and_notes":"Lists subcontractors and their function but does not state data residency, log retention, exit terms, incident notification timelines or audit rights, and is not financial-services specific."},{"id":"src_financial_services_fin_362","workbook_source_id":"FIN-362","url":"https://open-systems.com/open-systems-promise/","title":"The Open Systems Promise","publisher":"open-systems.com","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"medium","record_type":"Compliance attestation or statement","requirement_codes":["managed_operations_and_soc"],"named_customer":null,"segment":"Unspecified","named_product_or_service":"Open Systems managed service","service_family":"Managed SASE","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":null,"regulatory_regime":"Not stated","exact_supporting_wording":"Clear, contractual SLAs, including incident escalation to a certified engineer from your tickets.","reviewer_summary":"Open Systems commits to contractual SLAs, 24/7 Level-3 support and named customer success managers, but publishes no RTO/RPO figures, uptime percentage or incident notification timeline on this page.","limitation_and_notes":"No RTO/RPO, no uptime percentage, no incident notification timeline, and not financial-services specific."},{"id":"src_financial_services_fin_363","workbook_source_id":"FIN-363","url":"https://open-systems.com/privacy-statement/","title":"Privacy Statement","publisher":"open-systems.com","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"low","record_type":"Compliance attestation or statement","requirement_codes":["encryption_and_key_management"],"named_customer":null,"segment":"Unspecified","named_product_or_service":"Open Systems (corporate data handling)","service_family":"Not relevant","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":null,"regulatory_regime":"Not stated","exact_supporting_wording":"When we transmit highly-confidential information over the internet, we protect it through the use of encryption, such as later versions of the Transport Layer Security (\"TLS\") protocol.","reviewer_summary":"Open Systems' privacy statement describes TLS encryption for confidential data in transit and multi-year retention periods for employment and business records, but this covers corporate personal data handling, not the managed SASE/SD-WAN service's customer logs.","limitation_and_notes":"No FIPS validation, no key management detail, no service-specific log retention, no explicit data residency commitment for the managed service; this is a corporate privacy notice, not service documentation."},{"id":"src_financial_services_fin_364","workbook_source_id":"FIN-364","url":"https://open-systems.com/service-experience-delivery/","title":"Service Experience Delivery","publisher":"open-systems.com","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"medium","record_type":"Other","requirement_codes":["managed_operations_and_soc"],"named_customer":null,"segment":"Unspecified","named_product_or_service":"Open Systems service experience","service_family":"Managed SASE","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":null,"regulatory_regime":"Not stated","exact_supporting_wording":"Level-3 coverage, follow-the-sun across time zones","reviewer_summary":"Open Systems describes follow-the-sun, Level-3 24/7 support with unlimited tickets, but gives no change management, RBAC or DR testing detail.","limitation_and_notes":"No change control, RBAC, or DR testing detail; not financial-services specific."},{"id":"src_financial_services_fin_365","workbook_source_id":"FIN-365","url":"https://open-systems.com/blog/audit-readiness-compliance/","title":"Audit readiness and compliance blog post","publisher":"open-systems.com","publication_date":"2025-12-09","checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"medium","record_type":"Compliance attestation or statement","requirement_codes":["logging_audit_and_evidence_retention","eu_dora_alignment"],"named_customer":null,"segment":"Unspecified","named_product_or_service":"Calli (Reporting & Evidence) / Mission Control","service_family":"Managed SASE","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":"ISO 27001, SOC 2, IEC 62443, DORA, NIS2","regulatory_regime":"EU","exact_supporting_wording":"DORA. NIS2. ISO 27001. SOC 2. IEC 62443. Different frameworks, same concerns.","reviewer_summary":"A provider blog post names ISO 27001, SOC 2, IEC 62443, DORA and NIS2 as frameworks customers must satisfy, and names Calli (its reporting and evidence AI agent) and Mission Control tickets as sources of audit trail, but does not state that Open Systems itself is certified to these standards or give a log retention period.","limitation_and_notes":"Discusses frameworks in general terms aimed at the customer's own compliance; it does not attest that Open Systems holds ISO 27001 or SOC 2 certification itself, gives no retention period, and does not cite Article 30 DORA contractual terms or a named EU financial customer."},{"id":"src_financial_services_fin_366","workbook_source_id":"FIN-366","url":"https://open-systems.com/blog/critical-role-email-security-financial-services-bifs/","title":"The critical role of email security in financial services (BFSI)","publisher":"open-systems.com","publication_date":"2025-03-24","checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"low","record_type":"Financial services solution page","requirement_codes":["eu_dora_alignment"],"named_customer":null,"segment":"Multiple","named_product_or_service":"Secure Email Gateway / DLP","service_family":"SSE","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":"DORA, NIS2","regulatory_regime":"EU","exact_supporting_wording":"email security is not just about preventing spam or malware, it is a critical component of compliance, risk management, and operational resilience","reviewer_summary":"A provider blog post discusses financial services email security threats and cites DORA and NIS2 as drivers, without naming a customer or a specific Open Systems product feature tied to DORA articles.","limitation_and_notes":"No named financial institution, no product-to-DORA contractual link, no FCA/FFIEC/GLBA/NYDFS/SEC/OSFI/PCI/SWIFT mention."},{"id":"src_financial_services_fin_367","workbook_source_id":"FIN-367","url":"https://open-systems.com/blog/insurers-zero-trust/","title":"Insurers and zero trust blog post","publisher":"open-systems.com","publication_date":"2025-12-03","checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"low","record_type":"Financial services solution page","requirement_codes":["identity_and_zero_trust_access","eu_dora_alignment"],"named_customer":null,"segment":"Insurance","named_product_or_service":"SASE / ZTNA","service_family":"SASE","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":"DORA, NIS2, NIST CSF, ISO 27001","regulatory_regime":"EU","exact_supporting_wording":"Every connection is verified based on user identity, device posture, and context, regardless of location.","reviewer_summary":"A provider blog post recommends ZTNA for insurers and cites DORA and NIS2 as regulatory drivers, without naming an insurer or a specific contractual DORA commitment.","limitation_and_notes":"No named insurer, no product-specific DORA statement, generic sector commentary only."},{"id":"src_financial_services_fin_368","workbook_source_id":"FIN-368","url":"https://open-systems.com/blog/data-sovereignty-is-not-an-european-problem-its-an-architecture-problem/","title":"Data sovereignty is not a European problem, it is an architecture problem","publisher":"open-systems.com","publication_date":"2026-03-25","checked_date":"2026-09-15","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"low","record_type":"Other","requirement_codes":["data_residency_and_sovereignty"],"named_customer":null,"segment":"Unspecified","named_product_or_service":"Sovereign SASE","service_family":"SASE","estate":null,"countries_or_regions":"185 countries (general operating claim)","ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":"GDPR","regulatory_regime":"Not stated","exact_supporting_wording":"sovereign SASE - jurisdiction-aware Secure Access Service Edge","reviewer_summary":"A provider blog post argues data sovereignty is an architecture problem and describes its platform as jurisdiction-aware, referencing GDPR, China's PIPL and Gulf state rules, but states no specific data centre locations or residency guarantee for logs or the management plane.","limitation_and_notes":"Checker 2026-09-12: page carries the fact but the wording differs (The word 'jurisdiction-aware' appears (e.g. 'sovereign SASE - jurisdiction-aware Secure Access Service Edge') but not as an isolated exact match to the bare quo). Re-quote verbatim. No concrete Switzerland/EU/US/Canada data residency commitment for the service; conceptual marketing content. [2026-09-15] Re-quoted verbatim using the checker's own already-confirmed page wording - no fresh fetch needed, the exact sentence was already recorded in the check note."},{"id":"src_financial_services_fin_523","workbook_source_id":"FIN-523","url":"https://www.open-systems.com/solutions/financialservices/","title":"Financial Services - Open Systems","publisher":"open-systems.com","publication_date":null,"checked_date":"2026-09-15","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"medium","record_type":"Compliance attestation or statement","requirement_codes":["third_party_and_outsourced_access","managed_operations_and_soc"],"named_customer":null,"segment":"Unspecified","named_product_or_service":"Open Systems financial services SASE","service_family":"SASE","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":null,"regulatory_regime":null,"exact_supporting_wording":"Dedicated financial-services SASE page describing SASE, SD-WAN, SSE, managed operations, policy enforcement, third-party connectivity, and financial-services risk and resilience.","reviewer_summary":"Harry personally verified this live 2026-09-15. A dedicated sector page describing relevant capabilities, but no named financial customer and no DORA Article 30 contract schedule - graded Partial for managed operations and third-party access as product-capability evidence.","limitation_and_notes":"Added 2026-09-15, Harry-verified. Sector positioning page, no named customer or contractual regulatory mapping."},{"id":"src_financial_services_fin_369","workbook_source_id":"FIN-369","url":"https://open-systems.com/platform/","title":"Platform overview","publisher":"open-systems.com","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"rejected","reviewer_confidence":"low","record_type":"Other","requirement_codes":[],"named_customer":null,"segment":"Unspecified","named_product_or_service":"Open Systems platform","service_family":"SASE","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":null,"regulatory_regime":"Not stated","exact_supporting_wording":"Private global backbone, app-aware routing, China-ready","reviewer_summary":"The platform overview page lists ZTNA, SWG, CASB and a private global backbone at a feature level but gives no encryption standard, FIPS validation, key management or PoP location detail.","limitation_and_notes":"No technical or geographic specificity; contributes no defensible evidence for any column beyond what other pages already establish."},{"id":"src_financial_services_fin_370","workbook_source_id":"FIN-370","url":"https://open-systems.trustshare.com/home","title":"Open Systems Trust Center (TrustShare)","publisher":"open-systems.trustshare.com","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"rejected","reviewer_confidence":"low","record_type":"Other","requirement_codes":[],"named_customer":null,"segment":"Unspecified","named_product_or_service":"Open Systems Trust Center","service_family":"Not relevant","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":null,"regulatory_regime":"Not stated","exact_supporting_wording":"Transparent, real-time security and compliance status to continuously earn the trust of users and customers","reviewer_summary":"The Trust Center page is a JavaScript-rendered application; WebFetch could only retrieve metadata and a slogan, with no visible certification list, data residency statement or retention policy.","limitation_and_notes":"Page requires JavaScript rendering not accessible to WebFetch; certifications such as ISO 27001 or SOC 2 may exist behind this page but could not be verified from the fetched content, so none is claimed as Proven from it."},{"id":"src_financial_services_fin_371","workbook_source_id":"FIN-371","url":"https://open-systems.com/terms-of-use/","title":"Terms of Use","publisher":"open-systems.com","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"rejected","reviewer_confidence":"low","record_type":"Other","requirement_codes":[],"named_customer":null,"segment":"Unspecified","named_product_or_service":"Open Systems (corporate)","service_family":"Not relevant","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":null,"regulatory_regime":"Not stated","exact_supporting_wording":null,"reviewer_summary":"The Terms of Use page covers website usage, IP and liability, and contains no content on data return, export, termination assistance or exit process.","limitation_and_notes":"No exit or portability content found on this page."}]},{"slug":"hpe-aruba-edgeconnect","name":"HPE Aruba EdgeConnect","marketplace_url":"https://netify.co.uk/marketplace/hpe-aruba-edgeconnect/","research_status":"complete","overall_confidence":"low","fit_conclusion":"HPE Aruba EdgeConnect SD-WAN has one directly named US financial services deployment found, First Bank, an 80-location retail and wealth management bank, which is evidence for branch connectivity and North America delivery only. The EdgeConnect firmware module holds an active NIST FIPS 140-2 validation (certificate 4547), which is solid documentary evidence for encryption, though it sits under the legacy Silver Peak Systems name rather than HPE Aruba Networking. PCI DSS, GDPR/CCPA and segmentation material exists only as provider solution-overview titles with no retrievable body text, so these are Partial rather than Proven. No UK, EU, Canadian or SWIFT-specific regulatory alignment, no data residency or log retention statement, and no named financial customer for the SSE or Unified SASE product lines were found in the pages opened. On the evidence gathered, this provider is only weakly proven for financial services SD-WAN connectivity and encryption compliance, with most other requirement columns unevidenced from the pages accessible in this research session.","gaps_and_unknowns":"No UK or EU financial services deployments, no DORA, FCA/PRA, OSFI, FFIEC, NYDFS or SWIFT CSP material, and no data residency, log retention, sub-processor list, incident notification SLA or managed SOC documentation were found for EdgeConnect, SSE or Unified SASE. These would need direct access to the PCI DSS, GDPR/CCPA and EdgeConnect security-datasheet PDF bodies (only titles/metadata were retrievable here), the Axis Security trust and legal pages (blocked by robots.txt in this session), and a broader case-study search once web search quota is available, since several legacy Silver Peak bank and credit union case studies are known to exist but could not be located or opened in this session.","reviewed_by":"Harry Yelland","reviewed_date":"2026-09-14","source_count":10,"accepted_source_count":7,"requirements":[{"code":"branch_and_office_connectivity","label":"Branch and office connectivity","state":"proven","evidence_source_ids":["src_financial_services_fs_044","src_financial_services_fin_305"],"verified_date":"2026-09-14"},{"code":"trading_and_low_latency_connectivity","label":"Trading and low-latency connectivity","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"data_centre_colocation_and_cloud_connectivity","label":"Data-centre, colocation and cloud connectivity","state":"proven","evidence_source_ids":["src_financial_services_fs_044"],"verified_date":"2026-09-14"},{"code":"resilience_and_tested_recovery","label":"Resilience and tested recovery","state":"proven","evidence_source_ids":["src_financial_services_fs_044"],"verified_date":"2026-09-14"},{"code":"network_segmentation_and_zoning","label":"Network segmentation and zoning","state":"partial","evidence_source_ids":["src_manufacturing_mfg_034"],"verified_date":"2026-09-14"},{"code":"payment_and_cardholder_data_segmentation","label":"Payment and cardholder data segmentation","state":"partial","evidence_source_ids":["src_financial_services_fin_307"],"verified_date":"2026-09-14"},{"code":"third_party_and_outsourced_access","label":"Third-party and outsourced access","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"remote_and_hybrid_workforce","label":"Remote and hybrid workforce","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"data_residency_and_sovereignty","label":"Data residency and sovereignty","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"encryption_and_key_management","label":"Encryption and key management","state":"proven","evidence_source_ids":["src_financial_services_fin_306","src_financial_services_fin_517"],"verified_date":"2026-09-14"},{"code":"logging_audit_and_evidence_retention","label":"Logging, audit and evidence retention","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"identity_and_zero_trust_access","label":"Identity and zero trust access","state":"partial","evidence_source_ids":["src_manufacturing_mfg_034","src_manufacturing_mfg_035"],"verified_date":"2026-09-14"},{"code":"cloud_and_saas_data_controls","label":"Cloud and SaaS data controls","state":"partial","evidence_source_ids":["src_manufacturing_mfg_035"],"verified_date":"2026-09-14"},{"code":"managed_operations_and_soc","label":"Managed operations and SOC","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"network_visibility_and_reporting","label":"Network visibility and reporting","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"change_control_and_configuration_governance","label":"Change control and configuration governance","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"incident_notification_support","label":"Incident notification support","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"concentration_risk_and_subcontractor_transparency","label":"Concentration risk and subcontractor transparency","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"exit_and_portability","label":"Exit and portability","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"uk_regulatory_alignment_fca_and_pra","label":"UK regulatory alignment (FCA and PRA)","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"eu_dora_alignment","label":"EU DORA alignment","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"us_regulatory_alignment_ffiec_glba_nydfs_sec","label":"US regulatory alignment (FFIEC, GLBA, NYDFS, SEC)","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"canada_regulatory_alignment_osfi","label":"Canada regulatory alignment (OSFI)","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"pci_dss_alignment","label":"PCI DSS alignment","state":"partial","evidence_source_ids":["src_financial_services_fin_307"],"verified_date":"2026-09-14"},{"code":"swift_csp_alignment","label":"SWIFT CSP alignment","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"uk_delivery","label":"UK delivery","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"north_america_delivery","label":"North America delivery","state":"proven","evidence_source_ids":["src_financial_services_fin_305"],"verified_date":"2026-09-14"},{"code":"global_delivery","label":"Global delivery","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"}],"sources":[{"id":"src_financial_services_fin_305","workbook_source_id":"FIN-305","url":"https://www.hpe.com/psnow/doc/a50013999enw","title":"Building generational wealth - First Bank","publisher":"hpe.com","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"medium","record_type":"Named customer case study","requirement_codes":["branch_and_office_connectivity","north_america_delivery"],"named_customer":"First Bank","segment":"Retail banking","named_product_or_service":"HPE Aruba Networking EdgeConnect SD-WAN","service_family":"SD-WAN","estate":"80 locations","countries_or_regions":"Missouri, Illinois, California, United States","ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":null,"regulatory_regime":"US","exact_supporting_wording":"First Bank is a fourth-generation, family-owned bank with 80 locations in MO, IL, and CA, offering its clients comprehensive consumer, commercial, wealth management, and mortgage solutions.","reviewer_summary":"HPE's case study landing page names First Bank, a US retail and wealth management bank with 80 locations across three states, as a deployment of HPE Aruba Networking EdgeConnect SD-WAN and WAN Optimization, referenced from the unified SASE product page as a SASE-based SD-WAN deployment.","limitation_and_notes":"The underlying PDF body text could not be extracted (only page metadata/description was retrievable), so specific outcomes, user counts, security controls, trading/latency, segmentation or resilience metrics for First Bank are not confirmed. Does not prove SASE/SSE-specific capabilities, only SD-WAN/WAN optimisation connectivity."},{"id":"src_financial_services_fin_306","workbook_source_id":"FIN-306","url":"https://csrc.nist.gov/projects/cryptographic-module-validation-program/certificate/4547","title":"CMVP Certificate #4547 - Silver Peak EdgeConnect","publisher":"csrc.nist.gov","publication_date":"2023-07-09","checked_date":"2026-09-15","source_ownership":"independent","decision":"accepted","reviewer_confidence":"high","record_type":"Compliance attestation or statement","requirement_codes":["encryption_and_key_management"],"named_customer":null,"segment":"Unspecified","named_product_or_service":"EdgeConnect (Silver Peak EdgeConnect firmware)","service_family":"SD-WAN","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":"FIPS 140-2","regulatory_regime":"US","exact_supporting_wording":"Module Name: Silver Peak EdgeConnect | Standard: FIPS 140-2 | Status: Active | Sunset Date: 9/21/2026 | Overall Level: 1","reviewer_summary":"NIST's Cryptographic Module Validation Program lists an active FIPS 140-2 certificate (number 4547) for the Silver Peak EdgeConnect firmware module (ECOS 8.1.9 and 9.1.0), the EdgeConnect product line now sold as HPE Aruba Networking EdgeConnect SD-WAN.","limitation_and_notes":"Checker 2026-09-12: page carries the fact but the wording differs (All individual facts (vendor, module, standard, level, firmware versions, status, sunset date) are present on the page but as separate labeled fields, not as on). Re-quote verbatim. Confirms FIPS 140-2 validation of the EdgeConnect firmware module itself, not of the wider Unified SASE or SSE service, and the certificate is under the legacy Silver Peak Systems, Inc. vendor name rather than HPE Aruba Networking. Certificate has a stated sunset date of 2026-09-21, close to the checked date, so currency should be reverified periodically. Says nothing about key management practices beyond module validation. [2026-09-15, Playwright fetch] Re-confirmed live 2026-09-15 - all facts still present as separate labelled fields, not a single sentence, matching the original checker note. Certificate sunset date (2026-09-21) is now only 5 days away - flag for a follow-up check after that date."},{"id":"src_financial_services_fin_307","workbook_source_id":"FIN-307","url":"https://www.hpe.com/psnow/doc/a00119355enw?jumpid=in_pdfviewer-psnow","title":"How the EdgeConnect SD-WAN Platform Supports PCI DSS Compliance","publisher":"hpe.com","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"low","record_type":"Compliance attestation or statement","requirement_codes":["payment_and_cardholder_data_segmentation","pci_dss_alignment"],"named_customer":null,"segment":"Unspecified","named_product_or_service":"HPE Aruba Networking EdgeConnect SD-WAN","service_family":"SD-WAN","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":"PCI DSS","regulatory_regime":"Not stated","exact_supporting_wording":"How the EdgeConnect SD-WAN Platform Supports PCI DSS Compliance ... enables customers to simplify PCI DSS compliance and create business-driven networks where resources are deployed.","reviewer_summary":"HPE publishes a solution overview titled around EdgeConnect SD-WAN supporting PCI DSS compliance, describing simplified compliance through business-driven network segmentation, but the full document body (segmentation mechanics, PCI scope detail) could not be retrieved.","limitation_and_notes":"Checker 2026-09-12: page carries the fact but the wording differs (Title and meta-description each contain part of the quote, but not as one continuous sentence.). Re-quote verbatim. Only the page title and meta description were retrievable, not the document body, so no PCI DSS Attestation of Compliance, no PCI scope-reduction mechanism, and no named financial customer are confirmed. This is marketing/solution-overview material, not a PCI DSS AoC or certification, so it supports Partial rather than a stronger status for the PCI DSS column. [2026-09-15] Playwright fetch 2026-09-15 failed with a DNS resolution error (ERR_NAME_NOT_RESOLVED) for hpe.com - this looks like a transient local network/DNS issue rather than the page being genuinely unreachable, since hpe.com resolves normally in general. Worth a straightforward re-run rather than treating as a real access finding."},{"id":"src_financial_services_fin_517","workbook_source_id":"FIN-517","url":"https://arubanetworking.hpe.com/techdocs/sdwan/docs/fips/userguidance/","title":"EdgeConnect FIPS User Guidance","publisher":"arubanetworking.hpe.com","publication_date":null,"checked_date":"2026-09-15","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"high","record_type":"Compliance attestation or statement","requirement_codes":["encryption_and_key_management"],"named_customer":null,"segment":"Unspecified","named_product_or_service":"EdgeConnect SD-WAN","service_family":"SD-WAN","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":"FIPS 140-2","regulatory_regime":null,"exact_supporting_wording":"States EdgeConnect OS and Orchestrator can operate in FIPS mode, using FIPS-certified cryptographic modules in relevant releases, requiring IKE-based IPsec tunnels for FIPS/Common Criteria compliance.","reviewer_summary":"Harry personally verified this live 2026-09-15. Genuine product-level FIPS mode documentation naming EdgeConnect directly, release/version-specific rather than a blanket claim. Graded Proven for encryption/key management given the specificity, with the firmware-version caveat noted.","limitation_and_notes":"Added 2026-09-15, Harry-verified. FIPS mode is release-specific - record firmware/version scope before citing for a specific customer, per the documentation's own compatibility warnings."},{"id":"src_financial_services_fs_044","workbook_source_id":"FS-044","url":"https://paths.ext.hpe.com/r/a00119883?cc=us&lang=en","title":"Unified SASE in financial services","publisher":"paths.ext.hpe.com","publication_date":null,"checked_date":"2026-07-29","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"high","record_type":"Existing source lead","requirement_codes":["data_centre_colocation_and_cloud_connectivity","branch_and_office_connectivity","resilience_and_tested_recovery"],"named_customer":null,"segment":"Retail banking","named_product_or_service":"HPE Aruba Networking Unified SASE","service_family":"SASE","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":null,"regulatory_regime":"Not stated","exact_supporting_wording":"Unified SASE in financial services","reviewer_summary":"Dedicated financial services SASE document, plus a named bank customer on the SASE page, quoted verbatim there as: \"First Bank deploys a secure, resilient, and high-performance SASE-based SD-WAN to reduce costs, boost application performance and support a cloud-smart technology strategy.\"","limitation_and_notes":"Tier 1 supplier industry document linked from the SASE page. Title verified in title tag and og:title. | Confirmed - exact match"},{"id":"src_financial_services_fin_304","workbook_source_id":"FIN-304","url":"https://www.hpe.com/us/en/solutions/financial-services-industry.html","title":"Financial Services Industry Solutions | HPE","publisher":"hpe.com","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"rejected","reviewer_confidence":"low","record_type":"Financial services solution page","requirement_codes":[],"named_customer":null,"segment":"Unspecified","named_product_or_service":"HPE Aruba Networking unified SASE","service_family":"SASE","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":null,"regulatory_regime":"Not stated","exact_supporting_wording":"Easily adopt and deploy security solutions to meet regulations and stay compliant with HPE Aruba Networking unified SASE solution.","reviewer_summary":"HPE's financial services industry page names Unified SASE as a way to help meet regulatory requirements but names no financial institution, regime or specific control.","limitation_and_notes":"Generic solutions-page language with no named customer, no named regime, no technical detail. Does not prove any of the 28 columns on its own; kept as context only, not cited for any Proven/Partial status."},{"id":"src_financial_services_fin_310","workbook_source_id":"FIN-310","url":"https://www.hpe.com/us/en/about/digital-trust-center.html","title":"HPE Digital Trust Center","publisher":"hpe.com","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"rejected","reviewer_confidence":"low","record_type":"Other","requirement_codes":[],"named_customer":null,"segment":"Unspecified","named_product_or_service":"HPE Digital Trust Center","service_family":"Not relevant","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":null,"regulatory_regime":"Not stated","exact_supporting_wording":"HPE embraces security by design principles to mitigate risks and minimize vulnerabilities throughout the technology lifecycle.","reviewer_summary":"HPE's corporate Digital Trust Center is a general company-wide trust statement with no product-specific certification lists, sub-processor disclosures, data residency or incident notification detail for EdgeConnect, SSE or SASE.","limitation_and_notes":"Corporate-level page only; contains no EdgeConnect/SSE/SASE-specific compliance certifications, sub-processor lists, data residency statements or incident notification timelines, so it cannot support any of the 28 columns."},{"id":"src_financial_services_fs_043","workbook_source_id":"FS-043","url":"https://www.hpe.com/us/en/networking/sase.html","title":"HPE Aruba Networking SASE (solution page)","publisher":"hpe.com","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"superseded","reviewer_confidence":"high","record_type":"Existing source lead","requirement_codes":[],"named_customer":null,"segment":null,"named_product_or_service":"HPE Aruba Networking SASE","service_family":"SASE","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":null,"regulatory_regime":null,"exact_supporting_wording":"Unified SASE in financial services","reviewer_summary":"Dedicated financial services SASE document, plus a named bank customer on the SASE page, quoted verbatim there as: \"First Bank deploys a secure, resilient, and high-performance SASE-based SD-WAN to reduce costs, boost application performance and support a cloud-smart technology strategy.\"","limitation_and_notes":"Reverted from Accepted to Superseded 2026-09-12: this row's evidence (the First Bank quote) is identical to FS-044, which is the more specific source (a dedicated financial-services SASE document vs. this general SASE product page). Marking both Accepted would double-count a single piece of evidence as two sources, which Robert's rule 4 (\"do not add the same URL twice\") is intended to prevent even where the URLs technically differ. FS-044 remains Accepted and carries the Capabilities supported for HPE Aruba."}]},{"slug":"lumen","name":"Lumen","marketplace_url":"https://netify.co.uk/marketplace/lumen/","research_status":"complete","overall_confidence":"low","fit_conclusion":"Lumen has one clear named financial services deployment of its in-scope product: Hanmi Bank, a US community bank, running Lumen SD-WAN across its branches with an associated managed services and cost-saving outcome, which is solid evidence for US branch connectivity. Beyond that single case, the evidence is thin: other Lumen financial services case studies (Certegy, Horizon Bank, Nuvision, Bank of Tennessee) use different Lumen products (IP VPN, DIA, DDoS mitigation, Zoom voice, NaaS) and do not name SD-WAN, SASE or Managed SD-WAN, so they cannot be counted for this research. Lumen's SASE and managed ZTNA product pages describe zero trust, CASB and DLP capability and list financial services as a target industry, but with no named institution or FS-specific outcome. No UK, EU or Canadian financial services material, and no FFIEC, GLBA, NYDFS, DORA, OSFI, FCA/PRA or SWIFT CSP statements connecting the named services to those regimes, were found on the pages reviewed. The main limitation is the near total absence of documented compliance detail (specific certifications, encryption standards, log retention, incident notification timelines, subprocessor lists) tied to the named SD-WAN or SASE services themselves.","gaps_and_unknowns":"No evidence was found for trading/low-latency connectivity, data-centre or cloud on-ramp connectivity, network segmentation, cardholder data segmentation, third-party access controls, data residency commitments, encryption/key management, logging and retention, change control, incident notification, subcontractor transparency, exit/portability, PCI DSS or SWIFT CSP alignment, or any UK, EU or Canada regulatory alignment for the named SD-WAN/SASE services. Closing these gaps would require access to Lumen's SD-WAN and SASE specific privacy data sheets, its formal SOC 2/ISO 27001/PCI DSS certificates naming these services, its master service agreement or SLA schedule, and additional named financial services case studies outside the United States.","reviewed_by":"Harry Yelland","reviewed_date":"2026-09-14","source_count":16,"accepted_source_count":7,"requirements":[{"code":"branch_and_office_connectivity","label":"Branch and office connectivity","state":"proven","evidence_source_ids":["src_financial_services_fs_050","src_financial_services_fin_323"],"verified_date":"2026-09-14"},{"code":"trading_and_low_latency_connectivity","label":"Trading and low-latency connectivity","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"data_centre_colocation_and_cloud_connectivity","label":"Data-centre, colocation and cloud connectivity","state":"proven","evidence_source_ids":["src_financial_services_fin_529"],"verified_date":"2026-09-14"},{"code":"resilience_and_tested_recovery","label":"Resilience and tested recovery","state":"proven","evidence_source_ids":["src_financial_services_fs_050","src_financial_services_fs_049"],"verified_date":"2026-09-14"},{"code":"network_segmentation_and_zoning","label":"Network segmentation and zoning","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"payment_and_cardholder_data_segmentation","label":"Payment and cardholder data segmentation","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"third_party_and_outsourced_access","label":"Third-party and outsourced access","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"remote_and_hybrid_workforce","label":"Remote and hybrid workforce","state":"partial","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"data_residency_and_sovereignty","label":"Data residency and sovereignty","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"encryption_and_key_management","label":"Encryption and key management","state":"proven","evidence_source_ids":["src_financial_services_fin_529"],"verified_date":"2026-09-14"},{"code":"logging_audit_and_evidence_retention","label":"Logging, audit and evidence retention","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"identity_and_zero_trust_access","label":"Identity and zero trust access","state":"partial","evidence_source_ids":["src_financial_services_fin_330","src_financial_services_fin_331"],"verified_date":"2026-09-14"},{"code":"cloud_and_saas_data_controls","label":"Cloud and SaaS data controls","state":"partial","evidence_source_ids":["src_financial_services_fin_330"],"verified_date":"2026-09-14"},{"code":"managed_operations_and_soc","label":"Managed operations and SOC","state":"partial","evidence_source_ids":["src_financial_services_fin_323","src_financial_services_fin_514"],"verified_date":"2026-09-14"},{"code":"network_visibility_and_reporting","label":"Network visibility and reporting","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"change_control_and_configuration_governance","label":"Change control and configuration governance","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"incident_notification_support","label":"Incident notification support","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"concentration_risk_and_subcontractor_transparency","label":"Concentration risk and subcontractor transparency","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"exit_and_portability","label":"Exit and portability","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"uk_regulatory_alignment_fca_and_pra","label":"UK regulatory alignment (FCA and PRA)","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"eu_dora_alignment","label":"EU DORA alignment","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"us_regulatory_alignment_ffiec_glba_nydfs_sec","label":"US regulatory alignment (FFIEC, GLBA, NYDFS, SEC)","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"canada_regulatory_alignment_osfi","label":"Canada regulatory alignment (OSFI)","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"pci_dss_alignment","label":"PCI DSS alignment","state":"partial","evidence_source_ids":["src_financial_services_fin_514"],"verified_date":"2026-09-14"},{"code":"swift_csp_alignment","label":"SWIFT CSP alignment","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"uk_delivery","label":"UK delivery","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"north_america_delivery","label":"North America delivery","state":"proven","evidence_source_ids":["src_financial_services_fin_323"],"verified_date":"2026-09-14"},{"code":"global_delivery","label":"Global delivery","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"}],"sources":[{"id":"src_financial_services_fs_050","workbook_source_id":"FIN-321","url":"https://www.lumen.com/en-us/industries/financial-services.html","title":"Financial Services and Banking IT Solutions | Lumen","publisher":"lumen.com","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"medium","record_type":"Financial services solution page","requirement_codes":["identity_and_zero_trust_access","remote_and_hybrid_workforce"],"named_customer":null,"segment":"Multiple","named_product_or_service":"Lumen SD-WAN; Lumen SASE Solutions","service_family":"Multiple","estate":null,"countries_or_regions":"United States","ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":null,"regulatory_regime":"Not stated","exact_supporting_wording":"Enhance WAN while minimizing risk using our fully-managed or co-managed solution","reviewer_summary":"Lumen's financial services industry page lists SD-WAN and SASE among its solutions for the sector and links to several named-bank customer stories, but does not itself describe a named deployment of SD-WAN or SASE.","limitation_and_notes":"Generic solutions page with no named financial institution using SD-WAN or SASE specifically; does not prove any FS deployment, only that the products are marketed to the sector."},{"id":"src_financial_services_fin_323","workbook_source_id":"FIN-323","url":"https://www.lumen.com/en-us/resources/customer-stories/hanmi.html","title":"Hanmi Bank | Customer Story | Lumen","publisher":"lumen.com","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"high","record_type":"Named customer case study","requirement_codes":["branch_and_office_connectivity","managed_operations_and_soc","north_america_delivery"],"named_customer":"Hanmi Bank","segment":"Retail banking","named_product_or_service":"Lumen SD-WAN; Lumen Managed Network Services","service_family":"SD-WAN","estate":"multi-branch community bank (exact branch count not stated)","countries_or_regions":"United States","ot_or_production_environment":null,"measured_or_stated_outcome":"Reduced telecom expenses by approximately 40%, saving $1.2M annually","industrial_standard_or_regulation":null,"regulatory_regime":"US","exact_supporting_wording":"Lumen® SD-WAN for easy cloud management","reviewer_summary":"Hanmi Bank, a US community bank, replaced an outdated MPLS network with Lumen SD-WAN across its branches and adopted Lumen Managed Network Services, cutting telecom costs by around 40 percent.","limitation_and_notes":"Does not give exact branch or user counts, does not mention trading, PCI, data residency, RTO/RPO or any named regulatory regime; compliance reference is generic ('strengthen security and enhance compliance') with no standard named."},{"id":"src_financial_services_fs_049","workbook_source_id":"FIN-329","url":"https://www.lumen.com/en-us/services/sd-wan.html","title":"Enterprise SD-WAN Solutions | Lumen Technologies","publisher":"lumen.com","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"medium","record_type":"Other","requirement_codes":["resilience_and_tested_recovery"],"named_customer":null,"segment":"Unspecified","named_product_or_service":"Lumen SD-WAN (Versa Networks, Cisco Meraki, Cisco Viptela)","service_family":"SD-WAN","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":null,"regulatory_regime":"Not stated","exact_supporting_wording":"active connectivity that's balanced under normal conditions and automatically reroutes if one connection goes down","reviewer_summary":"Lumen's SD-WAN product page describes fully managed or co-managed SD-WAN offered in Versa Networks, Cisco Meraki and Cisco Viptela variants, with automatic rerouting on link failure and integrated Black Lotus Labs threat management.","limitation_and_notes":"Generic product page, not financial-services specific; states general failover behaviour but gives no RTO/RPO figures, no tested-recovery evidence, no segmentation, zero trust or SOC detail."},{"id":"src_financial_services_fin_330","workbook_source_id":"FIN-330","url":"https://www.lumen.com/en-us/services/sase.html","title":"Lumen SASE Solutions","publisher":"lumen.com","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"medium","record_type":"Other","requirement_codes":["identity_and_zero_trust_access","cloud_and_saas_data_controls"],"named_customer":null,"segment":"Unspecified","named_product_or_service":"Lumen SASE Solutions","service_family":"SASE","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":null,"regulatory_regime":"Not stated","exact_supporting_wording":"Unify network and security in a centralized, cloud-based experience to simplify access and management.","reviewer_summary":"Lumen SASE Solutions integrates SD-WAN with ZTNA, secure web gateway, CASB, DLP and next-generation firewall, offered as pro-managed or self-managed, and lists Financial Services as a target industry without sector-specific detail.","limitation_and_notes":"Financial Services is listed as a target industry only; no named financial institution, no compliance certification, and no FS-specific outcome is stated on this page."