Starting snapshot, one clear sentence

• To get us started, give a plain snapshot of your current cloud and remote access posture in one sentence.
• When did you last investigate a security incident that traced back to a SaaS app, and what was the outcome?
• On average, how many SaaS applications does an employee interact with each month? Options: 0-10, 11-25, 26-50, 51-100, 100+
• Name the categories of identity provider and endpoint management that protect user access today. Options: Cloud identity provider, On-prem identity, Mobile device management, Endpoint detection and response, No central solution
• Estimate the percentage of your user-to-SaaS traffic that currently bypasses corporate network controls. Options: 0-10%, 11-25%, 26-50%, 51-75%, 76-100%

If regulators asked for an explanation

• If regulators asked how you prevented sensitive data leaving through SaaS APIs this quarter, which control gaps would you have to admit?
• Which departments or countries create the most compliance exposure for SaaS use? Options: Finance, Legal and compliance, Sales and marketing, HR, Product and engineering, Global offices
• How often do you find unsanctioned SaaS apps handling regulated or sensitive data? Options: Daily, Weekly, Monthly, Rarely, Unknown
• Who on your team owns the response when SaaS data access fails an audit? Options: Cloud security or CASB team, Network security, Application security, Compliance/legal, No single owner
• What single audit finding or compliance gap would force you to pause SaaS rollouts or require immediate remediation?

Where employees widen the perimeter

• Which common employee behaviors most reliably create unseen paths for data to leave your environment?
• Walk me through the last time a remote user needed VPN to access a private app but worked around it, how did they get access?
• On a typical week, how many helpdesk tickets relate to remote access, VPN, or SaaS authentication issues? Options: 0-10, 11-50, 51-200, 201-500, 500+
• What workaround do business teams use when a protected SaaS feature is blocked by policy?
• If replacing VPN for one user population fails to maintain productivity, what is the maximum acceptable rollback window before leadership pauses the program? Options: 24 hours, 3 business days, 1 week, 2 weeks, No rollback acceptable

The technical blind spots that stop inspection

• Point to the technical blind spot in your stack that presently prevents inline inspection of encrypted SaaS traffic.
• Select the enforcement points you plan to keep, centralize, or retire during a migration. Options: Edge proxy, On-prem firewall, VPN concentrator, Cloud enforcement (cloud edge), Endpoint agent, SaaS native controls
• Are APIs for your critical SaaS apps available for third-party inspection and controls, yes or no? Options: Yes, for all critical apps, Available for some apps, No, not available, Unknown
• List the directory and identity connectors that must be live before a pilot can start.
• Identify the single missing integration that would block a pilot from demonstrating success.

Alternatives on the table, honestly

• Name the alternative solution you are most likely to pick if this project stalls. Options: Keep the incumbent vendor, Do nothing and accept current gaps, Internal build or project, Purchase point products to stitch together, Another converged vendor
• List the architectural approaches, legacy proxies, or internal projects you have evaluated so far. Options: Existing perimeter proxy upgrade, Proxy bolt-on to SD-WAN, Internal CASB initiative, Endpoint-only controls, Identity-only controls, Other
• Describe the conditions under which you would choose to keep your current approach instead of changing.
• Has anyone on your engineering organization proposed solving inspection and DLP without an external vendor, and if so, what timeline and cost did they estimate? Options: Yes, presented a plan, Yes, discussed informally, No internal proposal, Unknown
• Identify the acceptance criteria that would immediately tip the decision to the incumbent or internal option if met.

Readiness, people, and gating facts

• Imagine our deployment team arrived today, how many days until they could authenticate and inspect your first user population? Options: 0-5 days, 6-14 days, 15-30 days, 30-60 days, More than 60 days
• Select the integrations that must be completed before a proof of value can start. Options: Identity provider connector, Mobile device management, Endpoint detection and response, SaaS admin API access, Network peering or private link, SIEM/SOAR forwarding
• Who owns the API credentials and approvals for your top 10 SaaS apps, and are they prepared to grant access? Options: App owners in each BU, Central cloud security team, IT operations, Procurement/restricted, Unknown
• Do you have a named deployment owner and at least one engineer allocated part time or full time for the pilot? Options: Yes, full time, Yes, part time, No owner yet, Other
• Would integration work taking longer than 8 weeks stop the pilot from proceeding? Options: Yes, No, Depends on scope
• Are there regulatory approvals, legal reviews, or procurement steps that must be completed before we can sign an SOW? Options: Yes, No, Not sure
• Please list which approvals or steps would gate the timeline and who currently owns them.

