Duo Ordering Guide

 

1. Introduction

1.1 Purpose, Audience, and Scope

This document describes the pricing and packaging structure and ordering for Cisco^® Duo as an a la carte item.

Audience: This guide is for the Cisco field and any customer, distributor, or partner that can utilize CCW. Cisco Commerce Workspace (CCW) provides an integrated commerce experience that allows you to register deals, configure and price products, software and related services, and order from a single platform.

Scope: This ordering guide describes the pricing and ordering for the following products and services:

●     Cisco Duo Essentials (Formerly known as MFA)

●     Cisco Duo Advantage (Formerly known as Access)

●     Cisco Duo Premier (Formerly known as Beyond)

●     Cisco Duo Federal MFA

●     Cisco Duo Federal Access

●     Cisco Duo Telephony

●     Cisco Duo Token

●     Cisco Duo Services

For more detailed information on Cisco Duo products, go to https://duo.com/product.

Note: Duo renamed the non-Federal editions in May 2023 to better align with the Cisco Security Portfolio. There may continue to be reference to “MFA, Access or Beyond” on some materials during the transition.

1.2 Ordering and quoting tools

Cisco Commerce provides a Deals and Quotes application that enables the ability to build a system quote with:

●     Products, required modules, and software.

●     Auto-derived services based on products.

●     Design documentation.

For additional information about the Cisco Commerce Workspace, go to: https://apps.cisco.com/Commerce/home.

Cisco Commerce includes several helpful tools to estimate, configure, and order solutions, enabling you to configure products and view lead times and prices for each selection. It also allows you to view lead time and price changes under a variety of price lists and service contract terms. You can also track your order.

The following Cisco products, services and applications are supported in Cisco Estimates and Configurations Tool:

●     Cisco Duo Essentials

●     Cisco Duo Advantage

●     Cisco Duo Premier

●     Cisco Duo Federal MFA

●     Cisco Duo Federal Access

●     Cisco Duo Telephony

●     Cisco Duo Token

●     Cisco Duo Services

1.3 Orderability and First Customer Order (FCO)

Orderability for the following products/applications will be enabled May 1^st, 2023:

●     Cisco Duo Essentials

●     Cisco Duo Advantage

●     Cisco Duo Premier

●     Cisco Duo Federal MFA

●     Cisco Duo Federal Access

●     Cisco Duo Telephony

●     Cisco Duo Token

●     Cisco Duo Services

The first Customer Order date for all the products/applications listed above was December 2, 2019; this updated guide is due to the renaming of the Duo editions.

2. Cisco software subscription

2.1 Product description

Duo is a cloud-based security platform that protects access to all applications, for any user and device, from anywhere. It’s designed to be both easy to use and deploy, while providing complete endpoint visibility and control.

Duo verifies users' identities with strong multifactor authentication and protects against the latest MFA targeting attacks Paired with deep insights into your users’ devices, Duo gives you the policies and control you need to limit access based on endpoint or user risk. Users get a consistent login experience with Duo's single sign-on that delivers centralized access to both on-premises and cloud applications.

With Duo, you can protect against compromised credentials and risky devices, as well as unwanted access to your applications and data. This combination of user and device trust builds a strong foundation for a zero-trust security model.

2.2 Editions

Cisco Duo Essentials

Everything needed to secure access and boost user productivity:

●     Multi-Factor Authentication (MFA) protects against stolen credentials and account take-over.

●     Phishing Resistant Authentication prevents attackers from bypassing MFA (includes verified Duo push and support for FIDO2 authenticators).

●     Single Sign On (SSO) allows users to log in only once to access multiple applications with Duo SSO.

●     Passwordless enables secure log in without a password, using Duo Mobile or FIDO2 authenticators.

●     Trusted Endpoints, checks that device is registered or managed, before allowing access.

Cisco Duo Advantage

Includes Everything in Duo Essentials, Plus:

●     Device Health Check confirms device security posture before granting access and provides visibility into security health of devices trying to gain access.

●     Risk-Based Authentication dynamically adjusts the authentication requirements in real-time based on risk signals.

●     Threat Detection detects potential attack attempts in progress using Machine Learning with Duo Trust Monitor.

Cisco Duo Premier

Includes Everything in Duo Advantage, Plus:

●     VPN-less Remote Access to securely access on-premise resources without VPN with Duo Network Gateway (DNG).

