Cisco Security Cloud Control for Government Ordering Guide

 

Introduction. 3

Security Cloud Control for Government Eligibility. 4

Product licensing overview.. 5

Ordering process. 6

Appendix A: Security Cloud Control Firewall Management for Government License SKUs. 14

Provisioning information. 17

Subscription renewals, changes, and cancellations. 17

Introduction

This ordering guide is designed to help Cisco sales teams, partners, and distributors order Cisco Security Cloud Control for Government subscriptions. This guide will help you:

●     Understand various offers for Security Cloud Control for Government

●     Understand specific ordering SKUs for your needs

●     Make sure that the right quantities are selected to reduce the risk of order rejection

●     Explain eligibility requirements for Federal Risk and Authorization Management Program (FedRAMP) products to reduce the risk of order rejection

●     Provide information about the end-to-end quote-to-fulfillment process in Cisco Commerce for this offer

●     Provide information about the end-to-end quote-to-fulfillment process in Cisco Commerce

This guide is intended for Cisco sales teams, partners, and distributors qualified to sell Cisco Security Cloud Control for Government on the Cisco Global Price List.

Scope

This guide addresses the ordering experience for the firewall management capabilities in Security Cloud Control for Government.

For information about ordering Cisco network security devices and services or feature licenses on the Cisco Secure Firewall (Essential, IPS, URL Filtering, Malware etc.) refer to the Cisco Network Security Ordering Guide.

Authorization overview

Cisco Security Cloud Control Firewall Management for Government has a FedRAMP Moderate Authorization by the FedRAMP PMO and the sponsoring agency, the Federal Communications Commission. The basic authorization “Authority to Operate” (ATO) is granted to Cisco and is renewed each year in an annual audit. Security Cloud Control Firewall Management received authorization in August 2025 by the Significant Change process (SCR) and inherited the ATO from Cisco Umbrella^® for Government. We also perform “Continuous Monitoring” (ConMon) and do regular reporting with our sponsoring agency. The FedRAMP marketplace listing for Cisco Security Cloud for Government has been updated to include Security Cloud Control Firewall Management for Government, Cisco Multicloud Defense for Government, and Cisco Secure Access for Government.

Federal government agencies can request a copy of the SSP (security document for Security Cloud Control Firewall Management for Government) through the FedRAMP PMO via portal.max.gov. Other customers (state, local, and educational [SLED], contractors, etc.) cannot do so. Note that Security Cloud Control Firewall Management for Government is considered “Government Community Cloud,” which has eligibility guidelines for those who can trial, purchase, and use the product. (See below for eligibility)

Security Cloud Control for Government Eligibility

Since Security Cloud Control Firewall Management for Government is a FedRAMP Moderate authorized product, our distribution method is “Government Community Cloud.” This means that there are restrictions on who can purchase the product. The eligibility validation intake form can be found here.

 

To begin the eligibility review, the federal customer validation intake form needs to be completed. Note: To avoid browser related issues, it is recommended to avoid bookmarking this link in a browser. Instead, please save elsewhere such as a word document and copy and paste it into the browser each time you’d like to access it. If issues persist, try using a different browser or clearing cookies/cache.

The form, along with other information can be found on the security federal ordering process document on SalesConnect.

The federal customer validation intake form can be completed by the seller, partner, or customer directly and should be completed during the quoting period or when beginning a trial. When the order is placed, it will go on compliance hold to verify that the Intake form was completed and the necessary documentation confirming eligibility of the end customer was provided. If the end customer is determined ineligible for the federal edition, they may purchase the commercial version instead.

Product licensing overview

Security Cloud Control Firewall Management has two types of licensing: Base subscription and per device licensing. Both are needed for managing Cisco Secure Firewalls. Apart from that, there is optional licensing for Secure Firewall logging (covered in Table 1).

For Multicloud Defense for Government, the product licensing is based on the consumed amount of aggregated gateway hours across all the cloud environments. The product has two tiers available: Advantage and Premier. Secure Firewall device licenses, such as Threat, Malware, URL filtering, and support, should be purchased separately. Security Logging and Analytics can also be added for logging and troubleshooting use cases. For more information on Multicloud Defense ordering, visit the Multicloud Defense ordering guide.

Table 1.        Product Packaging

Logging Licensing

For customers who don’t wish to use the Management with Unlimited Logging option, they can buy logging capacity a-la-carte.

Service and Support

Cisco Solution Support for Government is required with the purchase of a Security Cloud Control Firewall Management for Government subscription. It provides technical support meeting the needs of public sector customers aligned with FedRAMP Moderate, including US-based support model and secure case management. This support entitles customers to the services listed here for the term of product subscription:

●     24/7 access to Cisco Technical Assistance Center (TAC)

●     30-minute initial response objective for high-severity service requests

●     Primary point of contact accountable for solution issues

●     Knowledge base and online resources

During product configuration, Solution Support for Security Cloud Control Firewall Management for Government (SKU: SVS-FWM-FED-SUP-S) is automatically included and cannot be deselected.

For more details on Cisco Solution Support for Government, click here.

Ordering process

Quoting Guidelines

Security Cloud Control Firewall Management for Government requires a base subscription for tenant entitlement and a per-device license for device management entitlement. The licenses are offered as a subscription ranging from 12-60 months with the default selection being 36 months.

●     Base tenant subscription: Priced per tenant, with the ability to add only one Base Tenant subscription per order. For multiple tenants, a new order must be placed.

●     Per-device licensing: Based on the model number and quantity per model. For instance, if you are ordering 10 Secure Firewall devices and want to manage these in a single tenant, you need to order 1 Base License Subscription and 10 per-device SKUs for the respective Secure Firewall devices. The per-device licensing does not depend on the type of Firewall OS (FTD or ASA) running on the device platform.

●     Firewall Threat Defense (FTD): The cloud-delivered Firewall Management Center (FMC) to manage FTD devices is included in the Base Tenant Subscription.

●     High-availability devices: In a high-availability pair, since only device is passing traffic at any given time, for licensing purposes, a high-availability pair of managed devices will count as one device license.

●     Clustered devices: In a cluster, multiple devices are passing traffic, for licensing purposes, number of per-device licenses bought must be equal to the number of devices in the cluster.

●     Multi-instance deployment: For firewalls deployed in multi-instance mode, the licenses are not counted per container instance. For example, a Secure Firewall 4215 running 10 instances, will require only one 4215 device license.

●     Multi-context deployment: For ASA devices that support multi-context, the Security Cloud Control Firewall Management for Government licensing is sold for just the device itself. Each context will be managed as a separate firewall, but the charge only applies to the admin context.

The quoting process outlined here considers two scenarios:

1.     Purchasing Security Cloud Control Firewall Management with unlimited logging storage

2.     Purchasing Security Cloud Control Firewall Management with cloud logging as an optional add-on

Scenario 1: Purchasing Security Cloud Control Firewall Management with unlimited logging storage

Step 1: Selecting the Subscription SKU

There is one subscription SKU for Security Cloud Control Firewall Management for Government (FWM-FED-SUB). There is no price for the subscription SKU. Pricing is determined when product SKUs are added and configured. The quantity is fixed at 1 because each end customer may have only one subscription. Product quantities will be entered when the product SKUs are added to the subscription.

a.   Search FWM-FED-SUB and add it.

b.   Click Select Options to add product SKUs to the subscription.

Step 2: Adding Product SKUs

The next step is to add products to the subscription. Here you will add the model and quantity of device platforms to be managed.

●     Firewall Management Base Tenant SKU

This represents the base tenant subscription for managing the Secure Firewalls. It is mandatory and will be added automatically when the Management and Logging Product SKUs are added. This is fixed at 1. If there is a need to purchase multiple tenants, additional orders need to be placed as each order allows only one tenant.

●     Cloud Management License with unlimited logging and 90 days retention

This represents the per Secure Firewall platform SKU representing the specific Secure Firewall model. This SKU provides entitlement to device management and unlimited logging storage with 90 days of rolling retention. The quantity represents the number of devices you wish to manage. Refer to quoting guidelines section of this document above for understanding the requirements for high availability, clustering, multi-instance or multi-context deployments.

In this example 1xFWM-FED-ML-FP1010 SKUs are added, which entitle the customer to onboard and manage 1x1010. Also, it provides entitlement for unlimited log storage for both with a 90-day rolling retention period.

Note: When one of the product SKUs is added, the Solution Support for Government SKU (SVS_FWM-FED-SUP-S) for the Security Cloud Control Firewall Management for Government subscription is automatically attached. It cannot be deselected.

Scroll to find the relevant platform model SKUs and add combination of SKUs as per your requirements. The complete SKU list is available in Appendix A.

Step 3: Modify Term Details

Click Terms Tab at the top right to view the details of the Terms. By default, it is 36 months. To adjust this, click the Edit button and makes changes required to the subscription and renewal under New Terms and Billing and click the Save Changes button.

At time of ordering, the subscription is set to auto-renew as a default, however, auto-renew can be turned off (toggle button on lower left as shown above) without triggering the deal to become nonstandard.

Step 4: Validate the order

Click the Summary tab at the top to ensure the order reflects the desired quantity and type of SKUs, then Click Verify and Save to proceed with the order completion.

Note: The federal customer validation intake form must be completed prior to tenant provisioning. Read below in the Provisioning information section for details.

Scenario 2: Purchasing Security Cloud Control Firewall Management with cloud logging as an optional add-on

Possible Use Cases:

●     Secure Firewall(s) already purchased as part of a different order

●     Customer has specific logging estimates and wishes to buy a tier based on fixed amount of ingest, storage and logging retention

●     Customer wishes to have a log retention period greater than 90 days

Step 1: Selecting the Subscription SKU

There is one subscription SKU for Security Cloud Control Firewall Management for Government (FWM-FED-SUB). There is no price for the subscription SKU. Pricing is determined when product SKUs are added and configured. The quantity is fixed at 1 because each end customer may have only one subscription. Product quantities will be entered when the product SKUs are added to the subscription.

a.   Search FWM-FED-SUB and add it.

b.   Click Select Options to add product SKUs to the subscription.

Step 2: Adding Product SKUs

The next step is to add products to the subscription. Here you will add the model and quantity of device platforms to be managed.

●     Firewall Management Base Tenant SKU

This represents the base tenant subscription for managing the Firewalls. It is mandatory and will be added automatically when the Management and Logging Product SKUs are added. This is fixed at quantity 1. If there is a need to purchase multiple tenants, additional orders need to be placed as each order allows only one tenant.

●     Add Per-Device Management SKUs (no logging included)

This represents the per Secure Firewall platform SKU representing the specific Secure Firewall model. This SKU provides entitlement to device management only. The Quantity represents the number of devices you wish to manage. Refer to Quoting Guidelines for understanding the requirements for High Availability, Clustering, Multi-Instance or Multi-Context deployments.

a.   Search for Cloud Management and choose the relevant SKUs. Scroll to find the relevant platform model SKUs and add combination of SKUs as per your requirements. The complete list is available in the Appendix A.

In this example 2xFWM-FED-FPR4215 SKUs are added, which entitles the customer to onboard and manage 2x4215. It does not provide any logging entitlement. Click Edit Service/Subscription.

Note: When one of the product SKUs is added, the Solution Support for Government SKU product subscription is automatically attached and cannot be deselected.

b.   Click Done after adding all the required device management SKUs for the Firewall models.

Step 3: Modify Term Details (Optional)

a.   Click Terms Tab at the top right to view the details of the Terms. By default, it is 36 months. To adjust this, click the Edit button and makes changes required to the subscription and renewal under New Terms and Billing.

At time of ordering, the subscription is set to auto-renew as a default, however, auto-renew can be turned off (toggle button on lower left as shown above) without triggering the deal to become nonstandard.

Step 4: Validate the Order

Click the Summary tab at the top to ensure the order reflects the desired quantity and type of SKUs, then click Verify and Save to proceed with the order completion.

Note: The Federal Customer Validation Intake form must be completed prior to tenant provisioning. Read below in the Provisioning information section for details.

Click Save Changes button. Click the Summary tab at the top to ensure the order reflects the desired quantity and type of SKUs. Click Verify and Save to proceed with the next step.

Step 5: Add Cloud Logging SKUs (Optional)

By purchasing this, the customer benefits from Centralized Log Management in the Cloud for Long Term Retention, Troubleshooting and Compliance. The Logging Subscription SKUs can be bought standalone also without purchasing any device management SKUs.

a.   Search for SAL-FED-SUB and add it.

b.   Click Select Options to configure the SAL logging requirements.

c.   Depending on the logging requirements, there are various tiered licensing options available for SAL based on the total storage offered, the retention period and the fixed daily ingest limits. In this example, the SAL-FED-ADV 3Y package is chosen which will provide 2000 GB of total ingest and storage per year, with 25 GB of daily ingestion limits supported and a 3 year log retention period.

Note: You can either estimate the logging requirements using the Performance Estimator Tool or use metrics within the existing installation such as Netflow data.

Note: Solution Support for Government SKU (SVS-SAL-FED-SUP-S) for the Security Analytics and Logging for Government subscription is automatically attached. It cannot be deselected.

d.   Modify Term Details (Optional). Click Terms Tab at the top right to view the details of the Terms. By default, it is 36 months. To adjust this, click the Edit button and makes changes if required to the subscription and renewal under New Terms and Billing.

e.   It is recommended that this matches the Term length of the Firewall Management Base Tenant SKU. At time of ordering, the subscription is set to auto-renew as a default, however, auto-renew can be turned off (toggle button on lower left as shown above) without triggering the deal to become nonstandard. Click Save Changes to finish adding products.

Appendix A: Security Cloud Control Firewall Management for Government License SKUs

Table 2.        Security Cloud Control Firewall Management for Government SKUs (Base Tenant and Unlimited Logging)

Table 3.        SAL Saas logging and troubleshooting XaaS license for logging entitlement

Table 4.        Firewall Management in Security Cloud Control: subscription of 1, 3, and 5 years available

Note: All the PIDs listed in Table 3 are available in 1, 3, and 5-year subscription PIDs. Example: FWM-FED-FPR4225 is available as FWM-FED-FPR4225-1Y, FWM-FED-FPR4225-2Y, and FWM-FED-FPR4225-3Y.

Provisioning information

After the order has been placed, an activation email will be created for the end customer and emailed to the Technical Contact’s email address as specified in the federal customer eligibility intake form. Refer to the Security Cloud Control user guide for details. Upon activation, the end-customer administrator will receive a welcome email with instructions to log in to the Security Cloud Control tenant to enable Firewall Management. When administrators have logged in to the dashboard, they will be aided by a setup guide as well as access to support resources to make sure their accounts are properly set up.

Subscription renewals, changes, and cancellations

At time of ordering, the subscription is set to auto-renew as a default, however, auto-renew can be turned off (toggle button on lower left as shown above) without triggering the deal to become nonstandard.

Subscription changes

Changes to the products, quantities, or terms of a subscription may be made at any time during the term of the subscription. To change the subscription, please refer to the Cisco Commerce Change Subscription Job Aid. Attempting to add products or quantities by creating a new subscription will result in an ordering error.

Subscription cancellations

Renewals may be cancelled up to 60 days before the start date of the new term. If the subscription is not cancelled, the subscription will automatically be renewed. Midterm cancellations of subscriptions for credit are not allowed.