How you will judge success, in hard numbers

• Suppose the pilot improved visibility but did not reduce data loss events, would you consider it successful? Options: Yes, if roadmap exists to reduce events, No, reduction is required, Unsure
• Choose the measurable KPIs you will use to judge pilot success. Options: Reduction in confirmed DLP incidents, Coverage of sanctioned SaaS apps by inline/API, User latency and session time, False positive rate on DLP, Time to remediate incidents, Operational effort for rule changes
• Specify the target reduction in sensitive data exfiltration or incidents you would require to proceed to purchase. Options: 10-25%, 26-50%, 51-75%, 76-100%, Reduction is not the primary metric
• Should the pilot meet the acceptance criteria, who can approve procurement and on what timeline?
• Choose the telemetry sources we will use to validate those KPIs. Options: Edge inspection logs, SaaS activity logs, DLP incident reports, SIEM aggregation, User experience monitoring

If the pilot proves the math, what stops you

• Assuming the pilot proves the numbers you need, what internal steps must happen for you to sign within 30 days?
• Tell us the stakeholders who must be convinced before budget moves, and who holds final veto. Options: CISO or InfoSec, CTO or architecture, CFO or finance, Procurement, Business unit leader, Legal
• Estimate the approval timeline from pilot success to contract signature. Options: Immediate to 2 weeks, 2-4 weeks, 1-2 months, 2-3 months, Longer than 3 months
• Describe the risks or unknowns that would make you delay or cancel this project after a successful pilot.
• Would you be open to a staged commercial model that ties payment to agreed acceptance criteria? Options: Yes, Maybe, No

• Solution Experience Session

• Confirm the current state and cost
• You confirm the demonstrated workflows remove the blind spots that led to the documented data exfiltration and audit findings.
• Prepare a scoped proof plan that maps the top three high-risk SaaS applications and one initial user population to specific acceptance tests for inline/API inspection, DLP outcomes, latency thresholds, and remote access behavior.
• Walk a real user journey to show end-to-end visibility
• You confirm the inline/API inspection and adaptive access behavior meet your performance and policy granularity needs for the representative SaaS use case.
• Provide the list of your top 10 highest-risk SaaS applications, application owners, and one sample user population targeted for remote access replacement.
• Prove inline and API inspection for a representative SaaS use case
• Share recent audit findings and the incident report details relevant to the data exfiltration example to seed proof test cases.
• You and the seller agree on the remaining evidence and measurable acceptance criteria required for a scoped proof of concept.
• Agree on numeric performance and DLP acceptance thresholds for the proof, including acceptable added latency and detection/false-positive targets.
• Demonstrate adaptive access and zero-trust remote access behavior
• Confirm acceptance criteria and rollout scope
• Forced validation, confirm this matches your needs

• Solution Experience Session
• Solution Experience Deck
• Solution Brief

• meeting
• slides
• document

• Provision user seats and licensing
• Deploy global cloud edge routing
• Enable inline TLS and encrypted API inspection
• Deploy inline inspection for top-risk SaaS (top 10)
• Connect API-based CASB connectors for SaaS portfolio
• Configure unified data loss prevention policies
• Configure adaptive access policies by identity, device, and data
• Integrate identity provider for access enforcement
• Integrate endpoint management for device posture checks
• Deploy zero trust network access for pilot user group
• Publish private applications via ZTNA
• Activate shadow IT discovery and unsanctioned app inventory
• Enable threat inspection and malware analysis
• Migrate VPN policies and retire legacy VPN access

Provision user seats and licensing

• How many user seats need initial provisioning and how are they grouped by workforce population (for example: 2,500 sales, 8,000 knowledge workers, 500 contractors)?
• Which license feature tiers do you require for each population (for example: inline inspection, API connectors, zero trust access, DLP)? Options: Inline inspection required, API connector required, Zero trust network access required, DLP required, Threat inspection required
• Who owns license procurement and renewal in your organization (title and email alias preferred)?
• Do you require seat allocation by cost center or department for billing chargeback? Options: Yes, by cost center, Yes, by department, No, single seat pool
• When do you plan to activate the first annual subscription term (quarter and year)? Options: Next 30 days, 30-60 days, 61-90 days, Later than 90 days
• Are there compliance or audit constraints that affect license residency or data locality for the subscription (e.g., EU data residency, FedRAMP needs)? Options: Yes - list requirements in free response, No