●     Support for internal web applications (HTTPS) and servers via SSH, RDP and SMB

●     Integration with Cisco Secure Endpoint to prevent infected devices from accessing resources

●     Checks for presence of EDR/AV agents

Duo Telephony Credits

Duo supports telephony-based authentication such as SMS and phone callback. In order to use these authentication methods, a customer must have the adequate telephony credits in their account. Duo provides 100 telephony credits per user per year at no additional cost. Customers can purchase additional increments of 1000 credits for $15 USD, either on CCW or the Admin Panel within the Duo product with a credit card. Country availability includes:

Duo sub accounts

Some customers have the need for multiple, but related, Duo Security accounts. This can be accomplished through sub-accounts, creating child accounts under one parent account. A portion of the total licenses purchased are then allocated to that subaccount. Large customers, such as Universities or enterprise customers, may use sub-accounts to create multiple Duo instances for subsets of users within their organization. Sub-accounts must be the same edition as the parent account.

Sub-accounts are best used when a separate instance of Duo is needed. Enrolled users cannot use both instances, only one. Payments are made at the Parent Account level so if differentiated billing is required, this is not a good option.

The primary purpose for creating a sub-account is when customers need:

1.     Different subsets of users or departments within one customer.

2.     Separate instances for production versus test accounts.

Talk to the Account Manager to determine if a sub-account is advisable.

To include a Sub Account at time of order, select Sub Account from the Add-on menu. The number requested in the quantity field should reflect the number of licenses that are to be allocated to the Sub Account. This will be a portion of the total, not in addition to the total.

If a Sub Account needs to be added after the order is placed, use the Change/Modify process to add the Sub Account billing PID. This is a $0 PID.

If more than one Sub Account is needed, contact Customer Support for assistance.

Duo hardware token

Duo also supports traditional one-time passcode-based hardware tokens for user authentication. While a Duo subscription does not come with hardware tokens, customers may purchase them in increments of 10 tokens for $300. All tokens ordered on a single order will need to be associated with a single subscription.

Tokens are not available for use with a FedRamp certified, Duo Federal offer.

Splitting tokens across multiple subscriptions or migrating from one subscription to another is not possible.

For any questions regarding sample hardware tokens, Cisco Sellers can reach out to your Duo Account Executive. Cisco partners and Cisco Cybersecurity Partner Specialists can reach out to partners@duo.com or a Duo partner manager.

SecureX entitlement

Included in the Duo subscription is access to Cisco SecureX^™. SecureX is a cloud-native, built-in XDR platform experience within our Cisco Secure portfolio and connected to your infrastructure. Integrated with the broad Cisco Secure portfolio as well as third-party solutions, it combines multiple otherwise disparate sensor and detection technologies into one unified location and provides automation and orchestration capabilities to respond rapidly to new threats impacting your organization. A recent TEI study of SecureX shows that switching to an integrated approach has helped one organization, over three years, achieve a saving of over half a million dollars, reduce analyst effort per incident by 90%, and reduce the risk and cost of data breach by 45% to 50%.

While the $0 SecureX PID will default to attach to the order, it is not mandatory and can be removed. When included in the order, account setup information will be included in the welcome email, following the purchase.

To learn more about how SecureX can be your first step toward XDR, refer to the SecureX getting started guide and browse from our video catalog to take a deep dive into solution features.

2.3 Customer experience

Cisco Technical Services for Duo

Cisco Software Support Services(SWSS) Basic Support is included with the purchase of every Duo subscription. No additional products or fees are required to receive these services with a software subscription.

Basic Support includes:

●     Access to support and troubleshooting 9x5 via phone, online tools and web case submission.

●     Cisco Duo support access 9 hours per day (local time), 5 days per week to assist by telephone, web case submission and online tools with application use and troubleshooting issues.

●     Access to https://duo.com/support. The support site provides customers with helpful technical and general information on Duo products, as well as access to Duo’s online community and documentation.

Solution Support is a higher tier of reactive-only technical support for Cisco and Cisco Duo customers. It is a paid service.

Solution Support includes:

●     Access to support and troubleshooting via phone, online tools, and web case submission. Click here for Solution Support program information.

●     Cisco Duo support access 24 hours per day (local time), 7 days per week to assist by telephone (with decreased wait times), web case submission and online tools with application use and troubleshooting issues.