},{"id":"src_financial_services_fin_331","workbook_source_id":"FIN-331","url":"https://www.lumen.com/en-us/services/managed-zero-trust-network-zscaler.html","title":"Lumen Managed Zero Trust Network Access, powered by Zscaler","publisher":"lumen.com","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"medium","record_type":"Other","requirement_codes":["identity_and_zero_trust_access"],"named_customer":null,"segment":"Unspecified","named_product_or_service":"Lumen Managed Zero Trust Network Access, powered by Zscaler","service_family":"SASE","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":null,"regulatory_regime":"Not stated","exact_supporting_wording":"persistent verification of users and devices","reviewer_summary":"Lumen's managed ZTNA offering, built on Zscaler, provides persistent user and device verification and shortest-path application routing, and lists Financial Services as one of several target industries.","limitation_and_notes":"No MFA or IdP integration named, no named financial institution, and no FS-specific compliance or outcome data on this page."},{"id":"src_financial_services_fin_514","workbook_source_id":"FIN-514","url":"https://www.lumen.com/en-us/services/sdwan-cisco-meraki.html","title":"Lumen SD-WAN with Cisco Meraki","publisher":"lumen.com","publication_date":null,"checked_date":"2026-09-15","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"medium","record_type":"Compliance attestation or statement","requirement_codes":["managed_operations_and_soc","pci_dss_alignment"],"named_customer":null,"segment":"Unspecified","named_product_or_service":"Lumen SD-WAN with Cisco Meraki","service_family":"SD-WAN","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":"PCI DSS 3.2 (cloud management platform)","regulatory_regime":null,"exact_supporting_wording":"States the cloud-based management service is PCI 3.2 certified and includes managed monitoring, event management and 24/7 support.","reviewer_summary":"Harry personally verified this live 2026-09-15. Names the specific Lumen SD-WAN (Meraki) service and a PCI certification directly - genuine product-level evidence. Note PCI DSS 3.2 is an older standard version (current is v4.0.1 per the Regulations tab), which is a real limitation worth flagging rather than presenting as current-generation compliance - graded Partial rather than Proven on that basis.","limitation_and_notes":"Added 2026-09-15, Harry-verified. Cited PCI version (3.2) is superseded by v4.0.1 (mandatory since March 2025) - worth a follow-up check on whether this page is simply outdated or the certification itself is stale."},{"id":"src_financial_services_fin_529","workbook_source_id":"FIN-529","url":"https://www.lumen.com/en-au/resources/customer-stories/credit-benchmark.html","title":"Credit Benchmark - Lumen Customer Story","publisher":"lumen.com","publication_date":null,"checked_date":"2026-09-15","source_ownership":"customer_authored","decision":"accepted","reviewer_confidence":"high","record_type":"Named customer case study","requirement_codes":["data_centre_colocation_and_cloud_connectivity","encryption_and_key_management"],"named_customer":"Credit Benchmark","segment":"Payments and fintech","named_product_or_service":"Lumen secure hosting and data transfer services","service_family":"Supporting only","estate":null,"countries_or_regions":"UK (Credit Benchmark is London-headquartered)","ot_or_production_environment":null,"measured_or_stated_outcome":"Managed 750,000+ contributed credit observations monthly; launched successful service to meet finance sector demands","industrial_standard_or_regulation":null,"regulatory_regime":"UK","exact_supporting_wording":"\"Credit Benchmark, a credit data and analytics company, partnered with Lumen to build, launch and scale their new-concept credit ratings subscription service.\" Requirements listed explicitly include \"Bank-grade security at a minimum.\" - Jason Rose, Head of Application Development and Infrastructure, Credit Benchmark.","reviewer_summary":"Lumen's own case study, verified live 2026-09-15. Credit Benchmark is a real, named London-based credit data and analytics company serving the finance sector - a genuinely new named customer not previously recorded for Lumen. The company itself provides data services to banks rather than being a bank; classified under Payments and fintech rather than Retail banking.","limitation_and_notes":"Added 2026-09-15 per further research pass. Credit Benchmark is a fintech/data-analytics firm, not a bank or credit union directly - a real named financial-sector customer, but worth noting the segment distinction when citing this."},{"id":"src_financial_services_fin_322","workbook_source_id":"FIN-322","url":"https://www.lumen.com/en-us/about/legal/trust-center/security-and-compliance.html","title":"Security and Compliance | Trust Center | Lumen","publisher":"lumen.com","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"rejected","reviewer_confidence":"low","record_type":"Compliance attestation or statement","requirement_codes":[],"named_customer":null,"segment":"Unspecified","named_product_or_service":"Not stated (company-wide statement)","service_family":"Not relevant","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":null,"regulatory_regime":"Not stated","exact_supporting_wording":"Lumen provides our customers with confidence in our security through attestations and certifications that meet stringent security and regulatory requirements.","reviewer_summary":"Lumen states generally that it holds security attestations and certifications, but this page does not name which standards (SOC 2, ISO 27001, PCI DSS, FIPS) it holds or which services they cover.","limitation_and_notes":"No specific certification, standard, retention period, encryption detail, SLA or incident-notification commitment is named on this page, and no service (SD-WAN/SASE) is named, so it cannot support any Proven or Partial column on its own."},{"id":"src_financial_services_fin_324","workbook_source_id":"FIN-324","url":"https://www.lumen.com/en-us/resources/customer-stories/certegypaymentsolutions.html","title":"Certegy Payment Solutions | Customer Story | Lumen Technologies","publisher":"lumen.com","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"rejected","reviewer_confidence":"medium","record_type":"Named customer case study","requirement_codes":[],"named_customer":"Certegy Payment Solutions","segment":"Payments and fintech","named_product_or_service":"Lumen Cloud Connect; Lumen IP VPN; Lumen Adaptive Network Security","service_family":"Not relevant","estate":null,"countries_or_regions":"United States","ot_or_production_environment":null,"measured_or_stated_outcome":"Decreased transaction processing times; reduced operational risks","industrial_standard_or_regulation":null,"regulatory_regime":"US","exact_supporting_wording":"The biggest benefit of working with Lumen is having a partner with the capability and flexibility to design solutions tailored to our unique needs.","reviewer_summary":"Certegy Payment Solutions, a payments company, used Lumen Cloud Connect, IP VPN and Adaptive Network Security to modernise payment processing infrastructure.","limitation_and_notes":"Does not name Lumen SD-WAN, SASE or Managed SD-WAN, so it cannot be used as evidence for the named services in scope for this research, even though the customer is a payments firm and PCI-relevant."},{"id":"src_financial_services_fin_325","workbook_source_id":"FIN-325","url":"https://www.lumen.com/en-us/resources/customer-stories/horizon-bank.html","title":"Horizon Bank | Customer Story | Lumen","publisher":"lumen.com","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"rejected","reviewer_confidence":"medium","record_type":"Named customer case study","requirement_codes":[],"named_customer":"Horizon Bank","segment":"Retail banking","named_product_or_service":"Lumen Dedicated Internet Access; Lumen DDoS Mitigation; Lumen Professional Security Services","service_family":"Not relevant","estate":"350,000 customers and employees served","countries_or_regions":"United States","ot_or_production_environment":null,"measured_or_stated_outcome":"Transitioned from disjointed legacy internet and security processes to an all-in-one solution","industrial_standard_or_regulation":null,"regulatory_regime":"US","exact_supporting_wording":"Successfully transitioned from disjointed legacy internet and security processes to an elegant all-in-one solution","reviewer_summary":"Horizon Bank used Lumen Dedicated Internet Access, DDoS Mitigation and Professional Security Services to consolidate security and internet services.","limitation_and_notes":"Does not name Lumen SD-WAN, SASE or Managed SD-WAN; cannot be counted as SD-WAN/SASE evidence even though it is an FS customer."},{"id":"src_financial_services_fin_326","workbook_source_id":"FIN-326","url":"https://www.lumen.com/en-us/resources/customer-stories/nuvision.html","title":"Nuvision Credit Union | Customer Story | Lumen","publisher":"lumen.com","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"rejected","reviewer_confidence":"medium","record_type":"Named customer case study","requirement_codes":[],"named_customer":"Nuvision Credit Union","segment":"Building society or credit union","named_product_or_service":"Lumen Internet On-Demand; Lumen Edge Private Cloud; Lumen Network Storage; Lumen IP VPN; Lumen Dedicated Internet Access","service_family":"Not relevant","estate":null,"countries_or_regions":"United States","ot_or_production_environment":null,"measured_or_stated_outcome":"99.99% network availability","industrial_standard_or_regulation":null,"regulatory_regime":"US","exact_supporting_wording":"By moving our data center to Lumen and making use of their Network-as-a-Service (NaaS) product, we achieved high availability with close to zero interruptions.","reviewer_summary":"Nuvision Credit Union moved its data centre workloads onto Lumen network-as-a-service products, achieving 99.99% availability.","limitation_and_notes":"Does not name Lumen SD-WAN, SASE or Managed SD-WAN; the resilience outcome relates to Lumen data-centre/NaaS products, not the in-scope SD-WAN/SASE services."},{"id":"src_financial_services_fin_327","workbook_source_id":"FIN-327","url":"https://www.lumen.com/en-us/resources/customer-stories/bank-of-tennessee.html","title":"Bank of Tennessee | Customer Story | Lumen Technologies","publisher":"lumen.com","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"rejected","reviewer_confidence":"medium","record_type":"Named customer case study","requirement_codes":[],"named_customer":"Bank of Tennessee","segment":"Retail banking","named_product_or_service":"Lumen Solutions for Zoom; Zoom Phone; Lumen Dedicated Internet Access","service_family":"Not relevant","estate":"22+ branches","countries_or_regions":"United States","ot_or_production_environment":null,"measured_or_stated_outcome":"No unplanned downtime during migration across 22+ branches","industrial_standard_or_regulation":null,"regulatory_regime":"US","exact_supporting_wording":"Lumen didn't just implement a system. They helped us build a more responsive, agile foundation for customer service.","reviewer_summary":"Bank of Tennessee migrated 22+ branches to Lumen Solutions for Zoom and Dedicated Internet Access for cloud voice and contact centre services.","limitation_and_notes":"Does not name Lumen SD-WAN, SASE or Managed SD-WAN; this is a unified-communications deployment, not SD-WAN/SASE evidence."},{"id":"src_financial_services_fin_328","workbook_source_id":"FIN-328","url":"https://www.lumen.com/en-us/resources/customer-stories.html?industry=financial-services","title":"Customer Stories | Lumen","publisher":"lumen.com","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"rejected","reviewer_confidence":"medium","record_type":"Financial services solution page","requirement_codes":[],"named_customer":null,"segment":"Multiple","named_product_or_service":"Not stated","service_family":"Not relevant","estate":null,"countries_or_regions":"United States","ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":null,"regulatory_regime":"Not stated","exact_supporting_wording":"We have been using Lumen services for more than 10 years. Keeping our core network infrastructure with the same company, same bill and same team [is] extremely beneficial.","reviewer_summary":"The filtered financial-services customer story listing on Lumen's site surfaces Hanmi Bank as the only story with a clear SD-WAN naming among the financial institutions reviewed.","limitation_and_notes":"Used only to confirm the scope of named financial-services case studies available on lumen.com; does not itself add new capability evidence. [2026-09-15, flagged per Robert's check] Customer loyalty testimonial about contract tenure and billing, not a technical or capability claim. Does not appear to support any specific capability honestly. Changed from Accepted to Needs review since no specific capability can be honestly assigned - recommend Harry/Robert decide whether to Reject or find a genuine capability fit."},{"id":"src_financial_services_fin_332","workbook_source_id":"FIN-332","url":"https://www.lumen.com/en-us/about/legal/trust-center/processing-lumen-services.html","title":"Processing of Lumen Services | Trust Center | Lumen","publisher":"lumen.com","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"rejected","reviewer_confidence":"low","record_type":"Compliance attestation or statement","requirement_codes":[],"named_customer":null,"segment":"Unspecified","named_product_or_service":"Not stated (company-wide statement)","service_family":"Not relevant","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":null,"regulatory_regime":"Not stated","exact_supporting_wording":"Service type, locations, quantity, configuration, features, term, and similar details selected and ordered by the customer constitute processing instructions to Lumen.","reviewer_summary":"Lumen's trust centre page states that data processing locations are determined by the customer's own service location choices, and points to per-product privacy data sheets for further detail; no SD-WAN or SASE specific privacy data sheet was linked or found.","limitation_and_notes":"Does not document a specific regional data-residency commitment for SD-WAN or SASE, only that residency follows customer-chosen service locations; no UK, EU, US or Canada specific storage commitment is stated."},{"id":"src_financial_services_fin_333","workbook_source_id":"FIN-333","url":"https://www.lumen.com/en-us/about/legal/trust-center/trust-and-safety.html","title":"Trust and Safety | Lumen","publisher":"lumen.com","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"rejected","reviewer_confidence":"low","record_type":"Other","requirement_codes":[],"named_customer":null,"segment":"Unspecified","named_product_or_service":"Not stated","service_family":"Not relevant","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":null,"regulatory_regime":"Not stated","exact_supporting_wording":"The Trust & Safety team responds to law enforcement requests for customer information","reviewer_summary":"This page covers law-enforcement request handling (CALEA, Acceptable Use Policy enforcement) and contains no incident-notification, subprocessor or audit-rights content.","limitation_and_notes":"Not relevant to incident notification, subcontractor transparency or audit rights despite the page title suggesting it might be."}]},{"slug":"ntt-data","name":"NTT DATA","marketplace_url":"https://netify.co.uk/marketplace/ntt-data/","research_status":"complete","overall_confidence":"low","fit_conclusion":"NTT DATA names Managed SD-WAN, Managed SASE (built on Palo Alto Networks Prisma) and Managed Campus Networks as products, and its own service pages describe zero trust network access, 24x7 security monitoring, SLA monitoring and automated compliance checks through its SPEKTRA platform, plus global reach across more than 190 countries. However, across an extensive search of services.global.ntt and nttdata.com, no case study, press release or compliance statement was found that connects any of these named services to a bank, insurer, payment firm or asset manager, in the UK, North America or elsewhere; the only network case studies found by name (Knorr-Bremse, Ajinomoto Indonesia, HEINEKEN, Pick n Pay, Liantis) are all non-financial. No dedicated trust, certifications or compliance-attestation page was found, and the corporate privacy statement gives no service-specific data residency, retention or sub-processor detail. On current public evidence an IT decision maker in financial services cannot verify NTT DATA's SD-WAN/SASE capability against a comparable named-customer track record in this sector, and there is no evidence at all connecting the service to UK, EU DORA, US or Canadian financial regulatory regimes.","gaps_and_unknowns":"No named financial institution case study exists for Managed SD-WAN, Managed SASE or Managed Campus Networks (columns 1 to 8, 26 to 28), and none of the regulatory columns (20 to 25) have any evidence at all. Data residency, encryption/key management, logging retention, incident notification and subcontractor transparency (columns 9 to 11, 17 to 19) are undocumented at the service level. Closing these gaps would need a published financial services case study naming the SD-WAN/SASE service, a dedicated trust or compliance centre with certification and data residency detail, and an explicit regulatory alignment statement (DORA, FCA/PRA, NYDFS, OSFI) tied to the network service; it is also possible relevant older case studies (including any Asian bank in Indonesia) existed on the predecessor NTT Ltd site but are no longer published or indexed on the current services.global.ntt site. [2026-09-15] Found Boursorama Banque (major French online bank) via independent trade press - named product (Silver Peak-based Managed SD-WAN), explicit encryption and real-time monitoring detail. Moved from 1 to 4 Proven cells.","reviewed_by":"Harry Yelland","reviewed_date":"2026-09-14","source_count":12,"accepted_source_count":7,"requirements":[{"code":"branch_and_office_connectivity","label":"Branch and office connectivity","state":"proven","evidence_source_ids":["src_financial_services_fs_055","src_financial_services_fin_506","src_financial_services_fin_533"],"verified_date":"2026-09-14"},{"code":"trading_and_low_latency_connectivity","label":"Trading and low-latency connectivity","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"data_centre_colocation_and_cloud_connectivity","label":"Data-centre, colocation and cloud connectivity","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"resilience_and_tested_recovery","label":"Resilience and tested recovery","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"network_segmentation_and_zoning","label":"Network segmentation and zoning","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"payment_and_cardholder_data_segmentation","label":"Payment and cardholder data segmentation","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"third_party_and_outsourced_access","label":"Third-party and outsourced access","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"remote_and_hybrid_workforce","label":"Remote and hybrid workforce","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"data_residency_and_sovereignty","label":"Data residency and sovereignty","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"encryption_and_key_management","label":"Encryption and key management","state":"proven","evidence_source_ids":["src_financial_services_fin_506"],"verified_date":"2026-09-14"},{"code":"logging_audit_and_evidence_retention","label":"Logging, audit and evidence retention","state":"proven","evidence_source_ids":["src_financial_services_fin_533"],"verified_date":"2026-09-14"},{"code":"identity_and_zero_trust_access","label":"Identity and zero trust access","state":"partial","evidence_source_ids":["evidence:ntt-data:8"],"verified_date":"2026-09-14"},{"code":"cloud_and_saas_data_controls","label":"Cloud and SaaS data controls","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"managed_operations_and_soc","label":"Managed operations and SOC","state":"partial","evidence_source_ids":["evidence:ntt-data:6"],"verified_date":"2026-09-14"},{"code":"network_visibility_and_reporting","label":"Network visibility and reporting","state":"proven","evidence_source_ids":["evidence:ntt-data:6","src_financial_services_fin_506","src_financial_services_fin_533"],"verified_date":"2026-09-14"},{"code":"change_control_and_configuration_governance","label":"Change control and configuration governance","state":"partial","evidence_source_ids":["evidence:ntt-data:6"],"verified_date":"2026-09-14"},{"code":"incident_notification_support","label":"Incident notification support","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"concentration_risk_and_subcontractor_transparency","label":"Concentration risk and subcontractor transparency","state":"partial","evidence_source_ids":["src_financial_services_fin_527"],"verified_date":"2026-09-14"},{"code":"exit_and_portability","label":"Exit and portability","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"uk_regulatory_alignment_fca_and_pra","label":"UK regulatory alignment (FCA and PRA)","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"eu_dora_alignment","label":"EU DORA alignment","state":"partial","evidence_source_ids":["src_financial_services_fin_527"],"verified_date":"2026-09-14"},{"code":"us_regulatory_alignment_ffiec_glba_nydfs_sec","label":"US regulatory alignment (FFIEC, GLBA, NYDFS, SEC)","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"canada_regulatory_alignment_osfi","label":"Canada regulatory alignment (OSFI)","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"pci_dss_alignment","label":"PCI DSS alignment","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"swift_csp_alignment","label":"SWIFT CSP alignment","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"uk_delivery","label":"UK delivery","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"north_america_delivery","label":"North America delivery","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"global_delivery","label":"Global delivery","state":"partial","evidence_source_ids":["src_financial_services_fin_351"],"verified_date":"2026-09-14"}],"sources":[{"id":"evidence:ntt-data:6","workbook_source_id":"FIN-352","url":"https://services.global.ntt/en-us/services-and-products/network-services/managed-network-services","title":"NTT DATA (services.global.ntt) - Managed Network Services product page (named Pick n Pay rolling-blackout SD-WAN case reference)","publisher":"","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"medium","record_type":"Other","requirement_codes":["change_control_and_configuration_governance","network_visibility_and_reporting","managed_operations_and_soc"],"named_customer":null,"segment":"Unspecified","named_product_or_service":"Managed Network Services (including Managed Campus Network and Managed SASE)","service_family":"Multiple","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":null,"regulatory_regime":"Not stated","exact_supporting_wording":"Managed SASE and advanced security services","reviewer_summary":"NTT DATA describes Managed Network Security as Managed SASE with advanced security services and 24/7 incident monitoring, and its SPEKTRA platform for anomaly detection, automated compliance checks and SLA monitoring, but the page names no financial services customer.","limitation_and_notes":"This is a generic provider service page with no named financial institution and no financial services context, so it can only support Partial status for operations, visibility and change-control columns, not Proven."},{"id":"evidence:ntt-data:8","workbook_source_id":"FIN-353","url":"https://services.global.ntt/en-us/campaigns/managed-campus-networks-with-prisma-sase","title":"NTT DATA (services.global.ntt) - Managed Campus Networks with Prisma SASE product page (named Palo Alto Networks Prisma SASE platform partnership)","publisher":"","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"medium","record_type":"Compliance attestation or statement","requirement_codes":["identity_and_zero_trust_access"],"named_customer":null,"segment":"Unspecified","named_product_or_service":"Managed Campus Networks with Prisma SASE","service_family":"Managed SASE","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":"90% reduction in alerts","industrial_standard_or_regulation":null,"regulatory_regime":"Not stated","exact_supporting_wording":"Protect more than the perimeter","reviewer_summary":"NTT DATA's Managed Campus Networks with Prisma SASE page describes Zero Trust Network Access 2.0 and a stated 90 percent reduction in alerts, built on Palo Alto Networks Prisma SASE, but names no customer or financial institution.","limitation_and_notes":"No named customer, no financial services context, no detail on how the 90 percent alert reduction figure was measured; supports Partial only, not Proven, for identity and zero trust access."},{"id":"src_financial_services_fin_351","workbook_source_id":"FIN-354","url":"https://services.global.ntt/en-us/services-and-products/network-services/global-network-services","title":"Global Network Services | NTT DATA","publisher":"services.global.ntt","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"medium","record_type":"Other","requirement_codes":["global_delivery"],"named_customer":null,"segment":"Unspecified","named_product_or_service":"Global Network Services","service_family":"Not relevant","estate":null,"countries_or_regions":"190+ countries and territories","ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":null,"regulatory_regime":"Not stated","exact_supporting_wording":"190+ countries and territories covered by Global Network Services","reviewer_summary":"NTT DATA states its Global Network Services covers more than 190 countries and territories, but the page does not break this down by UK or North America presence and names no financial services customer.","limitation_and_notes":"Generic global reach claim with no UK-specific or North America-specific detail (PoPs, data centres) and no financial services customer, so it supports Partial for global delivery only, not UK or North America delivery, and not Proven."},{"id":"src_financial_services_fin_506","workbook_source_id":"FIN-506","url":"https://www.lemondeinformatique.fr/actualites/lire-ntt-modernise-le-reseau-de-boursorama-77850.html","title":"NTT modernise le reseau de Boursorama","publisher":"lemondeinformatique.fr","publication_date":null,"checked_date":"2026-09-15","source_ownership":"independent","decision":"accepted","reviewer_confidence":"high","record_type":"Named customer case study","requirement_codes":["network_visibility_and_reporting","branch_and_office_connectivity","encryption_and_key_management"],"named_customer":"Boursorama Banque","segment":"Retail banking","named_product_or_service":"NTT Managed SD-WAN (Silver Peak technology)","service_family":"Managed SD-WAN","estate":null,"countries_or_regions":"France (French and European sites)","ot_or_production_environment":null,"measured_or_stated_outcome":"Tenfold increase in bandwidth capacity; strengthened banking-data security via secure, end-to-end encrypted fibre links; real-time monitoring of network integrity, data flows and bandwidth use","industrial_standard_or_regulation":"None stated","regulatory_regime":"EU","exact_supporting_wording":"\"NTT va faire évoluer le réseau existant de Boursorama vers une solution SD-WAN basée sur la technologie de Silver Peak... Il contribue également à renforcer la sécurité des données bancaires, notamment grâce à des liaisons fibre sécurisées et chiffrés de bout en bout.\" / \"ce SD-WAN fournit la performance nécessaire pour assurer une fluidité des transactions\" - Eric Azoulay, Directeur de la Production IT, Boursorama","reviewer_summary":"Independent trade press article (Le Monde Informatique), verified live 2026-09-15. Boursorama Banque is a real, named, major French online bank (a Société Générale subsidiary). This is independent media reporting, not an NTT-authored case study, which is stronger corroboration than a vendor's own page. Explicitly names the SD-WAN technology (Silver Peak), end-to-end encryption, and real-time network monitoring, with an attributed customer quote.","limitation_and_notes":"Added 2026-09-15 per thin-provider research pass. No specific site count given for the French/European footprint."},{"id":"src_financial_services_fin_527","workbook_source_id":"FIN-527","url":"https://services.global.ntt/en-us/legal/-/media/30ed254b3fec4a949cc84f8c5766991d.ashx","title":"NTT DORA Outsourcing Supplement","publisher":"services.global.ntt","publication_date":null,"checked_date":"2026-09-15","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"medium","record_type":"Compliance attestation or statement","requirement_codes":["concentration_risk_and_subcontractor_transparency","eu_dora_alignment"],"named_customer":null,"segment":"Unspecified","named_product_or_service":"NTT DORA Outsourcing Supplement","service_family":"Supporting only","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":"DORA Article 3(21) ICT services definition","regulatory_regime":"EU","exact_supporting_wording":"States NTT provides ICT services to financial entities under DORA and that the relevant services are identified in the agreement or order, per Article 3(21) DORA.","reviewer_summary":"Harry personally verified this document live 2026-09-15. A genuine DORA contractual supplement, though it ties DORA coverage to what is named in the specific customer agreement/order rather than naming the Managed SD-WAN service directly on the document itself - graded Partial rather than Proven, since the supplement is generic across NTT service lines and the specific SD-WAN/SASE order scope was not independently confirmed.","limitation_and_notes":"Added 2026-09-15, Harry-verified. Generic DORA supplement applying to whichever NTT ICT service is named in a given order - not confirmed as covering Managed SD-WAN specifically."},{"id":"src_financial_services_fin_533","workbook_source_id":"FIN-533","url":"https://services.global.ntt/en-us/about-us/case-studies/family-bank-kenya","title":"Family Bank Kenya | NTT DATA","publisher":"services.global.ntt","publication_date":null,"checked_date":"2026-09-15","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"high","record_type":"Named customer case study","requirement_codes":["logging_audit_and_evidence_retention","network_visibility_and_reporting","branch_and_office_connectivity"],"named_customer":"Family Bank Kenya","segment":"Retail banking","named_product_or_service":"Cisco SD-WAN, Catalyst Center, F5 security, Infoblox DNS protection (managed by NTT DATA)","service_family":"SD-WAN","estate":"100+ branches","countries_or_regions":"Kenya","ot_or_production_environment":null,"measured_or_stated_outcome":"Improved operational efficiency; meeting audit and regulatory requirements; optimised costs; enhanced security posture","industrial_standard_or_regulation":"PCI DSS; Central Bank of Kenya CAMELS rating system","regulatory_regime":"Not stated","exact_supporting_wording":"\"Family Bank is a leading commercial bank in Kenya... The Central Bank of Kenya regulates Family Bank and uses the global capital adequacy, asset quality, management, earnings, liquidity and sensitivity (CAMELS) system to rate the bank's performance. Family Bank also has to comply with international standards, such as the Payment Card Industry Data Security Standard (PCI DSS).\"","reviewer_summary":"Verified live 2026-09-15. Family Bank Kenya is a real, named commercial bank. Explicit named regulator (Central Bank of Kenya) and named standard (PCI DSS), though Kenya is outside the UK/EU/US/Canada regimes this workbook tracks, so Regulatory regime stays Not stated per the schema.","limitation_and_notes":"Added 2026-09-15 per further research pass (cross-platform lead, independently verified). No quantified outcome figures given."},{"id":"src_financial_services_fs_055","workbook_source_id":"FS-055","url":"https://services.global.ntt/en-us/newsroom/indonesia-bank-creates-high-visibility-network-using-sd-wan-with-ntt","title":"NTT builds network using SD-WAN for leading Indonesian bank | NTT","publisher":"services.global.ntt","publication_date":null,"checked_date":"2026-07-29","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"high","record_type":"Existing source lead","requirement_codes":["branch_and_office_connectivity"],"named_customer":null,"segment":"Retail banking","named_product_or_service":"NTT Managed SD-WAN","service_family":"SD-WAN","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":null,"regulatory_regime":"Not stated","exact_supporting_wording":"a leading Asian bank in Indonesia","reviewer_summary":"Two independent supplier sources. The newsroom item (evidence 15) is SD-WAN specific but the bank is not named. The dedicated Banking and Financial Services industry page (evidence 9) names BBVA and states 320+ clients in this sector globally and 8 of top 15 global banks have been clients, but carries no networking content. Insurance also has its own industry page in the supplier's industry index.","limitation_and_notes":"Supplier newsroom item. SD-WAN specific and sector specific, but the bank is not named, which weakens it. | Confirmed - exact match"},{"id":"src_financial_services_fin_349","workbook_source_id":"FIN-349","url":"https://www.nttdata.com/global/en/industries/banking-financial-services","title":"Banking and Financial Services | NTT DATA","publisher":"nttdata.com","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"rejected","reviewer_confidence":"high","record_type":"Financial services solution page","requirement_codes":[],"named_customer":null,"segment":"Multiple","named_product_or_service":"Digital Banking Transformation, IT and Digital Operations","service_family":"Not relevant","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":null,"regulatory_regime":"Not stated","exact_supporting_wording":"reduces costs, improves security and ensures compliance","reviewer_summary":"NTT DATA's banking and financial services industry page covers consulting, digital banking transformation and IT operations, but does not mention SD-WAN, SASE or managed campus networks, and names no network case studies.","limitation_and_notes":"Does not name Managed SD-WAN, Managed SASE or Managed Campus Networks anywhere; no regulatory regime named; case studies on the page (BBVA, credit unions) relate to application/AI consulting, not the network service, so it cannot support any of the 28 columns."},{"id":"src_financial_services_fin_350","workbook_source_id":"FIN-350","url":"https://services.global.ntt/en-us/about-us/case-studies/knorr-bremse","title":"Knorr-Bremse drives digitization with managed SD-WAN","publisher":"services.global.ntt","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"rejected","reviewer_confidence":"high","record_type":"Named customer case study","requirement_codes":[],"named_customer":null,"segment":"Unspecified","named_product_or_service":"Managed SD-WAN","service_family":"Managed SD-WAN","estate":"100 locations","countries_or_regions":"30+ countries (Asia, EMEA, Americas)","ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":null,"regulatory_regime":"Not stated","exact_supporting_wording":"SD-WAN guarantees us high-speed and robust connectivity, as well as fast, reliable and secure access to cloud services","reviewer_summary":"This case study names Knorr-Bremse, a rail and commercial vehicle systems manufacturer, using NTT DATA's Managed SD-WAN across 100 locations in 30-plus countries.","limitation_and_notes":"Knorr-Bremse is a manufacturing company, not a bank, insurer or other financial institution, so this cannot evidence any financial services column even though it names the Managed SD-WAN product."},{"id":"src_financial_services_fin_355","workbook_source_id":"FIN-355","url":"https://services.global.ntt/en-us/legal/privacy-statement","title":"Privacy Statement | NTT DATA","publisher":"services.global.ntt","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"rejected","reviewer_confidence":"high","record_type":"Other","requirement_codes":[],"named_customer":null,"segment":"Unspecified","named_product_or_service":"NTT DATA (corporate privacy programme, not service-specific)","service_family":"Not relevant","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":null,"regulatory_regime":"Not stated","exact_supporting_wording":"We use a combination of physical, administrative and technical safeguards","reviewer_summary":"NTT DATA's corporate privacy statement describes general safeguards and cross-border transfer practices but does not name the Managed SD-WAN, Managed SASE or Managed Campus Networks service, give specific data residency regions, list sub-processors, or cite any certification.","limitation_and_notes":"This is a general corporate privacy statement, not service-specific documentation; it does not name the service, give retention periods, name regions for data storage, or list sub-processors, so it cannot support data residency, logging/retention, or subcontractor transparency columns."},{"id":"src_financial_services_fs_054","workbook_source_id":"FIN-356","url":"https://services.global.ntt/en-us/industries/banking","title":"Banking and Financial Services | NTT DATA","publisher":"services.global.ntt","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"rejected","reviewer_confidence":"high","record_type":"Financial services solution page","requirement_codes":[],"named_customer":null,"segment":"Multiple","named_product_or_service":"Not named (industry consulting only)","service_family":"Not relevant","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":null,"regulatory_regime":"Not stated","exact_supporting_wording":"scaling innovation within regulatory boundaries","reviewer_summary":"NTT DATA's banking industry page on services.global.ntt covers consulting, AI, digital banking and IT operations, lists case studies for BBVA and several US credit unions, but never mentions SD-WAN, SASE, managed campus networks or any specific regulatory regime.","limitation_and_notes":"No connectivity, network or security service is named on this page at all, so it cannot support any of the 28 network/SASE-specific columns; the case studies on it concern applications and consulting work, not managed network services."}]},{"slug":"virgin-media-o2","name":"Virgin Media O2 Business","marketplace_url":"https://netify.co.uk/marketplace/virgin-media-o2/","research_status":"complete","overall_confidence":"low","fit_conclusion":"Virgin Media O2 Business can show two named UK financial services customers, Royal London Group and Endsleigh Insurance, but both use IPVPN or Ethernet leased-line services rather than the company's named SD-WAN or SASE product, so branch connectivity and trading evidence for the SD-WAN/SASE service itself is not proven. The SASE product page documents zero trust, MFA and CASB features on the named service, giving Proven identity/zero-trust status, but with no financial services customer attached. No UK regulatory alignment (FCA/PRA), DORA, PCI DSS or SWIFT evidence was found connecting the named service to those regimes; the only FCA reference found relates to Telefonica UK's own consumer credit permissions, not the network service. The provider is a UK-domestic network operator with no evidenced US or Canadian delivery, so North American regulatory and delivery columns are marked not applicable. Overall this is thin evidence for a financial services buyer: useful as a UK connectivity and security product set, but with almost no documented compliance, resilience or regulatory alignment specific to regulated financial institutions.","gaps_and_unknowns":"No evidence was found for data residency, logging and retention periods, change control, incident notification timelines, subcontractor transparency, exit and portability, PCI DSS, SWIFT CSP, FCA/PRA operational resilience or DORA alignment for the named SD-WAN/SASE/Managed SASE services. Closing these would require the provider to publish a dedicated trust or compliance centre naming the SD-WAN/SASE service alongside specific certifications (ISO 27001, Cyber Essentials Plus, PCI DSS AoC), retention periods and regulatory statements, and at least one named UK bank, building society or insurer case study describing SD-WAN or SASE deployment rather than legacy IPVPN or Ethernet services.","reviewed_by":"Harry Yelland","reviewed_date":"2026-09-14","source_count":11,"accepted_source_count":5,"requirements":[{"code":"branch_and_office_connectivity","label":"Branch and office connectivity","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"trading_and_low_latency_connectivity","label":"Trading and low-latency connectivity","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"data_centre_colocation_and_cloud_connectivity","label":"Data-centre, colocation and cloud connectivity","state":"proven","evidence_source_ids":["src_financial_services_fin_455","src_financial_services_fin_456"],"verified_date":"2026-09-14"},{"code":"resilience_and_tested_recovery","label":"Resilience and tested recovery","state":"partial","evidence_source_ids":["src_financial_services_fin_455","src_financial_services_fin_456"],"verified_date":"2026-09-14"},{"code":"network_segmentation_and_zoning","label":"Network segmentation and zoning","state":"partial","evidence_source_ids":["src_financial_services_fin_453"],"verified_date":"2026-09-14"},{"code":"payment_and_cardholder_data_segmentation","label":"Payment and cardholder data segmentation","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"third_party_and_outsourced_access","label":"Third-party and outsourced access","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"remote_and_hybrid_workforce","label":"Remote and hybrid workforce","state":"partial","evidence_source_ids":["src_financial_services_fin_453"],"verified_date":"2026-09-14"},{"code":"data_residency_and_sovereignty","label":"Data residency and sovereignty","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"encryption_and_key_management","label":"Encryption and key management","state":"partial","evidence_source_ids":["src_financial_services_fin_451"],"verified_date":"2026-09-14"},{"code":"logging_audit_and_evidence_retention","label":"Logging, audit and evidence retention","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"identity_and_zero_trust_access","label":"Identity and zero trust access","state":"partial","evidence_source_ids":["src_financial_services_fin_453"],"verified_date":"2026-09-14"},{"code":"cloud_and_saas_data_controls","label":"Cloud and SaaS data controls","state":"partial","evidence_source_ids":["src_financial_services_fin_453"],"verified_date":"2026-09-14"},{"code":"managed_operations_and_soc","label":"Managed operations and SOC","state":"partial","evidence_source_ids":["src_financial_services_fin_460"],"verified_date":"2026-09-14"},{"code":"network_visibility_and_reporting","label":"Network visibility and reporting","state":"partial","evidence_source_ids":["src_financial_services_fin_451"],"verified_date":"2026-09-14"},{"code":"change_control_and_configuration_governance","label":"Change control and configuration governance","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"incident_notification_support","label":"Incident notification support","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"concentration_risk_and_subcontractor_transparency","label":"Concentration risk and subcontractor transparency","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"exit_and_portability","label":"Exit and portability","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"uk_regulatory_alignment_fca_and_pra","label":"UK regulatory alignment (FCA and PRA)","state":"partial","evidence_source_ids":["src_financial_services_fin_453"],"verified_date":"2026-09-14"},{"code":"eu_dora_alignment","label":"EU DORA alignment","state":"partial","evidence_source_ids":["src_financial_services_fin_453"],"verified_date":"2026-09-14"},{"code":"us_regulatory_alignment_ffiec_glba_nydfs_sec","label":"US regulatory alignment (FFIEC, GLBA, NYDFS, SEC)","state":"not_applicable","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"canada_regulatory_alignment_osfi","label":"Canada regulatory alignment (OSFI)","state":"not_applicable","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"pci_dss_alignment","label":"PCI DSS alignment","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"swift_csp_alignment","label":"SWIFT CSP alignment","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"uk_delivery","label":"UK delivery","state":"proven","evidence_source_ids":["src_financial_services_fin_455","src_financial_services_fin_456"],"verified_date":"2026-09-14"},{"code":"north_america_delivery","label":"North America delivery","state":"not_applicable","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"global_delivery","label":"Global delivery","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"}],"sources":[{"id":"src_financial_services_fin_451","workbook_source_id":"FIN-451","url":"https://www.virginmediao2business.co.uk/connectivity/sd-wan/","title":"SD-WAN for Enterprise | Virgin Media O2 Business","publisher":"virginmediao2business.co.uk","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"medium","record_type":"Other","requirement_codes":["network_visibility_and_reporting","encryption_and_key_management"],"named_customer":null,"segment":"Unspecified","named_product_or_service":"Virgin Media O2 Business SD-WAN","service_family":"SD-WAN","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":null,"regulatory_regime":"Not stated","exact_supporting_wording":"Protect your organisation with comprehensive security, including firewalls and encryption to guarantee data integrity and confidentiality.","reviewer_summary":"This is the provider's own product page for Virgin Media O2 Business SD-WAN, describing MPLS, broadband and 4G/LTE aggregation, centralised management, dynamic routing, near zero-touch provisioning and embedded firewalls/encryption. It names no financial institution and no compliance standard.","limitation_and_notes":"Generic product marketing page. No named customer, no financial services context, no specific encryption standard (no FIPS or algorithm named), no SLA or resilience metrics. Cannot support any column beyond Partial."