In the ever-changing security landscape, federal agencies are challenged to find a security solution that not only works right now but will also address future security needs without adding unanticipated costs.

To help agencies choose a service that works for them, we compiled a list of the seven critical questions to ask vendors about the security solutions they provide. With this information in hand, agency IT decision makers can choose the service that best fits with their agency missions and priorities.
 

1. What FedRAMP status do you have today?

Many vendors say their services and technology are adequate enough to secure sensitive government data. However, without third-party verification to validate these claims, you could not only be risking the efficacy of your investment but also the security of your networks.
 

2. Does the service scale, and does scaling in any way cause outages?

Cloud-native and resilient services mean fewer security interruptions to the mission. You need to know if the service scales, and if scaling will cause outages. Often, updates to legacy infrastructure require an outage window, which is downtime for your users. A true multitenant cloud platform that scales reduces outages, which is why it's important to choose a cloud-native service.
 

3. Is the service zero trust by default?

By default, zero trust security means the system was designed with zero trust principles from its inception. For context, zero trust requires identity verification from everyone trying to gain access to the system and its applications. Access is granted based on policy requirements being met while all other connections are denied by default. This added layer of security prevents data breaches and secures agency data.

4. How does the solution peer with SaaS providers?

Knowing how your data moves improves performance. Ask whether the vendor peers with SaaS providers, such as Microsoft and Salesforce, and how these peering relationships will impact performance and cost.
 

5. How long does it take and how much does it cost to set up a proof of concept?

Chances are, if the company says it can set up a proof-of-concept/proof-of-value quickly, then their solution is likely cloud-native and resilient. If a vendor says it's going to take eight weeks or more to provide a proof-of-concept, and with additional costs, then the service is likely not easy to scale.
 

6. How does it interact with O365? Is it easy to configure? How does it perform?

Nearly every federal agency uses Office 365, meaning hundreds of thousands of users rely on it for everything from creating documents to hosting team meetings. Any security-as-a-service solution must interact well with O365, must be easy to configure, and must perform well without interruption. If configuration isn’t seamless, you spend more on professional service hours to get it working.
 

7. Will videos on iOS and Android impact SSL decrypt, bandwidth, and network performance?

Mobile devices are ubiquitous within the government, and they need to perform as well as desktop devices. Whether users are  deployed in the field or working from home, they need the ability to stream video and other high-bandwidth apps and content.
 

Be Sure and Secure

Don’t fall for a lift-and-shift of old appliances to the cloud. Asking these seven questions will help you determine whether your security provider truly has a cloud-native platform that is dynamic, scalable, and resilient. For more detail about what to assess in their answers, download the white paper: The 7 Critical Questions Agencies Should Ask Security Providers

Mark Harman is a sales engineer at Zscaler.