●     Access to https://duo.com/support. The support site gives customers helpful technical and general information on Duo products and access to Duo’s online community and documentation.

Software Support: Enhanced

Software Support Services(SWSS) Enhanced helps customers succeed during one of the most critical times in their subscription: during onboarding and implementation. To support customers with high-quality proactive support at a lower cost than Premium/Duo Care, Cisco provides SWSS Enhanced support using teams of Customer Success Managers and Engineers, and digital assets, all of which deliver onboarding and technical guidance, planning leadership, and adoption support.

SWSS Enhanced customers are also entitled to 24x7x365 phone and online troubleshooting support via the Duo Solution Support teams, and everything noted within Solution Support.

SWSS Enhanced support helps customers accelerate their return on investment by increasing active usage and guiding effective product security policy configuration in the customer environment.

SWSS Enhanced Support provides:

●     Strategic digital adoption and onboarding guidance from Customer Service Managers

●     24x7x365 Call-in and online case technical support from the Duo Solution Support team

●     Periodic product health checks

●     Higher priority ticket response with faster SLO

●     Accountability for issue management and resolution.

Refer to the https://duo.com/support. for more detailed information regarding SWSS Enhanced Support.

Support pricing is based on a percentage of product list price.

Software Support: Premium

Software Support (SWSS) Premium, also branded as Duo Care, is an essential element of Cisco Duo as it helps customers maximize their return on investment. With SWSS Premium Support, a team of Duo experts guides customers through the life of their subscription to ensure they maximize the value of their Duo investment as the organization and business needs evolve. Cisco Duo Care Premium Support also provides extended support services to ensure customers get the support they need when they need it most.

SWSS Premium customers are also entitled to 24x7x365 phone and online troubleshooting support via the Duo Solution Support teams, and everything noted within Solution Support.

SWSS Premium Support provides:

●     Strategic support from an assigned Customer Success Manager.

●     Technical support and response from an assigned Customer Solutions Engineer.

●     24x7x365 Call-in and online case technical support from the Duo Solution Support team, with limited Emergency support on Cisco observed holidays.

●     Extended Duo support access by a VIP support line, thereby providing a faster initial response time than SWSS Enhanced.

●     Accountability for issue management and resolution.

Refer to the data sheet for more detailed information regarding Cisco Duo Care Premium Support. Duo Care pricing varies based on the total number of user licenses purchased.

Technical Support for Duo

Customers and partners set up as the Duo Admin will access technical support using Duo tools and processes. The Duo Admin can initiate or check on the status of a support case online, by email or by contacting Duo by phone:

●     Duo Support Team

●     Online Support Portal

●     Phone:1 866 760-4247 (International Phone Numbers)

●     Email: mailto:support@duosecurity.com

Cisco Talos Incident Response

The Cisco Talos Incident Response (CTIR) retainer provides a full suite of proactive and emergency services to help customers prepare, respond, and recover from a cybersecurity breach. CTIR enables 24-hour emergency response capabilities and direct access to Cisco Talos^®, the world's largest threat intelligence and research group.

CTIR will be added to the Duo configuration by default, recommending the number of hours of CTIR service based on the license quantity. The auto-attached CTIR SKU can be removed and is not mandatory. Also, CTIR can be manually selected from the Services tab.

CTIR options available in the Duo configuration are as follows:

To learn more about CTIR, click here.

2.4 Licensing model subscriptions

Understanding the licensing model subscriptions overview

Cisco Duo is licensed on a subscription basis. Each end customer has only one subscription, though each subscription may comprise multiple products. Subscriptions are available for standard term lengths of 12-60 months. At time of ordering, the subscription is set to auto-renew as default; however, auto-renew can be turned off without triggering the deal to become nonstandard. If the order is booked as auto-renew, the subscription will be renewed automatically for an additional 12-month term following the completion of the initial term. If the removal of auto-renew after purchase is necessary, the auto-renewal option must be cancelled 60 days or more before the start date of the new term. Mid-term cancellations of subscriptions for credit are not allowed.

Cisco Duo Licensing

●     The user-based license follows a tiered-pricing model: pricing depends on the number of user licenses purchased. Sales and partner representatives should determine the correct sizing for each customer deployment so that the appropriate user count is selected. Cisco Commerce (CCW) will dynamically determine the correct price associated with the user count entered.