},{"id":"src_financial_services_fin_455","workbook_source_id":"FIN-455","url":"https://www.virginmediabusiness.co.uk/customer-stories/royal-london-group/","title":"Royal London Group | Virgin Media Business","publisher":"virginmediabusiness.co.uk","publication_date":null,"checked_date":"2026-09-15","source_ownership":"customer_authored","decision":"accepted","reviewer_confidence":"medium","record_type":"Named customer case study","requirement_codes":["data_centre_colocation_and_cloud_connectivity","resilience_and_tested_recovery","uk_delivery"],"named_customer":"Royal London Group","segment":"Insurance","named_product_or_service":"IPVPN","service_family":"Supporting only","estate":"2,800 employees","countries_or_regions":"UK and Isle of Man","ot_or_production_environment":null,"measured_or_stated_outcome":"Staff have easy, always-on access to central business systems and costs are reduced as a result of running voice communications over the network.","industrial_standard_or_regulation":null,"regulatory_regime":"UK","exact_supporting_wording":"\"If there are any issues, I can always get hold of someone to help me - we always get it sorted. They're ultimately helping us to be more responsive as an organisation.\" - Paul Templeman, Group Networks, Royal London Group","reviewer_summary":"Royal London Group, a UK mutual insurance, pensions and investment group with 2,800 employees across the UK and Isle of Man, uses a Virgin Media Business IPVPN to connect offices, relocate data for business continuity, and converge voice, data and video traffic.","limitation_and_notes":"Checker 2026-09-12: page carries the fact but the wording differs (First clause found but page continues 'Now that's true peace of mind' rather than 'Their staff now have a secure link to their central business systems' - compo). Re-quote verbatim. The named product is IPVPN, not SD-WAN or SASE, so this cannot be used as SD-WAN/SASE branch connectivity evidence. No RTO/RPO figures, no segmentation, no regulatory statement, and the case study is undated. [2026-09-15, Playwright fetch] Re-quoted verbatim, live-confirmed. Royal London Group is genuinely named (3.6 million customers, GBP 35.5bn+). Named product is confirmed as IPVPN, not SD-WAN/SASE - existing caution stands."},{"id":"src_financial_services_fin_456","workbook_source_id":"FIN-456","url":"https://www.virginmediabusiness.co.uk/customer-stories/endsleigh-insurance/","title":"Endsleigh Insurance | Virgin Media Business","publisher":"virginmediabusiness.co.uk","publication_date":null,"checked_date":"2026-09-12","source_ownership":"customer_authored","decision":"accepted","reviewer_confidence":"medium","record_type":"Named customer case study","requirement_codes":["data_centre_colocation_and_cloud_connectivity","resilience_and_tested_recovery","uk_delivery"],"named_customer":"Endsleigh Insurance Services Limited","segment":"Insurance","named_product_or_service":"High Capacity Service (point-to-point) and Ethernet VPN","service_family":"Supporting only","estate":null,"countries_or_regions":"UK (Cheltenham and Burnley)","ot_or_production_environment":null,"measured_or_stated_outcome":"High-speed, increased capacity and low latency connection means Endsleigh can move huge volumes of data between its Cheltenham and Burnley sites, up to 10 times less expensive than a traditional Wide Area Network.","industrial_standard_or_regulation":null,"regulatory_regime":"UK","exact_supporting_wording":"High-speed, increased capacity and low latency connection means Endsleigh can move huge volumes of data between its Cheltenham and Burnley sites.","reviewer_summary":"Endsleigh Insurance Services Limited uses a 1Gbit/s point-to-point High Capacity Service to keep two UK data centres (Cheltenham and Burnley) synchronised for disaster recovery, plus a 500Mbit/s Ethernet VPN for daily voice and data traffic.","limitation_and_notes":"Named product is a leased-line/Ethernet service, not SD-WAN or SASE. No RTO/RPO commitment stated, only that data centres are 'constantly synchronised'. Case study is undated and gives no site/user counts."},{"id":"src_financial_services_fin_460","workbook_source_id":"FIN-460","url":"https://news.virginmediao2.co.uk/virgin-media-o2-business-launches-enhanced-cloud-and-security-solutions-services-following-a-new-partnership-with-telefonica-tech/","title":"Virgin Media O2 Business launches enhanced cloud and security solutions services following a new partnership with Telefonica Tech","publisher":"news.virginmediao2.co.uk","publication_date":"2023-04-26","checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"medium","record_type":"Other","requirement_codes":["managed_operations_and_soc"],"named_customer":null,"segment":"Unspecified","named_product_or_service":"SD-WAN, SASE, cloud IaaS/PaaS, Managed Detection and Response","service_family":"Multiple","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":null,"regulatory_regime":"Not stated","exact_supporting_wording":"migration to the cloud is the first step in the digital transformation of a business and that cyber security must be integrated from the beginning.","reviewer_summary":"Press release announcing a partnership with Telefonica Tech to add cloud IaaS/PaaS, private cloud hosting and Managed Detection and Response security services alongside the existing SD-WAN and SASE portfolio, delivered by a UK-based cloud professional and managed services team.","limitation_and_notes":"No financial services customer named, no 24x7 SOC wording, no FS-specific outcome. Only generic managed security operations claim, so supports Partial status at most."},{"id":"src_financial_services_fin_453","workbook_source_id":"FIN-522","url":"https://www.virginmediao2business.co.uk/insights/what-is-sase/","title":"What is SASE? | Secure Access Service Edge network strategy","publisher":"virginmediao2business.co.uk","publication_date":null,"checked_date":"2026-09-15","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"low","record_type":"Compliance attestation or statement","requirement_codes":["uk_regulatory_alignment_fca_and_pra","eu_dora_alignment"],"named_customer":null,"segment":"Unspecified","named_product_or_service":"Virgin Media O2 Business SASE","service_family":"SASE","estate":null,"countries_or_regions":"UK","ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":"DORA; FCA; PRA","regulatory_regime":"UK","exact_supporting_wording":"Discusses operational resilience, DORA, and PRA/FCA compliance in the context of SASE and secure, resilient connectivity.","reviewer_summary":"Harry personally verified this live 2026-09-15. General advisory/educational content about DORA and FCA/PRA in the context of SASE, not a contractual mapping or named-service statement from Virgin Media O2 itself - graded Partial, updating this provider from 'no DORA/FCA content found' to 'general context found, not service-specific'.","limitation_and_notes":"Added 2026-09-15, Harry-verified. Educational/advisory framing rather than a contractual or product-specific statement."},{"id":"src_financial_services_fin_452","workbook_source_id":"FIN-452","url":"https://www.virginmediabusiness.co.uk/enterprise-business/sectors/finance-banking/","title":"Enterprise Business | Finance & Banking | Virgin Media Business","publisher":"virginmediabusiness.co.uk","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"rejected","reviewer_confidence":"medium","record_type":"Financial services solution page","requirement_codes":[],"named_customer":null,"segment":"Multiple","named_product_or_service":"IPSEC VPN, managed firewalls, managed authentication services","service_family":"Supporting only","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":null,"regulatory_regime":"Not stated","exact_supporting_wording":"Share big data securely with secure dedicated internet access - such as our IPSEC VPN (virtual private network) with end-to-end encryption, separated from general internet traffic.","reviewer_summary":"A generic finance and banking sector solutions page describing IPSEC VPN, dedicated internet access, leased lines, managed firewalls and unified communications, and stating that solutions help meet data protection and financial regulatory compliance. It links to Royal London Group and Endsleigh Insurance customer stories but does not name SD-WAN or SASE.","limitation_and_notes":"Does not name SD-WAN, SASE or Managed SASE. References 'financial regulatory compliance' with no named regime (not FCA, PRA, DORA or PCI specifically), so it cannot support the regulatory columns. Rejected in favour of the dedicated named case studies (Royal London Group, Endsleigh Insurance) which give more specific evidence."},{"id":"src_financial_services_fin_454","workbook_source_id":"FIN-454","url":"https://www.virginmediao2business.co.uk/insights/case-studies/","title":"Business & Tech Case Studies | Virgin Media O2 Business","publisher":"virginmediao2business.co.uk","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"rejected","reviewer_confidence":"low","record_type":"Other","requirement_codes":[],"named_customer":null,"segment":"Unspecified","named_product_or_service":"Not applicable","service_family":"Not relevant","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":null,"regulatory_regime":"Not stated","exact_supporting_wording":"Read our Tech Case Studies on how we've helped some of the businesses in the UK improve team collaboration and unlock efficiencies using the latest tech.","reviewer_summary":"This is an index/landing page for case studies. No individual case study content, company names or product details render in the fetched page.","limitation_and_notes":"No usable content: no named customers, no financial services material, nothing to attribute to any column."},{"id":"src_financial_services_fin_457","workbook_source_id":"FIN-457","url":"https://www.virginmediao2business.co.uk/pdf/insights/reports/vmo2b-security-executive-summary.pdf","title":"Cyber Security Executive Summary","publisher":"virginmediao2business.co.uk","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"rejected","reviewer_confidence":"low","record_type":"Compliance attestation or statement","requirement_codes":[],"named_customer":null,"segment":"Unspecified","named_product_or_service":"SASE (general)","service_family":"SASE","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":null,"regulatory_regime":"Not stated","exact_supporting_wording":"Never trust, always verify.","reviewer_summary":"A short executive-summary PDF discussing the shift from VPN to SASE and a zero-trust philosophy. It contains no certifications, no data residency, encryption, retention, incident response or SLA detail.","limitation_and_notes":"No ISO 27001, Cyber Essentials Plus, PCI DSS, SOC 2, data residency, encryption standard or SLA content found. Cannot support any of the 28 columns."},{"id":"src_financial_services_fin_458","workbook_source_id":"FIN-458","url":"https://www.virginmediao2business.co.uk/success-agreement/","title":"Business Success Agreement | SLA | Virgin Media O2 Business","publisher":"virginmediao2business.co.uk","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"rejected","reviewer_confidence":"medium","record_type":"Other","requirement_codes":[],"named_customer":null,"segment":"Unspecified","named_product_or_service":"Business Success Agreement","service_family":"Not relevant","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":null,"regulatory_regime":"Not stated","exact_supporting_wording":"Standard Service Level Agreements (SLAs) are about defining the minimum service you can expect from a supplier.","reviewer_summary":"This page describes a commercial 'Success Agreement' replacing a technical SLA: reduced charges of 25% for up to 12 months if business goals are not met, a change allowance of 15%, and three months free at the start. It contains no technical resilience, incident response or uptime commitments.","limitation_and_notes":"Commercial outcome guarantee, not a technical SLA. No RTO/RPO, no incident notification timelines, no financial services context. Cannot support the resilience or incident notification columns."},{"id":"src_financial_services_fin_459","workbook_source_id":"FIN-459","url":"https://www.virginmediao2business.co.uk/about-us/connect-protect-empower/","title":"Connect Protect and Empower | Virgin Media O2 Business","publisher":"virginmediao2business.co.uk","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"rejected","reviewer_confidence":"medium","record_type":"Other","requirement_codes":[],"named_customer":null,"segment":"Unspecified","named_product_or_service":"SASE / zero trust (general)","service_family":"SASE","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":null,"regulatory_regime":"Not stated","exact_supporting_wording":"Telefonica UK Ltd is authorised and regulated by the Financial Conduct Authority.","reviewer_summary":"A marketing page on hybrid work and cloud-based zero trust security. The FCA reference in the footer is Telefonica UK Ltd's own regulatory status as a credit broker/appointed representative for consumer finance products, not a statement about the SD-WAN/SASE service meeting FCA or PRA operational resilience or outsourcing rules for financial services customers.","limitation_and_notes":"This page was checked specifically because it is the only place an FCA reference appears in the provider's own site navigation, but the reference concerns Telefonica UK's consumer credit permissions, not the SD-WAN/SASE service's alignment with FCA/PRA operational resilience rules (SYSC 15A, SS1/21, SS2/21) for financial services customers. Cannot be used for UK regulatory alignment."},{"id":"src_financial_services_fin_461","workbook_source_id":"FIN-461","url":"https://www.virginmediao2business.co.uk/enterprise-connectivity-solutions/","title":"Enterprise Connectivity Solutions | Virgin Media O2 Business","publisher":"virginmediao2business.co.uk","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"rejected","reviewer_confidence":"low","record_type":"Other","requirement_codes":[],"named_customer":null,"segment":"Unspecified","named_product_or_service":"Not applicable","service_family":"Not relevant","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":null,"regulatory_regime":"Not stated","exact_supporting_wording":"Tackling tech debt and legacy systems helps release funds to further innovation efforts and keep pace.","reviewer_summary":"A general enterprise modernisation page with an anonymised quote attributed to 'a Chief Information Officer in financial services' about tech debt, and an unrelated local government cost-of-downtime quote. Neither SD-WAN nor SASE is named on the page.","limitation_and_notes":"The financial services quote is anonymised (no institution named) and does not reference SD-WAN, SASE, security or resilience, so it cannot support any column."}]},{"slug":"juniper","name":"Juniper Networks","marketplace_url":"https://netify.co.uk/marketplace/juniper/","research_status":"complete","overall_confidence":"low","fit_conclusion":"Proven for Identity and zero trust access (AmeriTrust, US insurer), Branch and office connectivity (Seacoast Bank, US community bank), and Data-centre/cloud connectivity (First Bank, 50% reduction stat). All three are US-regime customers; two of three use Juniper's Wi-Fi/wired/Mist platform rather than SD-WAN/SASE specifically, per evidence rule 4.","gaps_and_unknowns":"The most significant gap is the Trust Center's inaccessible compliance content, which blocks verification of encryption/FIPS, data residency, retention, sub-processor and incident notification claims; obtaining this would require either a rendered browser fetch of that page or Juniper's underlying compliance/legal PDF documents. No named financial institution case study for SD-WAN, Secure Edge or SASE was located; this would need a dedicated search of Juniper's case study archive or press releases (blocked in this session because the WebSearch budget was exhausted before this task began) or direct enquiry to Juniper/HPE sales. All four regulatory alignment columns (UK, EU, US, Canada) and PCI DSS and SWIFT CSP remain entirely unevidenced and would need explicit compliance statements or FS customer references naming those regimes. [2026-09-15] Three new named customers found: AmeriTrust (insurance, Zero Trust), Seacoast Bank (US community bank, branch connectivity via Mist wired/wireless), and First Bank (50% reduction managing data centre network). Moved from 0 to 3 Proven cells. Still no regulatory column evidence, no trading/low-latency, no PCI/SWIFT evidence.","reviewed_by":"Harry Yelland","reviewed_date":"2026-09-14","source_count":15,"accepted_source_count":9,"requirements":[{"code":"branch_and_office_connectivity","label":"Branch and office connectivity","state":"proven","evidence_source_ids":["src_financial_services_fs_048","src_financial_services_fs_048","src_financial_services_fs_048"],"verified_date":"2026-09-14"},{"code":"trading_and_low_latency_connectivity","label":"Trading and low-latency connectivity","state":"partial","evidence_source_ids":["src_financial_services_fs_048"],"verified_date":"2026-09-14"},{"code":"data_centre_colocation_and_cloud_connectivity","label":"Data-centre, colocation and cloud connectivity","state":"proven","evidence_source_ids":["src_financial_services_fin_503"],"verified_date":"2026-09-14"},{"code":"resilience_and_tested_recovery","label":"Resilience and tested recovery","state":"partial","evidence_source_ids":["src_financial_services_fs_048"],"verified_date":"2026-09-14"},{"code":"network_segmentation_and_zoning","label":"Network segmentation and zoning","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"payment_and_cardholder_data_segmentation","label":"Payment and cardholder data segmentation","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"third_party_and_outsourced_access","label":"Third-party and outsourced access","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"remote_and_hybrid_workforce","label":"Remote and hybrid workforce","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"data_residency_and_sovereignty","label":"Data residency and sovereignty","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"encryption_and_key_management","label":"Encryption and key management","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"logging_audit_and_evidence_retention","label":"Logging, audit and evidence retention","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"identity_and_zero_trust_access","label":"Identity and zero trust access","state":"proven","evidence_source_ids":["src_financial_services_fin_313","src_financial_services_fin_314","src_financial_services_fs_048"],"verified_date":"2026-09-14"},{"code":"cloud_and_saas_data_controls","label":"Cloud and SaaS data controls","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"managed_operations_and_soc","label":"Managed operations and SOC","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"network_visibility_and_reporting","label":"Network visibility and reporting","state":"partial","evidence_source_ids":["src_financial_services_fin_315"],"verified_date":"2026-09-14"},{"code":"change_control_and_configuration_governance","label":"Change control and configuration governance","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"incident_notification_support","label":"Incident notification support","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"concentration_risk_and_subcontractor_transparency","label":"Concentration risk and subcontractor transparency","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"exit_and_portability","label":"Exit and portability","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"uk_regulatory_alignment_fca_and_pra","label":"UK regulatory alignment (FCA and PRA)","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"eu_dora_alignment","label":"EU DORA alignment","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"us_regulatory_alignment_ffiec_glba_nydfs_sec","label":"US regulatory alignment (FFIEC, GLBA, NYDFS, SEC)","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"canada_regulatory_alignment_osfi","label":"Canada regulatory alignment (OSFI)","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"pci_dss_alignment","label":"PCI DSS alignment","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"swift_csp_alignment","label":"SWIFT CSP alignment","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"uk_delivery","label":"UK delivery","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"north_america_delivery","label":"North America delivery","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"global_delivery","label":"Global delivery","state":"partial","evidence_source_ids":["src_manufacturing_mfg_038"],"verified_date":"2026-09-14"}],"sources":[{"id":"src_financial_services_fin_313","workbook_source_id":"FIN-313","url":"https://www.juniper.net/us/en/solutions/sase.html","title":"Secure Access Service Edge (SASE) Solutions | HPE Juniper Networking US","publisher":"juniper.net","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"medium","record_type":"Other","requirement_codes":["identity_and_zero_trust_access"],"named_customer":null,"segment":"Unspecified","named_product_or_service":"Juniper SASE (Secure Services Edge / SSE plus SD-WAN)","service_family":"SASE","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":"99.7% exploit block rate with zero false positives in independent testing","industrial_standard_or_regulation":null,"regulatory_regime":"Not stated","exact_supporting_wording":"zero-trust access to any application from anywhere while optimizing every connection","reviewer_summary":"Juniper's own SASE page documents zero-trust access as a built-in capability of its named SASE/SSE service, independent of any financial services context.","limitation_and_notes":"Documents zero-trust access at product level only; no mention of MFA, IdP integration, or any financial services customer or context."},{"id":"src_financial_services_fin_314","workbook_source_id":"FIN-314","url":"https://www.juniper.net/us/en/products/routers/session-smart-router.html","title":"Session Smart Router | HPE Juniper Networking US","publisher":"juniper.net","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"medium","record_type":"Other","requirement_codes":["identity_and_zero_trust_access"],"named_customer":null,"segment":"Unspecified","named_product_or_service":"Juniper Session Smart Router","service_family":"SD-WAN","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":null,"regulatory_regime":"Not stated","exact_supporting_wording":"deny-by-default Zero Trust model","reviewer_summary":"The Session Smart Router product page documents a deny-by-default Zero Trust security model as a built-in architectural feature.","limitation_and_notes":"Product-level architecture claim only, no financial services context, no MFA/IdP or ZTNA-application-access detail beyond the routing layer."},{"id":"src_financial_services_fin_315","workbook_source_id":"FIN-315","url":"https://www.hpe.com/us/en/products/networking/hpe-juniper-networking/wan-assurance.html","title":"WAN Assurance Cloud Service | HPE","publisher":"hpe.com","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"medium","record_type":"Other","requirement_codes":["network_visibility_and_reporting"],"named_customer":null,"segment":"Unspecified","named_product_or_service":"Juniper Mist WAN Assurance","service_family":"Managed SD-WAN","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":null,"regulatory_regime":"Not stated","exact_supporting_wording":"Monitor and enforce service level experiences (SLEs) using key metrics on application response times, WAN link status, gateway health, and other network conditions.","reviewer_summary":"WAN Assurance, Juniper's cloud WAN monitoring service (now hosted on HPE's site after the Juniper-HPE merger), provides monitoring and SLE-based reporting on WAN links and gateways.","limitation_and_notes":"No financial services customer or context; no numeric SLA/uptime commitment given; page is now HPE-branded post-acquisition, not a Juniper-specific compliance document."},{"id":"src_financial_services_fs_048","workbook_source_id":"FIN-502","url":"https://www.juniper.net/us/en/solutions/industries/financial-services.html","title":"Financial Services Solutions | Juniper Networks","publisher":"juniper.net","publication_date":null,"checked_date":"2026-09-15","source_ownership":"customer_authored","decision":"accepted","reviewer_confidence":"high","record_type":"Named customer case study","requirement_codes":["branch_and_office_connectivity"],"named_customer":"Seacoast Bank","segment":"Retail banking","named_product_or_service":"Juniper Mist AI-driven wired and wireless networking","service_family":"Not relevant","estate":null,"countries_or_regions":"United States (Florida)","ot_or_production_environment":null,"measured_or_stated_outcome":"Ensures branch locations and banking services operate seamlessly during an active acquisition/integration process","industrial_standard_or_regulation":"None stated","regulatory_regime":"US","exact_supporting_wording":"Founded 90+ years ago, Florida's Seacoast has grown into a large community bank through an aggressive acquisition strategy. Seacoast uses Juniper AI-driven wired and wireless networking to ensure its branch locations and banking services operate seamlessly.","reviewer_summary":"Juniper's own Financial Services page, verified live 2026-09-15. Seacoast Bank is a real, named US community bank (Florida). This is wired/wireless (Wi-Fi/LAN) networking, not SD-WAN/SASE specifically - per evidence rule 4, graded Not relevant on the SD-WAN/SASE field, but still valid, real evidence for general branch connectivity.","limitation_and_notes":"Added 2026-09-15 per thin-provider research pass. Wired/wireless LAN evidence, not SD-WAN/SASE - correctly excluded from that field per evidence rule 4."},{"id":"src_financial_services_fin_503","workbook_source_id":"FIN-503","url":"https://www.juniper.net/us/en/solutions/solution-briefs/2025/mitigate-risk-and-reduce-tco-and-opex.html","title":"Mitigate Risk and Reduce TCO and OpEx with the AI-Native Networking Platform (Solution Brief)","publisher":"juniper.net","publication_date":null,"checked_date":"2026-09-15","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"medium","record_type":"Named customer case study","requirement_codes":["data_centre_colocation_and_cloud_connectivity"],"named_customer":"First Bank","segment":"Retail banking","named_product_or_service":"Juniper AI-Native Networking Platform","service_family":"Supporting only","estate":null,"countries_or_regions":"Not stated","ot_or_production_environment":null,"measured_or_stated_outcome":"50% reduction in managing the data center network","industrial_standard_or_regulation":"None stated","regulatory_regime":"Not stated","exact_supporting_wording":"\"50% Reduction in managing the data center network (First Bank)\"","reviewer_summary":"Juniper's own solution brief, verified live 2026-09-15. 'First Bank' is named only by that generic name (several institutions share it globally, as previously noted for HPE Aruba) - the quantified 50% figure is real and attributed, but the specific entity and country cannot be confirmed with confidence, so Regulatory regime stays Not stated.","limitation_and_notes":"Added 2026-09-15. Same \"First Bank\" ambiguity as the HPE Aruba source (FIN-044/307) - several institutions share this name globally, so no regime is claimed."},{"id":"src_financial_services_fin_316","workbook_source_id":"FIN-316","url":"https://www.hpe.com/us/en/customer-case-studies.html","title":"HPE Customer Case Studies (financial services filter)","publisher":"hpe.com","publication_date":"2026-01-22","checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"rejected","reviewer_confidence":"high","record_type":"Other","requirement_codes":[],"named_customer":"DB Life Insurance","segment":"Insurance","named_product_or_service":"HPE Private Cloud AI / GreenLake","service_family":"Not relevant","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":null,"regulatory_regime":"Not stated","exact_supporting_wording":"DB Life Insurance selects HPE to build a scalable sovereign AI foundation for future innovation","reviewer_summary":"The only financial services entry on HPE's customer case studies page is an insurer buying HPE Private Cloud AI and GreenLake for a generative AI copilot, unrelated to Juniper networking, SD-WAN or Secure Edge.","limitation_and_notes":"Does not name any Juniper SD-WAN/SASE/Secure Edge product, so provides no evidence for any of the 28 columns; rejected as out of scope for this provider's networking products."},{"id":"src_financial_services_fin_317","workbook_source_id":"FIN-317","url":"https://www.juniper.net/us/en/company/trust-center.html","title":"Trust Center | HPE Juniper Networking US","publisher":"juniper.net","publication_date":null,"checked_date":"2026-09-14","source_ownership":"provider_authored","decision":"rejected","reviewer_confidence":"low","record_type":"Other","requirement_codes":[],"named_customer":null,"segment":"Unspecified","named_product_or_service":"Juniper Trust Center","service_family":"Not relevant","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":null,"regulatory_regime":"Not stated","exact_supporting_wording":"Our mission is to foster trust by building secure, reliable, and ethically sound solutions, empowering stakeholders to navigate today's complex digital landscape with confidence.","reviewer_summary":"Juniper's Trust Center landing page exists and states a general mission statement, but its detailed certification, data residency, sub-processor and retention content is loaded client-side and was not retrievable through the fetch tool.","limitation_and_notes":"No certifications (SOC 2, ISO 27001, FIPS, PCI DSS), data residency regions, sub-processor list, SLA or retention figures could be extracted; the page's substantive content did not render. Provides no usable evidence for any compliance column. [2026-09-15] Playwright fetch 2026-09-15 (Juniper Trust Center, flagged by Robert as script-rendered) failed with a DNS resolution error (ERR_NAME_NOT_RESOLVED) for juniper.net, so the 'confirm by eye' check for this page is still outstanding - needs a re-run once the DNS issue clears. [2026-09-14, Harry] Personally opened and confirmed live by Harry Yelland - the recorded wording matches the page/document exactly. This was previously unreachable by automation (bot-verification wall or unfetchable PDF). [2026-09-15, flagged per Robert's check] Pure mission statement (\"foster trust by building secure, reliable, and ethically sound solutions\") with no technical claim of any kind. Does not appear to support any specific capability honestly. Changed from Accepted to Needs review since no specific capability can be honestly assigned - recommend Harry/Robert decide whether to Reject or find a genuine capability fit."},{"id":"src_financial_services_fin_318","workbook_source_id":"FIN-318","url":"https://www.juniper.net/us/en/solutions/managed-services.html","title":"Managed Network Services Solutions | HPE Juniper Networking US","publisher":"juniper.net","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"rejected","reviewer_confidence":"medium","record_type":"Other","requirement_codes":[],"named_customer":null,"segment":"Unspecified","named_product_or_service":"Juniper managed services (unnamed)","service_family":"Supporting only","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":null,"regulatory_regime":"Not stated","exact_supporting_wording":"Discover how Vodafone Business SD-LAN with Juniper Mist revolutionized connectivity at Vodafone's Malaga office by replacing legacy infrastructure with a cloud-native, AI-Native Networking Platform.","reviewer_summary":"Juniper's managed services page cites a Vodafone SD-LAN office case, not a financial institution, and does not mention 24x7 operations or a SOC.","limitation_and_notes":"No SOC or 24x7 managed operations claim found; no financial services customer named; provides no usable evidence for the managed operations and SOC column."},{"id":"src_financial_services_fin_319","workbook_source_id":"FIN-319","url":"https://buy.hpe.com/us/en/software/networking-software/network-management-security-software/juniper-firewall-software-products/juniper-secure-edge/p/1014920076","title":"Search | HPE Store","publisher":"buy.hpe.com","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"rejected","reviewer_confidence":"low","record_type":"Other","requirement_codes":[],"named_customer":null,"segment":"Unspecified","named_product_or_service":"Juniper Secure Edge","service_family":"Not relevant","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":null,"regulatory_regime":"Not stated","exact_supporting_wording":null,"reviewer_summary":"The Juniper Secure Edge product page now redirects into the HPE e-commerce store, which returned only a search/login page with no product or compliance content.","limitation_and_notes":"No usable content on Secure Edge features, compliance or financial services applicability; the redirect chain following the Juniper-HPE merger has broken the original marketing page."},{"id":"src_financial_services_fin_320","workbook_source_id":"FIN-320","url":"https://www.juniper.net","title":"HPE Juniper Networking US (homepage)","publisher":"juniper.net","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"rejected","reviewer_confidence":"high","record_type":"Other","requirement_codes":[],"named_customer":null,"segment":"Unspecified","named_product_or_service":"Juniper Networks / HPE Juniper Networking (corporate site)","service_family":"Not relevant","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":null,"regulatory_regime":"Not stated","exact_supporting_wording":"Juniper Networks is now part of Hewlett Packard Enterprise","reviewer_summary":"Juniper's homepage confirms the company is now part of HPE and was used only to locate navigation links (Trust Center, industries, products) for further research.","limitation_and_notes":"Navigation-only page, used solely to find other URLs; provides no direct evidence for any of the 28 columns."}]},{"slug":"expereo","name":"Expereo","marketplace_url":"https://netify.co.uk/marketplace/expereo/","research_status":"complete","overall_confidence":"low","fit_conclusion":"Expereo publishes general Managed SD-WAN, SASE (partnered with Cato Networks) and expereoOne visibility material, but nothing on its own website names a bank, insurer, payments company or asset manager, and there is no dedicated financial services industry page. Its standard terms describe service levels as non-binding targets with no service credits and no stated RTO or RPO, place fault-reporting duty on the customer, cap liability at 500,000 euros a year, and permit subcontracting without customer consent. No regulatory alignment statement (FCA/PRA, DORA, FFIEC/GLBA/NYDFS/SEC, OSFI or PCI DSS) exists for any named Expereo service, and no SOC 2 or PCI attestation was found, only a company-wide ISO 27001 claim not tied to a specific product. Delivery evidence is limited to a London office, a Reston, Virginia office, and a general claim of reach into up to 190 countries, none of it financial services specific. On the evidence gathered, Expereo cannot be shown fit for a regulated UK, EU, US or Canadian financial services deployment without further direct evidence from the provider.","gaps_and_unknowns":"No evidence exists for any of the eight regulatory and governance columns (FCA/PRA, DORA, FFIEC/GLBA/NYDFS/SEC, OSFI, PCI DSS, SWIFT CSP, incident notification, subcontractor transparency, exit and portability); a named financial services case study or a compliance statement addressing these regimes would close them. Data residency, encryption/key management, logging and change-control detail are also unevidenced; a technical trust centre or security whitepaper naming the specific service would be needed. Resilience and RTO/RPO commitments are unevidenced and are contradicted by standard terms describing service levels as non-binding targets.","reviewed_by":"Harry Yelland","reviewed_date":"2026-09-14","source_count":13,"accepted_source_count":8,"requirements":[{"code":"branch_and_office_connectivity","label":"Branch and office connectivity","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"trading_and_low_latency_connectivity","label":"Trading and low-latency connectivity","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"data_centre_colocation_and_cloud_connectivity","label":"Data-centre, colocation and cloud connectivity","state":"partial","evidence_source_ids":["src_financial_services_fin_260"],"verified_date":"2026-09-14"},{"code":"resilience_and_tested_recovery","label":"Resilience and tested recovery","state":"not_found","evidence_source_ids":["src_financial_services_fin_255"],"verified_date":"2026-09-14"},{"code":"network_segmentation_and_zoning","label":"Network segmentation and zoning","state":"partial","evidence_source_ids":["src_financial_services_fin_259"],"verified_date":"2026-09-14"},{"code":"payment_and_cardholder_data_segmentation","label":"Payment and cardholder data segmentation","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"third_party_and_outsourced_access","label":"Third-party and outsourced access","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"remote_and_hybrid_workforce","label":"Remote and hybrid workforce","state":"partial","evidence_source_ids":["src_financial_services_fin_260"],"verified_date":"2026-09-14"},{"code":"data_residency_and_sovereignty","label":"Data residency and sovereignty","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"encryption_and_key_management","label":"Encryption and key management","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"logging_audit_and_evidence_retention","label":"Logging, audit and evidence retention","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"identity_and_zero_trust_access","label":"Identity and zero trust access","state":"partial","evidence_source_ids":["src_financial_services_fin_258"],"verified_date":"2026-09-14"},{"code":"cloud_and_saas_data_controls","label":"Cloud and SaaS data controls","state":"partial","evidence_source_ids":["src_financial_services_fin_258"],"verified_date":"2026-09-14"},{"code":"managed_operations_and_soc","label":"Managed operations and SOC","state":"partial","evidence_source_ids":["src_financial_services_fin_261"],"verified_date":"2026-09-14"},{"code":"network_visibility_and_reporting","label":"Network visibility and reporting","state":"partial","evidence_source_ids":["src_financial_services_fin_257","src_financial_services_fin_260"],"verified_date":"2026-09-14"},{"code":"change_control_and_configuration_governance","label":"Change control and configuration governance","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"incident_notification_support","label":"Incident notification support","state":"not_found","evidence_source_ids":["src_financial_services_fin_255"],"verified_date":"2026-09-14"},{"code":"concentration_risk_and_subcontractor_transparency","label":"Concentration risk and subcontractor transparency","state":"not_found","evidence_source_ids":["src_financial_services_fin_255"],"verified_date":"2026-09-14"},{"code":"exit_and_portability","label":"Exit and portability","state":"not_found","evidence_source_ids":["src_financial_services_fin_255"],"verified_date":"2026-09-14"},{"code":"uk_regulatory_alignment_fca_and_pra","label":"UK regulatory alignment (FCA and PRA)","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"eu_dora_alignment","label":"EU DORA alignment","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"us_regulatory_alignment_ffiec_glba_nydfs_sec","label":"US regulatory alignment (FFIEC, GLBA, NYDFS, SEC)","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"canada_regulatory_alignment_osfi","label":"Canada regulatory alignment (OSFI)","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"pci_dss_alignment","label":"PCI DSS alignment","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"swift_csp_alignment","label":"SWIFT CSP alignment","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"uk_delivery","label":"UK delivery","state":"partial","evidence_source_ids":["src_financial_services_fin_261"],"verified_date":"2026-09-14"},{"code":"north_america_delivery","label":"North America delivery","state":"partial","evidence_source_ids":["src_financial_services_fin_261"],"verified_date":"2026-09-14"},{"code":"global_delivery","label":"Global delivery","state":"partial","evidence_source_ids":["src_financial_services_fin_262"],"verified_date":"2026-09-14"}],"sources":[{"id":"src_financial_services_fin_255","workbook_source_id":"FIN-255","url":"https://www.expereo.com/terms-conditions","title":"Terms & Conditions - Expereo","publisher":"expereo.com","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"high","record_type":"Contradiction","requirement_codes":["concentration_risk_and_subcontractor_transparency","resilience_and_tested_recovery","incident_notification_support","exit_and_portability"],"named_customer":null,"segment":"Unspecified","named_product_or_service":"Expereo Managed SD-WAN / SASE / Global Internet (general service agreement)","service_family":"Multiple","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":null,"regulatory_regime":"Not stated","exact_supporting_wording":"Service Level Targets...are targets only. Expereo will provide reasonable efforts to achieve these targets. Service credits are not applicable and non-achievement of such stated targets by Expereo will not constitute a breach of the Agreement.","reviewer_summary":"Expereo's standard terms describe service levels as non-binding targets with no service credits, place the duty to report faults on the customer within 30 days, limit aggregate liability to 500,000 euros a year, and permit Expereo to subcontract or assign the agreement to any affiliate or third party without customer consent.","limitation_and_notes":"Shows there is no published RTO/RPO or guaranteed resilience commitment, no provider-to-customer incident notification commitment, no defined data export/exit process, and no restriction on subcontracting; it does not itself say a regulatory regime applies. This is standard-terms evidence, not proof any of these controls exist for a specific FS customer."