Secure Access Service Edge (SASE) Welcome Kit

The Managed Services Implementation Manager is the primary contact for you regarding your SASE Management Services. They are responsible for the implementation of each SASE Management order. The Managed Services Implementation Manager will arrange a Customer Kickoff Call/Order Verification Call to review and approve the order, the Engineering Design Document (if applicable) and begin the implementation process.

Below is a list of activities to be performed by the Managed Services Implementation Manager:

• Schedule and run the Customer Kickoff Call/Order Verification Call(s).
  
• Perform overall implementation management services for the timely delivery and successful activation of the SASE Management service. 
• Act as a point of contact for issues or questions related to the implementation of a specific managed services order.
• Host conference calls among all relevant parties.
• Coordinate resource scheduling.
• Oversee the completion of all elements of the managed services orders. 
• Publish open action items and status reports.
• Interface with Verizon organizations to collect status information.
• Act as the point of contact for any order-related issues. 
• Verify individual order delivery is compliant with the submitted order.
  Note: E-mail communication sent by your assigned Managed Services Implementation Manager will contain their contact information along with escalation contact information in the signature section of the email.  

Your Order Manager will:

• Communicate as needed in the form of periodic emails and/or follow up calls to provide status on key information regarding the implementation and activation of your SASE Management Services.
• Work all aspects of the order directly with you and will gather any additional information needed. As noted above, a managed SASE solution can involve multiple products and service items. 

Note: Your Order Manager and Managed Services Implementation Manager will be in communication with each other to help move your order to completion, including provisioning and activation of Managed SD WAN and Cloud Security License orders.

Note: Though your Managed Services Implementation Manager is your primary contact for your SASE Management Services, you may contact your Order Manager via email or phone at any time for order related questions.

The role of your Implementation Engineer is to act as the technical point of contact. Below is a list of activities to be performed by the Implementation Engineer:

• Communicate with you as necessary for required technical information.
• Validate information in the Enterprise Service Portal (ESP) order. 
• Progress the SASE Management order and coordinate with your Project Engineer. 

Upon successfully completing the implementation requirements of your SASE Management  Services, your services will be handed off to the Verizon Network Operations Center and Security Operations Center.

The Network Operations Center and Security Operations Center will be responsible for incident and change management activities after your solution is accepted for management.

Within the Network Operations Center and Security Operations Center, your organization will have a Project Engineer assigned.  Below is a list of activities to be performed by the Project Engineer:

• Manages the hand-off transitioning process of networks from Design & Implementation (Managed Services Delivery) to Service Assurance (Network Operations Center ).
• Point-of-Contact for non-real-time-service issues.
• Point-of-Contact for your account requests and password resets.
• Maintains the Enterprise Service Portal (ESP), the Managed Network Services (MNS) Database of Record.

For more details, click on the Network Operations Center and Security Operations Center in the left navigation of this welcome kit.

You are responsible for the initial set of Policy Rules on the cloud security instances. If you have purchased Professional Services , they will assist you with the initial configuration. Thereafter, you may request changes via a Change Request to the Policy Rules associated with your SASE Management.

SASE Management provides customer-initiated Policy Change Management for the SASE package security components, such as Zscaler Internet Access (ZIA), Zscaler Private Access (ZPA), and Palo Alto Prisma Access. 

Verizon evaluates, prepares, and implements Policy Rule changes as described in the Policy Change Management Process section.

 The development and review of Policy Rules that are outside the scope of SASE Management and the migration of existing Policy Rules will be subject to a separate written work agreement and charged at the applicable rates.

SASE Management does not cover management or troubleshooting of your devices connected to the cloud security instance. Customers requiring support for such devices may purchase a separate service(s) such as Managed Security Services.

SASE Management can be provisioned for you with an endpoint licensing agreement for one or more of the supported third party vendor cloud security products. Ongoing management is provided through a third party vendor-provided console or web-enabled management portal. 

Your authorized users for Secure Access Service Edge (SASE) Management registered in the  Verizon Enterprise Center portal  may submit a Change Request for SASE Management. The change requests described below are for managed cloud security tenants. Please refer to the SD WAN welcome kit and service attachment for the Change Request process for changes related to your managed SD WAN service. 

 A Change Request is a change which involves creation, modification, or deletion of less than 10 Policy Rules and/or 40 objects. Verizon supports up to 5 change requests in a 4-hour window, or 10 changes in an 8-hour window (1.25 changes per hour). SASE Management provides up to 31 total change requests per month. The number of Change Requests per month cannot exceed following limits per change type, with a total of no more than 31 changes across all 3 change types defined below:

• Regular – 31 change requests
• Fast Track – 10 change requests
• Urgent – 10 change requests

Verizon assigns a unique ‘Change Request’ number to each Change Request submitted. Your authorized users can use this number in all communications about the Change Request. Verizon may ask the customer for additional confirmation and authorization before implementing a Change Request.