3. Understanding the quoting and ordering process

3.1 Cisco Duo SKU overview

Orders for Cisco Duo involve four PID/SKU types:

●     The subscription PID is used to define the subscription term and start date.

●     The product PIDs are used to define the products and quantities that make up the subscription.

●     The product add-on PID can only be added on to other product SKUs.

●     The support SKU defines the level of support for the subscription.

Orders start with the selection of the DUO-SUB or DUO-FED-SUB subscription SKU. This is followed by the configuration of the subscription by selecting the product, add-on, and support SKUs that will constitute the subscription.

Subscription SKUs

Cisco Duo SUB (Standard) or FED-SUB (Federal).

Note:       Customers can only purchase FED SKU if approved by Duo.

Standard product packages

Cisco Duo Essentials, Advantage, Premier

Note:       Customers can only purchase one product PID.

Federal product packages

Cisco Duo MFA, ACCESS

Note:       Customers can only purchase one product PID.

Add-on packages

Add-ons cannot be purchased alone but can be added to existing Cisco Duo products. Availability is based on Service-to Country.

Cisco Duo Technical Support SKUs for ordering

Note:        

1.     Cisco Duo Premium Support is not directly included in any Security Deal Registration Discounts, it is priced as a percentage of the Duo subscription net cost and must have an annual minimum order of $14,000.

2.     Duo products will be on market pricing which differs from pricing on other products within Cisco’s security portfolio.

4. Ordering process

4.1 Selecting the subscription SKU

There are two Cisco Duo subscription SKUs (DUO-SUB or DUO-FED-SUB). There is no price for the subscription SKU. Pricing is determined when product SKUs are added and configured. User license quantity will be entered when the product SKUs are added to the subscription.

Note:       Each end customer account may have only one active subscription of Cisco Duo.

This means that:

●     Each order may contain only one line item of DUO-SUB or DUO-FED-SUB.

●     Each end customer may have only one active order for DUO-SUB or DUO-FED-SUB.

Attempts to place multiple concurrent orders for DUO-SUB or DUO-FED-SUB or to place an order with multiple line items of DUO-SUB or DUO-FED-SUB will be rejected.

Then “Select Options” to configure.

4.2 Configuration page:

After selecting the subscription SKU, choose Requested Terms and Billing to edit the subscription term and the requested start date.

The subscription term will default to a 12-month term and Prepaid Term Billing. The Requested Start Date may also be changed at this time.

Note:       Annual billing option.

●     Only terms that are 12 to 60 months are allowed (1 to 11 months require nonstandard approval and can only be requested to co-term to another contract greater than 12 months).

●     A Purchase Order (PO) needs to be issued for the full amount, and billing will occur annually before the start date of each service year.

●     While billing is annual, the subscription is for the entire term, and cannot be cancelled mid-term. The service is provisioned, and the subscription starts on the service start date. The provisioning of the service may take up to 72 hours, assuming the order information is complete and correct.

4.3 Selecting the product SKU

●     When the subscription terms have been set, the next step is to add products to the subscription. The duration of the product is defined by the subscription term.

●     Start by selecting the appropriate product in the subscription configuration summary. The guidance below uses Cisco Duo Essentials as an example. Having chosen to configure the subscription for the product, the seller then enters the quantity based on the number of users for the service.

For user-based subscriptions of Cisco Duo, pricing is determined dynamically according to the quantity ordered based on a tiered pricing model. Per-month prices are displayed for the selected PID. However, billing is either annual or prepaid for the term of the subscription, and the term amount is shown in the subtotal.

Note:       Customers can add only one Cisco Duo product package (Essentials, Advantage, or Premier) to a subscription.

Note:       The previously named editions will be visible to support modifications of existing subscriptions. For new business orders, select one of Essentials, Advantage or Premier. For change modify, remove the quantity of the previously purchased edition and put the total desired quantity in one of Essentials, Advantage or Premier.

4.4 Selecting the service SKU

After adding the products, choose the support level desired for the subscription. There are three Cisco Duo service SKUs that correspond to the three levels of support. To configure support for the subscription, select Cisco Duo Support in the subscription configuration summary:

Please note: There is a minimum order amount of $14,000 for Premium Support (Duo Care).