Deploy global cloud edge routing

• Which SaaS endpoints or domains generate the highest traffic volume today (provide top 20 FQDNs or CIDR ranges if available)?
• What maximum added round-trip latency is acceptable for business-critical SaaS (specify threshold in milliseconds per app or 'under 50 ms')? Options: Under 20 ms, Under 50 ms, Under 100 ms, Custom - provide value
• Do you plan to route all egress traffic through the cloud edge or only specific user populations and app categories? Options: All user egress, Selected user populations, Only sanctioned SaaS traffic, Other (describe)
• Which corporate network egress points or SD-WAN locations must peer with the cloud edge (provide site names or IP ranges)?
• Who will provide network change windows and firewall ACL updates for edge routing (network operations contact)?
• Are there regulatory routing constraints for specific traffic (for example, payment card networks or health data flows)? Options: Yes - specify regimes (PCI, HIPAA, GDPR), No

Enable inline TLS and encrypted API inspection

• Which TLS interception model will you approve: corporate root certificate on managed devices, per-application certificate pinning exceptions, or certificate-on-edge for unmanaged devices? Options: Corporate root on managed devices, Per-app exceptions, Certificate-on-edge for unmanaged, Hybrid
• Provide the list of service account or certificate authority (CA) details we must import for TLS inspection (for example: internal CA thumbprint or public CA issuer details).
• Do any of your top SaaS applications use certificate pinning or proprietary TLS that will require an API-only connector instead of inline TLS interception (provide app names or domains)? Options: Yes - list affected apps, No
• How will you validate acceptable performance for TLS inspection in rollouts (specify per-app latency threshold or transaction SLA)?
• Who is responsible for device trust chain distribution (endpoint management team name and contact)?
• Are there legal or privacy constraints requiring selective bypass of TLS inspection for certain user groups or SaaS tenants (for example: legal hold, HR systems)? Options: Yes - list systems, No

Deploy inline inspection for top-risk SaaS (top 10)

• Please list your top 10 highest-risk sanctioned SaaS applications by business impact and provide the admin console URL for each.
• Which user populations should be included in the initial inline inspection pilot for the top 10 apps (for example: Sales APAC, Finance admins, Support contractors)?
• Which measurable acceptance criteria will confirm the inline inspection rollout is successful for each app (for example: added latency <50 ms, 100% of sanctioned sessions inspected, no critical functional failures in admin console)? Options: Added latency <20 ms, Added latency 20-50 ms, 100% session inspection coverage, No functional failures in app workflows
• Which SaaS features will you require full inline coverage for during the pilot (for example: web UI file uploads, real-time collaboration edits, embedded API calls)? Options: File uploads/downloads, Real-time collaboration edits, Embedded API calls, Admin console actions
• Who will authorize temporary debugging access to application owners if inline inspection causes functional regression (provide title and contact)?
• Are there explicit data classification thresholds that should trigger inspection or quarantine for these top 10 apps (for example: PCI data, PHI, PII by regular expression or DLP label)? Options: PCI, PHI, PII, Custom classification labels

Connect API-based CASB connectors for SaaS portfolio

• Which SaaS applications in your portfolio require API connector coverage (provide a list of all SaaS app tenants and admin URLs)?
• Do you have service account credentials or API tokens available for each SaaS tenant, and can you provide the admin role required (for example: OAuth client with admin scope)? Options: Yes - credentials ready, No - need to create, Partial - some tenants ready
• What is the expected connector scope per app: read-only metadata, user provisioning sync, policy enforcement via API, or data-level DLP? Options: Metadata discovery, User provisioning, Policy enforcement, Data-level DLP
• Are there tenant-specific API rate-limit constraints or governance approval processes we should factor into connector deployment (for example: scheduled API windows)? Options: Yes - provide details, No
• Who approves service account creation in each SaaS admin console (application owner contact)?
• Do you require connector activity logs to be forwarded to your SIEM or log archive (specify log destination and retention days)?