},{"id":"src_financial_services_fin_257","workbook_source_id":"FIN-257","url":"https://www.expereo.com/expereo-one","title":"expereoOne platform - Total visibility & control through a single view","publisher":"expereo.com","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"high","record_type":"Financial services solution page","requirement_codes":["network_visibility_and_reporting"],"named_customer":null,"segment":"Unspecified","named_product_or_service":"expereoOne","service_family":"Supporting only","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":null,"regulatory_regime":"Not stated","exact_supporting_wording":"see the status of your Global Internet, Enhanced Internet, SASE and SD-WAN services","reviewer_summary":"expereoOne is described as a portal and API giving a single view of network performance, incidents, tickets, orders and invoices across Expereo's connectivity, SD-WAN and SASE services.","limitation_and_notes":"Generic product description with no financial services customer, no RBAC, change-management or audit-trail detail, and no data residency statement for the platform's own data."},{"id":"src_financial_services_fin_258","workbook_source_id":"FIN-258","url":"https://www.expereo.com/services/sase","title":"Sase - Expereo","publisher":"expereo.com","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"medium","record_type":"Financial services solution page","requirement_codes":["identity_and_zero_trust_access","cloud_and_saas_data_controls"],"named_customer":null,"segment":"Unspecified","named_product_or_service":"Expereo SASE","service_family":"SASE","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":null,"regulatory_regime":"Not stated","exact_supporting_wording":"Verifies the identity of users and devices and checks against business policy before granting access to applications and data","reviewer_summary":"The Expereo SASE page describes ZTNA, secure web gateway and CASB components covering identity verification, URL filtering, malware detection, DLP and cloud app discovery.","limitation_and_notes":"Generic architecture description with no financial services customer, no named vendor partner on this specific page, and no MFA/IdP or CASB/DLP outcome tied to a real deployment."},{"id":"src_financial_services_fin_259","workbook_source_id":"FIN-259","url":"https://www.expereo.com/resources/blogs/enhance-network-security-sd-wan","title":"Enhancing Network Security With SD-WAN - Expereo","publisher":"expereo.com","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"medium","record_type":"Financial services solution page","requirement_codes":["network_segmentation_and_zoning"],"named_customer":null,"segment":"Unspecified","named_product_or_service":"Expereo Managed SD-WAN (via SASE)","service_family":"SD-WAN","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":null,"regulatory_regime":"Not stated","exact_supporting_wording":"Network segmentation and Zero Trust Security reduce the attack surface and prevent lateral movement of threats within the network","reviewer_summary":"A provider blog states that network segmentation and zero trust security, delivered as part of SASE/SD-WAN, reduce attack surface and lateral movement.","limitation_and_notes":"General marketing blog, not financial services material; no mention of VRF, micro-segmentation mechanics, cardholder data or PCI scope."},{"id":"src_financial_services_fin_260","workbook_source_id":"FIN-260","url":"https://www.expereo.com/services/sd-wan","title":"Managed SD-WAN - Expereo","publisher":"expereo.com","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"medium","record_type":"Financial services solution page","requirement_codes":["data_centre_colocation_and_cloud_connectivity","network_visibility_and_reporting","remote_and_hybrid_workforce"],"named_customer":null,"segment":"Unspecified","named_product_or_service":"Expereo Managed SD-WAN","service_family":"SD-WAN","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":null,"regulatory_regime":"Not stated","exact_supporting_wording":"optimized user experience for all your employees, no matter where they work","reviewer_summary":"Expereo describes Managed SD-WAN as cloud-centric, optimising traffic to SaaS applications and giving real-time analytics of service performance for employees regardless of location.","limitation_and_notes":"No named financial customer, no explicit data centre or colocation on-ramp list, and no detail on how remote/hybrid access is secured for regulated staff such as advisers or traders."},{"id":"src_financial_services_fin_261","workbook_source_id":"FIN-261","url":"https://www.expereo.com/support","title":"Support - Expereo","publisher":"expereo.com","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"medium","record_type":"Financial services solution page","requirement_codes":["managed_operations_and_soc","north_america_delivery","uk_delivery"],"named_customer":null,"segment":"Unspecified","named_product_or_service":"Expereo (support operations)","service_family":"Supporting only","estate":null,"countries_or_regions":"US, South America, Europe, Middle East, Asia","ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":null,"regulatory_regime":"Not stated","exact_supporting_wording":"Our global Customer Support Team and Network Operation Centers (NOC), operate on a 'follow-the-sun' basis to ensure 24/7 support is available when you need it.","reviewer_summary":"Expereo operates 24/7 follow-the-sun Network Operation Centres and regional phone support covering the US, South America, Europe, the Middle East and Asia.","limitation_and_notes":"Describes a Network Operations Centre, not a Security Operations Centre, gives no financial services customer, and does not list a UK-specific phone line separately from 'Europe'."},{"id":"src_financial_services_fin_262","workbook_source_id":"FIN-262","url":"https://www.expereo.com/services/connect","title":"Connect - Expereo","publisher":"expereo.com","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"medium","record_type":"Financial services solution page","requirement_codes":["global_delivery"],"named_customer":null,"segment":"Unspecified","named_product_or_service":"Expereo Global Internet","service_family":"Not relevant","estate":null,"countries_or_regions":"Up to 190 countries","ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":null,"regulatory_regime":"Not stated","exact_supporting_wording":"We can connect in up to 190 countries with local experts and partners","reviewer_summary":"Expereo states its Connect services (Global Internet, Fixed Wireless Access, Low Earth Orbit) can reach up to 190 countries using local partners.","limitation_and_notes":"General global coverage claim with no PoP count, no financial services customer and no breakdown by region."},{"id":"src_financial_services_fin_263","workbook_source_id":"FIN-263","url":"https://www.expereo.com/contact","title":"Contact - Expereo","publisher":"expereo.com","publication_date":null,"checked_date":"2026-09-15","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"medium","record_type":"Other","requirement_codes":["north_america_delivery","uk_delivery"],"named_customer":null,"segment":"Unspecified","named_product_or_service":"Expereo (corporate offices)","service_family":"Not relevant","estate":null,"countries_or_regions":"Netherlands, UK, USA, UAE, Singapore, Argentina, Brazil, Poland, Philippines, Spain, France","ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":null,"regulatory_regime":"Not stated","exact_supporting_wording":"Corporate offices are listed in the UK and the US; no Canadian office is listed on this page.","reviewer_summary":"Expereo lists a London, UK office and a Reston, Virginia, USA office among its eleven listed corporate office locations; no Canadian office is listed.","limitation_and_notes":"Quoted wording not found on the page in the 2026-09-12 check (Address text present but split across separate lines, not as one continuous string as quoted.). Re-quote before accepting. Confirms corporate office presence in the UK and US only, not network PoPs, data centres or named UK/US financial services customers, and shows no Canadian office. [2026-09-15 Harry review] Verified live 2026-09-15 (paraphrased per the checker's note - office addresses render as separate lines, not one continuous sentence, so no single verbatim sentence exists to quote). Confirms UK/US corporate presence only - not network PoPs or data centres, and explicitly no Canadian office, so this cannot support Canada delivery and only weakly supports UK/North America delivery as Partial."},{"id":"src_financial_services_fin_251","workbook_source_id":"FIN-251","url":"https://www.expereo.com/resources/case-studies","title":"Case Studies | Expereo","publisher":"expereo.com","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"rejected","reviewer_confidence":"high","record_type":"Other","requirement_codes":[],"named_customer":null,"segment":"Unspecified","named_product_or_service":"Expereo (general)","service_family":"Not relevant","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":null,"regulatory_regime":"Not stated","exact_supporting_wording":"How Heras delivered reliable connectivity across 5 countries","reviewer_summary":"Expereo's case studies index lists 12 customer stories (Heras, Kramp, LP Building Solutions, Socomec, Bilfinger, Schoeller Allibert and others), none of which are banks, insurers, payment firms or asset managers.","limitation_and_notes":"Does not prove any financial services capability; no named financial institution appears anywhere in the case study index."},{"id":"src_financial_services_fin_252","workbook_source_id":"FIN-252","url":"https://www.expereo.com","title":"Faster to the future - Expereo","publisher":"expereo.com","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"rejected","reviewer_confidence":"high","record_type":"Other","requirement_codes":[],"named_customer":null,"segment":"Unspecified","named_product_or_service":"Expereo (general)","service_family":"Not relevant","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":null,"regulatory_regime":"Not stated","exact_supporting_wording":"Connect, Enhance, Secure, expereoOne","reviewer_summary":"The main site navigation has no Industries or Financial Services section and no dedicated trust/security/compliance hub; only generic Privacy, Cookies, Terms and Modern Slavery links appear.","limitation_and_notes":"Confirms absence of a financial services vertical page and of a dedicated trust/compliance centre on the main site; proves nothing about any capability directly."},{"id":"src_financial_services_fin_253","workbook_source_id":"FIN-253","url":"https://www.expereo.com/resources/press-releases/expereo-and-cato-networks-collaborate-to-set-new-standard-for-global-enterprise-connectivity","title":"Expereo and Cato Networks Announce Collaboration","publisher":"expereo.com","publication_date":"2026-02-04","checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"rejected","reviewer_confidence":"high","record_type":"Other","requirement_codes":[],"named_customer":null,"segment":"Unspecified","named_product_or_service":"Expereo SASE (with Cato Networks)","service_family":"SASE","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":null,"regulatory_regime":"Not stated","exact_supporting_wording":"Direct on-ramps from Expereo's underlay to Cato's global private backbone, to deliver lower latency, higher reliability","reviewer_summary":"Expereo announced a partnership with Cato Networks to deliver managed SASE combining Expereo's global internet underlay with Cato's SASE overlay, targeted at medium to large multinational enterprises.","limitation_and_notes":"Confirms the named Cato SASE partnership but names no financial institution, no regulatory regime and no specific capability fact (e.g. segmentation, ZTNA detail, SLA); marketing-level partnership announcement only."},{"id":"src_financial_services_fin_254","workbook_source_id":"FIN-254","url":"https://www.expereo.com/privacy-policy","title":"Privacy Policy - Expereo","publisher":"expereo.com","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"rejected","reviewer_confidence":"medium","record_type":"Other","requirement_codes":[],"named_customer":null,"segment":"Unspecified","named_product_or_service":"Expereo (corporate privacy policy)","service_family":"Not relevant","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":"GDPR","regulatory_regime":"EU","exact_supporting_wording":"Expereo processes your personal data solely for internal purposes and does not give or sale any of your personal data to third parties.","reviewer_summary":"Expereo's website privacy policy references GDPR and Dutch law and states it does not sell personal data to third parties, but does not state data storage locations, retention periods, sub-processor names or encryption methods.","limitation_and_notes":"Covers website/marketing personal data, not the SD-WAN/SASE service's management-plane or log data; no data residency, retention or sub-processor detail is given, so it cannot prove columns 9, 11 or 18."},{"id":"src_financial_services_fin_256","workbook_source_id":"FIN-256","url":"https://www.expereo.com/esg","title":"Our ESG Practices To Make The World Better | Expereo","publisher":"expereo.com","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"rejected","reviewer_confidence":"medium","record_type":"Compliance attestation or statement","requirement_codes":[],"named_customer":null,"segment":"Unspecified","named_product_or_service":"Expereo (corporate)","service_family":"Not relevant","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":"ISO 27001","regulatory_regime":"Not stated","exact_supporting_wording":"we are proud to be ISO 27001 certified","reviewer_summary":"Expereo states on its ESG page that it is ISO 27001 certified and that staff are trained on cybersecurity and data protection; no SOC 2 or PCI DSS certification is mentioned anywhere on this page.","limitation_and_notes":"The ISO 27001 claim is a corporate-wide statement not tied to a named product (Managed SD-WAN, SASE or expereoOne) and gives no scope statement, certificate reference or audit date, so per the grading rules it cannot prove any of the named-service documentation columns or the regulatory columns."}]},{"slug":"forcepoint","name":"Forcepoint","marketplace_url":"https://netify.co.uk/marketplace/forcepoint/","research_status":"complete","overall_confidence":"low","fit_conclusion":"Forcepoint's public evidence for financial services is concentrated in data-loss-prevention and data-security-posture case studies (Vakifbank in Turkey, Fedbank in India, HDI Seguros in Brazil, an anonymised Middle East bank, FBD Insurance in Ireland and UCI in Spain), none of which names Forcepoint SD-WAN or Forcepoint ONE SASE as the deployed service. The strongest named customer is VAKIFBANK, a large Turkish bank using Forcepoint DLP at scale across 17,000 endpoints for GDPR and KVKK compliance. Cloud and SaaS data controls (DLP/CASB) is the only column reaching Proven status, based on named FS institutions. No UK, US or Canadian named financial institution was found, and none of the specific regulatory regimes tracked here (FCA/PRA, DORA, FFIEC/GLBA/NYDFS/SEC, OSFI) is connected to a named Forcepoint service anywhere in the pages opened. Connectivity, resilience, segmentation, identity, logging-retention, incident-notification and exit-portability columns are all unevidenced for the named SD-WAN/SASE product line, so this evidence base does not currently support Forcepoint ONE or Secure SD-WAN as a proven fit for UK or North American FS operational-resilience requirements.","gaps_and_unknowns":"No UK or North American named financial institution case study was found for any Forcepoint product, so UK delivery, North America delivery, FCA/PRA and NYDFS/GLBA/FFIEC/SEC columns are all unevidenced; a named SD-WAN or Forcepoint ONE deployment at a UK or US bank would close this. Forcepoint ONE's data residency, log retention period, SLA/uptime commitment and incident-notification timeline could not be located on any reachable page (the datasheet, SLA page and data-residency help page all returned 404), so these would need a directly-fetchable trust or product document. DORA, OSFI and SWIFT CSP alignment are entirely unevidenced and would require a dedicated compliance statement or an EU/Canadian named FS customer referencing those regimes.","reviewed_by":"Harry Yelland","reviewed_date":"2026-09-14","source_count":20,"accepted_source_count":9,"requirements":[{"code":"branch_and_office_connectivity","label":"Branch and office connectivity","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"trading_and_low_latency_connectivity","label":"Trading and low-latency connectivity","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"data_centre_colocation_and_cloud_connectivity","label":"Data-centre, colocation and cloud connectivity","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"resilience_and_tested_recovery","label":"Resilience and tested recovery","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"network_segmentation_and_zoning","label":"Network segmentation and zoning","state":"partial","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"payment_and_cardholder_data_segmentation","label":"Payment and cardholder data segmentation","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"third_party_and_outsourced_access","label":"Third-party and outsourced access","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"remote_and_hybrid_workforce","label":"Remote and hybrid workforce","state":"partial","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"data_residency_and_sovereignty","label":"Data residency and sovereignty","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"encryption_and_key_management","label":"Encryption and key management","state":"partial","evidence_source_ids":["src_financial_services_fin_267"],"verified_date":"2026-09-14"},{"code":"logging_audit_and_evidence_retention","label":"Logging, audit and evidence retention","state":"partial","evidence_source_ids":["src_financial_services_fin_531","src_financial_services_fin_532"],"verified_date":"2026-09-14"},{"code":"identity_and_zero_trust_access","label":"Identity and zero trust access","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"cloud_and_saas_data_controls","label":"Cloud and SaaS data controls","state":"proven","evidence_source_ids":["src_financial_services_fin_265","src_financial_services_fin_276","src_financial_services_fin_531","src_financial_services_fin_532"],"verified_date":"2026-09-14"},{"code":"managed_operations_and_soc","label":"Managed operations and SOC","state":"not_found","evidence_source_ids":["src_financial_services_fs_037"],"verified_date":"2026-09-14"},{"code":"network_visibility_and_reporting","label":"Network visibility and reporting","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"change_control_and_configuration_governance","label":"Change control and configuration governance","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"incident_notification_support","label":"Incident notification support","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"concentration_risk_and_subcontractor_transparency","label":"Concentration risk and subcontractor transparency","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"exit_and_portability","label":"Exit and portability","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"uk_regulatory_alignment_fca_and_pra","label":"UK regulatory alignment (FCA and PRA)","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"eu_dora_alignment","label":"EU DORA alignment","state":"partial","evidence_source_ids":["src_financial_services_fin_516"],"verified_date":"2026-09-14"},{"code":"us_regulatory_alignment_ffiec_glba_nydfs_sec","label":"US regulatory alignment (FFIEC, GLBA, NYDFS, SEC)","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"canada_regulatory_alignment_osfi","label":"Canada regulatory alignment (OSFI)","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"pci_dss_alignment","label":"PCI DSS alignment","state":"partial","evidence_source_ids":["src_financial_services_fin_273"],"verified_date":"2026-09-14"},{"code":"swift_csp_alignment","label":"SWIFT CSP alignment","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"uk_delivery","label":"UK delivery","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"north_america_delivery","label":"North America delivery","state":"not_found","evidence_source_ids":[],"verified_date":"2026-09-14"},{"code":"global_delivery","label":"Global delivery","state":"partial","evidence_source_ids":[],"verified_date":"2026-09-14"}],"sources":[{"id":"src_financial_services_fin_265","workbook_source_id":"FIN-265","url":"https://www.forcepoint.com/customer-stories/vakifbank","title":"VAKIFBANK Customer Story | Forcepoint","publisher":"forcepoint.com","publication_date":"2022-06-07","checked_date":"2026-09-12","source_ownership":"customer_authored","decision":"accepted","reviewer_confidence":"high","record_type":"Named customer case study","requirement_codes":["cloud_and_saas_data_controls"],"named_customer":"VAKIFBANK","segment":"Retail banking","named_product_or_service":"Forcepoint DLP","service_family":"Supporting only","estate":"900+ branches; 17,000 endpoint agents","countries_or_regions":"Turkey, with international offices in the US, Qatar, Bahrain and Austria","ot_or_production_environment":null,"measured_or_stated_outcome":"Blocked 4,000 incidents within the first three months; classified or fingerprinted nearly 20 million files","industrial_standard_or_regulation":"GDPR; KVKK","regulatory_regime":"Not stated","exact_supporting_wording":"VAKIFBANK blocked 4,000 incidents within the first three months and now manages nearly 50 policies.","reviewer_summary":"VAKIFBANK, Turkey's second-largest bank, deployed Forcepoint DLP across 17,000 endpoints to protect customer PII and financial information and to meet GDPR and KVKK requirements.","limitation_and_notes":"This is a DLP/data-security deployment, not a named SD-WAN or SASE service, so it does not prove branch connectivity, segmentation or any of the North American/UK/EU regulator-specific columns; Turkey is not one of the schema's tracked regimes."},{"id":"src_financial_services_fin_267","workbook_source_id":"FIN-267","url":"https://trust.forcepoint.com/","title":"Forcepoint Trust Center","publisher":"trust.forcepoint.com","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"medium","record_type":"Compliance attestation or statement","requirement_codes":["encryption_and_key_management"],"named_customer":null,"segment":"Unspecified","named_product_or_service":"Forcepoint ONE (FONE); Cloud DLP; Cloud DSPM; Cloud Web","service_family":"Multiple","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":"ISO/IEC 27001:2022; SOC 2 Type 2; FIPS 140-3","regulatory_regime":"Not stated","exact_supporting_wording":"SOC 2, Type 2 Report - Forcepoint ONE (FONE)","reviewer_summary":"Forcepoint's trust centre lists a SOC 2 Type 2 report specifically naming Forcepoint ONE, alongside organisation-wide ISO/IEC 27001:2022, 27017, 27018 certificates and a FIPS 140-3 listing, with detailed documents gated behind an access request.","limitation_and_notes":"FIPS 140-3 and the ISO certificates are listed at organisation level rather than tied to a named product on this page, and no data residency, retention period or SLA figures are disclosed; the underlying reports were not accessible without a gated request."},{"id":"src_financial_services_fs_037","workbook_source_id":"FIN-269","url":"https://www.forcepoint.com/solutions/industry/financial-services","title":"Forcepoint cybersecurity solutions for banks (Financial Services industry page)","publisher":"forcepoint.com","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"medium","record_type":"Financial services solution page","requirement_codes":["logging_audit_and_evidence_retention"],"named_customer":null,"segment":"Multiple","named_product_or_service":"Forcepoint AI Data Security (DLP, DSPM, DDR, CASB, NGFW)","service_family":"Multiple","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":null,"regulatory_regime":"Not stated","exact_supporting_wording":"Speed reporting and audits for national and industry-specific regulations","reviewer_summary":"Forcepoint's financial services industry page names Fedbank, UCI and Vakifbank as case studies and lists AI Data Security, DLP, DSPM, DDR, CASB and NGFW products, but does not name a specific regulation (no DORA, FCA, GLBA, NYDFS, OSFI or SWIFT reference) and includes no SD-WAN/SASE connectivity content.","limitation_and_notes":"Generic financial services solutions page; per the grading rules this is Partial at most and is used here only as the index linking to the three named case studies, not as standalone proof of any column. [2026-09-15, capability assigned per Robert's check] Directly describes \"speed reporting and audits for national and industry-specific regulations.\""},{"id":"src_financial_services_fin_271","workbook_source_id":"FIN-271","url":"https://www.forcepoint.com/customer-stories/fbd-insurance","title":"FBD Insurance Customer Story | Forcepoint","publisher":"forcepoint.com","publication_date":"2025-10-13","checked_date":"2026-09-15","source_ownership":"customer_authored","decision":"accepted","reviewer_confidence":"medium","record_type":"Named customer case study","requirement_codes":["cloud_and_saas_data_controls"],"named_customer":"FBD Insurance","segment":"Insurance","named_product_or_service":"Forcepoint DSPM; Forcepoint DDR","service_family":"Supporting only","estate":null,"countries_or_regions":"Ireland","ot_or_production_environment":null,"measured_or_stated_outcome":"Reduced alert fatigue and improved mean time to detect and respond","industrial_standard_or_regulation":"GDPR","regulatory_regime":"EU","exact_supporting_wording":"It's allowed us really to pinpoint what is the critical data we must manage, what we must lock down.","reviewer_summary":"FBD Insurance, an Irish general insurer, deployed Forcepoint DSPM and DDR to classify sensitive policyholder and claims data and support GDPR compliance reporting.","limitation_and_notes":"Quoted wording not found on the page in the 2026-09-12 check (Actual page text: 'It's allowed us really to pinpoint what is the critical data we must manage, what we must lock down.' - differs from quoted text.). Re-quote before accepting. No verbatim wording obtained on the page ties this deployment to a specific log retention period, audit-trail export or DORA; the case is EU/Ireland but concerns data classification, not SD-WAN/SASE connectivity or a named regulator regime beyond GDPR. [2026-09-15 Harry review] Re-quoted using the exact sentence the checker found on the live page. This is about data classification, not SD-WAN/SASE connectivity, and does not name a log-retention period, audit-trail export, or DORA - capability claims beyond general sector-fit are not supported by this source. [2026-09-15, capability assigned per Robert's check - WEAK FIT, flagged for review] FBD Insurance quote about data classification (\"what is the critical data we must manage, what we must lock down\") - closest capability fit but does not name a specific mechanism, retention period or regulation."},{"id":"src_financial_services_fin_273","workbook_source_id":"FIN-273","url":"https://www.forcepoint.com/customer-stories/middle-east-bank","title":"Middle East Bank Customer Story | Forcepoint","publisher":"forcepoint.com","publication_date":"2026-01-12","checked_date":"2026-09-12","source_ownership":"customer_authored","decision":"accepted","reviewer_confidence":"medium","record_type":"Named customer case study","requirement_codes":["pci_dss_alignment"],"named_customer":null,"segment":"Retail banking","named_product_or_service":"Forcepoint Data Loss Prevention Suite (IP Protection); Forcepoint DSPM","service_family":"Supporting only","estate":"1,000 users","countries_or_regions":"Egypt (Middle East)","ot_or_production_environment":null,"measured_or_stated_outcome":"Enhanced data visibility and faster incident response; shift from reactive compliance to proactive governance","industrial_standard_or_regulation":"PCI DSS","regulatory_regime":"Not stated","exact_supporting_wording":"The bank's leadership recognized that the evolving regulatory landscape spanning central bank mandates, PCI DSS, and PII protection requires a proactive and intelligent approach to data governance.","reviewer_summary":"An anonymised Egypt-headquartered bank deployed Forcepoint DLP Suite and DSPM for 1,000 users to address central bank, PCI DSS and PII data-governance requirements.","limitation_and_notes":"The institution is not named (described only as a leading Middle East bank headquartered in Egypt), so this is anonymised evidence; no PCI DSS Attestation of Compliance for the Forcepoint service itself is shown, and Egypt is outside the schema's tracked regimes."},{"id":"src_financial_services_fin_276","workbook_source_id":"FIN-276","url":"https://www.forcepoint.com/customer-stories/fedbank-financial-services-ltd","title":"Fedbank Financial Services Ltd (Fedfina) Customer Story | Forcepoint","publisher":"forcepoint.com","publication_date":"2020-03-16","checked_date":"2026-09-12","source_ownership":"customer_authored","decision":"accepted","reviewer_confidence":"high","record_type":"Named customer case study","requirement_codes":["cloud_and_saas_data_controls"],"named_customer":"Fedbank Financial Services Ltd (Fedfina)","segment":"Lending and consumer finance","named_product_or_service":"Forcepoint Web Security; Forcepoint DLP","service_family":"Supporting only","estate":"250+ gold loan branches; 300+ offices; 1,800+ employees; approx. 30,000 customers","countries_or_regions":"India","ot_or_production_environment":null,"measured_or_stated_outcome":"Blocked unwanted internet access; reduced policy application reflection time to 10-15 minutes","industrial_standard_or_regulation":"RBI (Reserve Bank of India) NBFC DLP mandate","regulatory_regime":"Not stated","exact_supporting_wording":"Besides, the regulatory mandate by Reserve Bank of India (RBI) also required NBFCs to install a Data Loss Prevention (DLP) system for data security.","reviewer_summary":"Fedbank Financial Services Ltd, an Indian NBFC with 250+ branches, deployed Forcepoint Web Security and DLP to meet an RBI mandate and to prevent data leakage.","limitation_and_notes":"The regulator named is India's RBI, which is outside the schema's tracked UK/EU/US/Canada regimes, so this does not support columns 20 to 23; the product is Web Security and DLP, not SD-WAN or SASE."},{"id":"src_financial_services_fin_516","workbook_source_id":"FIN-516","url":"https://www.forcepoint.com/sites/default/files/2025-01/EBA-guidance-forcepoint-eu-en.pdf","title":"Forcepoint EBA Guidance / Compliance Hub","publisher":"forcepoint.com","publication_date":null,"checked_date":"2026-09-15","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"medium","record_type":"Compliance attestation or statement","requirement_codes":["eu_dora_alignment"],"named_customer":null,"segment":"Unspecified","named_product_or_service":"Forcepoint ONE (SASE)","service_family":"SASE","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":"DORA (EBA guidance referenced)","regulatory_regime":"EU","exact_supporting_wording":"Discusses DORA's applicability and directs customers to the Forcepoint Trust Hub; the Compliance Hub separately lists an EU DORA compliance document alongside SOC 2 Type II and ISO Statement of Applicability access.","reviewer_summary":"Harry personally verified this live 2026-09-15. General DORA-awareness document referencing EBA guidance, not a named Forcepoint ONE contractual mapping or Article 30 terms - graded Partial, consistent with the document's own caveat that this needs contract-level confirmation.","limitation_and_notes":"Added 2026-09-15, Harry-verified. Awareness/guidance document rather than a contractual DORA mapping for the named SASE product."},{"id":"src_financial_services_fin_531","workbook_source_id":"FIN-531","url":"https://www.casestudies.com/company/forcepoint/case-study/bice-bank-adds-company-wide-value-with-dlp-and-casb","title":"Chilean Bank Gets Proactive on Data Security After Cyberattacks Rock Latin America (Banco BICE)","publisher":"casestudies.com","publication_date":null,"checked_date":"2026-09-15","source_ownership":"independent","decision":"accepted","reviewer_confidence":"medium","record_type":"Named customer case study","requirement_codes":["logging_audit_and_evidence_retention","cloud_and_saas_data_controls"],"named_customer":"Banco BICE","segment":"Retail banking","named_product_or_service":"Forcepoint CASB and Forcepoint DLP","service_family":"Not relevant","estate":null,"countries_or_regions":"Chile","ot_or_production_environment":null,"measured_or_stated_outcome":"Reduced leakage risk; controls aligned with daily business processes; stronger protection","industrial_standard_or_regulation":null,"regulatory_regime":"Not stated","exact_supporting_wording":"\"In July 2018 the bank adopted Forcepoint CASB and DLP and rolled out continuous internal training to create a human-centered, dynamic security model that anticipates incidents.\"","reviewer_summary":"Verified live 2026-09-15 (found independently via search; matches a candidate finding supplied separately). Banco BICE is a real, named Chilean corporate banking group. Product is CASB/DLP, not SD-WAN/SASE/SSE - correctly excluded from that field per evidence rule 4, supporting-only for data-control capabilities.","limitation_and_notes":"Added 2026-09-15. NGFW/DLP/CASB deployment, not SD-WAN/SASE. No specific regulation named on the page despite mentioning \"accelerated regulation\" generally."},{"id":"src_financial_services_fin_532","workbook_source_id":"FIN-532","url":"https://forcepoint.com/customer-stories/compartamos-banco","title":"Compartamos Banco Safeguards Data in Order to Better Serve its Customers","publisher":"forcepoint.com","publication_date":null,"checked_date":"2026-09-15","source_ownership":"provider_authored","decision":"accepted","reviewer_confidence":"high","record_type":"Named customer case study","requirement_codes":["logging_audit_and_evidence_retention","cloud_and_saas_data_controls"],"named_customer":"Compartamos Banco","segment":"Lending and consumer finance","named_product_or_service":"Forcepoint Hybrid Web Security with integrated DLP","service_family":"Not relevant","estate":"16,000 employees; 500+ offices; 2.5 million customers","countries_or_regions":"Mexico","ot_or_production_environment":null,"measured_or_stated_outcome":"Better monitoring and timely attack detection; IT role shifted from maintenance to value-added monitoring","industrial_standard_or_regulation":"National Banking and Securities Commission (CNBV); Federal Law of Protection of Data in Possession of Individuals (LFDPPP)","regulatory_regime":"Not stated","exact_supporting_wording":"\"The bank needed to comply with regulations including National Banking and Securities Commission (CNBV), Federal Law of Protection of Data in Possession of Individuals (LFDPPP), and international standards.\" - \"It changed the role of IT personnel from a maintenance and operational role to a monitoring role that allows adding value to the operation\" - Luis Felipe Rubalcava, Deputy Director of Communications and Security, Compartamos Banco.","reviewer_summary":"Verified live 2026-09-15, cross-checked across multiple Forcepoint locale mirrors for consistency. Compartamos Banco (Mexico's largest microfinance bank) is real and named, with a named executive quote. CNBV and LFDPPP are explicitly named regulations - stronger than initially reported (a candidate finding supplied separately said no regulation was named; the page does in fact name two). Mexico is outside the UK/EU/US/Canada regimes tracked by this workbook, so Regulatory regime stays Not stated despite the named regulations.","limitation_and_notes":"Added 2026-09-15. Web Security/DLP deployment, not SD-WAN/SASE. CNBV and LFDPPP are real named Mexican regulations but fall outside this workbook's tracked UK/EU/US/Canada regime columns."},{"id":"src_financial_services_fin_264","workbook_source_id":"FIN-264","url":"https://www.forcepoint.com/industry/financial-services","title":"Financial Services Cybersecurity | Forcepoint","publisher":"forcepoint.com","publication_date":"2022-03-29","checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"rejected","reviewer_confidence":"medium","record_type":"Financial services solution page","requirement_codes":[],"named_customer":null,"segment":"Multiple","named_product_or_service":"Forcepoint AI Data Security (DLP, DSPM, DDR, CASB, NGFW)","service_family":"Multiple","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":null,"regulatory_regime":"Not stated","exact_supporting_wording":"Your customers rely on you to keep their financial information safe.","reviewer_summary":"This is a generic Forcepoint financial services marketing page naming three data-security customer stories (Fedbank, UCI, Vakifbank) but stating no specific regulation itself.","limitation_and_notes":"Duplicate of the same content at forcepoint.com/solutions/industry/financial-services; a generic industry page with no named institution or regulation on the page itself, so it is not usable as direct proof of any single column and is superseded by the solutions URL used below."},{"id":"src_financial_services_fin_266","workbook_source_id":"FIN-266","url":"https://www.forcepoint.com/","title":"Forcepoint - Cybersecurity Solutions","publisher":"forcepoint.com","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"rejected","reviewer_confidence":"low","record_type":"Other","requirement_codes":[],"named_customer":null,"segment":"Unspecified","named_product_or_service":"Forcepoint ONE; DLP; NGFW; SD-WAN; CASB","service_family":"Not relevant","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":null,"regulatory_regime":"Not stated","exact_supporting_wording":"Forcepoint Trust Center","reviewer_summary":"Corporate homepage used only to locate navigation links to the trust centre, compliance hub, industry and product pages; carries no evidentiary claims itself.","limitation_and_notes":"Navigation page only; used to find URLs, not as evidence for any of the 28 columns."},{"id":"src_financial_services_fin_268","workbook_source_id":"FIN-268","url":"https://www.forcepoint.com/legal/forcepoint-compliance-hub","title":"Forcepoint Compliance Hub","publisher":"forcepoint.com","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"rejected","reviewer_confidence":"low","record_type":"Compliance attestation or statement","requirement_codes":[],"named_customer":null,"segment":"Unspecified","named_product_or_service":"Forcepoint (corporate)","service_family":"Not relevant","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":null,"regulatory_regime":"Not stated","exact_supporting_wording":"The Forcepoint Trust Center provides a centralized location to ask compliance and security questions and request access to our ISO Statement of Applicability and SOC 2 Type II certifications","reviewer_summary":"A hub page that points to the Trust Center for ISO and SOC 2 documentation without naming individual products, dates, or any FS-specific regulation.","limitation_and_notes":"No named service, product-specific certification, regulation (DORA, FCA, NYDFS, OSFI, SWIFT), data residency or SLA content; too generic to support any single column."},{"id":"src_financial_services_fs_038","workbook_source_id":"FIN-272","url":"https://www.forcepoint.com/customer-stories/hdi-seguros","title":"HDI Seguros customer story","publisher":"forcepoint.com","publication_date":null,"checked_date":"2026-09-15","source_ownership":"customer_authored","decision":"rejected","reviewer_confidence":"medium","record_type":"Named customer case study","requirement_codes":["cloud_and_saas_data_controls"],"named_customer":"HDI Seguros","segment":"Insurance","named_product_or_service":"Forcepoint DLP","service_family":"Supporting only","estate":null,"countries_or_regions":"Brazil (Latin America)","ot_or_production_environment":null,"measured_or_stated_outcome":"Automated data classification reducing false positives; rule enforcement across email and external drives","industrial_standard_or_regulation":null,"regulatory_regime":"Not stated","exact_supporting_wording":"Forcepoint DLP (primary deployment); Forcepoint Web Security and Forcepoint CASB under evaluation","reviewer_summary":"HDI Seguros, a Latin American insurer headquartered in Brazil, deployed Forcepoint DLP as its primary data-protection control, with Web Security and CASB under evaluation.","limitation_and_notes":"Quoted wording not found on the page in the 2026-09-12 check (Exact quoted structure not present; page separately mentions DLP deployment and Web Security/CASB under evaluation but not phrased this way.). Re-quote before accepting. CASB is described as under evaluation, not deployed; no specific regulation is named and Brazil is outside the schema's tracked UK/EU/US/Canada regimes. [2026-09-15 Harry review] Rejected 2026-09-15: the checker found CASB/Web Security is described on the page as \"under evaluation\", not deployed. A capability that a named customer is still evaluating is not evidence that the capability is delivered - Cloud and SaaS data controls cannot be supported by this source for HDI Seguros."},{"id":"src_financial_services_fin_274","workbook_source_id":"FIN-274","url":"https://www.forcepoint.com/customer-stories/uci","title":"UCI Customer Story | Forcepoint","publisher":"forcepoint.com","publication_date":"2019-07-16","checked_date":"2026-09-12","source_ownership":"customer_authored","decision":"rejected","reviewer_confidence":"medium","record_type":"Named customer case study","requirement_codes":["remote_and_hybrid_workforce"],"named_customer":"UCI","segment":"Lending and consumer finance","named_product_or_service":"Forcepoint NGFW; Forcepoint cloud proxy","service_family":"Supporting only","estate":null,"countries_or_regions":"Spain, across four European countries","ot_or_production_environment":null,"measured_or_stated_outcome":"Decreased downtime and reduced costs through reliable connectivity","industrial_standard_or_regulation":"GDPR","regulatory_regime":"EU","exact_supporting_wording":"Forcepoint NGFW firewalls help us protect our most valuable asset: customer information. Now the IT department is able to undertake new projects and bring greater value to the company.","reviewer_summary":"UCI, a Spain-based mortgage lender operating in four European countries, uses Forcepoint NGFW firewalls and a cloud proxy for consistent security policy and connectivity, driven by GDPR.","limitation_and_notes":"The named product is NGFW and a cloud proxy, not Forcepoint's SD-WAN or SASE (Forcepoint ONE) service, so this cannot be counted as SD-WAN/SASE branch connectivity evidence under the grading rules."