Verizon reviews and accepts Regular Change Requests within 24 hours after your submission. Verizon implements a Change Request in the next maintenance window, provided that the minimum time between Verizon’s acceptance of the Change Request and the implementation is at least 48 hours. A Regular Change Request is a planned change to the topology of the infrastructure or security policy that involves:

• Changes to existing rules, or the creation of new Policy Rules and/or objects;
• Creation of new hosts in the policy, and the host is part of a subnet that is already accessible and configured; or
• The distribution of traffic between existing hosts.

A Secure Access Service Edge (SASE) Management Fast Track Change Request (FCR) is a planned or unplanned change that: 

• Impacts changes to existing rules or the creation of new Policy Rules and/or objects;
• Creates new hosts in the policy of the service and the host is part of a subnet that is already accessible and configured in the service; or 
• Allows or disallows traffic between hosts. 

Verizon reviews and accepts an FCR within 4 hours and implements an accepted FCR within 36 hours after acceptance. 

Verizon will review and accept or reject an Urgent Change Request (UCR) within 2 hours and will implement an accepted UCR within 4 hours after acceptance. Your authorized user will acknowledge that a UCR gives Verizon less time to review and mitigate security risks associated with the change request and implementation of UCR carries a higher degree of risk. You will accept such risks associated with a UCR when submitting a UCR. 

A UCR is an unplanned change consisting of:

• Modification of the existing rules or the creation of new Policy Rules and/or objects; or
• Specification of the required configuration setting and its new value.

Your authorized users will provide the following when submitting an Urgent Change Request:

• Detailed data to allow Verizon to review the request within the SLA target of ≤ 2 hours.
• Availability of an authorized user by telephone to further clarify the Urgent Change Request.
• Written confirmation via Verizon Email(s) of decisions made during phone calls with Verizon

A Change Request is “Major” when it is not covered by Regular, Fast Track, or Urgent Change Requests including Change Request frequency or monthly volume. Major changes are out of scope for SASE Management, but can be performed by Verizon under a separate work agreement and are charged at the applicable rates.

Secure Access Service Edge (SASE) Management includes incident management on the cloud security instances. Incident tickets are logged when a ticket is created by your users or Verizon for service failures. Verizon created service-related incidents are based on data provided by Third Party Vendors. They are logged on a 24x7 basis.

The Priority Level of a ticket created by Verizon is based on the error conditions listed below. The Priority Level of a ticket created by your users is based on the information received from you and on the impact of the problem on your network. Verizon assigns a unique ticket ID and a Priority Level to every support request that it accepts.  

End-user help desk assistance is outside the scope of SASE Management. Your end-user help desk is expected to isolate users' connectivity issues. authorized users can then open a SASE Management incident ticket if the issue appears related to their cloud security instance.

Incident management for SD WAN is handled by the NOC pursuant to the SD WAN service.

Additional status updates can be provided to you. Please keep in mind Verizon will share confidential information and ticket updates only with your authorized users. Verizon has the right to refuse requests that:  

• Are made by a contact who is not a SASE Management authorized user
• Relate to the installation of software  
• Would involve training or consultancy services  
• Would involve a redesign of your infrastructure  
• Request management support for security instances not managed by Verizon 

Your authorized users may contact Verizon through the Verizon Enterprise Center (preferred approach), by email, or by telephone. The following information is required when registering a ticket:  

• The name of the caller, telephone number, email address, and customer name.  
• A detailed description of the problem and information on how the problem can be replicated.  
• Description of the error code and/or messages and how the network environment and business was impacted.

Your traffic may be impacted during Third Party Vendor maintenance windows or service outages. Verizon is not automatically notified of maintenance windows or service outages by Third Party Vendors. Verizon shall inform you when maintenance windows or service outages are determined as impacting user traffic.

Verizon monitors the health of the service instance 24x7 by checking the up/down status of the tunnel from the Verizon managed SD WAN service to the cloud security instance. 

If initial investigation indicates that the alert is a false positive, the monitoring alert will not be escalated. 

If the alert is valid or if certain monitoring thresholds are exceeded, a health incident ticket is created and Verizon notifies your authorized users by email. Verizon will close the ticket once your users have notified Verizon that the issue has been resolved. 

After contacting you three times, if Verizon does not receive communication from your users that the issue has been resolved, the ticket will be closed. 

Verizon will not collect events/logs created by the cloud security vendors as part of Secure Access Service Edge (SASE) Management. However, Verizon requires access to your logs/events on the vendor management portals in order to provide management for the security instances, including implementation and verification of your change requests. 

Security analytics is not part of SASE Management, but is available as part of the Managed Detection Response offering, which can be purchased separately.

If your security service instance requires integration with your network and those network devices are not managed by Verizon, then you are responsible for any actions taken on your network devices. 

Verizon will only employ policy changes in coordination with your authorized users on your network devices managed by Verizon under the fully managed or co-managed service level in conjunction with the SASE Management product.

Note: Device management is not part of the SASE Management service and requires another Verizon service to be ordered.