Note:       When ordering a Duo subscription in the CCW, the default support option will vary based on order amount. Orders of approximately $150,000 or greater will default to Cisco Duo Premium Support. To change the service SKU, click "+" next to the SKU needed for the customer's order. Cisco Duo Premium Support, must be coterminous with the Duo subscription.

4.5 Provisioning information

All Duo orders require a purchaser to provide the following end-customer information during order entry to properly provision a Duo account to the end customer.

Note:       The end-customer is the person who will be the Duo Administrator responsible for initially activating and accessing the new Duo account.

●     End-customer Duo Trial account ID, if available, should be provided.

◦     If this information is not provided, a completely new account will be created and will require license transfers.

●     End-customer administrator first name.

●     End-customer administrator last name.

●     End-customer administrator phone number.

●     End-customer administrator email address.

◦     This email address must be correct in order for the administrator to receive their account activation email.

●     End-customer administrator account name.

^*Failure to provide this information will delay the order provisioning process^*

Cisco Duo services will be provisioned, and the subscription will begin on the service start date specified on the order.

Enter the end customer Duo trial account ID (if available, should be provided), first name, last name, phone number, email address and account name of the end-customer administrator (NOT the partner).

After the order has been placed, the provided Duo trial account will be provisioned. If the customer does not have a trial account, a new Duo account will be created for the end customer on the service start date. Partners can also instruct their customer to create a Duo trial account at signup.duo.com prior to placing their order. Upon account creation, the end-customer administrators will receive welcome emails with instructions to log in to the Duo Admin Panel to set up their service. When administrators have logged in to the panel, they will be aided by a setup guide as well as access to support resources in order to make sure their accounts are properly set up.

5. Subscription renewals, changes and cancellations

5.1 Subscription renewals

Cisco Duo subscriptions automatically renew for an additional 12-month term by default. No quoting or ordering is required. Starting 90 days before the end of the initial term, renewal notices will be sent to the purchaser, informing them that their subscription is moving from the initial term to be auto-renewed. The customer or partner will receive an invoice at the start of each new annual term.

Note:       At time of ordering, the subscription is set to auto-renew as a default, however, auto-renew can be turned off (toggle button on lower left as shown above) without triggering the deal to become nonstandard.

5.2 Subscription changes

Customers who purchase on or after December 2, 2019, who would like to change their subscription, must do so via the CCW change subscription portal.

Customers who purchased Cisco Duo before December 2, 2019 can contact duorenewals@cisco.com for further assistance.

Partners can make changes to the products, quantities, or terms of a subscription, at any time during the term of the subscription. To change the subscription, select Cloud/SaaS Subscriptions under the Services and Subscriptions tab. Attempting to add products or seats by creating a new subscription will result in an ordering error.

 

Search for the active subscription and click to see the subscription details. Next, select the Modify/Renew button.

Partners are now able to adjust the products, quantities, start date, and term. To change products or quantities, start by selecting the appropriate product in the subscription configuration summary. The guidance below uses Cisco Duo Essentials as an example. Having chosen the product, partners then enter the quantity based on the number of users for the service.

For a manual renewal or to change the subscription terms, select “Change the terms of my subscription.” For a manual renewal, update the start date to begin one day after the existing subscription’s end date.

5.3 Subscription cancellations

Renewals may be cancelled up to 60 days before the start date of the new term. If the subscription is not cancelled, the subscription will automatically renew. Midterm cancellations of subscriptions for credit are not allowed.

6. Ordering NFR Licenses

Duo NFRs will be available and will follow the standard Cisco NFR process for ordering lab/demo + internal use. Standard PIDs for Essentials, Advantage, and Premier will be utilized for the Duo products within the Cisco NFR program. More details about the Cisco NFR Program can be found at https://www.cisco.com/c/en/us/partners/incentives/standard-not-for-resale.html.

Any promotional NFR offers available will be detailed on the Duo Partner Community Page at https://community.cisco.com/t5/security-documents/selling-duo/ta-p/3771678.

To ensure a smooth, continuous NFR subscription, please turn on “auto-renew” under the Terms tab of the configuration page in CCW:

7. Quoting and ordering help

For quoting or ordering questions, please contact cs-support@cisco.com, or open a case at https://www.cisco.com/cisco/psn/web/workspace.

8. Availability

Duo is available globally, except for these countries: