SASE RFP Questions: What to Ask Vendors Before You Choose

Short answer: a Secure Access Service Edge (SASE) request for proposal (RFP) should ask how each vendor's architecture works, not only which features it lists. The questions that separate vendors cover where traffic is inspected, what happens during an outage, where data is decrypted and stored, how one policy reaches every location, and the full cost over the contract term.

This brief lists 28 vendor-neutral RFP questions in seven areas, explains why each matters, and describes how to score the answers.

What is a SASE RFP?

A SASE RFP is a formal document an organization sends to SASE vendors to compare their platforms on the same questions. It describes the organization's environment and requirements, and asks each vendor to explain how its platform meets them.

Feature lists from SASE vendors look similar, because most platforms include the same core functions: Software-Defined Wide Area Network (SD-WAN), Firewall as a Service (FWaaS), Secure Web Gateway (SWG), Cloud Access Security Broker (CASB), and Zero Trust Network Access (ZTNA). A useful RFP moves past the checklist and asks how those functions are built, delivered, and operated.

What Should a SASE RFP Include?

A SASE RFP should include five parts before the questions themselves.

Environment summary: Number of users, sites, cloud platforms, and private applications, plus the existing firewalls, virtual private networks (VPNs), and identity provider.
Goals: The problems to solve, such as replacing a remote access VPN or reducing backhauled traffic.
Must-have requirements: Conditions a vendor must meet to stay in the evaluation, such as data residency rules.
Questions: The vendor questions below, grouped by area.
Scoring method: How answers are weighted, so vendors know what matters most.

Architecture and Enforcement Questions

Architecture questions show where and how a platform inspects traffic, which decides latency, resilience, and data control.

Where does inspection run? Ask whether traffic is inspected in vendor points of presence (PoPs), on the organization's endpoints and gateways, or both. This decides how far every session travels.
Is inspection single-pass? Ask whether traffic is decrypted and analyzed once for all security functions, or passed between separate engines. Chained engines add latency and can apply rules inconsistently.
Are all functions available at every enforcement point? Ask whether a branch gateway, an endpoint agent, and a PoP enforce the same policies. Some platforms offer lighter protection at some points.
What happens if the vendor cloud is unreachable? Ask whether enforcement continues with the last policy, fails open, or fails closed. The answer defines the outage risk.
Which parts were built in-house, and which were acquired or resold? Integrated components share one policy engine. Acquired ones often keep separate consoles and logs.

Security Coverage Questions

Security questions confirm that each function works at the depth the organization needs.

How does the platform inspect encrypted traffic? Ask about Transport Layer Security (TLS) decryption, certificate deployment, performance impact, and how exceptions are managed for sensitive categories.
How are applications identified? Ask how many applications the platform recognizes and whether policy can control actions within an application, such as uploads.
What CASB modes are supported? Ask whether the CASB works inline, through application interfaces, or both, and which cloud applications are covered.
What threat prevention is included? Ask about intrusion prevention, malware and phishing protection, and how often threat intelligence is updated.
How does ZTNA grant access to private applications? Ask which identity and device posture signals decide access, and whether users connect to applications, not networks.

Identity and Policy Questions

Identity and policy questions show whether one policy really covers every user and location.

Which identity providers integrate natively? Ask about directory sync, single sign-on, and multi-factor authentication (MFA).
Is there one policy for all locations? Ask whether a single rule applies to office, remote, and cloud traffic, or whether each location needs its own rules.
What device posture checks are available? Ask which checks run, such as operating system version, disk encryption, or endpoint protection status, and how often.
How are policy changes tested and rolled back? Ask about staging, change history, and audit logs for every change.

Data Handling and Sovereignty Questions

Data questions show who can see the organization's traffic and where it is processed.

Where is traffic decrypted, and who operates that infrastructure? This decides who could technically access decrypted data.
Where are logs stored, and for how long? Ask about regions, retention periods, and whether storage location can be chosen.
Can the organization keep traffic, logs, and keys in specific jurisdictions? Required where residency rules or contracts apply.
Who holds the decryption keys? Ask whether the organization can hold its own keys and certificates.
Which certifications and audits cover the service? Ask for current reports, such as SOC 2 or ISO 27001, and what they cover.

Operations and Management Questions

Operations questions show the day-to-day effort of running the platform.

Is there one console with consistent logs? Several consoles mean several policy models and more training.
How are enforcement points deployed and updated? Ask how agents and gateways are installed, updated, and monitored at scale.
What reporting and SIEM integration is available? Ask about export formats, streaming to a security information and event management (SIEM) system, and built-in reports.
Does the platform support role-based access and multi-tenant management? Required if separate business units or a managed service provider (MSP) will run it.
Who supports the service, and on what terms? Ask about service level agreements (SLAs), escalation paths, and support hours.

Migration Questions

Migration questions show how the organization gets from its current tools to the new platform.

Can existing hardware be reused? Ask whether current firewalls or gateways can host enforcement, or whether everything must be replaced.
What does a phased migration look like? Ask for a typical plan by site and user group, and how old and new tools run side by side.

Pricing and Contract Questions

Pricing questions show the full cost, not only the headline rate.

What is the total cost over the contract term? Ask for per-user and per-site prices, add-ons, bandwidth or traffic charges, and the cost of running old and new systems in parallel during migration.
What are the contract terms and exit conditions? Ask about term length, renewal increases, minimum commitments, and how data is returned at the end.

How Should an Organization Score SASE RFP Answers?

An organization scores SASE RFP answers by weighting the areas that are hardest to change later. Use these steps.

Set weights before reading answers: Give each area a weight based on the goals in the RFP.
Weight architecture, data handling, and resilience highest: These decide latency, outage risk, and data control, and they rarely change after purchase.
Score evidence, not claims: Give full marks only to answers backed by documentation, a demo, or a pilot result.
Run a pilot with the top two vendors: Test one site and one user group, and measure latency, policy coverage, and admin effort.
Compare total cost last: Price matters, but only between vendors that pass the earlier steps.

Frequently Asked Questions

What Should Be in a SASE RFP?

An environment summary, the goals, must-have requirements, vendor questions grouped by area, and the scoring method.

What Are the Most Important SASE Evaluation Criteria?

Where traffic is inspected, what happens during a vendor cloud outage, where data is decrypted and stored, whether one policy covers every location, and the total cost over the contract term.

How Many Vendors Should Receive a SASE RFP?

Most organizations send an RFP to three to five vendors, then pilot the top two before deciding.

What Is the Difference Between an RFI and an RFP for SASE?

A request for information (RFI) gathers general information to build a shortlist. An RFP asks the shortlisted vendors detailed questions and requests a proposal with pricing.