Secure Access Sub Ordering Guide

 

1. Introduction

This ordering guide is designed to help Cisco sales teams, partners, and distributors order Cisco Secure Access subscriptions. This guide will help you:

●     Understand the Cisco Secure Access product and support offerings.

●     Understand the specific Cisco Global Price List (GPL) offers.

●     Help customers purchase the correct quantities and types of SKUs to reduce the risk of order rejection.

●     Provide information about the end-to-end quote-to-fulfillment process in Cisco Commerce for this offer.

Audience

This guide is intended for Cisco sales teams, partners, and distributors qualified to sell Cisco Secure Access on the Cisco Global Price List.

Scope

The ordering guide provides information about pricing, packaging, and ordering for the Cisco Secure Access Essentials and Advantage packages: Secure Internet Access and Secure Private Access.

2. Understanding the products

Product overview

Cisco Secure Access

Cisco Secure Access is a converged cloud security solution, grounded in zero trust, that enforces modern cybersecurity, while radically reducing risk and delighting both end-users and IT staff. It provides a seamless and secure experience as users connect from anything to anywhere, enabling frictionless work via a single, common access approach. It mitigates risk across your business by applying ZTNA principles and enforcing granular security policies. It simplifies and automates IT operations through a single, cloud-managed console and client, centralized policy creation, and aggregated reporting. Market leading Talos threat intelligence fuels unmatched threat blocking capabilities and reveals attack details to mitigate risk and speed investigations. Experience Insights powered by Cisco ThousandEyes provides digital experience monitoring for end users, to help quickly identify and remediate network and connectivity issues.

Product packaging

Cisco Secure Access has two primary tiers: Secure Access Essentials and Secure Access Advantage. Both tiers are divided into two use cases – Secure Internet Access (SIA) and Secure Private Access (SPA). Both use cases are purchased as part of a single subscription and are delivered as a single, unified dashboard and service. A customer can choose to purchase only one use case depending on their needs.

Table 1.           Product Descriptions

Please refer to the Cisco Secure Access datasheet for all the latest details:

https://www.cisco.com/c/en/us/products/collateral/security/hybrid-workforce-cloud-agile-security-ds.html.

All Cisco Secure Access packages include access to download the Cisco Secure Client from the Software Download center for use with Cisco Secure Access. Cisco Secure Client is required for VPN, client based Zero Trust Access, Internet Security features, and Experience Insights. There is also a link to the Secure Client in the Secure Access dashboard for customers to easily access the Secure Client software.

The Cisco support contract generated provides access to those with their Cisco.com ID associated, to download the Cisco Secure Client only for the purpose of using Secure Access. For all other use cases, including the use of Secure Client with on-prem ASA/FTD devices, a separate Cisco Secure Client license is required. Please refer to the Secure Client ordering guide for further details: https://www.cisco.com/c/en/us/products/collateral/security/anyconnect-secure-mobility-client/secure-client-og.html.

Availability on global price list

Cisco Secure Access on the Global Price List is available in all countries except for China, Cuba, Iran, North Korea, Sudan, Syria, and Russia.

3. Understanding the licensing model

Subscriptions overview

Cisco Secure Access is licensed on a subscription basis. Each end customer has only one subscription, though each subscription may comprise multiple types of users: Secure Internet Access (SIA) and/or Secure Private Access (SPA). Subscriptions are available for standard term lengths of 12, 36, and 60 months. Following the completion of the term, the subscription will be renewed automatically for an additional 12-month term unless the renewal is cancelled or auto-renewal was deselected at the time of initial order. Subscriptions can be changed mid-term or manually renewed using the Change-Subscription flow outlined in section 6.

Cisco Secure Access licensing

Cisco Secure Access is licensed per covered user. A covered user is defined as an internet-connected employee, subcontractor or other authorized individual covered by the deployment of the Software or Cloud Service, as applicable. The subscription quantity should cover the total quantity of covered users.

User bands

The user-based license follows a tiered pricing model: pricing depends on the covered user count and the term of the subscription. Sales and partner representatives should determine the correct sizing for each customer deployment so that the appropriate covered user count is selected. Cisco Commerce (CCW) will dynamically determine the correct price associated with the covered user count entered.

Subscription changes

Existing subscriptions may be changed during the term of the subscription. Changes may be made to products and/or quantities ordered. Additional quantities may be added to the subscription at any time during the subscription term by placing a “Change-Subscription” order. Quantities added through a Change-Subscription order will co-terminate with the existing subscription. Quantities may be decreased for a subscription renewal, but not midterm for a current subscription.

Each end customer may have only one subscription to Cisco Secure Access. Attempts to change subscriptions by placing a new order for an existing customer will result in an error and guidance to place a change order.

4. Understanding services and support

Cisco Secure Access purchase comes with Software Support (SWSS) Enhanced, with the option to upgrade to SWSS Premium. SWSS Premium support requires a minimum spend of $30,000 USD net annually. Customers are entitled to technical support for the term of their subscription.

Table 2.           Support Descriptions

To learn more about Cisco Support Services for Security Software, [[click here]]

5. Understanding the quoting and ordering process

New versus change subscriptions

Each end customer may have only one subscription. For new Cisco Secure Access customers, the orders team will create a new subscription beginning on the requested start date and lasting for the specified term. Existing Cisco Secure Access customers should place a Change-Subscription order rather than an order for a new subscription. The Change-Subscription process is outlined in Section 6.

Cisco Secure Access SKU overview

Orders for Cisco Secure Access involve three SKU types:

●     The subscription SKU, which is used to define the subscription term and start date.

●     The product SKUs, which are used to define the products and quantities that make up the subscription.

●     The support SKUs, which define the level of support for the subscription.

Orders start with the selection of the Secure Access subscription SKU. This is followed by the configuration of the subscription by selecting the product(s) and support SKUs that will constitute the subscription. When adding the product(s) SKUs, the $0 Experience Insights SKU will be automatically added, and cannot be removed.

Subscription SKU

There is only one subscription SKU for Cisco Secure Access. The term of the subscription applies to all products included in the subscription.

Product SKUs: Secure Internet Access (SIA) and Secure Private Access (SPA)

There are four SKUs for Secure Access Essentials and Advantage packages. Pricing follows a tiered pricing model and is calculated dynamically based on the SIA and SPA user counts and term of the subscription.

Support SKUs: SWSS Enhanced and SWSS Premium

There are two SKUs for support. SWSS Enhanced is selected by default, with the option to upgrade to SWSS Premium. Support is required for all Cisco Secure Access subscriptions.

Experience Insights SKU:

There is only one SKU for Experience Insights. This SKU will be added automatically to all Secure Access Subscriptions and is $0.  This SKU can not be removed from the order.

Step 1: Selecting the subscription SKU

There is one Cisco Secure Access subscription SKU (SECURE-ACCESS-SUB). There is no price for the subscription SKU. Pricing is determined when product SKUs are added and configured. Select a quantity of one because each end customer may have only one subscription. Product quantities will be entered when the product SKUs are added to the subscription.

Note:       Each end customer may have only one active subscription of Cisco Secure Access. This means that:

●     Each order may contain only one top-level line item of SECURE-ACCESS-SUB.

●     Each order can only contain all Essentials or all Advantage SKU’s (no mixing)

●     Each order may contain only SIA, or only SPA or both SIA and SPA SKUs

●     Each end customer may have only one active order for SECURE-ACCESS-SUB.

Attempts to place multiple concurrent orders for SECURE-ACCESS-SUB or to place an order with multiple line items of SECURE-ACCESS-SUB will be rejected. To change products or quantities for an end customer, place a Change-Subscription order.

After selecting the subscription SKU, choose Edit Options to edit the subscription term and the requested start date.

The subscription term will default to a 12-month term and prepaid term billing. Billing frequency can be changed to annual from the drop-down selection. The requested start date may also be changed at this time.

Note:       Annual billing option

●     Only terms that are multiples of 12 months (for example, 12, 24, 36) are allowed (for example, no 42 month “co-term” subscriptions with annual billing).

●     The PO needs to be issued for the full amount of the entire term, but billing will occur annually at the start of each service year.

●     While billing is annual or monthly, the subscription is for the entire term and cannot be cancelled mid-term.

The service is provisioned, and the subscription starts on the service start date. The provisioning of the service may take up to 72 hours, assuming the order information is complete and correct.

Note that when adding the Subscription SKU, CCW will automatically add the $0 Experience Insights SKU to the order. This cannot be removed.

Step 2: Selecting the product SKU

When the subscription terms have been set, the next step is to add products to the subscription. The term for the product is defined by the subscription term.

Start by selecting the appropriate product(s) in the subscription configuration summary. The guidance below uses Secure Private Access (SPA) Essentials as an example. Having chosen to configure the subscription for the product, you then enter the quantity based on the number of covered users for the service.

A selection from Secure Internet Access (SIA) and/or Secure Private Access (SPA) is allowed within a single tier, Essentials or Advantage. Selecting billing SKUs from both tiers will result in an invalid configuration. There is a minimum quantity of 100 users for each billing SKU selected.

Pricing is determined dynamically according to the quantity ordered and term and is based on a tiered pricing model. Annualized “per 12 months” prices are displayed for the selected SKU. However, billing is either annual or prepaid for the full term of the subscription, and the term amount is shown in the subtotal.

Step 3: Selecting the Support SKU

After you have added the products, the next step is to define the support level desired for the subscription. There are two Secure Access Support SKUs, corresponding to the two levels of support. To configure support for the subscription, start by selecting Secure Access Support Options in the subscription configuration summary:

SWSS Enhanced Support is selected by default. You can upgrade to SWSS Premium Support by selecting the appropriate SKU from the available options. Support service prices are calculated dynamically based on a percentage of the product list price. SWSS Premium requires a minimum spend of $30,000 USD annually. Cisco Account Managers can apply discounts to the support price. However, even then CCW will not allow it to be discounted below the minimum required threshold.

Step 4: Provisioning information

All Cisco Secure Access orders require you to provide the following end-customer information during order entry to properly provision an account to a customer:

●     End-customer administrator email address.

Failure to provide this information will delay the order provisioning process.

Secure Access services will be provisioned, and the subscription will begin on the service start date specified on the order. You can enter provisioning information by clicking the View/Edit link in the Provision Details section:

In the provisioning details page, enter the first name, last name, and email address of the end-customer administrator (not the partner.)

After the order has been placed, a claim code will be created for the end customer and emailed to the address specified above for subsequent provisioning. Refer to the Security Cloud Control user guide for details. Upon activation, the end-customer administrator will receive a welcome email with instructions to log in to the Secure Access Dashboard to set up their services. When administrators have logged in to the dashboard, they will be aided by a setup guide as well as access to support resources in order to make sure their accounts are properly set up.

Quoting and ordering help

For quoting or ordering questions, please contact cs-support@cisco.com, or open a case at https://customerservice.cloudapps.cisco.com/.

6. Subscription renewals, cancellations, and changes

Automatic renewal

Secure Access subscriptions automatically renew for an additional 12-month term by default unless Auto Renewal is deselected at the time of initial order. No quoting or ordering is required. Starting 120 days before the end of the initial term, renewal notices will be sent to the customer and partner. The partner will receive an invoice at the start of the new term.

You can cancel a renewal up to 60 days prior to the start date of the new term. If the subscription is not cancelled 60 days prior to the start of the new term, the subscription will auto-renew. Mid-term cancellations of subscriptions for credit are not allowed.

Manual renewal

Any subscription can be manually renewed if the customer or partner desires, with standard terms of 12, 36, or 60 months. For manual renewals, quotes are created using the same process as the Change-Subscription process outlined below. This process will create a new quote. After a quote is approved, it can be converted to an order following the standard process.

Subscription cancellations

Renewals may be cancelled up to 60 days before the start date of the new term. If the subscription is not cancelled 60 days prior to the start of the new term, the subscription will automatically renew. Mid-term cancellations of subscriptions for credit are not allowed.

Subscription changes (Change-Subscription)

Changes to the products, quantities, or terms of a subscription may be made at any time during the term of the subscription. To change the subscription, please refer to this Cisco Commerce Change Subscription Job Aide. Attempting to add products or users by creating a new subscription will result in an ordering error. Subscription changes to Secure Access from existing Umbrella or Secure Connect subscriptions is a manual process and cannot use the automated change subscription process described here.

7. Partner and distributor ordering guidelines

Channel Booking Neutrality and Distribution Sales Visibility (DSV)

Cisco Secure Access is a SaaS offer. Any quote lines for SaaS offers will be automatically confirmed for Channel Booking Neutrality (CBN) order processing. A US$100,000 minimum threshold must be met for non-SaaS offers to be eligible for CBN processing. This threshold does not apply to SaaS offers, which will be processed using CBN regardless of deal size.

Distributors using Distribution Sales Visibility (DSV) should continue to use the CBN process for SaaS offers, which cannot be processed with DSV.

Nonstandard discounting and DART

Cisco Secure Access quote lines are not included in the distributor authorization Deviation Authentication Request Tool (DART). As a SaaS offer, Cisco Secure Access will be automatically confirmed for CBN order processing, where any approved nonstandard discount is provided to the distributor at the time of ordering. A DART is therefore not needed for the distributor to claim the discount after the order is processed. CBN-confirmed quote lines are not included in the DART, but will be included with the Deal ID that is approved along with any discounts.

Hybrid orders by distributors

Cisco is able to process hybrid orders. These are defined as SaaS SKUs and hardware and/ or software SKUs that are quoted and ordered together. For CBN order creation, the distributor can place orders with their CBN Direct Value-Add Distributor (DVAD) ID. SaaS SKU order lines will be automatically confirmed. You can manually confirm hardware and on-premises lines if the total order is greater than US$100,000.

Note:       Cisco distributors have an assigned CBN DVAD ID for processing orders on Cisco Commerce. When ordering SaaS SKUs, distributors must use their CBN DVAD ID unless they are DSV enabled and their CBN profile flag is disabled. Distributors that are DSV enabled and whose CBN profile is disabled will place SaaS and hybrid orders using contractual BIDs and the net-price flow. (Refer to the net-price solution for SaaS and on-premises orders).

Choose one of the two ordering flows outlined below depending on the distributor profile (CBN flow or net-price flow).

Quotes placed with the CBN profile (CBN Profile = YES)

Hardware and/or software and SaaS SKUs can be ordered in the same deal.

Ordering flow 1: The total deal value is US$100,000 or more:

●   SaaS lines will be auto confirmed as CBN.

●   On-premises and hardware orders will need to be confirmed manually.
(Note: A nonstandard discount on hardware will not carry from the quote to the order).

●   To convert the quote to an order:

●   CBN-enabled distributors can select “CBN DVAD BID” so that the ordered products will be autoconfirmed at the time of ordering.

●   Contractual BIDs or CBN DVAD BIDs can be used for non-SaaS orders (hardware or software).

Ordering flow 2: The total deal is less than US$100,000:

●   For CBN-enabled distributors, SaaS orders are autoconfirmed as CBN.

●   On-premises and hardware orders cannot be confirmed as CBN. (Nonstandard discounts on hardware will not carry from quote to order.)

To convert the quote to an order:

●   CBN DVAD BIDs should be used for CBN confirmed lines at the time of ordering (applicable only to SaaS lines).

●   Contractual BIDs or CBN DVAD BIDs can be used for non-SaaS orders (hardware or software).

Quotes placed with the CBN profile disabled (CBN Profile = NO)

You can order hardware and/or software and SaaS SKUs in the same deal. There is no order amount threshold.

To convert a quote to an order, choose Contractual BID from the menu. Note that a nonstandard discount for hardware or software on the quote will not carry over to the order because the order will follow a net-price model. Point-Of-Sale (POS) reporting and DART will be deployed for these products. No DART will be generated for SaaS SKUs.

For your order, you can select all items, or select individual line items and continue with the ordering process.