},{"id":"src_financial_services_fin_277","workbook_source_id":"FIN-277","url":"https://www.forcepoint.com/product/dlp-data-loss-prevention","title":"Forcepoint DLP","publisher":"forcepoint.com","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"rejected","reviewer_confidence":"low","record_type":"Financial services solution page","requirement_codes":[],"named_customer":null,"segment":"Unspecified","named_product_or_service":"Forcepoint DLP","service_family":"Supporting only","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":null,"regulatory_regime":"Not stated","exact_supporting_wording":"If your organization handles Personally Identifiable Information (PII), Protected Health Information (PHI), Payment Card Information (PCI)","reviewer_summary":"Forcepoint's DLP product page mentions payment card information as a data type it can classify, and shows Visa and American Express customer logos, but names no FS case study, PCI DSS attestation or cardholder-data segmentation detail.","limitation_and_notes":"Customer logos (Visa, American Express) are not linked to any case study or quote and cannot be treated as a named deployment; no PCI DSS certification, encryption or FIPS detail is given on this page."},{"id":"src_financial_services_fin_278","workbook_source_id":"FIN-278","url":"https://www.forcepoint.com/resources/ebooks/finserve-data-security-reinvent-risk-compliance","title":"Financial Services Data Security 2.0: Reinventing Risk and Compliance","publisher":"forcepoint.com","publication_date":"2025-02-18","checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"rejected","reviewer_confidence":"low","record_type":"Financial services solution page","requirement_codes":[],"named_customer":null,"segment":"Unspecified","named_product_or_service":"Forcepoint (general)","service_family":"Not relevant","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":null,"regulatory_regime":"Not stated","exact_supporting_wording":"Financial Services Data Security 2.0: Reinventing Risk and Compliance","reviewer_summary":"A gated ebook landing page with no DORA, FCA, PRA, GLBA, NYDFS, SEC, OSFI or SWIFT CSP reference in the accessible page content.","limitation_and_notes":"Only the landing page was accessible, not the full ebook text; no regulation named on the page itself, so it cannot be cited for any regulatory column."},{"id":"src_financial_services_fin_279","workbook_source_id":"FIN-279","url":"https://www.forcepoint.com/product/forcepoint-one","title":"Forcepoint ONE","publisher":"forcepoint.com","publication_date":null,"checked_date":"2026-09-12","source_ownership":"provider_authored","decision":"rejected","reviewer_confidence":"low","record_type":"Financial services solution page","requirement_codes":[],"named_customer":null,"segment":"Unspecified","named_product_or_service":"Forcepoint ONE","service_family":"SASE","estate":null,"countries_or_regions":null,"ot_or_production_environment":null,"measured_or_stated_outcome":null,"industrial_standard_or_regulation":null,"regulatory_regime":"Not stated","exact_supporting_wording":"Forcepoint Cloud App Security","reviewer_summary":"The Forcepoint ONE product page describes DLP, DSPM and DDR capabilities but contains no data residency, SLA/uptime, encryption, FIPS or ZTNA detail, and no financial services content beyond a navigation link.","limitation_and_notes":"No data residency, retention, SLA, FIPS or ZTNA detail found on this page for Forcepoint ONE despite it being the named SASE product; a dedicated datasheet or admin guide would be needed and none was reachable."}]}]},"live_evidence_source":"https://netify.co.uk/sase/best/sd-wan-sase-providers-for-financial-services/data.json","live_evidence":{"page":"https://netify.co.uk/sase/best/sd-wan-sase-providers-for-financial-services","title":"Best SD-WAN and SASE providers for Financial services","description":"Explore published provider evidence for a financial-services project. Confirm each requirement, deployment scope and supplier claim against your own procurement needs; directory inclusion is not a recommendation or a compliance assurance. Typical drivers in this sector include protecting cardholder data for PCI-DSS, prioritising latency-sensitive traffic (such as trading feeds, SWIFT messaging and core banking ledgers), segmenting ATMs, branch tellers, corporate office traffic and remote wealth management devices, and connectivity to AWS, Azure or Google Cloud without adding policy fragmentation or backhaul delay.","publisher":"Netify Group Limited","last_reviewed":"2026-07-29","criteria":{"sector":"financial_services","shortlist_size":10},"interactive_equivalent":"https://netify.co.uk/sase/shortlist/?n=10&s=financial_services","ordered_by":"evidence_coverage_pct desc, provider name asc, slug asc","introduction":"Explore published provider evidence for a financial-services project. Confirm each requirement, deployment scope and supplier claim against your own procurement needs; directory inclusion is not a recommendation or a compliance assurance. Typical drivers in this sector include protecting cardholder data for PCI-DSS, prioritising latency-sensitive traffic (such as trading feeds, SWIFT messaging and core banking ledgers), segmenting ATMs, branch tellers, corporate office traffic and remote wealth management devices, and connectivity to AWS, Azure or Google Cloud without adding policy fragmentation or backhaul delay.","result":{"contract_version":"public-provider-evidence/4.0.0","requires_publication":false,"ordered_by":"evidence_coverage_pct desc, provider name asc, slug asc","input":{"service_model":"any","required_features":[],"preferred_features":[],"required_regions":[],"preferred_regions":[],"required_clouds":[],"ai_requirements":[],"disaster_recovery_required":false,"max_deployment_speed":"any","weight_preset":"balanced","shortlist_size":10,"uk_provider_only":false,"sector":"financial_services","organisation_size":"any","intent":"none"},"criteria_summary":"Sector: Financial services. Scoring profile: balanced.","shortlist":[{"slug":"cato-networks","name":"Cato Networks","website":"https://www.catonetworks.com","category":"Cloud-native SASE / SD-WAN platform","product_focus":"Cato SASE Cloud, Cato Socket, private backbone","cost_model":"Quote-based subscription; typically site/user/bandwidth/security bundle based.","public_pricing_visibility":"quote_based","value_tier":"mid","uk_delivery":"uk_pops_partner","uk_basis":"No UK HQ (Israel and US). Delivers in the UK from London and Manchester PoPs; contract direct or through UK partners including Netify routes.","capabilities":{"f01_fully_managed_service":"yes","f02_diy_self_managed_model":"yes","f03_co_managed_service":"yes","f04_multi_tenant_msp_white_label_support":"partial","f05_professional_services_and_migration_support":"partial","f06_last_mile_circuit_management":"partner_integrated","f07_lifecycle_management":"partial","f08_flexible_commercial_model":"yes","f09_encrypted_overlay_fabric":"yes","f10_dynamic_path_selection":"yes","f11_active_active_link_utilisation":"yes","f12_application_aware_routing":"yes","f13_qos_and_traffic_shaping":"not_confirmed","f14_packet_loss_remediation":"yes","f15_local_internet_breakout":"yes","f16_mpls_coexistence_and_migration":"yes","f17_cellular_and_5g_support":"not_confirmed","f18_cloud_on_ramp":"yes","f19_public_cloud_gateways":"yes","f20_private_pops_dedicated_pops":"yes","f21_private_global_backbone":"yes","f22_regional_breakout_and_data_residency":"yes","f23_multi_cloud_transit_fabric":"yes","f24_flexible_edge_form_factors":"not_confirmed","f25_high_availability_design":"partner_integrated","f26_sla_backed_service_fabric":"yes","f27_integrated_next_generation_firewall":"yes","f28_full_sase_platform":"yes","f29_sse_ecosystem_integration":"yes","f30_zero_trust_network_access":"yes","f31_secure_web_gateway":"yes","f32_casb_capability":"yes","f33_data_loss_prevention":"yes","f34_remote_user_access":"yes","f35_soc_siem_soar_integration":"yes","f36_centralised_orchestration":"yes","f37_customer_portal_and_rbac":"yes","f38_observability_and_digital_experience_monitoring":"yes","f39_apis_and_automation":"yes","f40_managed_service_assurance":"yes"},"deployment_speed":"hours","regions":{"uk_ireland":"yes","europe":"yes","north_america":"yes","asia_pacific":"yes","middle_east_africa":"yes","latin_america":"yes","china_mainland":"yes"},"supported_clouds":{"aws":"yes","azure":"yes","gcp":"yes","oracle_cloud":"partial","alibaba_cloud":"partial"},"ai_capability":{"ai_driven_operations":"yes","ai_security_analytics":"yes","ai_assistant":"partial","note":"Real-time ML threat prevention, autonomous policy recommendations and built-in DEM."},"resilience":{"disaster_recovery":"yes","note":"Self-healing backbone; sockets fail over between PoPs automatically with no customer action."},"sectors":{"healthcare":"yes","financial_services":"yes","retail_ecommerce":"yes","manufacturing":"yes","energy_utilities":"yes","government_public_sector":"partial","education":"yes","transport_logistics":"yes","professional_services":"yes","hospitality_leisure":"partial"},"organisation_fit":{"large_global_enterprise":"yes","mid_market":"yes","small_business":"not_confirmed"},"pricing_units":["per_site","per_user","per_bandwidth","custom_quote"],"identity_providers":{"entra_id":"yes","okta":"yes","ping":"yes","google_workspace":"yes"},"device_posture":"yes","agent_platforms":{"windows":"yes","macos":"yes","ios":"yes","android":"yes","linux":"partial","chromeos":"partial","agentless":"yes"},"pop_count":100,"sla_availability_pct":99.999,"support_model":{"follow_the_sun_24x7":"yes","uk_support_desk":"partial","named_tam":"partial"},"logging":{"siem_export":"yes","log_retention_days":null},"marketplace_url":"https://netify.co.uk/marketplace/cato-networks/","shortlist_summary":"Cato Networks is frequently scored by us at Netify as being one of the easiest platforms to actually use, and they’re often considered a more integrated offering than most of the competition, which is primarily down to building their SASE solution from the ground up rather than bolting security onto an existing networking product, or the other way round.","key_differentiators":["Single converged platform with no policy or log fragmentation across SD-WAN and security functions.","100+ PoP global private backbone reduces internet variability and provides predictable performance for SaaS-heavy traffic.","Strong story for organisations consolidating multiple point solutions onto one operational platform."],"best_fit_for":["Mid-market and enterprise buyers consolidating SD-WAN and SASE on one platform from a single vendor.","Global organisations with SaaS-heavy traffic patterns that benefit from a private backbone.","Teams without dedicated security operations capacity who want a managed SASE experience."],"watch_outs":["Less suited to best-of-breed buyers wanting Zscaler or Netskope as the SSE layer.","Customer does not own the underlay; circuits sourced separately, so multi-supplier coordination remains.","Less mature than incumbents for very large multinational deployments with heavy legacy MPLS estates."],"evidence_coverage_pct":0.925,"last_verified":"2026-09-01","evidence_source_count":40,"independent_evidence_source_count":0,"position":1,"research_metrics":{"supported":32,"partial":3,"partner_delivered":2,"managed_service_dependent":0,"not_primary":0,"unconfirmed":3,"total":40,"reviewed":37,"completeness_percent":93,"completeness":0.925},"proven_evidence_count":32,"gaps":[]},{"slug":"cisco","name":"Cisco","website":"https://www.cisco.com/site/us/en/solutions/networking/sdwan/index.html","category":"SD-WAN / SASE technology vendor","product_focus":"Catalyst SD-WAN, Meraki MX, Cisco Secure Access","cost_model":"Quote-based subscription/licence + appliance/support; Meraki public SKUs via partners, enterprise pricing varies by platform and term.","public_pricing_visibility":"quote_based","value_tier":"mid","uk_delivery":"uk_pops_partner","uk_basis":"No UK HQ (US). Extensive UK channel; Catalyst and Meraki widely delivered as UK managed services.","capabilities":{"f01_fully_managed_service":"not_primary","f02_diy_self_managed_model":"yes","f03_co_managed_service":"partial","f04_multi_tenant_msp_white_label_support":"yes","f05_professional_services_and_migration_support":"partial","f06_last_mile_circuit_management":"partner_integrated","f07_lifecycle_management":"yes","f08_flexible_commercial_model":"yes","f09_encrypted_overlay_fabric":"yes","f10_dynamic_path_selection":"not_primary","f11_active_active_link_utilisation":"yes","f12_application_aware_routing":"yes","f13_qos_and_traffic_shaping":"yes","f14_packet_loss_remediation":"yes","f15_local_internet_breakout":"not_confirmed","f16_mpls_coexistence_and_migration":"yes","f17_cellular_and_5g_support":"yes","f18_cloud_on_ramp":"yes","f19_public_cloud_gateways":"not_confirmed","f20_private_pops_dedicated_pops":"not_confirmed","f21_private_global_backbone":"partial","f22_regional_breakout_and_data_residency":"yes","f23_multi_cloud_transit_fabric":"yes","f24_flexible_edge_form_factors":"not_confirmed","f25_high_availability_design":"yes","f26_sla_backed_service_fabric":"partial","f27_integrated_next_generation_firewall":"yes","f28_full_sase_platform":"yes","f29_sse_ecosystem_integration":"yes","f30_zero_trust_network_access":"yes","f31_secure_web_gateway":"yes","f32_casb_capability":"yes","f33_data_loss_prevention":"yes","f34_remote_user_access":"yes","f35_soc_siem_soar_integration":"yes","f36_centralised_orchestration":"yes","f37_customer_portal_and_rbac":"yes","f38_observability_and_digital_experience_monitoring":"yes","f39_apis_and_automation":"yes","f40_managed_service_assurance":"not_primary"},"deployment_speed":"weeks","regions":{"uk_ireland":"yes","europe":"yes","north_america":"yes","asia_pacific":"yes","middle_east_africa":"yes","latin_america":"yes","china_mainland":"partial"},"supported_clouds":{"aws":"yes","azure":"yes","gcp":"yes","oracle_cloud":"partial","alibaba_cloud":"not_confirmed"},"ai_capability":{"ai_driven_operations":"yes","ai_security_analytics":"yes","ai_assistant":"yes","note":"AI Assistant across Catalyst and Meraki dashboards; predictive path analytics; Talos-backed security AI."},"resilience":{"disaster_recovery":"yes","note":"Multi-region controllers, HA edge pairs and SSE redundancy via Cisco Secure Access."},"sectors":{"healthcare":"yes","financial_services":"yes","retail_ecommerce":"yes","manufacturing":"yes","energy_utilities":"partial","government_public_sector":"yes","education":"yes","transport_logistics":"yes","professional_services":"yes","hospitality_leisure":"yes"},"organisation_fit":{"large_global_enterprise":"yes","mid_market":"yes","small_business":"partial"},"pricing_units":["per_site","per_user","custom_quote"],"identity_providers":{"entra_id":"yes","okta":"yes","ping":"partial","google_workspace":"partial"},"device_posture":"yes","agent_platforms":{"windows":"yes","macos":"yes","ios":"partial","android":"partial","linux":"partial","chromeos":"not_confirmed","agentless":"partial"},"pop_count":null,"sla_availability_pct":99.999,"support_model":{"follow_the_sun_24x7":"yes","uk_support_desk":"partial","named_tam":"partial"},"logging":{"siem_export":"yes","log_retention_days":null},"marketplace_url":"https://netify.co.uk/marketplace/cisco/","shortlist_summary":"Cisco’s own materials describe SASE explicitly as ‘a journey - you can start with SD-WAN or SSE and converge over time’, which is a different pitch to Cato’s, Zscaler’s, Netskope’s or Palo Alto’s single-platform-from-day-one story. In practise, ‘Cisco SASE’ means choosing between Cisco Secure Access (cloud-delivered SSE, evolved from Cisco Umbrella), Cisco Catalyst SD-WAN (the enterprise-grade fabric, formerly Viptela) or Meraki SD-WAN (the simpler, cloud-first option), and Cisco Secure Connect (a turnkey bundle of Secure Access plus Meraki SD-WAN specifically).","key_differentiators":["Broadest platform portfolio in the category, covering Catalyst SD-WAN for enterprise WAN, Meraki MX for cloud-managed branch, and Cisco Secure Access for converged SASE delivery.","Cloud OnRamp provides automated optimisation paths for Microsoft 365, Salesforce, and major cloud providers, with native integration into the Cisco security stack.","Large global partner and integrator ecosystem reduces delivery risk for buyers wanting managed or co-managed delivery."],"best_fit_for":["Enterprises already standardised on Cisco networking who want platform consistency from LAN through WAN to security.","Multinational organisations needing strong vendor presence across regions and a deep partner channel.","Buyers prioritising single-vendor risk consolidation across networking and security."],"watch_outs":["Two distinct SD-WAN product lines (Catalyst and Meraki) means buyers should confirm which fits the target deployment profile and the longer-term roadmap.","Managed delivery is partner-led rather than first-party, so service quality varies meaningfully by integrator.","Private global backbone is not part of the platform; cloud transport relies on internet and partner gateways."],"evidence_coverage_pct":0.9,"last_verified":"2026-09-01","evidence_source_count":49,"independent_evidence_source_count":0,"position":2,"research_metrics":{"supported":28,"partial":4,"partner_delivered":1,"managed_service_dependent":0,"not_primary":3,"unconfirmed":4,"total":40,"reviewed":36,"completeness_percent":90,"completeness":0.9},"proven_evidence_count":28,"gaps":[]},{"slug":"netskope","name":"Netskope","website":"https://www.netskope.com","category":"SSE / SASE platform","product_focus":"Netskope One, Borderless WAN/Infiot heritage","cost_model":"Quote-based subscription; modules commonly priced by users, sites, traffic and security functions.","public_pricing_visibility":"quote_based","value_tier":"mid","uk_delivery":"uk_pops_partner","uk_basis":"No UK HQ (US). UK NewEdge presence; delivered direct or via UK security MSPs.","capabilities":{"f01_fully_managed_service":"managed_service_dependent","f02_diy_self_managed_model":"yes","f03_co_managed_service":"managed_service_dependent","f04_multi_tenant_msp_white_label_support":"partial","f05_professional_services_and_migration_support":"yes","f06_last_mile_circuit_management":"partner_integrated","f07_lifecycle_management":"partial","f08_flexible_commercial_model":"yes","f09_encrypted_overlay_fabric":"partial","f10_dynamic_path_selection":"yes","f11_active_active_link_utilisation":"partial","f12_application_aware_routing":"yes","f13_qos_and_traffic_shaping":"yes","f14_packet_loss_remediation":"yes","f15_local_internet_breakout":"yes","f16_mpls_coexistence_and_migration":"partial","f17_cellular_and_5g_support":"not_confirmed","f18_cloud_on_ramp":"yes","f19_public_cloud_gateways":"yes","f20_private_pops_dedicated_pops":"yes","f21_private_global_backbone":"not_confirmed","f22_regional_breakout_and_data_residency":"yes","f23_multi_cloud_transit_fabric":"yes","f24_flexible_edge_form_factors":"not_confirmed","f25_high_availability_design":"yes","f26_sla_backed_service_fabric":"yes","f27_integrated_next_generation_firewall":"yes","f28_full_sase_platform":"yes","f29_sse_ecosystem_integration":"yes","f30_zero_trust_network_access":"yes","f31_secure_web_gateway":"yes","f32_casb_capability":"yes","f33_data_loss_prevention":"yes","f34_remote_user_access":"yes","f35_soc_siem_soar_integration":"yes","f36_centralised_orchestration":"yes","f37_customer_portal_and_rbac":"yes","f38_observability_and_digital_experience_monitoring":"not_confirmed","f39_apis_and_automation":"yes","f40_managed_service_assurance":"partial"},"deployment_speed":"days","regions":{"uk_ireland":"yes","europe":"yes","north_america":"yes","asia_pacific":"yes","middle_east_africa":"not_confirmed","latin_america":"not_confirmed","china_mainland":"yes"},"supported_clouds":{"aws":"yes","azure":"yes","gcp":"yes","oracle_cloud":"partial","alibaba_cloud":"not_confirmed"},"ai_capability":{"ai_driven_operations":"partial","ai_security_analytics":"yes","ai_assistant":"partial","note":"SkopeAI for data and threat protection; UEBA analytics across users and apps."},"resilience":{"disaster_recovery":"yes","note":"NewEdge private cloud runs full compute in every region; localised failover."},"sectors":{"healthcare":"yes","financial_services":"yes","retail_ecommerce":"yes","manufacturing":"yes","energy_utilities":"yes","government_public_sector":"yes","education":"yes","transport_logistics":"not_confirmed","professional_services":"yes","hospitality_leisure":"partial"},"organisation_fit":{"large_global_enterprise":"yes","mid_market":"not_confirmed","small_business":"not_confirmed"},"pricing_units":["per_user","custom_quote"],"identity_providers":{"entra_id":"yes","okta":"yes","ping":"yes","google_workspace":"yes"},"device_posture":"yes","agent_platforms":{"windows":"yes","macos":"yes","ios":"yes","android":"yes","linux":"partial","chromeos":"partial","agentless":"yes"},"pop_count":120,"sla_availability_pct":99.999,"support_model":{"follow_the_sun_24x7":"yes","uk_support_desk":"partial","named_tam":"partial"},"logging":{"siem_export":"yes","log_retention_days":null},"marketplace_url":"https://netify.co.uk/marketplace/netskope/","shortlist_summary":"Netskope sits in an interesting middle ground between a pure security-first platform and a fully networked one: unlike the likes of Zscaler, it has invested in its own converged mesh network (NewEdge) and a purpose-built SD-WAN (Borderless SD-WAN, built on the 2022 Infiot acquisition), so the ‘security company bolting on networking’ story is a few years further along than Zscaler’s; unlike Cato, that network is built on peering and interconnects across 67 regions rather than an owned private backbone.","key_differentiators":["Strong CASB heritage; widely recognised as a leading SSE vendor for SaaS-heavy environments.","Borderless WAN (from the Infiot acquisition) extends Netskope into single-vendor SASE for buyers wanting both layers from one platform.","Detailed SaaS application visibility and policy controls."],"best_fit_for":["Enterprises with deep SaaS adoption where CASB and DLP are top procurement priorities.","Buyers comparing single-vendor SASE platforms after starting with SSE.","Organisations selecting Netskope SSE alongside a separate SD-WAN platform via partner integration."],"watch_outs":["Native SD-WAN (Borderless WAN) is newer than dedicated SD-WAN platforms; validate path selection and QoS depth in RFP.","Managed delivery is partner-led; first-party managed service is limited.","Premium pricing with modular structure; full SASE bundle costs can scale meaningfully with users and traffic."],"evidence_coverage_pct":0.9,"last_verified":"2026-09-01","evidence_source_count":45,"independent_evidence_source_count":0,"position":3,"research_metrics":{"supported":27,"partial":6,"partner_delivered":1,"managed_service_dependent":2,"not_primary":0,"unconfirmed":4,"total":40,"reviewed":36,"completeness_percent":90,"completeness":0.9},"proven_evidence_count":27,"gaps":[]},{"slug":"palo-alto-networks","name":"Palo Alto Networks Prisma SASE","website":"https://www.paloaltonetworks.com/sase","category":"SD-WAN / SASE technology vendor","product_focus":"Prisma SD-WAN, Prisma Access, ADEM","cost_model":"Quote-based subscriptions; appliance/ION and Prisma Access/SASE licensing typically priced by users, bandwidth, locations and term.","public_pricing_visibility":"quote_based","value_tier":"premium","uk_delivery":"uk_pops_partner","uk_basis":"No UK HQ (US). UK Prisma Access presence; delivered direct or via UK partners and carriers.","capabilities":{"f01_fully_managed_service":"managed_service_dependent","f02_diy_self_managed_model":"yes","f03_co_managed_service":"managed_service_dependent","f04_multi_tenant_msp_white_label_support":"partial","f05_professional_services_and_migration_support":"partner_integrated","f06_last_mile_circuit_management":"partner_integrated","f07_lifecycle_management":"partial","f08_flexible_commercial_model":"yes","f09_encrypted_overlay_fabric":"yes","f10_dynamic_path_selection":"yes","f11_active_active_link_utilisation":"yes","f12_application_aware_routing":"yes","f13_qos_and_traffic_shaping":"yes","f14_packet_loss_remediation":"yes","f15_local_internet_breakout":"yes","f16_mpls_coexistence_and_migration":"yes","f17_cellular_and_5g_support":"yes","f18_cloud_on_ramp":"yes","f19_public_cloud_gateways":"not_confirmed","f20_private_pops_dedicated_pops":"yes","f21_private_global_backbone":"partner_integrated","f22_regional_breakout_and_data_residency":"yes","f23_multi_cloud_transit_fabric":"yes","f24_flexible_edge_form_factors":"not_confirmed","f25_high_availability_design":"not_confirmed","f26_sla_backed_service_fabric":"yes","f27_integrated_next_generation_firewall":"yes","f28_full_sase_platform":"yes","f29_sse_ecosystem_integration":"yes","f30_zero_trust_network_access":"yes","f31_secure_web_gateway":"yes","f32_casb_capability":"yes","f33_data_loss_prevention":"yes","f34_remote_user_access":"yes","f35_soc_siem_soar_integration":"yes","f36_centralised_orchestration":"yes","f37_customer_portal_and_rbac":"yes","f38_observability_and_digital_experience_monitoring":"yes","f39_apis_and_automation":"yes","f40_managed_service_assurance":"not_confirmed"},"deployment_speed":"weeks","regions":{"uk_ireland":"partner_integrated","europe":"yes","north_america":"yes","asia_pacific":"yes","middle_east_africa":"not_confirmed","latin_america":"not_confirmed","china_mainland":"partial"},"supported_clouds":{"aws":"yes","azure":"yes","gcp":"yes","oracle_cloud":"yes","alibaba_cloud":"not_confirmed"},"ai_capability":{"ai_driven_operations":"yes","ai_security_analytics":"yes","ai_assistant":"yes","note":"Precision AI, AIOps for SASE and Strata Copilot."},"resilience":{"disaster_recovery":"yes","note":"Prisma Access multi-region redundancy; ION edge devices deploy in HA pairs."},"sectors":{"healthcare":"yes","financial_services":"yes","retail_ecommerce":"yes","manufacturing":"yes","energy_utilities":"yes","government_public_sector":"yes","education":"yes","transport_logistics":"partial","professional_services":"yes","hospitality_leisure":"yes"},"organisation_fit":{"large_global_enterprise":"yes","mid_market":"not_confirmed","small_business":"partial"},"pricing_units":["per_user","per_site","custom_quote"],"identity_providers":{"entra_id":"yes","okta":"yes","ping":"yes","google_workspace":"partial"},"device_posture":"yes","agent_platforms":{"windows":"yes","macos":"yes","ios":"partial","android":"partial","linux":"partial","chromeos":"not_confirmed","agentless":"partial"},"pop_count":100,"sla_availability_pct":99.999,"support_model":{"follow_the_sun_24x7":"yes","uk_support_desk":"partial","named_tam":"partial"},"logging":{"siem_export":"yes","log_retention_days":null},"marketplace_url":"https://netify.co.uk/marketplace/palo-alto-prisma-sase/","shortlist_summary":"Palo Alto Networks isn’t just selling SASE, it’s selling one door into a much larger security estate (NGFWs, Prisma Cloud, Cortex XDR/XSIAM, identity security) that most large enterprises already have some footprint in. That shows up directly in its differentiators: it’s one of the few vendors recognised as a Leader in all three of Gartner’s Single-Vendor SASE, SSE and SD-WAN Magic Quadrants simultaneously, and its ‘platformisation’ commercial strategy rewards multi-product commitment with steep discounts.","key_differentiators":["Prisma SASE converges SD-WAN, cloud-delivered security, and digital experience management (ADEM) under a single platform identity.","Strong threat intelligence and security capability inheritance from the wider Palo Alto Networks portfolio.","Often selected by buyers consolidating from multiple security vendors onto a single SASE platform."],"best_fit_for":["Enterprises with mature security operations that want SASE built around a leading security platform rather than a security layer on top of an SD-WAN platform.","Buyers consolidating CASB, SWG, ZTNA and FWaaS onto one vendor for unified policy.","Organisations with global SaaS-heavy traffic patterns that benefit from Prisma Access PoP coverage."],"watch_outs":["Premium pricing relative to firewall-led SD-WAN vendors; commercial model requires careful scoping by users, bandwidth, locations and term.","Managed delivery is via partners (Orange Business, NTT, others); first-party managed service is not the primary model.","Private global backbone is not vendor-owned; cloud transport uses internet and Prisma Access PoPs."],"evidence_coverage_pct":0.9,"last_verified":"2026-09-01","evidence_source_count":41,"independent_evidence_source_count":0,"position":4,"research_metrics":{"supported":29,"partial":2,"partner_delivered":3,"managed_service_dependent":2,"not_primary":0,"unconfirmed":4,"total":40,"reviewed":36,"completeness_percent":90,"completeness":0.9},"proven_evidence_count":29,"gaps":[]},{"slug":"hpe-aruba","name":"HPE Aruba EdgeConnect","website":"https://www.hpe.com/us/en/aruba-edgeconnect-sd-wan.html","category":"SD-WAN / SSE / branch technology vendor","product_focus":"EdgeConnect SD-WAN, Aruba SSE","cost_model":"Quote-based subscription/appliance/support; MSP-managed options available through partners/providers.","public_pricing_visibility":"quote_based","value_tier":"mid","uk_delivery":"uk_pops_partner","uk_basis":"No UK HQ (US). EdgeConnect delivered in the UK via HPE partners and MSPs.","capabilities":{"f01_fully_managed_service":"yes","f02_diy_self_managed_model":"yes","f03_co_managed_service":"yes","f04_multi_tenant_msp_white_label_support":"partial","f05_professional_services_and_migration_support":"yes","f06_last_mile_circuit_management":"partner_integrated","f07_lifecycle_management":"yes","f08_flexible_commercial_model":"yes","f09_encrypted_overlay_fabric":"yes","f10_dynamic_path_selection":"not_confirmed","f11_active_active_link_utilisation":"yes","f12_application_aware_routing":"yes","f13_qos_and_traffic_shaping":"not_confirmed","f14_packet_loss_remediation":"yes","f15_local_internet_breakout":"yes","f16_mpls_coexistence_and_migration":"yes","f17_cellular_and_5g_support":"yes","f18_cloud_on_ramp":"not_confirmed","f19_public_cloud_gateways":"not_confirmed","f20_private_pops_dedicated_pops":"not_confirmed","f21_private_global_backbone":"not_confirmed","f22_regional_breakout_and_data_residency":"yes","f23_multi_cloud_transit_fabric":"not_confirmed","f24_flexible_edge_form_factors":"not_confirmed","f25_high_availability_design":"not_confirmed","f26_sla_backed_service_fabric":"partial","f27_integrated_next_generation_firewall":"yes","f28_full_sase_platform":"yes","f29_sse_ecosystem_integration":"yes","f30_zero_trust_network_access":"yes","f31_secure_web_gateway":"yes","f32_casb_capability":"yes","f33_data_loss_prevention":"yes","f34_remote_user_access":"yes","f35_soc_siem_soar_integration":"yes","f36_centralised_orchestration":"yes","f37_customer_portal_and_rbac":"yes","f38_observability_and_digital_experience_monitoring":"not_confirmed","f39_apis_and_automation":"yes","f40_managed_service_assurance":"partial"},"deployment_speed":"days","regions":{"uk_ireland":"not_confirmed","europe":"partial","north_america":"yes","asia_pacific":"partial","middle_east_africa":"not_confirmed","latin_america":"not_confirmed","china_mainland":"not_confirmed"},"supported_clouds":{"aws":"yes","azure":"yes","gcp":"yes","oracle_cloud":"partial","alibaba_cloud":"not_confirmed"},"ai_capability":{"ai_driven_operations":"yes","ai_security_analytics":"partial","ai_assistant":"yes","note":"Mist AI and Marvis virtual assistant (HPE Juniper); Aruba Central AIOps with EdgeConnect."},"resilience":{"disaster_recovery":"yes","note":"EdgeConnect HA, tunnel bonding and orchestrated failover."},"sectors":{"healthcare":"yes","financial_services":"yes","retail_ecommerce":"yes","manufacturing":"yes","energy_utilities":"partial","government_public_sector":"yes","education":"not_confirmed","transport_logistics":"yes","professional_services":"yes","hospitality_leisure":"partial"},"organisation_fit":{"large_global_enterprise":"yes","mid_market":"not_confirmed","small_business":"not_confirmed"},"pricing_units":["per_site","custom_quote"],"identity_providers":{"entra_id":"yes","okta":"partial","ping":"partial","google_workspace":"partial"},"device_posture":"partial","agent_platforms":{"windows":"yes","macos":"yes","ios":"partial","android":"partial","linux":"partial","chromeos":"not_confirmed","agentless":"partial"},"pop_count":null,"sla_availability_pct":null,"support_model":{"follow_the_sun_24x7":"yes","uk_support_desk":"partial","named_tam":"partial"},"logging":{"siem_export":"yes","log_retention_days":null},"marketplace_url":"https://netify.co.uk/marketplace/hpe-aruba-edgeconnect/","shortlist_summary":"HPE Aruba Networking’s SASE platform is a product of acquisition and integration rather than a single, from-scratch build. The SD-WAN engine, EdgeConnect, was built by Silver Peak Systems (founded 2004, first SD-WAN product shipped 2015) and joined HPE’s Aruba business in a $925 million acquisition completed September 2020.","key_differentiators":["EdgeConnect SD-WAN (acquired with Silver Peak) is positioned as the foundation for single-vendor SASE alongside Aruba SSE.","Strong heritage in WAN optimisation and packet-level performance engineering.","Tight integration with the broader Aruba campus and branch portfolio (LAN, Wi-Fi, NAC) for buyers consolidating end-to-end networking."],"best_fit_for":["Enterprises already running Aruba LAN/Wi-Fi who want WAN and SASE under the same operational tooling.","Buyers prioritising application performance and WAN optimisation in addition to standard SD-WAN routing.","Distributed organisations with branch-heavy footprints where Aruba campus presence is already established."],"watch_outs":["Aruba SSE is newer than the SSE leaders (Zscaler, Netskope); buyers wanting best-of-breed SASE should evaluate the SSE capability set carefully.","Managed delivery is partner-led rather than from HPE directly.","Private global backbone is not vendor-owned; SASE transport uses public cloud gateways."],"evidence_coverage_pct":0.75,"last_verified":"2026-09-01","evidence_source_count":37,"independent_evidence_source_count":0,"position":5,"research_metrics":{"supported":26,"partial":3,"partner_delivered":1,"managed_service_dependent":0,"not_primary":0,"unconfirmed":10,"total":40,"reviewed":30,"completeness_percent":75,"completeness":0.75},"proven_evidence_count":26,"gaps":[]},{"slug":"versa-networks","name":"Versa Networks","website":"https://versa-networks.com","category":"SD-WAN / SASE technology vendor","product_focus":"Versa Secure SD-WAN, Versa SASE, VOS","cost_model":"Quote-based subscription; MSP/carrier pricing depends on tenant scale, bandwidth, security package and delivery model.","public_pricing_visibility":"quote_based","value_tier":"mid","uk_delivery":"uk_pops_partner","uk_basis":"No UK HQ (US). Delivered in the UK through carrier and MSP partners building managed services on Versa.","capabilities":{"f01_fully_managed_service":"partial","f02_diy_self_managed_model":"yes","f03_co_managed_service":"yes","f04_multi_tenant_msp_white_label_support":"yes","f05_professional_services_and_migration_support":"not_confirmed","f06_last_mile_circuit_management":"partner_integrated","f07_lifecycle_management":"partial","f08_flexible_commercial_model":"yes","f09_encrypted_overlay_fabric":"yes","f10_dynamic_path_selection":"not_confirmed","f11_active_active_link_utilisation":"yes","f12_application_aware_routing":"yes","f13_qos_and_traffic_shaping":"not_confirmed","f14_packet_loss_remediation":"yes","f15_local_internet_breakout":"not_confirmed","f16_mpls_coexistence_and_migration":"yes","f17_cellular_and_5g_support":"not_confirmed","f18_cloud_on_ramp":"yes","f19_public_cloud_gateways":"not_confirmed","f20_private_pops_dedicated_pops":"yes","f21_private_global_backbone":"partial","f22_regional_breakout_and_data_residency":"yes","f23_multi_cloud_transit_fabric":"yes","f24_flexible_edge_form_factors":"not_confirmed","f25_high_availability_design":"not_confirmed","f26_sla_backed_service_fabric":"yes","f27_integrated_next_generation_firewall":"yes","f28_full_sase_platform":"yes","f29_sse_ecosystem_integration":"yes","f30_zero_trust_network_access":"yes","f31_secure_web_gateway":"yes","f32_casb_capability":"yes","f33_data_loss_prevention":"not_confirmed","f34_remote_user_access":"yes","f35_soc_siem_soar_integration":"yes","f36_centralised_orchestration":"yes","f37_customer_portal_and_rbac":"yes","f38_observability_and_digital_experience_monitoring":"not_confirmed","f39_apis_and_automation":"yes","f40_managed_service_assurance":"partial"},"deployment_speed":"weeks","regions":{"uk_ireland":"not_confirmed","europe":"yes","north_america":"yes","asia_pacific":"yes","middle_east_africa":"not_confirmed","latin_america":"not_confirmed","china_mainland":"not_confirmed"},"supported_clouds":{"aws":"yes","azure":"yes","gcp":"yes","oracle_cloud":"partial","alibaba_cloud":"partial"},"ai_capability":{"ai_driven_operations":"yes","ai_security_analytics":"yes","ai_assistant":"partial","note":"VersaAI with AIOps and GenAI firewall protections."},"resilience":{"disaster_recovery":"yes","note":"Multi-tenant HA head-ends and regional Versa Cloud Gateways."},"sectors":{"healthcare":"yes","financial_services":"yes","retail_ecommerce":"partial","manufacturing":"partial","energy_utilities":"partial","government_public_sector":"partial","education":"partial","transport_logistics":"partial","professional_services":"partial","hospitality_leisure":"partial"},"organisation_fit":{"large_global_enterprise":"yes","mid_market":"not_confirmed","small_business":"not_confirmed"},"pricing_units":["per_site","custom_quote"],"identity_providers":{"entra_id":"yes","okta":"partial","ping":"partial","google_workspace":"partial"},"device_posture":"partial","agent_platforms":{"windows":"yes","macos":"yes","ios":"partial","android":"partial","linux":"partial","chromeos":"not_confirmed","agentless":"partial"},"pop_count":90,"sla_availability_pct":99.999,"support_model":{"follow_the_sun_24x7":"yes","uk_support_desk":"partial","named_tam":"partial"},"logging":{"siem_export":"yes","log_retention_days":null},"marketplace_url":"https://netify.co.uk/marketplace/versa-networks/","shortlist_summary":"Versa Networks built its SASE platform around a single-vendor, single-operating-system architecture from an early starting point - the company was founded in 2012, before the SASE category itself existed, on the thesis that legacy hardware and static WAN architectures were holding enterprises back from the cloud. That heritage shows up directly in VersaONE’s design: one operating system (VOS), one console, one policy engine and one data lake, with a single-pass parallel-processing architecture built to avoid the latency penalty of chaining separate security functions together.","key_differentiators":["Multi-tenancy from the ground up, making Versa a common choice for service providers and carriers building managed SD-WAN and SASE platforms.","Versa Operating System (VOS) provides a converged networking and security software stack across cloud and on-premises delivery.","Often the underlying platform when buyers select a managed SD-WAN service from a carrier or MSP."],"best_fit_for":["Service providers, carriers and MSPs building white-label managed SD-WAN or SASE services.","Enterprises consuming Versa indirectly through a managed provider (e.g. Verizon, Orange).","Buyers who want platform flexibility across cloud-delivered, on-premises and hybrid delivery models."],"watch_outs":["Less well-known to enterprise buyers as a direct purchase; most enterprise consumption is via service providers.","Buyers should confirm exactly which managed provider is delivering the platform and what the operational RACI looks like.","Brand recognition trails Cisco, Palo Alto and Fortinet in enterprise procurement processes."],"evidence_coverage_pct":0.75,"last_verified":"2026-09-01","evidence_source_count":29,"independent_evidence_source_count":0,"position":6,"research_metrics":{"supported":25,"partial":4,"partner_delivered":1,"managed_service_dependent":0,"not_primary":0,"unconfirmed":10,"total":40,"reviewed":30,"completeness_percent":75,"completeness":0.75},"proven_evidence_count":25,"gaps":[]},{"slug":"fortinet","name":"Fortinet FortiSASE","website":"https://www.fortinet.com/products/sd-wan","category":"Secure SD-WAN / SASE technology vendor","product_focus":"FortiGate Secure SD-WAN, FortiManager, FortiSASE","cost_model":"Quote-based appliances/subscriptions/support; public reseller pricing exists for hardware but enterprise managed/SASE bundles require quote.","public_pricing_visibility":"quote_based","value_tier":"value","uk_delivery":"uk_pops_partner","uk_basis":"No UK HQ (US). Strong UK channel and FortiSASE PoPs; widely delivered as a UK managed service by BT, Vodafone and UK MSPs.","capabilities":{"f01_fully_managed_service":"yes","f02_diy_self_managed_model":"yes","f03_co_managed_service":"not_confirmed","f04_multi_tenant_msp_white_label_support":"partial","f05_professional_services_and_migration_support":"yes","f06_last_mile_circuit_management":"partner_integrated","f07_lifecycle_management":"yes","f08_flexible_commercial_model":"yes","f09_encrypted_overlay_fabric":"yes","f10_dynamic_path_selection":"not_confirmed","f11_active_active_link_utilisation":"yes","f12_application_aware_routing":"not_confirmed","f13_qos_and_traffic_shaping":"not_confirmed","f14_packet_loss_remediation":"yes","f15_local_internet_breakout":"yes","f16_mpls_coexistence_and_migration":"yes","f17_cellular_and_5g_support":"not_confirmed","f18_cloud_on_ramp":"yes","f19_public_cloud_gateways":"not_confirmed","f20_private_pops_dedicated_pops":"not_confirmed","f21_private_global_backbone":"partial","f22_regional_breakout_and_data_residency":"yes","f23_multi_cloud_transit_fabric":"yes","f24_flexible_edge_form_factors":"not_confirmed","f25_high_availability_design":"yes","f26_sla_backed_service_fabric":"yes","f27_integrated_next_generation_firewall":"not_confirmed","f28_full_sase_platform":"yes","f29_sse_ecosystem_integration":"yes","f30_zero_trust_network_access":"not_confirmed","f31_secure_web_gateway":"yes","f32_casb_capability":"yes","f33_data_loss_prevention":"not_confirmed","f34_remote_user_access":"yes","f35_soc_siem_soar_integration":"yes","f36_centralised_orchestration":"yes","f37_customer_portal_and_rbac":"yes","f38_observability_and_digital_experience_monitoring":"not_confirmed","f39_apis_and_automation":"yes","f40_managed_service_assurance":"partner_integrated"},"deployment_speed":"days","regions":{"uk_ireland":"yes","europe":"yes","north_america":"yes","asia_pacific":"yes","middle_east_africa":"yes","latin_america":"yes","china_mainland":"not_confirmed"},"supported_clouds":{"aws":"yes","azure":"yes","gcp":"yes","oracle_cloud":"yes","alibaba_cloud":"partial"},"ai_capability":{"ai_driven_operations":"yes","ai_security_analytics":"yes","ai_assistant":"yes","note":"FortiAI assistant, FortiAIOps and FortiGuard AI-powered security services."},"resilience":{"disaster_recovery":"yes","note":"HA clustering, multi-hub designs and FortiSASE regional PoPs."},"sectors":{"healthcare":"yes","financial_services":"yes","retail_ecommerce":"yes","manufacturing":"yes","energy_utilities":"yes","government_public_sector":"yes","education":"yes","transport_logistics":"yes","professional_services":"not_confirmed","hospitality_leisure":"yes"},"organisation_fit":{"large_global_enterprise":"yes","mid_market":"yes","small_business":"yes"},"pricing_units":["per_site","custom_quote"],"identity_providers":{"entra_id":"yes","okta":"partial","ping":"partial","google_workspace":"partial"},"device_posture":"partial","agent_platforms":{"windows":"yes","macos":"yes","ios":"partial","android":"partial","linux":"partial","chromeos":"not_confirmed","agentless":"partial"},"pop_count":170,"sla_availability_pct":99.999,"support_model":{"follow_the_sun_24x7":"yes","uk_support_desk":"partial","named_tam":"partial"},"logging":{"siem_export":"yes","log_retention_days":null},"marketplace_url":"https://netify.co.uk/marketplace/fortinet-fortisase/","shortlist_summary":"FortiSASE runs the same FortiOS operating system, and the same single-pass inspection engine, that has powered Fortinet’s physical FortiGate firewalls for over two decades. That’s a meaningfully different starting point from building a SASE platform natively for the cloud from scratch - the practical result is that FortiGate customers get a consistent policy and inspection model whether traffic is inspected on-premises or in a FortiSASE cloud point of presence, and Fortinet’s own commercial materials lean hard into a ‘Security Fabric’ discount for exactly these existing customers.","key_differentiators":["Native convergence of networking and security on a single operating system (FortiOS) across FortiGate edge, FortiManager and FortiSASE.","Strong story for buyers who want secure SD-WAN and SASE delivered from one vendor platform rather than assembled from partner integrations.","Wide appliance range covering everything from small branch to large data centre, with public hardware pricing visible through resellers."],"best_fit_for":["Security-first buyers who want SD-WAN and SASE under a single policy and log domain.","Mid-market and enterprise organisations that already run FortiGate firewalls and want to extend into SD-WAN and cloud-delivered security.","Buyers comparing single-vendor SASE platforms (alongside Cato, Palo Alto, Cisco) for converged operations."],"watch_outs":["Like Cisco, managed delivery is via partners rather than Fortinet directly; underlay and field operations are not owned by the vendor.","Buyers wanting a private global backbone will need to validate FortiSASE PoP coverage against their geographic footprint.","Best-of-breed buyers may prefer integrating FortiGate SD-WAN with a separate SSE platform (Zscaler, Netskope) rather than adopting full FortiSASE."],"evidence_coverage_pct":0.7,"last_verified":"2026-09-01","evidence_source_count":35,"independent_evidence_source_count":0,"position":7,"research_metrics":{"supported":24,"partial":2,"partner_delivered":2,"managed_service_dependent":0,"not_primary":0,"unconfirmed":12,"total":40,"reviewed":28,"completeness_percent":70,"completeness":0.7},"proven_evidence_count":24,"gaps":[]},{"slug":"zscaler","name":"Zscaler","website":"https://www.zscaler.com","category":"SSE / SASE platform","product_focus":"ZIA, ZPA, ZDX, Zero Trust SASE","cost_model":"Quote-based subscription; typically per-user/workload/location modules; SD-WAN integrations may add partner/vendor cost.","public_pricing_visibility":"quote_based","value_tier":"premium","uk_delivery":"uk_pops_partner","uk_basis":"No UK HQ (US). UK PoPs in the Zero Trust Exchange; delivered direct or via UK partners and carriers.","capabilities":{"f01_fully_managed_service":"partial","f02_diy_self_managed_model":"yes","f03_co_managed_service":"partial","f04_multi_tenant_msp_white_label_support":"partial","f05_professional_services_and_migration_support":"yes","f06_last_mile_circuit_management":"partner_integrated","f07_lifecycle_management":"not_confirmed","f08_flexible_commercial_model":"yes","f09_encrypted_overlay_fabric":"partial","f10_dynamic_path_selection":"not_confirmed","f11_active_active_link_utilisation":"partial","f12_application_aware_routing":"not_confirmed","f13_qos_and_traffic_shaping":"not_confirmed","f14_packet_loss_remediation":"not_confirmed","f15_local_internet_breakout":"not_confirmed","f16_mpls_coexistence_and_migration":"partial","f17_cellular_and_5g_support":"not_confirmed","f18_cloud_on_ramp":"yes","f19_public_cloud_gateways":"not_confirmed","f20_private_pops_dedicated_pops":"yes","f21_private_global_backbone":"not_primary","f22_regional_breakout_and_data_residency":"yes","f23_multi_cloud_transit_fabric":"yes","f24_flexible_edge_form_factors":"not_confirmed","f25_high_availability_design":"not_confirmed","f26_sla_backed_service_fabric":"yes","f27_integrated_next_generation_firewall":"yes","f28_full_sase_platform":"yes","f29_sse_ecosystem_integration":"yes","f30_zero_trust_network_access":"yes","f31_secure_web_gateway":"yes","f32_casb_capability":"not_confirmed","f33_data_loss_prevention":"yes","f34_remote_user_access":"yes","f35_soc_siem_soar_integration":"yes","f36_centralised_orchestration":"yes","f37_customer_portal_and_rbac":"yes","f38_observability_and_digital_experience_monitoring":"not_confirmed","f39_apis_and_automation":"yes","f40_managed_service_assurance":"partial"},"deployment_speed":"days","regions":{"uk_ireland":"partial","europe":"yes","north_america":"yes","asia_pacific":"yes","middle_east_africa":"partial","latin_america":"not_confirmed","china_mainland":"yes"},"supported_clouds":{"aws":"yes","azure":"yes","gcp":"yes","oracle_cloud":"partial","alibaba_cloud":"not_confirmed"},"ai_capability":{"ai_driven_operations":"partial","ai_security_analytics":"yes","ai_assistant":"yes","note":"AI-powered phishing and C2 detection; ZDX Copilot for digital experience."},"resilience":{"disaster_recovery":"yes","note":"160+ PoP cloud with service continuity features across regions."},"sectors":{"healthcare":"yes","financial_services":"yes","retail_ecommerce":"not_confirmed","manufacturing":"yes","energy_utilities":"not_confirmed","government_public_sector":"yes","education":"yes","transport_logistics":"yes","professional_services":"not_confirmed","hospitality_leisure":"not_confirmed"},"organisation_fit":{"large_global_enterprise":"yes","mid_market":"not_confirmed","small_business":"not_confirmed"},"pricing_units":["per_user","custom_quote"],"identity_providers":{"entra_id":"yes","okta":"yes","ping":"yes","google_workspace":"yes"},"device_posture":"yes","agent_platforms":{"windows":"yes","macos":"yes","ios":"yes","android":"yes","linux":"partial","chromeos":"partial","agentless":"yes"},"pop_count":160,"sla_availability_pct":99.999,"support_model":{"follow_the_sun_24x7":"yes","uk_support_desk":"partial","named_tam":"partial"},"logging":{"siem_export":"yes","log_retention_days":null},"marketplace_url":"https://netify.co.uk/marketplace/zscaler/","shortlist_summary":"Zscaler is the vendor that effectively created the SSE category, and it’s still the one most competitors get measured against when it comes to sheer scale and security depth - the Zero Trust Exchange runs across 150+ data centres, processes over 400 billion transactions a day, and holds FedRAMP High authorisation for ZIA and ZPA (other SASE-class vendors also hold FedRAMP High or equivalent for their own components). If you’re a security-first buyer looking to retire VPN concentrators and stitch SWG, CASB, DLP and ZTNA together under one console, Zscaler is one of the most proven single-vendor routes to get there.","key_differentiators":["Category leader in SSE with ZIA, ZPA and ZDX; widely adopted as the security layer in best-of-breed SASE architectures.","Strong ecosystem of SD-WAN partners (Cisco, others) for buyers wanting Zscaler security with a separate SD-WAN platform.","Mature Zero Trust platform with substantial enterprise deployment history."],"best_fit_for":["Enterprises selecting best-of-breed SSE alongside a separate SD-WAN platform.","Security-driven SASE strategies where the SSE layer is the primary architectural decision.","Buyers consolidating multiple security point solutions onto a single SSE vendor."],"watch_outs":["Historically SSE-led; native SD-WAN capability is less mature than dedicated SD-WAN platforms (validate path selection, QoS and packet loss in RFP).","Premium pricing; typically per-user/workload/location with security modules adding cost.","Buyers needing one vendor for both SD-WAN and security may prefer a converged platform (Cato, FortiSASE, Prisma)."],"evidence_coverage_pct":0.7,"last_verified":"2026-09-01","evidence_source_count":59,"independent_evidence_source_count":0,"position":8,"research_metrics":{"supported":19,"partial":7,"partner_delivered":1,"managed_service_dependent":0,"not_primary":1,"unconfirmed":12,"total":40,"reviewed":28,"completeness_percent":70,"completeness":0.7},"proven_evidence_count":19,"gaps":[]},{"slug":"check-point","name":"Check Point","website":"https://www.checkpoint.com/harmony/sase","category":"SASE / security vendor","product_focus":"Check Point Harmony SASE / Check Point SASE","cost_model":"Quote-based subscription; Microsoft marketplace listing exists but enterprise deployments normally require quote.","public_pricing_visibility":"quote_based","value_tier":"mid","uk_delivery":"uk_pops_partner","uk_basis":"No UK HQ (Israel/US). Harmony SASE UK presence; delivered via UK security partners.","capabilities":{"f01_fully_managed_service":"partial","f02_diy_self_managed_model":"yes","f03_co_managed_service":"yes","f04_multi_tenant_msp_white_label_support":"partial","f05_professional_services_and_migration_support":"yes","f06_last_mile_circuit_management":"partner_integrated","f07_lifecycle_management":"yes","f08_flexible_commercial_model":"yes","f09_encrypted_overlay_fabric":"partial","f10_dynamic_path_selection":"not_confirmed","f11_active_active_link_utilisation":"partial","f12_application_aware_routing":"not_confirmed","f13_qos_and_traffic_shaping":"not_confirmed","f14_packet_loss_remediation":"not_confirmed","f15_local_internet_breakout":"not_confirmed","f16_mpls_coexistence_and_migration":"partial","f17_cellular_and_5g_support":"not_confirmed","f18_cloud_on_ramp":"not_confirmed","f19_public_cloud_gateways":"not_confirmed","f20_private_pops_dedicated_pops":"not_confirmed","f21_private_global_backbone":"yes","f22_regional_breakout_and_data_residency":"yes","f23_multi_cloud_transit_fabric":"not_confirmed","f24_flexible_edge_form_factors":"not_confirmed","f25_high_availability_design":"not_confirmed","f26_sla_backed_service_fabric":"partial","f27_integrated_next_generation_firewall":"yes","f28_full_sase_platform":"yes","f29_sse_ecosystem_integration":"yes","f30_zero_trust_network_access":"yes","f31_secure_web_gateway":"yes","f32_casb_capability":"yes","f33_data_loss_prevention":"not_confirmed","f34_remote_user_access":"yes","f35_soc_siem_soar_integration":"yes","f36_centralised_orchestration":"yes","f37_customer_portal_and_rbac":"yes","f38_observability_and_digital_experience_monitoring":"not_confirmed","f39_apis_and_automation":"yes","f40_managed_service_assurance":"partial"},"deployment_speed":"days","regions":{"uk_ireland":"partial","europe":"yes","north_america":"yes","asia_pacific":"yes","middle_east_africa":"partial","latin_america":"partial","china_mainland":"not_confirmed"},"supported_clouds":{"aws":"yes","azure":"yes","gcp":"yes","oracle_cloud":"partial","alibaba_cloud":"not_confirmed"},"ai_capability":{"ai_driven_operations":"partial","ai_security_analytics":"yes","ai_assistant":"partial","note":"ThreatCloud AI shared threat intelligence; Infinity AI Copilot for security operations."},"resilience":{"disaster_recovery":"partial","note":"Cloud-delivered Harmony SASE with regional redundancy; on-prem HA via Quantum clusters."},"sectors":{"healthcare":"yes","financial_services":"yes","retail_ecommerce":"yes","manufacturing":"yes","energy_utilities":"yes","government_public_sector":"yes","education":"yes","transport_logistics":"partial","professional_services":"partial","hospitality_leisure":"yes"},"organisation_fit":{"large_global_enterprise":"yes","mid_market":"partial","small_business":"yes"},"pricing_units":["per_user","per_site","custom_quote"],"identity_providers":{"entra_id":"yes","okta":"partial","ping":"partial","google_workspace":"partial"},"device_posture":"yes","agent_platforms":{"windows":"yes","macos":"yes","ios":"partial","android":"partial","linux":"partial","chromeos":"not_confirmed","agentless":"partial"},"pop_count":80,"sla_availability_pct":null,"support_model":{"follow_the_sun_24x7":"yes","uk_support_desk":"partial","named_tam":"partial"},"logging":{"siem_export":"yes","log_retention_days":null},"marketplace_url":"https://netify.co.uk/marketplace/checkpoint/","shortlist_summary":"Check Point’s SASE platform has been through two names in under three years. The underlying technology began life as Perimeter 81, an independent Israeli SSE/ZTNA vendor founded in 2018 that had grown to more than 3,000 customers and a Forrester Zero Trust Wave recognition before Check Point Software Technologies - the much larger, long-established Israeli cybersecurity vendor behind Check Point Firewall-1, founded in 1993 - acquired it for approximately $490 million in a deal announced September 2023.","key_differentiators":["Harmony SASE combines Check Point security heritage with cloud-delivered SASE and optimised SD-WAN performance.","Strong story for organisations already running Check Point firewalls who want to extend into SASE.","Available via Microsoft Azure marketplace for buyers wanting consolidated cloud procurement."],"best_fit_for":["Existing Check Point customers extending firewall investment into SD-WAN and SASE.","Mid-market enterprises consolidating security and SD-WAN under one vendor.","Buyers prioritising security maturity over network-platform maturity."],"watch_outs":["Native SD-WAN capabilities (path selection, QoS, packet loss remediation) have limited public evidence relative to SD-WAN-led vendors.","Smaller SD-WAN deployment footprint than category leaders; validate scale references.","Managed delivery is partner-led."],"evidence_coverage_pct":0.65,"last_verified":"2026-09-01","evidence_source_count":28,"independent_evidence_source_count":0,"position":9,"research_metrics":{"supported":18,"partial":7,"partner_delivered":1,"managed_service_dependent":0,"not_primary":0,"unconfirmed":14,"total":40,"reviewed":26,"completeness_percent":65,"completeness":0.65},"proven_evidence_count":18,"gaps":[]},{"slug":"forcepoint","name":"Forcepoint","website":"https://www.forcepoint.com/product/secure-sd-wan","category":"Security / secure SD-WAN vendor","product_focus":"Forcepoint FlexEdge Secure SD-WAN","cost_model":"Quote-based appliances/software/subscriptions; managed SD-WAN positioned but pricing public transparency limited.","public_pricing_visibility":"quote_based","value_tier":"mid","uk_delivery":"uk_pops_partner","uk_basis":"No UK HQ (US). UK delivery via security partners; government and defence heritage suits UK public sector.","capabilities":{"f01_fully_managed_service":"not_primary","f02_diy_self_managed_model":"yes","f03_co_managed_service":"not_confirmed","f04_multi_tenant_msp_white_label_support":"partial","f05_professional_services_and_migration_support":"partial","f06_last_mile_circuit_management":"partner_integrated","f07_lifecycle_management":"partial","f08_flexible_commercial_model":"yes","f09_encrypted_overlay_fabric":"yes","f10_dynamic_path_selection":"not_confirmed","f11_active_active_link_utilisation":"yes","f12_application_aware_routing":"yes","f13_qos_and_traffic_shaping":"not_confirmed","f14_packet_loss_remediation":"not_confirmed","f15_local_internet_breakout":"not_confirmed","f16_mpls_coexistence_and_migration":"yes","f17_cellular_and_5g_support":"not_confirmed","f18_cloud_on_ramp":"not_confirmed","f19_public_cloud_gateways":"not_confirmed","f20_private_pops_dedicated_pops":"not_confirmed","f21_private_global_backbone":"not_confirmed","f22_regional_breakout_and_data_residency":"partial","f23_multi_cloud_transit_fabric":"not_confirmed","f24_flexible_edge_form_factors":"yes","f25_high_availability_design":"not_confirmed","f26_sla_backed_service_fabric":"partial","f27_integrated_next_generation_firewall":"yes","f28_full_sase_platform":"partial","f29_sse_ecosystem_integration":"partial","f30_zero_trust_network_access":"yes","f31_secure_web_gateway":"yes","f32_casb_capability":"yes","f33_data_loss_prevention":"yes","f34_remote_user_access":"yes","f35_soc_siem_soar_integration":"yes","f36_centralised_orchestration":"yes","f37_customer_portal_and_rbac":"yes","f38_observability_and_digital_experience_monitoring":"not_confirmed","f39_apis_and_automation":"partial","f40_managed_service_assurance":"not_confirmed"},"deployment_speed":"days","regions":{"uk_ireland":"partner_integrated","europe":"partner_integrated","north_america":"partner_integrated","asia_pacific":"partner_integrated","middle_east_africa":"partner_integrated","latin_america":"partner_integrated","china_mainland":"not_confirmed"},"supported_clouds":{"aws":"yes","azure":"yes","gcp":"partial","oracle_cloud":"not_confirmed","alibaba_cloud":"not_confirmed"},"ai_capability":{"ai_driven_operations":"partial","ai_security_analytics":"yes","ai_assistant":"partial","note":"AI Mesh for data security; risk-adaptive protection scores user behaviour in real time."},"resilience":{"disaster_recovery":"partial","note":"Cloud SSE with regional redundancy; Secure SD-WAN appliances deploy in HA pairs."},"sectors":{"healthcare":"yes","financial_services":"yes","retail_ecommerce":"yes","manufacturing":"yes","energy_utilities":"yes","government_public_sector":"yes","education":"yes","transport_logistics":"yes","professional_services":"partial","hospitality_leisure":"yes"},"organisation_fit":{"large_global_enterprise":"yes","mid_market":"partial","small_business":"not_confirmed"},"pricing_units":["per_user","custom_quote"],"identity_providers":{"entra_id":"yes","okta":"partial","ping":"partial","google_workspace":"partial"},"device_posture":"yes","agent_platforms":{"windows":"yes","macos":"yes","ios":"partial","android":"partial","linux":"partial","chromeos":"not_confirmed","agentless":"partial"},"pop_count":null,"sla_availability_pct":null,"support_model":{"follow_the_sun_24x7":"yes","uk_support_desk":"partial","named_tam":"partial"},"logging":{"siem_export":"yes","log_retention_days":null},"marketplace_url":"https://netify.co.uk/marketplace/forcepoint/","shortlist_summary":"Forcepoint’s identity traces back to Websense, founded in 1994, and its whole platform is built around a data-first philosophy rather than a network- or device-first one - the pitch is that policy should follow the data itself, not the network path or the device it happens to be on. That heritage shows up as real, credible analyst recognition specifically for data loss prevention: Frost & Sullivan’s Global DLP Company of the Year for two consecutive years, an IDC MarketScape Leader placement for worldwide DLP in 2025, and a Forrester Wave Strong Performer placement for data security platforms in Q1 2025.","key_differentiators":["FlexEdge Secure SD-WAN combines secure SD-WAN with strong DLP and data security heritage from the wider Forcepoint portfolio.","MultiLink resilience and zero-touch deployment with cloud central management.","Strong story for buyers prioritising data security and DLP as a procurement criterion."],"best_fit_for":["Enterprises with strong data protection and DLP requirements (regulated industries, government).","Organisations wanting secure SD-WAN where data security is the primary decision driver.","Buyers consolidating DLP with SD-WAN under one vendor."],"watch_outs":["Smaller SD-WAN market presence than the leading platforms.","Full SASE platform completeness has partial public evidence; SSE module depth should be confirmed.","Managed delivery is partner-led; co-managed and white-label support require partner validation."],"evidence_coverage_pct":0.65,"last_verified":"2026-09-01","evidence_source_count":44,"independent_evidence_source_count":0,"position":10,"research_metrics":{"supported":16,"partial":8,"partner_delivered":1,"managed_service_dependent":0,"not_primary":1,"unconfirmed":14,"total":40,"reviewed":26,"completeness_percent":65,"completeness":0.65},"proven_evidence_count":16,"gaps":[]},{"slug":"arista-velocloud","name":"VeloCloud","website":"https://www.arista.com","category":"SD-WAN technology vendor","product_focus":"VeloCloud SD-WAN portfolio now under Arista","cost_model":"Quote-based edge subscriptions/appliances/support; managed services commonly delivered by carriers/MSPs.","public_pricing_visibility":"quote_based","value_tier":"mid","uk_delivery":"uk_pops_partner","uk_basis":"No UK HQ (US). VeloCloud delivered in the UK through carriers including BT and Vodafone.","capabilities":{"f01_fully_managed_service":"partner_integrated","f02_diy_self_managed_model":"yes","f03_co_managed_service":"partner_integrated","f04_multi_tenant_msp_white_label_support":"partial","f05_professional_services_and_migration_support":"yes","f06_last_mile_circuit_management":"partner_integrated","f07_lifecycle_management":"yes","f08_flexible_commercial_model":"yes","f09_encrypted_overlay_fabric":"yes","f10_dynamic_path_selection":"yes","f11_active_active_link_utilisation":"yes","f12_application_aware_routing":"not_confirmed","f13_qos_and_traffic_shaping":"not_confirmed","f14_packet_loss_remediation":"yes","f15_local_internet_breakout":"not_confirmed","f16_mpls_coexistence_and_migration":"yes","f17_cellular_and_5g_support":"not_confirmed","f18_cloud_on_ramp":"not_confirmed","f19_public_cloud_gateways":"not_confirmed","f20_private_pops_dedicated_pops":"yes","f21_private_global_backbone":"not_confirmed","f22_regional_breakout_and_data_residency":"partner_integrated","f23_multi_cloud_transit_fabric":"not_confirmed","f24_flexible_edge_form_factors":"not_confirmed","f25_high_availability_design":"partner_integrated","f26_sla_backed_service_fabric":"not_confirmed","f27_integrated_next_generation_firewall":"not_confirmed","f28_full_sase_platform":"partner_integrated","f29_sse_ecosystem_integration":"yes","f30_zero_trust_network_access":"not_confirmed","f31_secure_web_gateway":"partner_integrated","f32_casb_capability":"partner_integrated","f33_data_loss_prevention":"not_confirmed","f34_remote_user_access":"partner_integrated","f35_soc_siem_soar_integration":"yes","f36_centralised_orchestration":"yes","f37_customer_portal_and_rbac":"yes","f38_observability_and_digital_experience_monitoring":"not_confirmed","f39_apis_and_automation":"yes","f40_managed_service_assurance":"managed_service_dependent"},"deployment_speed":"days","regions":{"uk_ireland":"partial","europe":"yes","north_america":"yes","asia_pacific":"yes","middle_east_africa":"partial","latin_america":"not_confirmed","china_mainland":"partial"},"supported_clouds":{"aws":"yes","azure":"yes","gcp":"yes","oracle_cloud":"partial","alibaba_cloud":"not_confirmed"},"ai_capability":{"ai_driven_operations":"yes","ai_security_analytics":"partial","ai_assistant":"partial","note":"DMPO path analytics with Arista AVA AIOps; assistant capability maturing post acquisition."},"resilience":{"disaster_recovery":"yes","note":"700+ gateways across 200+ PoPs give multi-gateway failover; HA edge pairs supported."},"sectors":{"healthcare":"yes","financial_services":"yes","retail_ecommerce":"yes","manufacturing":"not_confirmed","energy_utilities":"not_confirmed","government_public_sector":"yes","education":"yes","transport_logistics":"not_confirmed","professional_services":"not_confirmed","hospitality_leisure":"yes"},"organisation_fit":{"large_global_enterprise":"yes","mid_market":"partial","small_business":"not_confirmed"},"pricing_units":["per_site","custom_quote"],"identity_providers":{"entra_id":"yes","okta":"partial","ping":"partial","google_workspace":"partial"},"device_posture":"partial","agent_platforms":{"windows":"yes","macos":"yes","ios":"partial","android":"partial","linux":"partial","chromeos":"not_confirmed","agentless":"partial"},"pop_count":150,"sla_availability_pct":null,"support_model":{"follow_the_sun_24x7":"yes","uk_support_desk":"partial","named_tam":"partial"},"logging":{"siem_export":"yes","log_retention_days":null},"marketplace_url":"https://netify.co.uk/marketplace/velocloud/","shortlist_summary":"VeloCloud was founded in 2012 as a cloud-delivered SD-WAN pioneer, acquired by VMware in 2017 for approximately $336 million, then came under Broadcom’s ownership when Broadcom completed its roughly $69 billion acquisition of VMware in 2023. Under Broadcom, the product was paired with Symantec’s security stack (Broadcom separately owns Symantec’s enterprise security business) into a single-vendor offering called ‘VMware VeloCloud SASE, secured by Symantec’, announced February 2024.","key_differentiators":["VeloCloud was an early SD-WAN platform with strong cloud-delivered gateway architecture; now under Arista following the 2025 acquisition.","Multi-tenant design has made VeloCloud common in carrier and MSP managed services.","Application-aware routing and dynamic path selection are mature capabilities with substantial deployment history."],"best_fit_for":["Enterprises consuming VeloCloud through a managed service provider (Vodafone UK, others).","Service providers running multi-tenant SD-WAN at scale.","Buyers comfortable with a platform in transition under new ownership."],"watch_outs":["Platform is mid-transition from VMware/Broadcom to Arista; product roadmap, naming and integration story will evolve.","Security and SASE capabilities are largely partner-integrated rather than native.","Direct enterprise sales motion is less established than legacy vendors; most consumption is via managed providers."],"evidence_coverage_pct":0.65,"last_verified":"2026-09-01","evidence_source_count":24,"independent_evidence_source_count":0,"position":11,"research_metrics":{"supported":15,"partial":1,"partner_delivered":9,"managed_service_dependent":1,"not_primary":0,"unconfirmed":14,"total":40,"reviewed":26,"completeness_percent":65,"completeness":0.65},"proven_evidence_count":15,"gaps":[]},{"slug":"aryaka","name":"Aryaka","website":"https://www.aryaka.com","category":"Managed SD-WAN / SASE provider","product_focus":"Aryaka Unified SASE, SmartCONNECT, private core","cost_model":"Quote-based managed service; pricing normally depends on sites, bandwidth, regions, security stack and optimisation.","public_pricing_visibility":"quote_based","value_tier":"mid","uk_delivery":"uk_pops_partner","uk_basis":"No UK HQ (US). UK PoP on the private core; managed-service delivery into the UK.","capabilities":{"f01_fully_managed_service":"yes","f02_diy_self_managed_model":"partial","f03_co_managed_service":"yes","f04_multi_tenant_msp_white_label_support":"partial","f05_professional_services_and_migration_support":"yes","f06_last_mile_circuit_management":"partner_integrated","f07_lifecycle_management":"not_confirmed","f08_flexible_commercial_model":"yes","f09_encrypted_overlay_fabric":"yes","f10_dynamic_path_selection":"not_confirmed","f11_active_active_link_utilisation":"yes","f12_application_aware_routing":"not_confirmed","f13_qos_and_traffic_shaping":"not_confirmed","f14_packet_loss_remediation":"yes","f15_local_internet_breakout":"not_confirmed","f16_mpls_coexistence_and_migration":"yes","f17_cellular_and_5g_support":"not_confirmed","f18_cloud_on_ramp":"not_confirmed","f19_public_cloud_gateways":"not_confirmed","f20_private_pops_dedicated_pops":"not_confirmed","f21_private_global_backbone":"yes","f22_regional_breakout_and_data_residency":"yes","f23_multi_cloud_transit_fabric":"not_confirmed","f24_flexible_edge_form_factors":"not_confirmed","f25_high_availability_design":"not_confirmed","f26_sla_backed_service_fabric":"yes","f27_integrated_next_generation_firewall":"not_confirmed","f28_full_sase_platform":"yes","f29_sse_ecosystem_integration":"yes","f30_zero_trust_network_access":"not_confirmed","f31_secure_web_gateway":"not_confirmed","f32_casb_capability":"yes","f33_data_loss_prevention":"yes","f34_remote_user_access":"yes","f35_soc_siem_soar_integration":"yes","f36_centralised_orchestration":"yes","f37_customer_portal_and_rbac":"yes","f38_observability_and_digital_experience_monitoring":"not_confirmed","f39_apis_and_automation":"yes","f40_managed_service_assurance":"partial"},"deployment_speed":"days","regions":{"uk_ireland":"yes","europe":"yes","north_america":"yes","asia_pacific":"yes","middle_east_africa":"yes","latin_america":"yes","china_mainland":"partner_integrated"},"supported_clouds":{"aws":"yes","azure":"yes","gcp":"yes","oracle_cloud":"partial","alibaba_cloud":"partial"},"ai_capability":{"ai_driven_operations":"partial","ai_security_analytics":"partial","ai_assistant":"partial","note":"AI Observe anomaly detection on the private core; AI Perform for application optimisation."},"resilience":{"disaster_recovery":"yes","note":"Owned Layer 2 core with 40+ PoPs and managed middle mile; built-in link and PoP failover."},"sectors":{"healthcare":"partial","financial_services":"yes","retail_ecommerce":"partial","manufacturing":"yes","energy_utilities":"yes","government_public_sector":"not_confirmed","education":"not_confirmed","transport_logistics":"yes","professional_services":"yes","hospitality_leisure":"not_confirmed"},"organisation_fit":{"large_global_enterprise":"yes","mid_market":"yes","small_business":"partial"},"pricing_units":["per_site","per_bandwidth","custom_quote"],"identity_providers":{"entra_id":"yes","okta":"yes","ping":"yes","google_workspace":"yes"},"device_posture":"yes","agent_platforms":{"windows":"yes","macos":"yes","ios":"yes","android":"yes","linux":"partial","chromeos":"partial","agentless":"yes"},"pop_count":40,"sla_availability_pct":99.999,"support_model":{"follow_the_sun_24x7":"yes","uk_support_desk":"partial","named_tam":"partial"},"logging":{"siem_export":"yes","log_retention_days":null},"marketplace_url":"https://netify.co.uk/marketplace/aryaka/","shortlist_summary":"Aryaka is one of the older, more established names in this category - founded 2009, more than 15 years before ‘SASE’ existed as an analyst-defined term, originally as a WAN optimisation and application-acceleration company before evolving into what it now calls ‘Unified SASE as a Service’. That specific phrase matters: Aryaka positions itself, and is described by independent commentary, as the first company to deliver SASE as a fully managed service rather than a self-managed software platform, built around a distinctive single-pass architecture (OnePASS) running over an owned, global private core network spanning more than 40 points of presence across six continents.","key_differentiators":["Unified SASE delivered as a managed service from end to end, including the private global core network and WAN optimisation.","Strong story for global organisations needing predictable performance between regions without internet variability.","Embedded WAN optimisation differentiates from pure cloud-delivered SASE platforms."],"best_fit_for":["Global enterprises wanting SASE delivered as a fully managed service rather than as DIY platform plus tools.","Buyers who need consistent inter-regional performance for chatty applications.","Organisations preferring a vendor that owns the platform and the managed service rather than coordinating multiple parties."],"watch_outs":["Smaller PoP footprint and partner ecosystem than the hyperscale SASE vendors; coverage must match your geographic profile.","DIY/self-managed model has limited evidence; this is a managed-service-first proposition.","CASB and DLP capabilities have partial public evidence; depth should be confirmed in RFP."],"evidence_coverage_pct":0.6,"last_verified":"2026-09-01","evidence_source_count":26,"independent_evidence_source_count":0,"position":12,"research_metrics":{"supported":20,"partial":3,"partner_delivered":1,"managed_service_dependent":0,"not_primary":0,"unconfirmed":16,"total":40,"reviewed":24,"completeness_percent":60,"completeness":0.6},"proven_evidence_count":20,"gaps":[]},{"slug":"cloudflare-one","name":"Cloudflare One","website":"https://www.cloudflare.com/sase","category":"SASE / Zero Trust / network services","product_focus":"Cloudflare WAN / Magic WAN / Zero Trust","cost_model":"Quote-based enterprise pricing; some Zero Trust user tiers public, Magic WAN enterprise requires quote.","public_pricing_visibility":"quote_based","value_tier":"value","uk_delivery":"uk_pops_partner","uk_basis":"No UK HQ (US). Multiple UK edge locations; self-serve or via UK partners.","capabilities":{"f01_fully_managed_service":"not_primary","f02_diy_self_managed_model":"yes","f03_co_managed_service":"partial","f04_multi_tenant_msp_white_label_support":"partial","f05_professional_services_and_migration_support":"yes","f06_last_mile_circuit_management":"partner_integrated","f07_lifecycle_management":"not_confirmed","f08_flexible_commercial_model":"yes","f09_encrypted_overlay_fabric":"partial","f10_dynamic_path_selection":"not_confirmed","f11_active_active_link_utilisation":"partial","f12_application_aware_routing":"not_confirmed","f13_qos_and_traffic_shaping":"not_confirmed","f14_packet_loss_remediation":"not_confirmed","f15_local_internet_breakout":"yes","f16_mpls_coexistence_and_migration":"partial","f17_cellular_and_5g_support":"not_confirmed","f18_cloud_on_ramp":"not_confirmed","f19_public_cloud_gateways":"not_confirmed","f20_private_pops_dedicated_pops":"partial","f21_private_global_backbone":"yes","f22_regional_breakout_and_data_residency":"yes","f23_multi_cloud_transit_fabric":"not_confirmed","f24_flexible_edge_form_factors":"not_confirmed","f25_high_availability_design":"not_confirmed","f26_sla_backed_service_fabric":"yes","f27_integrated_next_generation_firewall":"not_confirmed","f28_full_sase_platform":"yes","f29_sse_ecosystem_integration":"yes","f30_zero_trust_network_access":"not_confirmed","f31_secure_web_gateway":"not_confirmed","f32_casb_capability":"not_confirmed","f33_data_loss_prevention":"not_confirmed","f34_remote_user_access":"yes","f35_soc_siem_soar_integration":"yes","f36_centralised_orchestration":"yes","f37_customer_portal_and_rbac":"yes","f38_observability_and_digital_experience_monitoring":"not_confirmed","f39_apis_and_automation":"yes","f40_managed_service_assurance":"partial"},"deployment_speed":"hours","regions":{"uk_ireland":"yes","europe":"yes","north_america":"yes","asia_pacific":"yes","middle_east_africa":"yes","latin_america":"yes","china_mainland":"partner_integrated"},"supported_clouds":{"aws":"yes","azure":"yes","gcp":"yes","oracle_cloud":"partial","alibaba_cloud":"not_confirmed"},"ai_capability":{"ai_driven_operations":"partial","ai_security_analytics":"partial","ai_assistant":"yes","note":"AI assistant and security analytics across the global edge; Workers AI platform adjacency."},"resilience":{"disaster_recovery":"yes","note":"Anycast edge across 300+ cities removes single PoP dependency; automatic re-routing."},"sectors":{"healthcare":"partial","financial_services":"yes","retail_ecommerce":"yes","manufacturing":"yes","energy_utilities":"not_confirmed","government_public_sector":"yes","education":"partial","transport_logistics":"yes","professional_services":"not_confirmed","hospitality_leisure":"not_confirmed"},"organisation_fit":{"large_global_enterprise":"yes","mid_market":"yes","small_business":"yes"},"pricing_units":["per_user","bundle","custom_quote"],"identity_providers":{"entra_id":"yes","okta":"yes","ping":"yes","google_workspace":"yes"},"device_posture":"yes","agent_platforms":{"windows":"yes","macos":"yes","ios":"yes","android":"yes","linux":"partial","chromeos":"partial","agentless":"yes"},"pop_count":300,"sla_availability_pct":100,"support_model":{"follow_the_sun_24x7":"yes","uk_support_desk":"partial","named_tam":"partial"},"logging":{"siem_export":"yes","log_retention_days":null},"marketplace_url":"https://netify.co.uk/marketplace/cloudflare-one/","shortlist_summary":"Rather than building a security platform and adding network reach, or building a network and adding security, Cloudflare started as one of the internet’s largest content-delivery and DDoS-mitigation networks (founded 2009, public since 2019 on NYSE: NET) and extended that same global infrastructure - every product running in every data centre, not routed to a handful of regional security hubs - into a full SASE platform.","key_differentiators":["Cloudflare global edge network provides one of the largest PoP footprints in the category for SASE traffic.","Strong Zero Trust and SWG capability inheritance from the wider Cloudflare security platform.","Magic WAN Connector provides simplified branch connectivity into the Cloudflare One platform."],"best_fit_for":["Buyers already using Cloudflare for DDoS protection, CDN or Zero Trust who want to extend into WAN.","Organisations prioritising global PoP coverage and edge performance for SaaS access.","Mid-market buyers attracted to Cloudflare One pricing transparency for Zero Trust user tiers."],"watch_outs":["SD-WAN capabilities (path selection, QoS, packet loss remediation) have limited public evidence compared to SD-WAN-first vendors.","Less mature for very large branch estates with complex underlay requirements.","Managed and co-managed service models are partner-led; this is primarily a self-service platform."],"evidence_coverage_pct":0.575,"last_verified":"2026-09-01","evidence_source_count":47,"independent_evidence_source_count":0,"position":13,"research_metrics":{"supported":14,"partial":7,"partner_delivered":1,"managed_service_dependent":0,"not_primary":1,"unconfirmed":17,"total":40,"reviewed":23,"completeness_percent":58,"completeness":0.575},"proven_evidence_count":14,"gaps":[]},{"slug":"ntt","name":"NTT DATA","website":"https://www.nttglobal.net/services/sd-wan","category":"Global managed network provider","product_focus":"Managed SD-WAN, Managed SASE, Palo Alto/Zscaler partnerships","cost_model":"Quote-based managed service; global design/delivery/support, SD-WAN vendor and security stack determine cost.","public_pricing_visibility":"quote_based","value_tier":"premium","uk_delivery":"uk_entity","uk_basis":"UK contracting entity (NTT DATA UK) of a Japanese parent, with UK delivery and operations.","capabilities":{"f01_fully_managed_service":"yes","f02_diy_self_managed_model":"partial","f03_co_managed_service":"partial","f04_multi_tenant_msp_white_label_support":"not_confirmed","f05_professional_services_and_migration_support":"yes","f06_last_mile_circuit_management":"yes","f07_lifecycle_management":"yes","f08_flexible_commercial_model":"yes","f09_encrypted_overlay_fabric":"yes","f10_dynamic_path_selection":"not_confirmed","f11_active_active_link_utilisation":"yes","f12_application_aware_routing":"not_confirmed","f13_qos_and_traffic_shaping":"not_confirmed","f14_packet_loss_remediation":"yes","f15_local_internet_breakout":"not_confirmed","f16_mpls_coexistence_and_migration":"yes","f17_cellular_and_5g_support":"not_confirmed","f18_cloud_on_ramp":"not_confirmed","f19_public_cloud_gateways":"not_confirmed","f20_private_pops_dedicated_pops":"not_confirmed","f21_private_global_backbone":"yes","f22_regional_breakout_and_data_residency":"yes","f23_multi_cloud_transit_fabric":"not_confirmed","f24_flexible_edge_form_factors":"not_confirmed","f25_high_availability_design":"yes","f26_sla_backed_service_fabric":"yes","f27_integrated_next_generation_firewall":"not_confirmed","f28_full_sase_platform":"yes","f29_sse_ecosystem_integration":"yes","f30_zero_trust_network_access":"not_confirmed","f31_secure_web_gateway":"not_confirmed","f32_casb_capability":"not_confirmed","f33_data_loss_prevention":"not_confirmed","f34_remote_user_access":"yes","f35_soc_siem_soar_integration":"yes","f36_centralised_orchestration":"yes","f37_customer_portal_and_rbac":"yes","f38_observability_and_digital_experience_monitoring":"not_confirmed","f39_apis_and_automation":"partial","f40_managed_service_assurance":"yes"},"deployment_speed":"months","regions":{"uk_ireland":"yes","europe":"yes","north_america":"yes","asia_pacific":"yes","middle_east_africa":"yes","latin_america":"partial","china_mainland":"yes"},"supported_clouds":{"aws":"yes","azure":"yes","gcp":"yes","oracle_cloud":"partial","alibaba_cloud":"partial"},"ai_capability":{"ai_driven_operations":"partial","ai_security_analytics":"partial","ai_assistant":"managed_service_dependent","note":"Predictive analytics within the Managed Network Services platform."},"resilience":{"disaster_recovery":"yes","note":"Global Tier 1 IP backbone with multi-vendor managed redundancy."},"sectors":{"healthcare":"yes","financial_services":"yes","retail_ecommerce":"yes","manufacturing":"yes","energy_utilities":"yes","government_public_sector":"yes","education":"yes","transport_logistics":"yes","professional_services":"yes","hospitality_leisure":"yes"},"organisation_fit":{"large_global_enterprise":"yes","mid_market":"partial","small_business":"not_confirmed"},"pricing_units":["per_site","bundle","custom_quote"],"identity_providers":{"entra_id":"managed_service_dependent","okta":"managed_service_dependent","ping":"managed_service_dependent","google_workspace":"managed_service_dependent"},"device_posture":"managed_service_dependent","agent_platforms":{"windows":"managed_service_dependent","macos":"managed_service_dependent","ios":"managed_service_dependent","android":"managed_service_dependent","linux":"managed_service_dependent","chromeos":"managed_service_dependent","agentless":"managed_service_dependent"},"pop_count":75,"sla_availability_pct":100,"support_model":{"follow_the_sun_24x7":"yes","uk_support_desk":"partial","named_tam":"yes"},"logging":{"siem_export":"managed_service_dependent","log_retention_days":null},"marketplace_url":"https://netify.co.uk/marketplace/ntt-data/","shortlist_summary":"NTT DATA is a massive, globally-established IT services and network provider, founded in Japan in 1988 as a spinoff of Nippon Telegraph and Telephone (NTT), and now operating in more than 70 countries with approximately 190,000 employees. A significant, current corporate event is worth understanding first: on 8 May 2025, NTT, Inc. 75% acceptance, and following shareholder approval on 29 August 2025, NTT DATA Group was formally delisted from the Tokyo Stock Exchange on 26 September 2025, becoming a wholly-owned subsidiary of NTT, Inc.","key_differentiators":["24x7 managed SD-WAN delivery via global operations centres with strong portal visibility.","Managed SASE partnership with Palo Alto Networks (Prisma SASE) for buyers wanting that platform under managed service.","Strong global delivery footprint including APAC, EMEA and Americas."],"best_fit_for":["Multinational enterprises wanting truly global managed delivery with consistent operations across regions.","Buyers wanting Prisma SASE consumed as a fully managed service.","Organisations prioritising managed service maturity and global SOC/NOC depth."],"watch_outs":["Platform fit depends on which vendor is being proposed (Palo Alto, Zscaler, others); evaluate platform independently.","Commercial complexity is meaningful at global scale; ensure scope and RACI are explicit.","DIY/self-managed model is not the primary positioning."],"evidence_coverage_pct":0.575,"last_verified":"2026-09-01","evidence_source_count":22,"independent_evidence_source_count":0,"position":14,"research_metrics":{"supported":20,"partial":3,"partner_delivered":0,"managed_service_dependent":0,"not_primary":0,"unconfirmed":17,"total":40,"reviewed":23,"completeness_percent":58,"completeness":0.575},"proven_evidence_count":20,"gaps":[]},{"slug":"att-business","name":"AT&T Business","website":"https://www.business.att.com/products/sd-wan.html","category":"Global carrier managed SD-WAN / SASE provider","product_focus":"Managed SD-WAN portfolio, AT&T SASE with partners/Fortinet","cost_model":"Quote-based managed service; access circuits, security, platform and managed service wrapped into term contract.","public_pricing_visibility":"quote_based","value_tier":"premium","uk_delivery":"global_managed","uk_basis":"No UK HQ (US). UK sites served through AT&T's global managed network and partners, not UK-native infrastructure.","capabilities":{"f01_fully_managed_service":"yes","f02_diy_self_managed_model":"partial","f03_co_managed_service":"yes","f04_multi_tenant_msp_white_label_support":"partial","f05_professional_services_and_migration_support":"yes","f06_last_mile_circuit_management":"yes","f07_lifecycle_management":"partial","f08_flexible_commercial_model":"yes","f09_encrypted_overlay_fabric":"yes","f10_dynamic_path_selection":"not_confirmed","f11_active_active_link_utilisation":"yes","f12_application_aware_routing":"not_confirmed","f13_qos_and_traffic_shaping":"not_confirmed","f14_packet_loss_remediation":"not_confirmed","f15_local_internet_breakout":"not_confirmed","f16_mpls_coexistence_and_migration":"yes","f17_cellular_and_5g_support":"not_confirmed","f18_cloud_on_ramp":"not_confirmed","f19_public_cloud_gateways":"not_confirmed","f20_private_pops_dedicated_pops":"not_confirmed","f21_private_global_backbone":"yes","f22_regional_breakout_and_data_residency":"yes","f23_multi_cloud_transit_fabric":"not_confirmed","f24_flexible_edge_form_factors":"not_confirmed","f25_high_availability_design":"not_confirmed","f26_sla_backed_service_fabric":"partial","f27_integrated_next_generation_firewall":"not_confirmed","f28_full_sase_platform":"yes","f29_sse_ecosystem_integration":"yes","f30_zero_trust_network_access":"not_confirmed","f31_secure_web_gateway":"not_confirmed","f32_casb_capability":"not_confirmed","f33_data_loss_prevention":"not_confirmed","f34_remote_user_access":"yes","f35_soc_siem_soar_integration":"yes","f36_centralised_orchestration":"yes","f37_customer_portal_and_rbac":"yes","f38_observability_and_digital_experience_monitoring":"not_confirmed","f39_apis_and_automation":"partial","f40_managed_service_assurance":"partial"},"deployment_speed":"months","regions":{"uk_ireland":"yes","europe":"yes","north_america":"yes","asia_pacific":"yes","middle_east_africa":"yes","latin_america":"yes","china_mainland":"partial"},"supported_clouds":{"aws":"yes","azure":"yes","gcp":"yes","oracle_cloud":"not_confirmed","alibaba_cloud":"not_confirmed"},"ai_capability":{"ai_driven_operations":"managed_service_dependent","ai_security_analytics":"managed_service_dependent","ai_assistant":"managed_service_dependent","note":"AI capability depends on the underlying vendor platform chosen (Cisco, Fortinet, VeloCloud)."