Configure unified data loss prevention policies

• Which data classes must be covered by unified DLP templates (select all that apply and specify any enterprise classification labels): Options: PHI (health data), PCI (cardholder data), PII (personal data), Intellectual property, Custom classification labels
• For each data class, what enforcement actions do you require on detection within SaaS and web flows (for example: alert only, block upload, quarantine to secure container)? Options: Alert only, Block upload, Quarantine, Apply watermarking/obfuscation
• Which measurable thresholds will define DLP success during the pilot (for example: detection rate >95% on seeded test data, false positive rate <2%)? Options: Detection rate >95%, False positive rate <2%, Custom - provide thresholds
• Do you maintain canonical data loss policies or templates we should import (for example: internal DLP rule pack or compliance playbooks)? Options: Yes - provide templates, No
• Who owns incident response for DLP triggers and what is the expected SLA for triage (for example: 2 business hours)?
• Do you require DLP actions to integrate with existing ticketing or SOAR systems (provide connector endpoints)? Options: Yes - provide endpoint, No

Configure adaptive access policies by identity, device, and data

• Which identity attributes and IdP group mappings should drive access tiering (for example: role, department, privileged admin group names)?
• Which endpoint posture signals must be evaluated before granting access (for example: MDM compliant, disk encryption, AV up-to-date)? Options: MDM compliant, Disk encrypted, AV signatures current, Secure boot enabled, Custom posture checks
• What adaptive controls should apply by risk level (for example: step-up MFA, restrict file download, deny access)? Options: Step-up MFA, Restrict download, Read-only access, Deny access
• Which app-level data sensitivity labels should increase enforcement (for example: Finance docs labeled 'Confidential', HR records labeled 'PHI')?
• Who will own policy exceptions and approvals for adaptive rules (provide role and escalation path)?
• Do you require policy decision logging to your audit trail and what retention period is mandated (specify days)? Options: 30 days, 90 days, 1 year, Custom - provide value

Integrate identity provider for access enforcement

• Which identity provider(s) are in use and can you provide the IdP metadata endpoint (SAML/OIDC metadata URL)?
• Do you require sync of group memberships from the IdP or will you map groups manually in the policy console? Options: Automatic group sync, Manual mapping, Hybrid
• Which authentication flows must be supported: SAML, OIDC, SCIM user provisioning, or legacy LDAP proxy? Options: SAML, OIDC, SCIM, LDAP proxy
• Who will provide IdP admin privileges for connector setup and testing (IdP admin contact)?
• Are there custom claims or attributes your applications depend on that must be preserved in assertion mappings (for example: employeeNumber, riskScore)? Options: Yes - list claims, No
• Do you require just-in-time provisioning or full directory sync during pilot? Options: Just-in-time provisioning, Full sync, No provisioning required

Integrate endpoint management for device posture checks

• Which endpoint management platform(s) do you use (provide connector type and management console URL)?
• Which device posture attributes must be reported by the endpoint manager (for example: MDM compliance status, OS patch level, disk encryption state)? Options: MDM compliance, OS patch level, Disk encrypted, Antivirus status, Custom attributes
• Do you allow unmanaged BYOD devices to access sanctioned SaaS, and if so, what reduced access profile should apply? Options: No BYOD allowed, BYOD with limited access (read-only), BYOD with quarantine
• Who will provide connector credentials or API tokens for endpoint management integration (endpoint admin contact)?
• How frequently must posture signals be re-evaluated for active sessions (options in minutes)? Options: Every 5 minutes, Every 15 minutes, Every 60 minutes, On event only
• Are there device classes excluded from posture checks (for example: kiosks, OT devices)? Options: Yes - list device classes, No

Deploy zero trust network access for pilot user group

• Which pilot user group will test ZTNA for remote access replacement (for example: 200 engineering VPN users, 50 finance admins)?
• Which private applications will be in scope for the pilot (provide app FQDNs, internal IPs, and protocol e.g., RDP, SSH, HTTPS)?
• Which performance or availability acceptance criteria will you require to sign off ZTNA as a VPN replacement for the pilot (for example: connection time <3 seconds, throughput within 90% of VPN baseline)? Options: Connection time <3s, Throughput >=90% of VPN baseline, No functional regressions in app workflows
• How will multi-factor authentication be enforced with ZTNA for the pilot (for example: IdP step-up, built-in MFA challenge)? Options: IdP step-up, Built-in MFA, Conditional step-up
• Who will own onboarding and offboarding for pilot users (provide identity admin and application owner contacts)?
• Do any private apps require client-based connectors or tunnel modes that cannot be proxied inline (list apps if applicable)? Options: Yes - list apps, No

