Add criteria · test customer

MDM enforcement access must have POC already added

Access is gated on the device being enrolled and compliant in the customer's MDM (Intune, JAMF, Kandji, Workspace ONE, etc.). Unmanaged or out-of-compliance devices are blocked or stepped-up regardless of user identity.

TLS termination security must have POC already added

TLS terminates at the vendor edge (for published apps and for inline inspection of user traffic) using customer-approved certificates and cipher policy. The customer can see where termination happens and validate the chain.

SSO access must have POC already added

All POC applications authenticate through the customer IdP (SAML or OIDC) with MFA enforced. No local accounts, no per-app identity duplication.

SCIM user provisioning access should have Project kickoff

Users and groups are provisioned and deprovisioned from the IdP to the vendor via SCIM — no manual lifecycle management in the vendor console.

Monitoring AI usage via TLS decryption security should have POC already added

Usage of public GenAI tools (ChatGPT, Gemini, Claude, Copilot, etc.) is visible in logs and governable by policy — who, what tool, how often, what was sent — via inline TLS decryption on the user's outbound traffic.

LLM API-based observability and guardrails security nice to have POC already added

For LLM calls the business itself makes (application backends, internal agents, AI copilots), a vendor-provided layer sits between the app and the model provider — observing prompts/responses, enforcing guardrails, and surfacing usage and cost in a dashboard.

Shadow IT detection security should have POC

Security gets a ranked inventory of every SaaS / web app users are reaching (sanctioned + unsanctioned), with risk scoring, user counts, and the ability to block or coach per app.

Clientless access access must have POC already added

Users and third parties can reach internal web apps from a plain browser with no agent installed, authenticated via the IdP and governed by policy — reducing the unmanaged-device / contractor friction of traditional VPNs.

Access to internet (SWG) security must have POC already added

All outbound user web traffic flows through the vendor's SWG with URL/category filtering, threat protection, and per-user reporting. Acceptable-use policy is enforced consistently on-site and off-site.

Access to internal environments (ZTNA) connectivity must have POC already added

Users reach specific internal apps and resources (web, SSH, RDP, DB, thick-client) based on identity + device posture — replacing broad VPN network access.

Hostname-based routing connectivity must have POC already added

Internal apps can be published and reached on a customer-chosen hostname (public or private), with the vendor making policy decisions based on the hostname — no need to expose raw IPs or re-IP when apps move.

Terraform support operations should have Project kickoff already added

The vendor is configurable via a maintained Terraform provider — identity, policy, apps, tunnels, sites — so the customer can manage the estate as code in their existing pipelines.

SIEM setup observability must have Project kickoff already added

Access, security, and admin-change events stream to the customer's SIEM with documented fields and retention meeting policy. Alerts can be built off the stream.

Alerts and notifications operations should have Project kickoff already added

Critical events (tunnel down, cert expiry, policy change, quota breach, security incident) produce alerts to the right channel (email, Slack, webhook, PagerDuty) — no waiting for a user to report the outage.