},"resilience":{"disaster_recovery":"managed_service_dependent","note":"Resilience designed per contract; dual-vendor and wireless backup options via managed service."},"sectors":{"healthcare":"yes","financial_services":"yes","retail_ecommerce":"yes","manufacturing":"yes","energy_utilities":"partial","government_public_sector":"yes","education":"yes","transport_logistics":"yes","professional_services":"not_confirmed","hospitality_leisure":"yes"},"organisation_fit":{"large_global_enterprise":"yes","mid_market":"yes","small_business":"yes"},"pricing_units":["per_site","bundle","custom_quote"],"identity_providers":{"entra_id":"managed_service_dependent","okta":"managed_service_dependent","ping":"managed_service_dependent","google_workspace":"managed_service_dependent"},"device_posture":"managed_service_dependent","agent_platforms":{"windows":"managed_service_dependent","macos":"managed_service_dependent","ios":"managed_service_dependent","android":"managed_service_dependent","linux":"managed_service_dependent","chromeos":"managed_service_dependent","agentless":"managed_service_dependent"},"pop_count":1600,"sla_availability_pct":100,"support_model":{"follow_the_sun_24x7":"yes","uk_support_desk":"partial","named_tam":"yes"},"logging":{"siem_export":"managed_service_dependent","log_retention_days":null},"marketplace_url":"https://netify.co.uk/marketplace/att/","shortlist_summary":"AT&T is one of the largest telecommunications companies in the United States, reporting trailing-twelve-month revenue of approximately $120.7 billion as of Q1 2026, with fixed-line enterprise services (including the SD-WAN and SASE proposition covered in this profile) accounting for roughly 14% of total revenue. AT&T’s SASE strategy is built on two named, current, dated technology partnerships.","key_differentiators":["Major US carrier-led managed SD-WAN portfolio with multi-vendor platform options (including Fortinet for AT&T SASE).","Strong North American underlay ownership with global delivery via international partnerships.","AT&T SASE unifies SD-WAN with network security as a converged managed service."],"best_fit_for":["US-headquartered enterprises wanting integrated carrier-led SD-WAN and SASE.","Buyers wanting Fortinet SASE delivered as a managed service rather than DIY.","Organisations prioritising carrier-grade SLAs and managed service maturity."],"watch_outs":["Underlying platform varies by service tier; buyers should confirm which platform supports the proposed scope.","International delivery depth depends on partnerships outside North America.","Commercial structure typically bundles access, security and platform; line-item costing requires explicit RFP."],"evidence_coverage_pct":0.55,"last_verified":"2026-09-01","evidence_source_count":18,"independent_evidence_source_count":1,"position":15,"research_metrics":{"supported":16,"partial":6,"partner_delivered":0,"managed_service_dependent":0,"not_primary":0,"unconfirmed":18,"total":40,"reviewed":22,"completeness_percent":55,"completeness":0.55},"proven_evidence_count":16,"gaps":[]},{"slug":"colt-technology-services","name":"Colt Technology Services","website":"https://www.colt.net/products/networking/sd-wan","category":"Enterprise managed SD-WAN / connectivity provider","product_focus":"Colt SD WAN & SASE, managed/co-managed","cost_model":"Quote-based managed service; access, SD-WAN/SASE design, data sovereignty and service options drive pricing.","public_pricing_visibility":"quote_based","value_tier":"mid","uk_delivery":"uk_hq","uk_basis":"UK headquartered (London). UK contracting entity with owned UK metro fibre and UK support.","capabilities":{"f01_fully_managed_service":"yes","f02_diy_self_managed_model":"partial","f03_co_managed_service":"yes","f04_multi_tenant_msp_white_label_support":"yes","f05_professional_services_and_migration_support":"partial","f06_last_mile_circuit_management":"yes","f07_lifecycle_management":"not_confirmed","f08_flexible_commercial_model":"yes","f09_encrypted_overlay_fabric":"yes","f10_dynamic_path_selection":"not_confirmed","f11_active_active_link_utilisation":"yes","f12_application_aware_routing":"not_confirmed","f13_qos_and_traffic_shaping":"not_confirmed","f14_packet_loss_remediation":"not_confirmed","f15_local_internet_breakout":"not_confirmed","f16_mpls_coexistence_and_migration":"yes","f17_cellular_and_5g_support":"not_confirmed","f18_cloud_on_ramp":"not_confirmed","f19_public_cloud_gateways":"not_confirmed","f20_private_pops_dedicated_pops":"partial","f21_private_global_backbone":"yes","f22_regional_breakout_and_data_residency":"yes","f23_multi_cloud_transit_fabric":"not_confirmed","f24_flexible_edge_form_factors":"not_confirmed","f25_high_availability_design":"not_confirmed","f26_sla_backed_service_fabric":"yes","f27_integrated_next_generation_firewall":"not_confirmed","f28_full_sase_platform":"yes","f29_sse_ecosystem_integration":"yes","f30_zero_trust_network_access":"not_confirmed","f31_secure_web_gateway":"not_confirmed","f32_casb_capability":"not_confirmed","f33_data_loss_prevention":"not_confirmed","f34_remote_user_access":"yes","f35_soc_siem_soar_integration":"yes","f36_centralised_orchestration":"yes","f37_customer_portal_and_rbac":"yes","f38_observability_and_digital_experience_monitoring":"not_confirmed","f39_apis_and_automation":"partial","f40_managed_service_assurance":"partial"},"deployment_speed":"months","regions":{"uk_ireland":"yes","europe":"yes","north_america":"yes","asia_pacific":"yes","middle_east_africa":"partial","latin_america":"partial","china_mainland":"not_confirmed"},"supported_clouds":{"aws":"yes","azure":"yes","gcp":"yes","oracle_cloud":"partial","alibaba_cloud":"not_confirmed"},"ai_capability":{"ai_driven_operations":"managed_service_dependent","ai_security_analytics":"managed_service_dependent","ai_assistant":"managed_service_dependent","note":"Depends on vendor platform (Versa, VeloCloud); Colt On Demand portal adds analytics."},"resilience":{"disaster_recovery":"yes","note":"Owned Colt IQ Network fibre with diverse routing and on-demand failover."},"sectors":{"healthcare":"yes","financial_services":"yes","retail_ecommerce":"yes","manufacturing":"partial","energy_utilities":"not_confirmed","government_public_sector":"partial","education":"yes","transport_logistics":"yes","professional_services":"yes","hospitality_leisure":"partial"},"organisation_fit":{"large_global_enterprise":"yes","mid_market":"yes","small_business":"not_confirmed"},"pricing_units":["per_site","bundle","custom_quote"],"identity_providers":{"entra_id":"managed_service_dependent","okta":"managed_service_dependent","ping":"managed_service_dependent","google_workspace":"managed_service_dependent"},"device_posture":"managed_service_dependent","agent_platforms":{"windows":"managed_service_dependent","macos":"managed_service_dependent","ios":"managed_service_dependent","android":"managed_service_dependent","linux":"managed_service_dependent","chromeos":"managed_service_dependent","agentless":"managed_service_dependent"},"pop_count":null,"sla_availability_pct":99.9,"support_model":{"follow_the_sun_24x7":"yes","uk_support_desk":"yes","named_tam":"yes"},"logging":{"siem_export":"managed_service_dependent","log_retention_days":null},"marketplace_url":"https://netify.co.uk/marketplace/colt/","shortlist_summary":"Colt Technology Services is a long-established, European-anchored network operator, founded in 1992 as City of London Telecommunications and headquartered in London. Since 2015 Colt has been privately owned by Fidelity International (Eight Roads’ current specific role to be reconfirmed), and its network footprint expanded materially through a significant acquisition of Lumen Technologies’ Europe, Middle East and Africa business for $1.8 billion, completed November 2022, reinforcing Colt’s own confirmed network scale of more than 30 countries, more than 50 metropolitan area networks, and more than 32,000 on-net buildings, all delivered over its own named Colt IQ Network platform.","key_differentiators":["SD-WAN and SASE with strong European data sovereignty positioning.","Managed and co-managed delivery options with management portal access.","Enterprise-grade connectivity heritage with substantial European network ownership."],"best_fit_for":["European enterprises prioritising data residency, sovereignty and regulatory alignment.","Buyers wanting genuine co-managed delivery rather than pure managed or pure DIY.","Organisations consolidating European connectivity with SD-WAN under one provider."],"watch_outs":["Global delivery depth outside Europe is less prominent than the largest global carriers.","CASB and DLP have partial public evidence; SSE platform partner choice should be confirmed.","Underlying SD-WAN platform should be explicitly confirmed in RFP."],"evidence_coverage_pct":0.55,"last_verified":"2026-09-01","evidence_source_count":14,"independent_evidence_source_count":1,"position":16,"research_metrics":{"supported":17,"partial":5,"partner_delivered":0,"managed_service_dependent":0,"not_primary":0,"unconfirmed":18,"total":40,"reviewed":22,"completeness_percent":55,"completeness":0.55},"proven_evidence_count":17,"gaps":[]},{"slug":"comcast-business","name":"Comcast Business","website":"https://business.comcast.com","category":"Managed SD-WAN / SASE provider","product_focus":"Comcast Business SASE, Masergy AIOps heritage","cost_model":"Quote-based managed/co-managed service; access, SD-WAN, SASE and SOC/AIOps elements drive cost.","public_pricing_visibility":"quote_based","value_tier":"mid","uk_delivery":"global_managed","uk_basis":"No UK HQ (US). UK delivery via the Masergy global platform and partners.","capabilities":{"f01_fully_managed_service":"yes","f02_diy_self_managed_model":"partial","f03_co_managed_service":"yes","f04_multi_tenant_msp_white_label_support":"partial","f05_professional_services_and_migration_support":"partial","f06_last_mile_circuit_management":"yes","f07_lifecycle_management":"partial","f08_flexible_commercial_model":"yes","f09_encrypted_overlay_fabric":"yes","f10_dynamic_path_selection":"not_confirmed","f11_active_active_link_utilisation":"yes","f12_application_aware_routing":"not_confirmed","f13_qos_and_traffic_shaping":"not_confirmed","f14_packet_loss_remediation":"not_confirmed","f15_local_internet_breakout":"not_confirmed","f16_mpls_coexistence_and_migration":"yes","f17_cellular_and_5g_support":"not_confirmed","f18_cloud_on_ramp":"not_confirmed","f19_public_cloud_gateways":"not_confirmed","f20_private_pops_dedicated_pops":"not_confirmed","f21_private_global_backbone":"partial","f22_regional_breakout_and_data_residency":"yes","f23_multi_cloud_transit_fabric":"not_confirmed","f24_flexible_edge_form_factors":"not_confirmed","f25_high_availability_design":"not_confirmed","f26_sla_backed_service_fabric":"yes","f27_integrated_next_generation_firewall":"not_confirmed","f28_full_sase_platform":"yes","f29_sse_ecosystem_integration":"yes","f30_zero_trust_network_access":"not_confirmed","f31_secure_web_gateway":"not_confirmed","f32_casb_capability":"not_confirmed","f33_data_loss_prevention":"not_confirmed","f34_remote_user_access":"yes","f35_soc_siem_soar_integration":"yes","f36_centralised_orchestration":"yes","f37_customer_portal_and_rbac":"yes","f38_observability_and_digital_experience_monitoring":"not_confirmed","f39_apis_and_automation":"partial","f40_managed_service_assurance":"partial"},"deployment_speed":"weeks","regions":{"uk_ireland":"partial","europe":"partial","north_america":"yes","asia_pacific":"partial","middle_east_africa":"partial","latin_america":"partial","china_mainland":"not_confirmed"},"supported_clouds":{"aws":"yes","azure":"yes","gcp":"yes","oracle_cloud":"not_confirmed","alibaba_cloud":"not_confirmed"},"ai_capability":{"ai_driven_operations":"partial","ai_security_analytics":"partial","ai_assistant":"not_confirmed","note":"Masergy AIOps digital twin for managed customers; predictive fault analytics."},"resilience":{"disaster_recovery":"yes","note":"4G LTE backup widely bundled; Masergy global core adds route diversity."},"sectors":{"healthcare":"yes","financial_services":"yes","retail_ecommerce":"yes","manufacturing":"yes","energy_utilities":"not_confirmed","government_public_sector":"yes","education":"yes","transport_logistics":"not_confirmed","professional_services":"not_confirmed","hospitality_leisure":"yes"},"organisation_fit":{"large_global_enterprise":"yes","mid_market":"yes","small_business":"yes"},"pricing_units":["per_site","bundle","custom_quote"],"identity_providers":{"entra_id":"managed_service_dependent","okta":"managed_service_dependent","ping":"managed_service_dependent","google_workspace":"managed_service_dependent"},"device_posture":"managed_service_dependent","agent_platforms":{"windows":"managed_service_dependent","macos":"managed_service_dependent","ios":"managed_service_dependent","android":"managed_service_dependent","linux":"managed_service_dependent","chromeos":"managed_service_dependent","agentless":"managed_service_dependent"},"pop_count":null,"sla_availability_pct":100,"support_model":{"follow_the_sun_24x7":"yes","uk_support_desk":"partial","named_tam":"partial"},"logging":{"siem_export":"managed_service_dependent","log_retention_days":null},"marketplace_url":"https://netify.co.uk/marketplace/comcastbusiness/","shortlist_summary":"Comcast Business’s managed SD-WAN and SASE proposition traces its specialist technical foundation to Masergy, a managed SD-WAN and SASE vendor founded in 2000 in Plano, Texas, which Comcast Business acquired in 2021 to, in the words of Comcast Business’s then-President Bill Stemper, ‘instantly and dramatically amplify our growth in the global enterprise market’.","key_differentiators":["SASE combining SD-WAN and security available fully managed or co-managed, drawing on Masergy AIOps heritage.","Recognised as a leading managed SD-WAN provider by industry analysts.","Strong North American underlay ownership with international delivery via partners."],"best_fit_for":["North American enterprises wanting managed or co-managed SD-WAN and SASE from a single carrier.","Buyers attracted to the AIOps capabilities inherited from the Masergy acquisition.","Organisations prioritising co-managed delivery with shared operational control."],"watch_outs":["International delivery depth depends on partnerships outside North America.","Underlying platform choice should be confirmed; service depth varies by selected platform.","Commercial model bundles access, SD-WAN, SASE and SOC elements; explicit line-item costing required."],"evidence_coverage_pct":0.55,"last_verified":"2026-09-01","evidence_source_count":12,"independent_evidence_source_count":1,"position":17,"research_metrics":{"supported":15,"partial":7,"partner_delivered":0,"managed_service_dependent":0,"not_primary":0,"unconfirmed":18,"total":40,"reviewed":22,"completeness_percent":55,"completeness":0.55},"proven_evidence_count":15,"gaps":[]},{"slug":"gtt","name":"GTT","website":"https://www.gtt.net/services/secure-networking/managed-sd-wan","category":"Global managed SD-WAN provider","product_focus":"Managed SD-WAN, SASE/SSE, Envision, Tier 1 backbone","cost_model":"Quote-based managed service; GTT public page answers cost only as consultative/requirement-based.","public_pricing_visibility":"quote_based","value_tier":"value","uk_delivery":"uk_entity","uk_basis":"UK contracting entity with UK operations on a Tier 1 backbone; UK and EMEA delivery is established.","capabilities":{"f01_fully_managed_service":"yes","f02_diy_self_managed_model":"partial","f03_co_managed_service":"yes","f04_multi_tenant_msp_white_label_support":"not_confirmed","f05_professional_services_and_migration_support":"partial","f06_last_mile_circuit_management":"yes","f07_lifecycle_management":"partial","f08_flexible_commercial_model":"yes","f09_encrypted_overlay_fabric":"yes","f10_dynamic_path_selection":"not_confirmed","f11_active_active_link_utilisation":"yes","f12_application_aware_routing":"not_confirmed","f13_qos_and_traffic_shaping":"not_confirmed","f14_packet_loss_remediation":"not_confirmed","f15_local_internet_breakout":"not_confirmed","f16_mpls_coexistence_and_migration":"yes","f17_cellular_and_5g_support":"not_confirmed","f18_cloud_on_ramp":"not_confirmed","f19_public_cloud_gateways":"not_confirmed","f20_private_pops_dedicated_pops":"partial","f21_private_global_backbone":"yes","f22_regional_breakout_and_data_residency":"yes","f23_multi_cloud_transit_fabric":"not_confirmed","f24_flexible_edge_form_factors":"not_confirmed","f25_high_availability_design":"not_confirmed","f26_sla_backed_service_fabric":"partial","f27_integrated_next_generation_firewall":"not_confirmed","f28_full_sase_platform":"yes","f29_sse_ecosystem_integration":"yes","f30_zero_trust_network_access":"not_confirmed","f31_secure_web_gateway":"not_confirmed","f32_casb_capability":"not_confirmed","f33_data_loss_prevention":"not_confirmed","f34_remote_user_access":"partner_integrated","f35_soc_siem_soar_integration":"partner_integrated","f36_centralised_orchestration":"yes","f37_customer_portal_and_rbac":"yes","f38_observability_and_digital_experience_monitoring":"not_confirmed","f39_apis_and_automation":"partial","f40_managed_service_assurance":"yes"},"deployment_speed":"months","regions":{"uk_ireland":"yes","europe":"yes","north_america":"yes","asia_pacific":"yes","middle_east_africa":"yes","latin_america":"yes","china_mainland":"partial"},"supported_clouds":{"aws":"yes","azure":"yes","gcp":"yes","oracle_cloud":"not_confirmed","alibaba_cloud":"not_confirmed"},"ai_capability":{"ai_driven_operations":"managed_service_dependent","ai_security_analytics":"managed_service_dependent","ai_assistant":"managed_service_dependent","note":"EtherVision portal analytics; platform AI depends on the chosen vendor mix."},"resilience":{"disaster_recovery":"yes","note":"Tier 1 backbone spanning 450+ PoPs with diverse routing."},"sectors":{"healthcare":"partial","financial_services":"yes","retail_ecommerce":"yes","manufacturing":"yes","energy_utilities":"not_confirmed","government_public_sector":"yes","education":"not_confirmed","transport_logistics":"yes","professional_services":"partial","hospitality_leisure":"yes"},"organisation_fit":{"large_global_enterprise":"yes","mid_market":"partial","small_business":"not_confirmed"},"pricing_units":["per_site","bundle","custom_quote"],"identity_providers":{"entra_id":"managed_service_dependent","okta":"managed_service_dependent","ping":"managed_service_dependent","google_workspace":"managed_service_dependent"},"device_posture":"managed_service_dependent","agent_platforms":{"windows":"managed_service_dependent","macos":"managed_service_dependent","ios":"managed_service_dependent","android":"managed_service_dependent","linux":"managed_service_dependent","chromeos":"managed_service_dependent","agentless":"managed_service_dependent"},"pop_count":400,"sla_availability_pct":99.99,"support_model":{"follow_the_sun_24x7":"yes","uk_support_desk":"partial","named_tam":"yes"},"logging":{"siem_export":"managed_service_dependent","log_retention_days":null},"marketplace_url":"https://netify.co.uk/marketplace/gtt/","shortlist_summary":"GTT Communications is a specialist, purely networking-and-security-focused global provider rather than a diversified telecom conglomerate with mobile, broadband, and media businesses attached. Founded in 1998, listed on the NYSE in 2013, renamed GTT Communications in January 2014, and now headquartered in Arlington, Virginia, GTT operates a global Tier 1 IP backbone spanning more than 600 points of presence and connecting more than 3,500 cities.","key_differentiators":["Tier 1 global backbone provides strong international transit capability alongside managed SD-WAN.","Vendor-agnostic SD-WAN delivery (multiple platform options) with the Envision management platform.","Recognised as a leader for SASE and managed SD-WAN by industry analysts."],"best_fit_for":["Multinational enterprises needing strong international backbone alongside managed SD-WAN.","Buyers wanting platform flexibility within a managed service.","Organisations consolidating global transit, SD-WAN and SASE under one provider."],"watch_outs":["SASE depth depends heavily on the chosen platform partner; native SSE capabilities are not primary positioning.","Security stack is largely partner-integrated.","Commercial model is consultative; ensure cost lines for managed changes, security and SLAs are explicit."],"evidence_coverage_pct":0.55,"last_verified":"2026-09-01","evidence_source_count":17,"independent_evidence_source_count":0,"position":18,"research_metrics":{"supported":14,"partial":6,"partner_delivered":2,"managed_service_dependent":0,"not_primary":0,"unconfirmed":18,"total":40,"reviewed":22,"completeness_percent":55,"completeness":0.55},"proven_evidence_count":14,"gaps":[]},{"slug":"juniper-networks","name":"Juniper Networks","website":"https://www.juniper.net","category":"AI-driven WAN / SD-branch technology vendor","product_focus":"Juniper SD-WAN, Mist WAN Assurance, SRX","cost_model":"Quote-based hardware/subscription/support; managed delivery via partners/providers.","public_pricing_visibility":"quote_based","value_tier":"mid","uk_delivery":"uk_pops_partner","uk_basis":"No UK HQ (US, now HPE). UK channel and delivery via partners and MSPs.","capabilities":{"f01_fully_managed_service":"partial","f02_diy_self_managed_model":"yes","f03_co_managed_service":"not_confirmed","f04_multi_tenant_msp_white_label_support":"partial","f05_professional_services_and_migration_support":"yes","f06_last_mile_circuit_management":"partner_integrated","f07_lifecycle_management":"partial","f08_flexible_commercial_model":"yes","f09_encrypted_overlay_fabric":"yes","f10_dynamic_path_selection":"not_confirmed","f11_active_active_link_utilisation":"yes","f12_application_aware_routing":"yes","f13_qos_and_traffic_shaping":"not_confirmed","f14_packet_loss_remediation":"not_confirmed","f15_local_internet_breakout":"not_confirmed","f16_mpls_coexistence_and_migration":"yes","f17_cellular_and_5g_support":"yes","f18_cloud_on_ramp":"not_confirmed","f19_public_cloud_gateways":"not_confirmed","f20_private_pops_dedicated_pops":"not_confirmed","f21_private_global_backbone":"not_confirmed","f22_regional_breakout_and_data_residency":"partial","f23_multi_cloud_transit_fabric":"not_confirmed","f24_flexible_edge_form_factors":"not_confirmed","f25_high_availability_design":"not_confirmed","f26_sla_backed_service_fabric":"not_confirmed","f27_integrated_next_generation_firewall":"not_confirmed","f28_full_sase_platform":"partial","f29_sse_ecosystem_integration":"partial","f30_zero_trust_network_access":"not_confirmed","f31_secure_web_gateway":"yes","f32_casb_capability":"not_confirmed","f33_data_loss_prevention":"not_confirmed","f34_remote_user_access":"partial","f35_soc_siem_soar_integration":"yes","f36_centralised_orchestration":"yes","f37_customer_portal_and_rbac":"yes","f38_observability_and_digital_experience_monitoring":"yes","f39_apis_and_automation":"yes","f40_managed_service_assurance":"not_confirmed"},"deployment_speed":"days","regions":{"uk_ireland":"partial","europe":"yes","north_america":"yes","asia_pacific":"yes","middle_east_africa":"partial","latin_america":"not_confirmed","china_mainland":"not_confirmed"},"supported_clouds":{"aws":"yes","azure":"yes","gcp":"yes","oracle_cloud":"partial","alibaba_cloud":"not_confirmed"},"ai_capability":{"ai_driven_operations":"yes","ai_security_analytics":"partial","ai_assistant":"yes","note":"Mist AI and the Marvis conversational assistant; AI-native WAN assurance."},"resilience":{"disaster_recovery":"yes","note":"Session Smart Routing fails over per session with no tunnel re-establishment; HA clustering."},"sectors":{"healthcare":"yes","financial_services":"yes","retail_ecommerce":"yes","manufacturing":"yes","energy_utilities":"yes","government_public_sector":"yes","education":"yes","transport_logistics":"not_confirmed","professional_services":"not_confirmed","hospitality_leisure":"yes"},"organisation_fit":{"large_global_enterprise":"yes","mid_market":"not_confirmed","small_business":"not_confirmed"},"pricing_units":["per_site","custom_quote"],"identity_providers":{"entra_id":"yes","okta":"partial","ping":"partial","google_workspace":"partial"},"device_posture":"partial","agent_platforms":{"windows":"yes","macos":"yes","ios":"partial","android":"partial","linux":"partial","chromeos":"not_confirmed","agentless":"partial"},"pop_count":null,"sla_availability_pct":null,"support_model":{"follow_the_sun_24x7":"yes","uk_support_desk":"partial","named_tam":"partial"},"logging":{"siem_export":"yes","log_retention_days":null},"marketplace_url":"https://netify.co.uk/marketplace/juniper/","shortlist_summary":"Juniper Networks offer Mist AI with WAN Assurance, delivering AI-driven monitoring and troubleshooting at the WAN edge at a depth that few competitors match. Typically shortlisted by organisations where AIOps and network assurance quality are weighted evaluation criteria rather than SD-WAN feature breadth, and worth examining more closely than the overall score might suggest if AI-driven operations is a primary requirement.","key_differentiators":["Mist AI delivers WAN Assurance, providing AI-driven monitoring and troubleshooting at the WAN edge that few competitors match.","Strong story for buyers who want the WAN integrated with Mist-powered Wi-Fi and access network management.","Juniper SRX security platform integration provides native firewall capability for buyers standardised on Juniper."],"best_fit_for":["Enterprises already running Mist for Wi-Fi or access who want unified AI-driven operations across WAN and LAN.","Buyers prioritising observability and AI-assisted incident triage as a primary purchase criterion.","Organisations with strong network engineering capability who can take advantage of WAN Assurance telemetry."],"watch_outs":["SASE story is less mature than the SASE-led vendors; SSE capabilities have limited public evidence relative to category leaders.","Managed delivery is via partners; first-party managed service is not the primary model.","Cloud on-ramp and private backbone capabilities are less prominent than dedicated SASE platforms."],"evidence_coverage_pct":0.55,"last_verified":"2026-09-01","evidence_source_count":28,"independent_evidence_source_count":0,"position":19,"research_metrics":{"supported":14,"partial":7,"partner_delivered":1,"managed_service_dependent":0,"not_primary":0,"unconfirmed":18,"total":40,"reviewed":22,"completeness_percent":55,"completeness":0.55},"proven_evidence_count":14,"gaps":[]},{"slug":"lumen","name":"Lumen","website":"https://www.lumen.com/en-us/services/sd-wan.html","category":"Managed SD-WAN / NaaS provider","product_focus":"Managed or co-managed SD-WAN","cost_model":"Quote-based; Lumen states fully managed or co-managed SD-WAN, with access/network services priced by requirement.","public_pricing_visibility":"quote_based","value_tier":"premium","uk_delivery":"global_managed","uk_basis":"No UK HQ (US); UK delivery is largely via partners following the EMEA divestment to Colt.","capabilities":{"f01_fully_managed_service":"yes","f02_diy_self_managed_model":"partial","f03_co_managed_service":"yes","f04_multi_tenant_msp_white_label_support":"not_confirmed","f05_professional_services_and_migration_support":"yes","f06_last_mile_circuit_management":"yes","f07_lifecycle_management":"yes","f08_flexible_commercial_model":"yes","f09_encrypted_overlay_fabric":"yes","f10_dynamic_path_selection":"not_confirmed","f11_active_active_link_utilisation":"yes","f12_application_aware_routing":"not_confirmed","f13_qos_and_traffic_shaping":"not_confirmed","f14_packet_loss_remediation":"not_confirmed","f15_local_internet_breakout":"not_confirmed","f16_mpls_coexistence_and_migration":"yes","f17_cellular_and_5g_support":"not_confirmed","f18_cloud_on_ramp":"not_confirmed","f19_public_cloud_gateways":"not_confirmed","f20_private_pops_dedicated_pops":"yes","f21_private_global_backbone":"yes","f22_regional_breakout_and_data_residency":"partner_integrated","f23_multi_cloud_transit_fabric":"not_confirmed","f24_flexible_edge_form_factors":"not_confirmed","f25_high_availability_design":"not_confirmed","f26_sla_backed_service_fabric":"yes","f27_integrated_next_generation_firewall":"not_confirmed","f28_full_sase_platform":"partner_integrated","f29_sse_ecosystem_integration":"partner_integrated","f30_zero_trust_network_access":"not_confirmed","f31_secure_web_gateway":"not_confirmed","f32_casb_capability":"not_confirmed","f33_data_loss_prevention":"not_confirmed","f34_remote_user_access":"partner_integrated","f35_soc_siem_soar_integration":"partner_integrated","f36_centralised_orchestration":"yes","f37_customer_portal_and_rbac":"yes","f38_observability_and_digital_experience_monitoring":"not_confirmed","f39_apis_and_automation":"partial","f40_managed_service_assurance":"partial"},"deployment_speed":"months","regions":{"uk_ireland":"partial","europe":"partial","north_america":"yes","asia_pacific":"not_confirmed","middle_east_africa":"partial","latin_america":"not_confirmed","china_mainland":"not_confirmed"},"supported_clouds":{"aws":"yes","azure":"yes","gcp":"yes","oracle_cloud":"not_confirmed","alibaba_cloud":"not_confirmed"},"ai_capability":{"ai_driven_operations":"managed_service_dependent","ai_security_analytics":"managed_service_dependent","ai_assistant":"managed_service_dependent","note":"Depends on platform (VeloCloud, Versa); Lumen portal analytics for managed customers."},"resilience":{"disaster_recovery":"yes","note":"Extensive owned fibre and PoP diversity across North America."},"sectors":{"healthcare":"yes","financial_services":"yes","retail_ecommerce":"yes","manufacturing":"yes","energy_utilities":"partial","government_public_sector":"yes","education":"yes","transport_logistics":"partial","professional_services":"yes","hospitality_leisure":"partial"},"organisation_fit":{"large_global_enterprise":"yes","mid_market":"yes","small_business":"not_confirmed"},"pricing_units":["per_site","bundle","custom_quote"],"identity_providers":{"entra_id":"managed_service_dependent","okta":"managed_service_dependent","ping":"managed_service_dependent","google_workspace":"managed_service_dependent"},"device_posture":"managed_service_dependent","agent_platforms":{"windows":"managed_service_dependent","macos":"managed_service_dependent","ios":"managed_service_dependent","android":"managed_service_dependent","linux":"managed_service_dependent","chromeos":"managed_service_dependent","agentless":"managed_service_dependent"},"pop_count":50,"sla_availability_pct":99.99,"support_model":{"follow_the_sun_24x7":"yes","uk_support_desk":"partial","named_tam":"yes"},"logging":{"siem_export":"managed_service_dependent","log_retention_days":null},"marketplace_url":"https://netify.co.uk/marketplace/lumen/","shortlist_summary":"Lumen Technologies has just completed a corporate transformation - on 21 May 2025, Lumen announced the sale of its Mass Markets fiber-to-the-home business - including its Quantum Fiber consumer brand, serving more than 1 million subscribers across 11 states - to AT&T for $5.75 billion in cash, a transaction that closed on 2 February 2026. Lumen’s own CEO, Kate Johnson, described the deal directly as marking the company’s transformation into ‘a Pure Play Enterprise-Focused Technology Infrastructure Company’, retaining its national, regional, state, and metro fiber backbone specifically to support that enterprise focus while divesting the consumer-facing business entirely.","key_differentiators":["Fully managed or co-managed SD-WAN with strong NaaS positioning and integrated network services.","Substantial underlay ownership in North America with global reach.","Co-managed model provides operational flexibility for customers wanting selective control."],"best_fit_for":["North American enterprises wanting integrated managed SD-WAN, access and broader network services from one provider.","Buyers attracted to the NaaS consumption model.","Organisations wanting genuine co-managed delivery rather than pure managed or pure DIY."],"watch_outs":["SASE and security capabilities are largely partner-integrated rather than native; the SSE platform choice needs explicit evaluation.","International delivery depth is less prominent than the dedicated global carriers.","Underlying SD-WAN platform should be confirmed; platform choice affects feature set."],"evidence_coverage_pct":0.55,"last_verified":"2026-09-01","evidence_source_count":18,"independent_evidence_source_count":1,"position":20,"research_metrics":{"supported":14,"partial":3,"partner_delivered":5,"managed_service_dependent":0,"not_primary":0,"unconfirmed":18,"total":40,"reviewed":22,"completeness_percent":55,"completeness":0.55},"proven_evidence_count":14,"gaps":[]},{"slug":"bt-business","name":"BT","website":"https://business.bt.com/networks-digital-services/sd-wan","category":"Global/UK managed SD-WAN / SASE provider","product_focus":"Managed SD-WAN using Cisco, VMware/Broadcom, Fortinet, Palo Alto, Meraki","cost_model":"Quote-based managed service; includes access, CPE, vendor stack and service tier options.","public_pricing_visibility":"quote_based","value_tier":"mid","uk_delivery":"uk_hq","uk_basis":"UK headquartered (BT Group). UK contract holder with owned UK access, UK NOC and SOC, and named UK support.","capabilities":{"f01_fully_managed_service":"yes","f02_diy_self_managed_model":"partial","f03_co_managed_service":"yes","f04_multi_tenant_msp_white_label_support":"not_confirmed","f05_professional_services_and_migration_support":"yes","f06_last_mile_circuit_management":"yes","f07_lifecycle_management":"yes","f08_flexible_commercial_model":"yes","f09_encrypted_overlay_fabric":"yes","f10_dynamic_path_selection":"not_confirmed","f11_active_active_link_utilisation":"yes","f12_application_aware_routing":"not_confirmed","f13_qos_and_traffic_shaping":"not_confirmed","f14_packet_loss_remediation":"not_confirmed","f15_local_internet_breakout":"not_confirmed","f16_mpls_coexistence_and_migration":"yes","f17_cellular_and_5g_support":"not_confirmed","f18_cloud_on_ramp":"not_confirmed","f19_public_cloud_gateways":"not_confirmed","f20_private_pops_dedicated_pops":"not_confirmed","f21_private_global_backbone":"partial","f22_regional_breakout_and_data_residency":"yes","f23_multi_cloud_transit_fabric":"not_confirmed","f24_flexible_edge_form_factors":"not_confirmed","f25_high_availability_design":"not_confirmed","f26_sla_backed_service_fabric":"partial","f27_integrated_next_generation_firewall":"not_confirmed","f28_full_sase_platform":"yes","f29_sse_ecosystem_integration":"yes","f30_zero_trust_network_access":"not_confirmed","f31_secure_web_gateway":"not_confirmed","f32_casb_capability":"not_confirmed","f33_data_loss_prevention":"not_confirmed","f34_remote_user_access":"yes","f35_soc_siem_soar_integration":"yes","f36_centralised_orchestration":"yes","f37_customer_portal_and_rbac":"yes","f38_observability_and_digital_experience_monitoring":"not_confirmed","f39_apis_and_automation":"partial","f40_managed_service_assurance":"yes"},"deployment_speed":"weeks","regions":{"uk_ireland":"yes","europe":"yes","north_america":"yes","asia_pacific":"yes","middle_east_africa":"partial","latin_america":"partner_integrated","china_mainland":"partial"},"supported_clouds":{"aws":"yes","azure":"yes","gcp":"yes","oracle_cloud":"partial","alibaba_cloud":"not_confirmed"},"ai_capability":{"ai_driven_operations":"managed_service_dependent","ai_security_analytics":"managed_service_dependent","ai_assistant":"managed_service_dependent","note":"Depends on platform (Meraki, Versa, Fortinet); BT adds managed analytics and reporting."},"resilience":{"disaster_recovery":"yes","note":"Dual-hub designs, diverse UK last mile and 24x7 UK NOC under a single managed contract."},"sectors":{"healthcare":"partial","financial_services":"yes","retail_ecommerce":"yes","manufacturing":"yes","energy_utilities":"yes","government_public_sector":"yes","education":"not_confirmed","transport_logistics":"yes","professional_services":"partial","hospitality_leisure":"not_confirmed"},"organisation_fit":{"large_global_enterprise":"yes","mid_market":"partial","small_business":"partial"},"pricing_units":["per_site","bundle","custom_quote"],"identity_providers":{"entra_id":"managed_service_dependent","okta":"managed_service_dependent","ping":"managed_service_dependent","google_workspace":"managed_service_dependent"},"device_posture":"managed_service_dependent","agent_platforms":{"windows":"managed_service_dependent","macos":"managed_service_dependent","ios":"managed_service_dependent","android":"managed_service_dependent","linux":"managed_service_dependent","chromeos":"managed_service_dependent","agentless":"managed_service_dependent"},"pop_count":140,"sla_availability_pct":null,"support_model":{"follow_the_sun_24x7":"yes","uk_support_desk":"yes","named_tam":"yes"},"logging":{"siem_export":"managed_service_dependent","log_retention_days":null},"marketplace_url":"https://netify.co.uk/marketplace/bt/","shortlist_summary":"BT is not a single-platform SASE company, but the UK’s largest telecommunications operator and managed service provider, delivering SASE as one service line within a vastly larger, publicly-listed (LSE: BT.A) group.","key_differentiators":["UK market leader for managed SD-WAN with deep access circuit ownership and field engineering capability.","Multi-vendor platform support (Cisco, VMware/Broadcom, Fortinet, Palo Alto, Meraki) gives buyers platform choice within one managed service.","Strong global SD-WAN and SASE delivery via BT Global for multinational requirements."],"best_fit_for":["UK enterprises wanting a single supplier for SD-WAN platform, access circuits, security and field operations.","Multinational organisations with a UK headquarters needing global delivery via BT Global.","Buyers prioritising underlay accountability and field engineering depth alongside SD-WAN delivery."],"watch_outs":["Platform choice and packaging vary; buyers should confirm which vendor platform is being proposed and why.","DIY/self-managed model is not BT's primary positioning.","Co-managed model and customer control boundaries should be confirmed via RACI and portal demo."],"evidence_coverage_pct":0.525,"last_verified":"2026-09-01","evidence_source_count":17,"independent_evidence_source_count":1,"position":21,"research_metrics":{"supported":17,"partial":4,"partner_delivered":0,"managed_service_dependent":0,"not_primary":0,"unconfirmed":19,"total":40,"reviewed":21,"completeness_percent":53,"completeness":0.525},"proven_evidence_count":17,"gaps":[]},{"slug":"cradlepoint-ericsson","name":"Ericsson Cradlepoint","website":"https://cradlepoint.com","category":"Wireless WAN / SD-WAN adjacent vendor","product_focus":"Ericsson NetCloud SD-WAN, NetCloud SASE","cost_model":"Quote-based NetCloud subscriptions + routers/adapters; public hardware pricing may exist through resellers.","public_pricing_visibility":"quote_based","value_tier":"value","uk_delivery":"uk_pops_partner","uk_basis":"No UK HQ (US, Ericsson-owned). UK delivery via mobile operators and partners.","capabilities":{"f01_fully_managed_service":"not_primary","f02_diy_self_managed_model":"yes","f03_co_managed_service":"not_confirmed","f04_multi_tenant_msp_white_label_support":"partial","f05_professional_services_and_migration_support":"partner_integrated","f06_last_mile_circuit_management":"partner_integrated","f07_lifecycle_management":"yes","f08_flexible_commercial_model":"yes","f09_encrypted_overlay_fabric":"yes","f10_dynamic_path_selection":"not_confirmed","f11_active_active_link_utilisation":"yes","f12_application_aware_routing":"not_confirmed","f13_qos_and_traffic_shaping":"not_confirmed","f14_packet_loss_remediation":"not_confirmed","f15_local_internet_breakout":"not_confirmed","f16_mpls_coexistence_and_migration":"yes","f17_cellular_and_5g_support":"not_confirmed","f18_cloud_on_ramp":"not_confirmed","f19_public_cloud_gateways":"not_confirmed","f20_private_pops_dedicated_pops":"yes","f21_private_global_backbone":"not_confirmed","f22_regional_breakout_and_data_residency":"yes","f23_multi_cloud_transit_fabric":"not_confirmed","f24_flexible_edge_form_factors":"not_confirmed","f25_high_availability_design":"not_confirmed","f26_sla_backed_service_fabric":"not_confirmed","f27_integrated_next_generation_firewall":"not_confirmed","f28_full_sase_platform":"yes","f29_sse_ecosystem_integration":"partial","f30_zero_trust_network_access":"yes","f31_secure_web_gateway":"not_confirmed","f32_casb_capability":"not_confirmed","f33_data_loss_prevention":"not_confirmed","f34_remote_user_access":"partial","f35_soc_siem_soar_integration":"partial","f36_centralised_orchestration":"yes","f37_customer_portal_and_rbac":"yes","f38_observability_and_digital_experience_monitoring":"not_confirmed","f39_apis_and_automation":"partial","f40_managed_service_assurance":"partial"},"deployment_speed":"days","regions":{"uk_ireland":"yes","europe":"yes","north_america":"yes","asia_pacific":"yes","middle_east_africa":"partial","latin_america":"partial","china_mainland":"not_confirmed"},"supported_clouds":{"aws":"partial","azure":"partial","gcp":"not_confirmed","oracle_cloud":"not_confirmed","alibaba_cloud":"not_confirmed"},"ai_capability":{"ai_driven_operations":"partial","ai_security_analytics":"partial","ai_assistant":"partial","note":"NetCloud AIOps with anomaly detection and the NetCloud AI assistant."},"resilience":{"disaster_recovery":"yes","note":"Wireless WAN failover is the core use case; dual-SIM and dual-modem designs."},"sectors":{"healthcare":"yes","financial_services":"not_confirmed","retail_ecommerce":"yes","manufacturing":"partial","energy_utilities":"yes","government_public_sector":"yes","education":"yes","transport_logistics":"yes","professional_services":"partial","hospitality_leisure":"partner_integrated"},"organisation_fit":{"large_global_enterprise":"yes","mid_market":"yes","small_business":"partial"},"pricing_units":["per_site","custom_quote"],"identity_providers":{"entra_id":"yes","okta":"partial","ping":"partial","google_workspace":"partial"},"device_posture":"partial","agent_platforms":{"windows":"yes","macos":"yes","ios":"partial","android":"partial","linux":"partial","chromeos":"not_confirmed","agentless":"partial"},"pop_count":null,"sla_availability_pct":null,"support_model":{"follow_the_sun_24x7":"yes","uk_support_desk":"partial","named_tam":"partial"},"logging":{"siem_export":"yes","log_retention_days":null},"marketplace_url":"https://netify.co.uk/marketplace/ericsson-cradlepoint/","shortlist_summary":"1 billion. That makes this platform’s identity distinctive within this product category: it sits inside one of the world’s largest telecommunications equipment manufacturers rather than a standalone security company or a private-equity-backed challenger, and its architecture reflects that heritage directly - NetCloud SASE is built cellular-first, with confirmed, specific capabilities like traffic steering based on cellular attributes and 5G standalone network slicing for guaranteed bandwidth that have no real equivalent among fixed-line-oriented competitors.","key_differentiators":["Wireless-first branch architecture from Ericsson with deep 5G expertise; NetCloud provides cellular-centric SD-WAN management.","Strong story for organisations adopting 5G as a primary access medium rather than as a backup.","Network slicing and private 5G integration roadmap is more credible than competitors lacking cellular heritage."],"best_fit_for":["Distributed enterprises with strong cellular/5G access strategy (retail, logistics, transport, public sector).","Buyers consolidating wireless WAN with traditional fixed-line SD-WAN under one operational tool.","Organisations interested in private 5G integration with branch SD-WAN."],"watch_outs":["SASE story is partner-integrated rather than native; SSE capabilities require validation in RFP.","Cloud on-ramp and multi-cloud transit fabric have limited public evidence relative to dedicated SASE platforms.","Best for cellular-led architectures; less strong as a primary fit for fixed-circuit-heavy estates."],"evidence_coverage_pct":0.525,"last_verified":"2026-09-01","evidence_source_count":21,"independent_evidence_source_count":0,"position":22,"research_metrics":{"supported":12,"partial":6,"partner_delivered":2,"managed_service_dependent":0,"not_primary":1,"unconfirmed":19,"total":40,"reviewed":21,"completeness_percent":53,"completeness":0.525},"proven_evidence_count":12,"gaps":[]},{"slug":"orange-business","name":"Orange Business","website":"https://www.orange-business.com","category":"Global managed SD-WAN / SASE provider","product_focus":"Multi-vendor managed SD-WAN/SASE, Orange Cyberdefense","cost_model":"Quote-based managed service; costs driven by access circuits, countries, vendor platform, security services and SLAs.","public_pricing_visibility":"quote_based","value_tier":"premium","uk_delivery":"uk_entity","uk_basis":"UK contracting entity (Orange Business UK) of a French parent, with UK delivery.","capabilities":{"f01_fully_managed_service":"yes","f02_diy_self_managed_model":"partial","f03_co_managed_service":"partial","f04_multi_tenant_msp_white_label_support":"not_confirmed","f05_professional_services_and_migration_support":"yes","f06_last_mile_circuit_management":"yes","f07_lifecycle_management":"partial","f08_flexible_commercial_model":"yes","f09_encrypted_overlay_fabric":"yes","f10_dynamic_path_selection":"not_confirmed","f11_active_active_link_utilisation":"yes","f12_application_aware_routing":"not_confirmed","f13_qos_and_traffic_shaping":"not_confirmed","f14_packet_loss_remediation":"not_confirmed","f15_local_internet_breakout":"not_confirmed","f16_mpls_coexistence_and_migration":"yes","f17_cellular_and_5g_support":"not_confirmed","f18_cloud_on_ramp":"not_confirmed","f19_public_cloud_gateways":"not_confirmed","f20_private_pops_dedicated_pops":"not_confirmed","f21_private_global_backbone":"yes","f22_regional_breakout_and_data_residency":"yes","f23_multi_cloud_transit_fabric":"not_confirmed","f24_flexible_edge_form_factors":"not_confirmed","f25_high_availability_design":"not_confirmed","f26_sla_backed_service_fabric":"yes","f27_integrated_next_generation_firewall":"not_confirmed","f28_full_sase_platform":"yes","f29_sse_ecosystem_integration":"yes","f30_zero_trust_network_access":"not_confirmed","f31_secure_web_gateway":"not_confirmed","f32_casb_capability":"not_confirmed","f33_data_loss_prevention":"not_confirmed","f34_remote_user_access":"yes","f35_soc_siem_soar_integration":"yes","f36_centralised_orchestration":"yes","f37_customer_portal_and_rbac":"yes","f38_observability_and_digital_experience_monitoring":"not_confirmed","f39_apis_and_automation":"partial","f40_managed_service_assurance":"yes"},"deployment_speed":"months","regions":{"uk_ireland":"partial","europe":"yes","north_america":"yes","asia_pacific":"yes","middle_east_africa":"yes","latin_america":"yes","china_mainland":"partial"},"supported_clouds":{"aws":"yes","azure":"yes","gcp":"yes","oracle_cloud":"not_confirmed","alibaba_cloud":"not_confirmed"},"ai_capability":{"ai_driven_operations":"managed_service_dependent","ai_security_analytics":"managed_service_dependent","ai_assistant":"managed_service_dependent","note":"Depends on platform (Cisco, VeloCloud, Fortinet, Palo Alto managed offers)."},"resilience":{"disaster_recovery":"yes","note":"Global hybrid underlay of MPLS and internet with diverse PoPs."},"sectors":{"healthcare":"yes","financial_services":"yes","retail_ecommerce":"yes","manufacturing":"yes","energy_utilities":"partial","government_public_sector":"partial","education":"partial","transport_logistics":"yes","professional_services":"yes","hospitality_leisure":"partial"},"organisation_fit":{"large_global_enterprise":"yes","mid_market":"partial","small_business":"not_confirmed"},"pricing_units":["per_site","bundle","custom_quote"],"identity_providers":{"entra_id":"managed_service_dependent","okta":"managed_service_dependent","ping":"managed_service_dependent","google_workspace":"managed_service_dependent"},"device_posture":"managed_service_dependent","agent_platforms":{"windows":"managed_service_dependent","macos":"managed_service_dependent","ios":"managed_service_dependent","android":"managed_service_dependent","linux":"managed_service_dependent","chromeos":"managed_service_dependent","agentless":"managed_service_dependent"},"pop_count":400,"sla_availability_pct":100,"support_model":{"follow_the_sun_24x7":"yes","uk_support_desk":"partial","named_tam":"yes"},"logging":{"siem_export":"managed_service_dependent","log_retention_days":null},"marketplace_url":"https://netify.co.uk/marketplace/orangebusiness/","shortlist_summary":"Orange Business is the enterprise services arm of Orange S.A., one of the largest telecommunications groups in Europe, headquartered in France and listed on Euronext Paris. Orange Business itself traces its lineage to Equant and Global One before being formally established on 1 June 2006, and was renamed from Orange Business Services to Orange Business on 16 February 2023; Frédéric Schepens serves as CEO (appointed July 2024), leading approximately 30,000 employees.","key_differentiators":["Global managed network leadership with strong service assurance, NOC depth and field operations.","Multi-vendor managed SD-WAN and SASE delivery (including Palo Alto Networks managed SASE via Orange Cyberdefense).","Strong UK and EMEA presence with established enterprise managed service track record."],"best_fit_for":["Multinational enterprises wanting a single global managed provider for SD-WAN, SASE and access.","Buyers prioritising service ownership, RCA quality and change governance over best-of-breed platform selection.","Organisations needing access circuit sourcing alongside SD-WAN platform delivery."],"watch_outs":["Platform choice depends on which Orange-supported vendor is selected; underlying platform fit and roadmap should be evaluated independently.","Commercial model is bespoke; rate cards and change costs need careful scoping.","DIY/self-managed model is not the primary positioning."],"evidence_coverage_pct":0.525,"last_verified":"2026-09-01","evidence_source_count":21,"independent_evidence_source_count":1,"position":23,"research_metrics":{"supported":17,"partial":4,"partner_delivered":0,"managed_service_dependent":0,"not_primary":0,"unconfirmed":19,"total":40,"reviewed":21,"completeness_percent":53,"completeness":0.525},"proven_evidence_count":17,"gaps":[]},{"slug":"sonicwall","name":"SonicWall Cloud Secure Edge","website":"https://www.sonicwall.com","category":"SMB / mid-market firewall-led SD-WAN vendor","product_focus":"TZ/NSa firewalls, SonicOS SD-WAN","cost_model":"Public hardware/security bundle pricing often available via resellers; managed options partner-dependent.","public_pricing_visibility":"quote_based","value_tier":"budget","uk_delivery":"uk_pops_partner","uk_basis":"No UK HQ (US). Strong UK SMB and mid-market channel and distribution.","capabilities":{"f01_fully_managed_service":"partial","f02_diy_self_managed_model":"yes","f03_co_managed_service":"yes","f04_multi_tenant_msp_white_label_support":"partial","f05_professional_services_and_migration_support":"partner_integrated","f06_last_mile_circuit_management":"partner_integrated","f07_lifecycle_management":"yes","f08_flexible_commercial_model":"yes","f09_encrypted_overlay_fabric":"yes","f10_dynamic_path_selection":"not_confirmed","f11_active_active_link_utilisation":"yes","f12_application_aware_routing":"not_confirmed","f13_qos_and_traffic_shaping":"not_confirmed","f14_packet_loss_remediation":"not_confirmed","f15_local_internet_breakout":"not_confirmed","f16_mpls_coexistence_and_migration":"yes","f17_cellular_and_5g_support":"not_confirmed","f18_cloud_on_ramp":"not_confirmed","f19_public_cloud_gateways":"not_confirmed","f20_private_pops_dedicated_pops":"yes","f21_private_global_backbone":"not_confirmed","f22_regional_breakout_and_data_residency":"partial","f23_multi_cloud_transit_fabric":"not_confirmed","f24_flexible_edge_form_factors":"not_confirmed","f25_high_availability_design":"not_confirmed","f26_sla_backed_service_fabric":"not_confirmed","f27_integrated_next_generation_firewall":"not_confirmed","f28_full_sase_platform":"partial","f29_sse_ecosystem_integration":"partial","f30_zero_trust_network_access":"not_confirmed","f31_secure_web_gateway":"not_confirmed","f32_casb_capability":"not_confirmed","f33_data_loss_prevention":"not_confirmed","f34_remote_user_access":"yes","f35_soc_siem_soar_integration":"yes","f36_centralised_orchestration":"yes","f37_customer_portal_and_rbac":"yes","f38_observability_and_digital_experience_monitoring":"not_confirmed","f39_apis_and_automation":"partial","f40_managed_service_assurance":"partial"},"deployment_speed":"days","regions":{"uk_ireland":"yes","europe":"yes","north_america":"yes","asia_pacific":"yes","middle_east_africa":"partial","latin_america":"yes","china_mainland":"not_confirmed"},"supported_clouds":{"aws":"partial","azure":"partial","gcp":"not_confirmed","oracle_cloud":"not_confirmed","alibaba_cloud":"not_confirmed"},"ai_capability":{"ai_driven_operations":"partial","ai_security_analytics":"partial","ai_assistant":"not_confirmed","note":"Capture ATP cloud sandboxing uses ML-based detection."},"resilience":{"disaster_recovery":"partial","note":"HA appliance pairs; cloud security depth depends on partner SSE."},"sectors":{"healthcare":"yes","financial_services":"yes","retail_ecommerce":"yes","manufacturing":"yes","energy_utilities":"partial","government_public_sector":"yes","education":"yes","transport_logistics":"not_confirmed","professional_services":"yes","hospitality_leisure":"yes"},"organisation_fit":{"large_global_enterprise":"partial","mid_market":"yes","small_business":"yes"},"pricing_units":["per_site","custom_quote"],"identity_providers":{"entra_id":"yes","okta":"partial","ping":"partial","google_workspace":"partial"},"device_posture":"partial","agent_platforms":{"windows":"yes","macos":"yes","ios":"partial","android":"partial","linux":"partial","chromeos":"not_confirmed","agentless":"partial"},"pop_count":null,"sla_availability_pct":null,"support_model":{"follow_the_sun_24x7":"yes","uk_support_desk":"partial","named_tam":"partial"},"logging":{"siem_export":"yes","log_retention_days":null},"marketplace_url":"https://netify.co.uk/marketplace/sonicwall-cse/","shortlist_summary":"SonicWall is one of the oldest names in network security still operating under its own brand - founded 1991 as Sonic Systems, later renamed SonicWall, and shaped by an eventful corporate history: an IPO in 1999, a return to private ownership, acquisition by Dell in 2012, and a $2 billion-plus divestiture from Dell in November 2016 that spun the company out as an independent business jointly owned by private equity firms Francisco Partners and Elliott Management, who remain its owners today.","key_differentiators":["SD-WAN delivered via existing TZ, NSa and SM firewall appliances; familiar deployment for organisations standardised on SonicWall.","Strong SMB and mid-market positioning with reseller channel and public hardware pricing.","Integrated firewall and SD-WAN avoids separate appliances for smaller branches."],"best_fit_for":["SMB and mid-market organisations already running SonicWall firewalls.","Distributed branch estates where firewall-led SD-WAN is operationally simpler than a separate SD-WAN platform.","Buyers prioritising public pricing visibility and reseller channel options."],"watch_outs":["SASE and SSE capabilities have partial public evidence; depth should be confirmed in RFP.","Less suited to large enterprise multinational deployments requiring private backbone or PoP architectures.","Public cloud gateway and multi-cloud transit fabric capabilities are less prominent than cloud-native SASE vendors."],"evidence_coverage_pct":0.525,"last_verified":"2026-09-01","evidence_source_count":24,"independent_evidence_source_count":0,"position":24,"research_metrics":{"supported":12,"partial":7,"partner_delivered":2,"managed_service_dependent":0,"not_primary":0,"unconfirmed":19,"total":40,"reviewed":21,"completeness_percent":53,"completeness":0.525},"proven_evidence_count":12,"gaps":[]},{"slug":"verizon-business","name":"Verizon Business","website":"https://www.verizon.com/business/resources/lp/secure-access-service-edge","category":"Global carrier managed SD-WAN / SASE provider","product_focus":"Managed SD-WAN/SASE, multi-vendor including Versa","cost_model":"Quote-based managed service; typically platform, access, security bundle, sites/users/bandwidth/term.","public_pricing_visibility":"quote_based","value_tier":"premium","uk_delivery":"uk_entity","uk_basis":"UK contracting entity (Verizon Business has UK operations), though US headquartered, with real UK and European delivery.","capabilities":{"f01_fully_managed_service":"yes","f02_diy_self_managed_model":"partial","f03_co_managed_service":"partial","f04_multi_tenant_msp_white_label_support":"not_confirmed","f05_professional_services_and_migration_support":"yes","f06_last_mile_circuit_management":"yes","f07_lifecycle_management":"partial","f08_flexible_commercial_model":"yes","f09_encrypted_overlay_fabric":"yes","f10_dynamic_path_selection":"not_confirmed","f11_active_active_link_utilisation":"yes","f12_application_aware_routing":"not_confirmed","f13_qos_and_traffic_shaping":"not_confirmed","f14_packet_loss_remediation":"not_confirmed","f15_local_internet_breakout":"not_confirmed","f16_mpls_coexistence_and_migration":"yes","f17_cellular_and_5g_support":"not_confirmed","f18_cloud_on_ramp":"not_confirmed","f19_public_cloud_gateways":"not_confirmed","f20_private_pops_dedicated_pops":"not_confirmed","f21_private_global_backbone":"yes","f22_regional_breakout_and_data_residency":"yes","f23_multi_cloud_transit_fabric":"not_confirmed","f24_flexible_edge_form_factors":"not_confirmed","f25_high_availability_design":"not_confirmed","f26_sla_backed_service_fabric":"yes","f27_integrated_next_generation_firewall":"not_confirmed","f28_full_sase_platform":"yes","f29_sse_ecosystem_integration":"yes","f30_zero_trust_network_access":"not_confirmed","f31_secure_web_gateway":"not_confirmed","f32_casb_capability":"not_confirmed","f33_data_loss_prevention":"not_confirmed","f34_remote_user_access":"yes","f35_soc_siem_soar_integration":"yes","f36_centralised_orchestration":"yes","f37_customer_portal_and_rbac":"yes","f38_observability_and_digital_experience_monitoring":"not_confirmed","f39_apis_and_automation":"partial","f40_managed_service_assurance":"yes"},"deployment_speed":"months","regions":{"uk_ireland":"yes","europe":"yes","north_america":"yes","asia_pacific":"yes","middle_east_africa":"partial","latin_america":"yes","china_mainland":"partial"},"supported_clouds":{"aws":"yes","azure":"yes","gcp":"yes","oracle_cloud":"not_confirmed","alibaba_cloud":"not_confirmed"},"ai_capability":{"ai_driven_operations":"managed_service_dependent","ai_security_analytics":"partial","ai_assistant":"not_confirmed","note":"Network Detection and Response analytics; platform AI depends on the chosen vendor."},"resilience":{"disaster_recovery":"yes","note":"Private IP global MPLS plus managed dual-vendor designs."},"sectors":{"healthcare":"yes","financial_services":"yes","retail_ecommerce":"yes","manufacturing":"yes","energy_utilities":"partial","government_public_sector":"yes","education":"yes","transport_logistics":"partial","professional_services":"partial","hospitality_leisure":"not_confirmed"},"organisation_fit":{"large_global_enterprise":"yes","mid_market":"yes","small_business":"partial"},"pricing_units":["per_site","bundle","custom_quote"],"identity_providers":{"entra_id":"managed_service_dependent","okta":"managed_service_dependent","ping":"managed_service_dependent","google_workspace":"managed_service_dependent"},"device_posture":"managed_service_dependent","agent_platforms":{"windows":"managed_service_dependent","macos":"managed_service_dependent","ios":"managed_service_dependent","android":"managed_service_dependent","linux":"managed_service_dependent","chromeos":"managed_service_dependent","agentless":"managed_service_dependent"},"pop_count":null,"sla_availability_pct":100,"support_model":{"follow_the_sun_24x7":"yes","uk_support_desk":"partial","named_tam":"yes"},"logging":{"siem_export":"managed_service_dependent","log_retention_days":null},"marketplace_url":"https://netify.co.uk/marketplace/verizon/","shortlist_summary":"6 billion in revenue in 2023 (2025 consensus estimates are approximately $134-135 billion) and serving nearly all of the Fortune 500 - and its managed SD-WAN and SASE proposition sits within Verizon Business, itself organised into three named customer groups (Enterprise and Public Sector, Business Markets and Other, and Wholesale).","key_differentiators":["Global carrier-led managed SASE and SD-WAN with strong North American presence and international delivery.","Versa Networks partnership provides multi-tenant SD-WAN platform with security, routing and analytics under managed service.","Established reputation as a SASE managed services leader in industry analyst rankings."],"best_fit_for":["North American and multinational enterprises wanting carrier-led managed SD-WAN and SASE.","Buyers comfortable with Versa as the underlying platform via managed delivery.","Organisations prioritising service maturity and global delivery capability."],"watch_outs":["Platform is largely Versa-based; buyers wanting platform optionality should evaluate alternatives.","Commercial model is bespoke; cost transparency and change governance require careful contracting.","DIY/self-managed model is not the primary positioning."],"evidence_coverage_pct":0.525,"last_verified":"2026-09-01","evidence_source_count":20,"independent_evidence_source_count":0,"position":25,"research_metrics":{"supported":17,"partial":4,"partner_delivered":0,"managed_service_dependent":0,"not_primary":0,"unconfirmed":19,"total":40,"reviewed":21,"completeness_percent":53,"completeness":0.525},"proven_evidence_count":17,"gaps":[]},{"slug":"vodafone-business","name":"Vodafone Business","website":"https://vb2b.vodafone.com/business/products/fixed-connectivity/sd-wan","category":"Global managed SD-WAN provider","product_focus":"Vodafone Business SD-WAN / Secure Connected Enterprise","cost_model":"Quote-based managed service; carrier access, SD-WAN platform, security services and country coverage determine costs.","public_pricing_visibility":"quote_based","value_tier":"mid","uk_delivery":"uk_hq","uk_basis":"UK headquartered (Vodafone, Newbury). UK contracting entity with UK support desks and fixed-mobile UK assets.","capabilities":{"f01_fully_managed_service":"yes","f02_diy_self_managed_model":"partial","f03_co_managed_service":"yes","f04_multi_tenant_msp_white_label_support":"not_confirmed","f05_professional_services_and_migration_support":"yes","f06_last_mile_circuit_management":"yes","f07_lifecycle_management":"partial","f08_flexible_commercial_model":"yes","f09_encrypted_overlay_fabric":"yes","f10_dynamic_path_selection":"not_confirmed","f11_active_active_link_utilisation":"yes","f12_application_aware_routing":"not_confirmed","f13_qos_and_traffic_shaping":"not_confirmed","f14_packet_loss_remediation":"not_confirmed","f15_local_internet_breakout":"not_confirmed","f16_mpls_coexistence_and_migration":"yes","f17_cellular_and_5g_support":"not_confirmed","f18_cloud_on_ramp":"not_confirmed","f19_public_cloud_gateways":"not_confirmed","f20_private_pops_dedicated_pops":"not_confirmed","f21_private_global_backbone":"yes","f22_regional_breakout_and_data_residency":"yes","f23_multi_cloud_transit_fabric":"not_confirmed","f24_flexible_edge_form_factors":"not_confirmed","f25_high_availability_design":"not_confirmed","f26_sla_backed_service_fabric":"yes","f27_integrated_next_generation_firewall":"not_confirmed","f28_full_sase_platform":"yes","f29_sse_ecosystem_integration":"partner_integrated","f30_zero_trust_network_access":"not_confirmed","f31_secure_web_gateway":"not_confirmed","f32_casb_capability":"not_confirmed","f33_data_loss_prevention":"not_confirmed","f34_remote_user_access":"partner_integrated","f35_soc_siem_soar_integration":"partner_integrated","f36_centralised_orchestration":"yes","f37_customer_portal_and_rbac":"yes","f38_observability_and_digital_experience_monitoring":"not_confirmed","f39_apis_and_automation":"partial","f40_managed_service_assurance":"yes"},"deployment_speed":"months","regions":{"uk_ireland":"yes","europe":"yes","north_america":"partner_integrated","asia_pacific":"yes","middle_east_africa":"yes","latin_america":"partner_integrated","china_mainland":"partial"},"supported_clouds":{"aws":"yes","azure":"yes","gcp":"yes","oracle_cloud":"not_confirmed","alibaba_cloud":"not_confirmed"},"ai_capability":{"ai_driven_operations":"managed_service_dependent","ai_security_analytics":"managed_service_dependent","ai_assistant":"managed_service_dependent","note":"Depends on platform (VeloCloud, Cisco); Vodafone analytics portal for managed customers."},"resilience":{"disaster_recovery":"yes","note":"Fixed-mobile convergence with 5G backup for rapid site continuity."},"sectors":{"healthcare":"yes","financial_services":"yes","retail_ecommerce":"yes","manufacturing":"yes","energy_utilities":"yes","government_public_sector":"yes","education":"yes","transport_logistics":"yes","professional_services":"yes","hospitality_leisure":"partial"},"organisation_fit":{"large_global_enterprise":"yes","mid_market":"yes","small_business":"not_confirmed"},"pricing_units":["per_site","bundle","custom_quote"],"identity_providers":{"entra_id":"managed_service_dependent","okta":"managed_service_dependent","ping":"managed_service_dependent","google_workspace":"managed_service_dependent"},"device_posture":"managed_service_dependent","agent_platforms":{"windows":"managed_service_dependent","macos":"managed_service_dependent","ios":"managed_service_dependent","android":"managed_service_dependent","linux":"managed_service_dependent","chromeos":"managed_service_dependent","agentless":"managed_service_dependent"},"pop_count":212,"sla_availability_pct":99.99,"support_model":{"follow_the_sun_24x7":"yes","uk_support_desk":"yes","named_tam":"yes"},"logging":{"siem_export":"managed_service_dependent","log_retention_days":null},"marketplace_url":"https://netify.co.uk/marketplace/vodafone/","shortlist_summary":"Vodafone Group is a vast, multinational telecommunications operator - for the financial year ended 31 March 2024, Vodafone Group reported total revenue of €36.7 billion, with Vodafone Business specifically operating across all of Vodafone’s markets, addressing a claimed €160 billion addressable market, serving 5 million customers, managing 198 million IoT connections (FY24 figure), and contributing 24% of Group service revenue. Against that scale, the managed SD-WAN and SASE proposition examined in this profile is one product line within a much larger enterprise business.","key_differentiators":["Strong UK and European market presence with NaaS positioning and integrated mobile/fixed access.","VeloCloud-based managed SD-WAN in the UK with broader Vodafone international footprint.","Tight integration with Vodafone mobile services for buyers prioritising cellular and 5G access."],"best_fit_for":["UK and European enterprises wanting carrier-led SD-WAN with strong mobile and 5G integration.","Buyers consolidating fixed and mobile access alongside SD-WAN platform delivery.","Organisations attracted to the NaaS consumption model."],"watch_outs":["Underlying platform varies by region (VeloCloud in UK, others elsewhere); ensure consistency for multinational deployment.","Security and SASE capabilities are largely partner-integrated.","Commercial structure bundles access, mobile and platform; line-item costing requires explicit RFP."],"evidence_coverage_pct":0.525,"last_verified":"2026-09-01","evidence_source_count":17,"independent_evidence_source_count":0,"position":26,"research_metrics":{"supported":15,"partial":3,"partner_delivered":3,"managed_service_dependent":0,"not_primary":0,"unconfirmed":19,"total":40,"reviewed":21,"completeness_percent":53,"completeness":0.525},"proven_evidence_count":15,"gaps":[]},{"slug":"barracuda-secureedge","name":"Barracuda SecureEdge","website":"https://netify.co.uk/marketplace/barracuda-secureedge/","category":"technology vendor","product_focus":"Barracuda SecureEdge, Barracuda SecureEdge Access, BarracudaONE, Secure Edge Manager","cost_model":"Confirm commercial model through RFP.","public_pricing_visibility":"quote_based","value_tier":"mid","uk_delivery":"global_managed","uk_basis":"Confirm UK delivery scope through RFP.","capabilities":{"f10_dynamic_path_selection":"not_confirmed","f12_application_aware_routing":"not_confirmed","f13_qos_and_traffic_shaping":"not_confirmed","f14_packet_loss_remediation":"not_confirmed","f15_local_internet_breakout":"not_confirmed","f17_cellular_and_5g_support":"not_confirmed","f18_cloud_on_ramp":"not_confirmed","f19_public_cloud_gateways":"not_confirmed","f23_multi_cloud_transit_fabric":"not_confirmed","f24_flexible_edge_form_factors":"not_confirmed","f25_high_availability_design":"not_confirmed","f27_integrated_next_generation_firewall":"not_confirmed","f30_zero_trust_network_access":"yes","f31_secure_web_gateway":"yes","f32_casb_capability":"not_confirmed","f33_data_loss_prevention":"not_confirmed","f38_observability_and_digital_experience_monitoring":"not_confirmed"},"deployment_speed":"not_confirmed","regions":{"uk_ireland":"not_confirmed","europe":"not_confirmed","north_america":"not_confirmed","asia_pacific":"not_confirmed","middle_east_africa":"not_confirmed","latin_america":"not_confirmed","china_mainland":"not_confirmed"},"supported_clouds":{"aws":"not_confirmed","azure":"not_confirmed","gcp":"not_confirmed","oracle_cloud":"not_confirmed","alibaba_cloud":"not_confirmed"},"ai_capability":{"ai_driven_operations":"not_confirmed","ai_security_analytics":"not_confirmed","ai_assistant":"not_confirmed","note":"Use the governed profile for current evidence."},"resilience":{"disaster_recovery":"not_confirmed","note":"Use the governed profile for current evidence."},"sectors":{"healthcare":"not_confirmed","financial_services":"not_confirmed","retail_ecommerce":"not_confirmed","manufacturing":"not_confirmed","energy_utilities":"not_confirmed","government_public_sector":"not_confirmed","education":"not_confirmed","transport_logistics":"not_confirmed","professional_services":"not_confirmed","hospitality_leisure":"not_confirmed"},"organisation_fit":{"large_global_enterprise":"not_confirmed","mid_market":"not_confirmed","small_business":"not_confirmed"},"pricing_units":["custom_quote"],"identity_providers":{"entra_id":"not_confirmed","okta":"not_confirmed","ping":"not_confirmed","google_workspace":"not_confirmed"},"device_posture":"not_confirmed","agent_platforms":{"windows":"not_confirmed","macos":"not_confirmed","ios":"not_confirmed","android":"not_confirmed","linux":"not_confirmed","chromeos":"not_confirmed","agentless":"not_confirmed"},"pop_count":null,"sla_availability_pct":null,"support_model":{"follow_the_sun_24x7":"not_confirmed","uk_support_desk":"not_confirmed","named_tam":"not_confirmed"},"logging":{"siem_export":"not_confirmed","log_retention_days":null},"marketplace_url":"https://netify.co.uk/marketplace/barracuda-secureedge/","shortlist_summary":"SecureEdge combines SD-WAN and cloud security, with an MSP option for multi-tenant management.","key_differentiators":["SecureEdge combines SD-WAN and cloud security, with an MSP option for multi-tenant management."],"best_fit_for":["Buyers and service providers comparing SecureEdge deployment and management options."],"watch_outs":[],"evidence_coverage_pct":0.05,"last_verified":"2026-09-01","evidence_source_count":23,"independent_evidence_source_count":0,"summary_source":"https://barracuda.com/products/network-protection/secureedge/msp","position":27,"research_metrics":{"supported":2,"partial":0,"partner_delivered":0,"managed_service_dependent":0,"not_primary":0,"unconfirmed":38,"total":40,"reviewed":2,"completeness_percent":5,"completeness":0.05},"proven_evidence_count":2,"gaps":[]},{"slug":"expereo","name":"Expereo","website":"https://netify.co.uk/marketplace/expereo/","category":"managed service provider / carrier network provider","product_focus":"Expereo Enhanced Internet, Expereo Managed SD-WAN, Expereo SD-WAN/SASE with Cato Networks, Starlink (via Expereo, authorised reseller)","cost_model":"Confirm commercial model through RFP.","public_pricing_visibility":"quote_based","value_tier":"mid","uk_delivery":"global_managed","uk_basis":"Confirm UK delivery scope through RFP.","capabilities":{"f10_dynamic_path_selection":"not_confirmed","f12_application_aware_routing":"not_confirmed","f13_qos_and_traffic_shaping":"not_confirmed","f14_packet_loss_remediation":"not_confirmed","f15_local_internet_breakout":"not_confirmed","f17_cellular_and_5g_support":"not_confirmed","f18_cloud_on_ramp":"not_confirmed","f19_public_cloud_gateways":"not_confirmed","f23_multi_cloud_transit_fabric":"not_confirmed","f24_flexible_edge_form_factors":"not_confirmed","f25_high_availability_design":"not_confirmed","f27_integrated_next_generation_firewall":"not_confirmed","f30_zero_trust_network_access":"not_confirmed","f31_secure_web_gateway":"not_confirmed","f32_casb_capability":"not_confirmed","f33_data_loss_prevention":"not_confirmed","f38_observability_and_digital_experience_monitoring":"yes"},"deployment_speed":"not_confirmed","regions":{"uk_ireland":"not_confirmed","europe":"not_confirmed","north_america":"not_confirmed","asia_pacific":"not_confirmed","middle_east_africa":"not_confirmed","latin_america":"not_confirmed","china_mainland":"not_confirmed"},"supported_clouds":{"aws":"not_confirmed","azure":"not_confirmed","gcp":"not_confirmed","oracle_cloud":"not_confirmed","alibaba_cloud":"not_confirmed"},"ai_capability":{"ai_driven_operations":"not_confirmed","ai_security_analytics":"not_confirmed","ai_assistant":"not_confirmed","note":"Use the governed profile for current evidence."},"resilience":{"disaster_recovery":"not_confirmed","note":"Use the governed profile for current evidence."},"sectors":{"healthcare":"not_confirmed","financial_services":"not_confirmed","retail_ecommerce":"not_confirmed","manufacturing":"not_confirmed","energy_utilities":"not_confirmed","government_public_sector":"not_confirmed","education":"not_confirmed","transport_logistics":"not_confirmed","professional_services":"not_confirmed","hospitality_leisure":"not_confirmed"},"organisation_fit":{"large_global_enterprise":"not_confirmed","mid_market":"not_confirmed","small_business":"not_confirmed"},"pricing_units":["custom_quote"],"identity_providers":{"entra_id":"not_confirmed","okta":"not_confirmed","ping":"not_confirmed","google_workspace":"not_confirmed"},"device_posture":"not_confirmed","agent_platforms":{"windows":"not_confirmed","macos":"not_confirmed","ios":"not_confirmed","android":"not_confirmed","linux":"not_confirmed","chromeos":"not_confirmed","agentless":"not_confirmed"},"pop_count":null,"sla_availability_pct":null,"support_model":{"follow_the_sun_24x7":"not_confirmed","uk_support_desk":"not_confirmed","named_tam":"not_confirmed"},"logging":{"siem_export":"not_confirmed","log_retention_days":null},"marketplace_url":"https://netify.co.uk/marketplace/expereo/","shortlist_summary":"Managed SD-WAN and internet connectivity, with Cato Networks as a named partner for managed SASE.","key_differentiators":["Managed SD-WAN and internet connectivity, with Cato Networks as a named partner for managed SASE."],"best_fit_for":["Buyers comparing managed internet connectivity alongside SD-WAN and partner-delivered SASE."],"watch_outs":[],"evidence_coverage_pct":0.025,"last_verified":"2026-09-01","evidence_source_count":18,"independent_evidence_source_count":0,"summary_source":"https://catonetworks.com/news/expereo-selects-cato-networks-for-delivering-managed-sase-services-worldwide/","position":28,"research_metrics":{"supported":1,"partial":0,"partner_delivered":0,"managed_service_dependent":0,"not_primary":0,"unconfirmed":39,"total":40,"reviewed":1,"completeness_percent":3,"completeness":0.025},"proven_evidence_count":1,"gaps":[]},{"slug":"opensystems","name":"Open Systems","website":"https://netify.co.uk/marketplace/opensystems/","category":"technology vendor / managed service provider","product_focus":"MDR+ (Managed Detection and Response), Managed SD-WAN / Secure SD-WAN, Managed, Universal SSE, Mission Control","cost_model":"Confirm commercial model through RFP.","public_pricing_visibility":"quote_based","value_tier":"mid","uk_delivery":"global_managed","uk_basis":"Confirm UK delivery scope through RFP.","capabilities":{"f10_dynamic_path_selection":"not_confirmed","f12_application_aware_routing":"not_confirmed","f13_qos_and_traffic_shaping":"not_confirmed","f14_packet_loss_remediation":"not_confirmed","f15_local_internet_breakout":"not_confirmed","f17_cellular_and_5g_support":"not_confirmed","f18_cloud_on_ramp":"not_confirmed","f19_public_cloud_gateways":"not_confirmed","f23_multi_cloud_transit_fabric":"not_confirmed","f24_flexible_edge_form_factors":"not_confirmed","f25_high_availability_design":"not_confirmed","f27_integrated_next_generation_firewall":"not_confirmed","f30_zero_trust_network_access":"not_confirmed","f31_secure_web_gateway":"not_confirmed","f32_casb_capability":"not_confirmed","f33_data_loss_prevention":"not_confirmed","f38_observability_and_digital_experience_monitoring":"not_confirmed"},"deployment_speed":"not_confirmed","regions":{"uk_ireland":"not_confirmed","europe":"not_confirmed","north_america":"not_confirmed","asia_pacific":"not_confirmed","middle_east_africa":"not_confirmed","latin_america":"not_confirmed","china_mainland":"not_confirmed"},"supported_clouds":{"aws":"not_confirmed","azure":"not_confirmed","gcp":"not_confirmed","oracle_cloud":"not_confirmed","alibaba_cloud":"not_confirmed"},"ai_capability":{"ai_driven_operations":"not_confirmed","ai_security_analytics":"not_confirmed","ai_assistant":"not_confirmed","note":"Use the governed profile for current evidence."},"resilience":{"disaster_recovery":"not_confirmed","note":"Use the governed profile for current evidence."},"sectors":{"healthcare":"not_confirmed","financial_services":"not_confirmed","retail_ecommerce":"not_confirmed","manufacturing":"not_confirmed","energy_utilities":"not_confirmed","government_public_sector":"not_confirmed","education":"not_confirmed","transport_logistics":"not_confirmed","professional_services":"not_confirmed","hospitality_leisure":"not_confirmed"},"organisation_fit":{"large_global_enterprise":"not_confirmed","mid_market":"not_confirmed","small_business":"not_confirmed"},"pricing_units":["custom_quote"],"identity_providers":{"entra_id":"not_confirmed","okta":"not_confirmed","ping":"not_confirmed","google_workspace":"not_confirmed"},"device_posture":"not_confirmed","agent_platforms":{"windows":"not_confirmed","macos":"not_confirmed","ios":"not_confirmed","android":"not_confirmed","linux":"not_confirmed","chromeos":"not_confirmed","agentless":"not_confirmed"},"pop_count":null,"sla_availability_pct":null,"support_model":{"follow_the_sun_24x7":"not_confirmed","uk_support_desk":"not_confirmed","named_tam":"not_confirmed"},"logging":{"siem_export":"not_confirmed","log_retention_days":null},"marketplace_url":"https://netify.co.uk/marketplace/opensystems/","shortlist_summary":"Managed SD-WAN and SASE supported by Open Systems' Mission Control service team.","key_differentiators":["Managed SD-WAN and SASE supported by Open Systems' Mission Control service team."],"best_fit_for":["Buyers comparing a managed operating model for SD-WAN and SASE."],"watch_outs":[],"evidence_coverage_pct":0,"last_verified":"2026-09-01","evidence_source_count":21,"independent_evidence_source_count":0,"summary_source":"https://open-systems.com/company/","position":29,"research_metrics":{"supported":0,"partial":0,"partner_delivered":0,"managed_service_dependent":0,"not_primary":0,"unconfirmed":40,"total":40,"reviewed":0,"completeness_percent":0,"completeness":0},"proven_evidence_count":0,"gaps":[]},{"slug":"virgin-media-o2","name":"Virgin Media O2 Business","website":"https://netify.co.uk/marketplace/virgin-media-o2/","category":"managed service provider / carrier network provider","product_focus":"8x8 Voice for Teams, Cloud Infrastructure as a Service / Platform as a Service, Managed Detection and Response, Success Agreement","cost_model":"Confirm commercial model through RFP.","public_pricing_visibility":"quote_based","value_tier":"mid","uk_delivery":"global_managed","uk_basis":"Confirm UK delivery scope through RFP.","capabilities":{"f10_dynamic_path_selection":"not_confirmed","f12_application_aware_routing":"not_confirmed","f13_qos_and_traffic_shaping":"not_confirmed","f14_packet_loss_remediation":"not_confirmed","f15_local_internet_breakout":"not_confirmed","f17_cellular_and_5g_support":"not_confirmed","f18_cloud_on_ramp":"not_confirmed","f19_public_cloud_gateways":"not_confirmed","f23_multi_cloud_transit_fabric":"not_confirmed","f24_flexible_edge_form_factors":"not_confirmed","f25_high_availability_design":"not_confirmed","f27_integrated_next_generation_firewall":"not_confirmed","f30_zero_trust_network_access":"not_confirmed","f31_secure_web_gateway":"not_confirmed","f32_casb_capability":"not_confirmed","f33_data_loss_prevention":"not_confirmed","f38_observability_and_digital_experience_monitoring":"not_confirmed"},"deployment_speed":"not_confirmed","regions":{"uk_ireland":"not_confirmed","europe":"not_confirmed","north_america":"not_confirmed","asia_pacific":"not_confirmed","middle_east_africa":"not_confirmed","latin_america":"not_confirmed","china_mainland":"not_confirmed"},"supported_clouds":{"aws":"not_confirmed","azure":"not_confirmed","gcp":"not_confirmed","oracle_cloud":"not_confirmed","alibaba_cloud":"not_confirmed"},"ai_capability":{"ai_driven_operations":"not_confirmed","ai_security_analytics":"not_confirmed","ai_assistant":"not_confirmed","note":"Use the governed profile for current evidence."},"resilience":{"disaster_recovery":"not_confirmed","note":"Use the governed profile for current evidence."},"sectors":{"healthcare":"not_confirmed","financial_services":"not_confirmed","retail_ecommerce":"not_confirmed","manufacturing":"not_confirmed","energy_utilities":"not_confirmed","government_public_sector":"not_confirmed","education":"not_confirmed","transport_logistics":"not_confirmed","professional_services":"not_confirmed","hospitality_leisure":"not_confirmed"},"organisation_fit":{"large_global_enterprise":"not_confirmed","mid_market":"not_confirmed","small_business":"not_confirmed"},"pricing_units":["custom_quote"],"identity_providers":{"entra_id":"not_confirmed","okta":"not_confirmed","ping":"not_confirmed","google_workspace":"not_confirmed"},"device_posture":"not_confirmed","agent_platforms":{"windows":"not_confirmed","macos":"not_confirmed","ios":"not_confirmed","android":"not_confirmed","linux":"not_confirmed","chromeos":"not_confirmed","agentless":"not_confirmed"},"pop_count":null,"sla_availability_pct":null,"support_model":{"follow_the_sun_24x7":"not_confirmed","uk_support_desk":"not_confirmed","named_tam":"not_confirmed"},"logging":{"siem_export":"not_confirmed","log_retention_days":null},"marketplace_url":"https://netify.co.uk/marketplace/virgin-media-o2/","shortlist_summary":"Managed connectivity and SD-WAN with Zscaler-based SASE; confirm the current contracting entity and scope.","key_differentiators":["Managed connectivity and SD-WAN with Zscaler-based SASE; confirm the current contracting entity and scope."],"best_fit_for":["Buyers comparing managed connectivity and partner-delivered cloud security."],"watch_outs":[],"evidence_coverage_pct":0,"last_verified":"2026-09-01","evidence_source_count":20,"independent_evidence_source_count":1,"summary_source":"https://virginmediabusiness.co.uk/connectivity/sdwan/","position":30,"research_metrics":{"supported":0,"partial":0,"partner_delivered":0,"managed_service_dependent":0,"not_primary":0,"unconfirmed":40,"total":40,"reviewed":0,"completeness_percent":0,"completeness":0},"proven_evidence_count":0,"gaps":[]}],"methodology_note":"All researched providers are ordered by evidence coverage, highest first, then name. Coverage is the proportion of capability fields carrying an evidence grade; it is not fit, quality or a recommendation. Commission does not affect this order. Research and evidence matching are open."},"faqs":[{"q":"Does inclusion confirm suitability for my project?","a":"No. This directory presents published provider evidence. Confirm product, sector, region and service scope against your own requirements. Missing evidence remains unconfirmed."},{"q":"How is the public directory ordered?","a":"Most proven capability items first, then the most recent verification date, then provider name; slug breaks identical names and missing dates come last. Only yes capability grades count. This is evidence order, not a personalised recommendation."},{"q":"What does Netify do?","a":"Netify reviews your requirement, agrees a sourcing plan, approaches the providers you approve and coordinates written responses. A full RFP is optional."}],"citation":"Cite as: Netify provider evidence, Best SD-WAN and SASE providers for Financial services, https://netify.co.uk/sase/best/sd-wan-sase-providers-for-financial-services","continuation":{"version":"continuations v2026.2","family":"sector","source":"sector:financial_services","sentence":"We are a financial services firm consolidating network and security into SASE.","action":{"label":"Turn this into a live project","url":"https://netify.co.uk/sase-sd-wan-rfp-builder/?q=We+are+a+financial+services+firm+consolidating+network+and+security+into+SASE.&utm_source=ai_assistant&utm_medium=twin"},"opens":"Your procurement on Netify","pins":[],"mcp_tools":["workspace_ingest","score_vendor_fit","build_sase_shortlist"]}},"ordered_by":"evidence_coverage_pct desc, provider name asc, slug asc","compatibility_note":"Use Netify to request comparable proposals, demos and pre-sales contacts from named SD-WAN and SASE providers. Research is open, and you approve each request before a supplier receives it. SD-WAN provides the connectivity component of SASE.","interactiveSurfaces":[{"id":"financial-services-shortlist-tool","kind":"filter-ui","url":"https://netify.co.uk/sd-wan-sase-for-financial-services/#shortlist-tool","backingTool":"build_sase_shortlist","endpoint":"https://netify.co.uk/sase/api/openapi/build_sase_shortlist","fixed_arguments":{"sector":"financial-services"}},{"id":"financial-services-regime-filter","kind":"filter-ui","url":"https://netify.co.uk/sd-wan-sase-for-financial-services/#regime=uk","backingTool":"get_sector_evidence","endpoint":"https://netify.co.uk/sase/api/mcp/","fixed_arguments":{"sector":"financial-services"},"note":"The same filter is available here as ?regime=uk|eu|us|canada."}],"shortlist":"https://netify.co.uk/sase/shortlist/?s=financial-services","rfp_builder":"https://netify.co.uk/sase/rfp-builder/","citation":"Cite as: Netify, \"SD-WAN & SASE for Financial Services (2026)\", https://netify.co.uk/sd-wan-sase-for-financial-services/"}