• current_state
• decision_readiness
• success_criteria
• desired_state
• gaps
• stakeholders
• gaps
• stakeholders
• desired_state
• success_criteria
• decision_readiness
• current_state
• gaps
• current_state
• desired_state
• success_criteria
• stakeholders
• decision_readiness
• decision_readiness
• decision_readiness
• decision_readiness
• decision_readiness

• Subscription Agreement
• Order Form
• Master Services Agreement (MSA)
• Service Level Agreement (SLA)
• Data Processing Agreement (DPA)
• Statement of Work (SOW)
• Acceptance Criteria & Go‑Live Annex
• Change Order Agreement
• Compliance Addendum (conditional)
• Mutual Responsibilities Matrix

• Go-live Health Check (weeks 1-4)
• First Measurement Review (weeks 4-10)
• 90-Day Outcomes and Operationalization Review
• Quarterly Operational Review
• Annual Effectiveness Review

• Provide the quarterly telemetry package with weekly active users, per-app inspection coverage, DLP incidents, and remediation times.
• Agree a final remediation plan with completion dates to reach steady state monitoring.
• Produce a gap register mapping each unmet target to a remediation task, acceptance criteria for closure, and a target completion date.
• Publish the incumbent retirement confirmation or read-only retention plan, including data archival proof and contract/renewal notes.
• Enable quarterly dashboards and set alerting thresholds for the sustained KPI set used in this review.
• Telemetry and trend analysis
• Verify that weekly active users and inline inspection coverage remain at or above the operational thresholds recorded in Hands-on Evaluation.
• Reduce the list of persistent blockers with agreed closure dates for the quarter.
• Prioritize enhancement requests so development and operational teams have a clear roadmap for the next quarter.
• Re-confirm success criteria and owners
• Publish the prioritized enhancement backlog with expected delivery windows and acceptance criteria.
• Close or reassign any persistent blockers that have no progress updates in the shared issue channel.
• Yearly outcomes versus baseline and targets
• Confirm the percent reduction in data exfiltration incidents and the remote access replacement rate meet or exceed the long-term expectations recorded in Hands-on Evaluation.
• Agree a multi-quarter plan to close any remaining high-risk gaps and to maintain policy hygiene.
• Set the annual monitoring and governance cadence for the next 12 months.
• Produce an annual outcomes report comparing baseline metrics to current performance for exfiltration incidents, remote access replacement rate, and DLP efficacy.
• Deliver the long-term remediation plan for any remaining high-risk items with quarterly milestones.
• Publish the annual monitoring calendar and escalation contacts for the coming year.
• Confirm core enforcement points and integrations are live and reporting without critical errors.
• Agree immediate remediation tasks with target completion dates for any go-live blockers.
• Establish the shared channel for incident tracking and continuous telemetry access.
• Produce and share a health export showing connector status, auth errors, and enforcement hits for the go-live window.
• Document and publish the remediation plan for each open blocker with a target completion date.
• Enable the agreed shared issue channel and provide access instructions for your team.
• Present first-window telemetry against targets
• Determine whether inline inspection coverage for the top ten apps and remote access replacement rate are trending toward targets recorded in Hands-on Evaluation.
• Agree a prioritized set of corrective actions with resolution dates to close any measurement gaps.
• Confirm the telemetry exports and measurement method that will be reused at the acceptance milestone.
• Deliver a telemetry export showing per-app inline inspection coverage, DLP detections, and remote access session counts for the measurement window.
• Apply the agreed policy/configuration changes in a staged test and report the test results within the agreed timeline.
• Schedule the next measurement checkpoint and define the exact data slices to be used for acceptance comparison.
• Restate acceptance targets from Hands-on Evaluation
• Confirm which acceptance targets recorded in Hands-on Evaluation are sustained in production and which require remediation.
• Ensure the legacy incumbent is either decommissioned or formally retained read-only, with data archived and fallback habits closed.
• Deployment and connector validation
• Diagnose gaps and root causes
• Operational posture and policy inventory
• Present 90-day outcome data per criterion
• Policy effectiveness and tuning outcomes
• Incumbent retirement and fallback closure
• Persistent risk items and long-term remediation
• Policy and configuration adjustments
• Open persistent issues and blocker burn-down
• User onboarding and access checks
• Document residual remediation and timeline
• Early telemetry and error review
• Annual monitoring and issue governance
• Agree corrective actions and timeline to acceptance gate
• Enhancement request backlog and prioritization
• Open issues and immediate remediation plan
• Confirm owners and next check-in
• Agree ongoing monitoring and issue escalation path