In short
Public sector SASE gives councils, schools, colleges, health bodies and agencies one cloud-delivered policy for staff, sites and internet traffic. UK public bodies usually start from the NCSC's zero trust and ZTNA guidance, buy under their own procurement rules, then pilot before rolling out site by site. Subscriptions can be billed monthly, terms confirmed at quote.
Not sure where to start?
Tell us what you need to achieve and we will point you to the right option.
Why public sector organisations are moving to SASE
Public sector estates are often spread across many buildings, with staff who work from home, from partner premises and on the move, and a growing share of applications in the cloud. Traditional designs send that traffic back through a central firewall and VPN, which adds delay and leaves broad network access once someone is connected.
SASE moves access and inspection to the cloud and the device: per-application access for staff and partners, web and SaaS security wherever they work, and SD-WAN to manage the links between sites. The guide below is framed around the National Cyber Security Centre's published guidance, which applies to public and private sectors alike. For the zero trust angle on its own, ztna.org.uk covers zero trust for the public sector (opens in a new tab).
Start from the NCSC's guidance
The NCSC publishes two pieces of guidance that shape a public sector SASE project:
- Zero trust architecture design principles (opens in a new tab): eight principles, from "know your architecture, including users, devices, services and data" to "don't trust any network, including your own". The NCSC says the guidance is aimed at those implementing a zero trust architecture in an enterprise environment, including public and private sectors.
- Zero Trust Network Access (ZTNA) guidance (opens in a new tab): what to do before building a ZTNA architecture, eight design requirements for implementation, reference architectures (opens in a new tab) and anti-patterns. It names SASE and Security Service Edge (SSE) platforms, alongside VPNs and VPN-as-a-Service, as ways to provide the connection to a ZTNA policy engine.
Two points from it matter most for SASE. The anti-patterns (opens in a new tab) warn against deploying SASE as a direct replacement for a VPN while keeping broad network access, and against keeping legacy access routes that bypass the policy engine. And the section on tunnelling internet traffic (opens in a new tab) says tunnelling all traffic should not be a default design choice. A summary of the NCSC's zero trust material is on ztna.org.uk's NCSC zero trust (opens in a new tab) page.
Public sector SASE implementation guide: a phased plan
| Phase | What happens | NCSC reference |
|---|---|---|
| 1. Discover | Inventory users, devices, sites, applications and data flows, including partners and suppliers who connect in | Principle 1: know your architecture; readiness checks before building ZTNA |
| 2. Prerequisites | An authoritative identity provider, phishing-resistant authentication such as FIDO2, centralised device management and device posture signals | Identity and device prerequisites |
| 3. Requirements | Decide which components you need now (ZTNA, web gateway, CASB (opens in a new tab), firewall as a service, SD-WAN) and which later; agree the internet breakout and TLS inspection approach | Internet access controls; tunnelling and TLS inspection considerations |
| 4. Market engagement and procurement | Write an outcome-based requirement, engage the market and buy through the route your procurement rules allow | Assessing services and providers: trust relationship, assurance, shared responsibility |
| 5. Pilot | One group of users and real applications, with success measures agreed in advance | Trials or proof-of-concept deployments before commitment |
| 6. Roll out | Move internet access, private applications and then sites in waves | Eight design requirements for implementing ZTNA |
| 7. Retire legacy routes | Close VPNs, open ports and firewall rules that bypass the new policy | Anti-pattern: legacy access routes that bypass the policy engine |
| 8. Operate and review | Logging into your monitoring, regular policy and licence reviews | Make ZTNA architectures observable |
References are to the NCSC pages linked above, checked 9 November 2026. The technical detail of each phase is on SASE implementation.
Not sure which plan fits? Ask us
Tell us what you need and we will help you choose the right plan.
Procurement steps for public sector SASE
Public bodies buy under their own procurement rules and the public procurement regime that applies to them, so the route differs between a council, a school, an NHS body and a central government agency. Whatever the route, the same steps help:
- Write the requirement around outcomes, such as per-application access for staff and partners, web filtering on and off site, and resilience between sites, rather than naming a product.
- Set evaluation criteria that reflect the NCSC's points on assessing providers: what you delegate to the provider, what visibility and control you keep, logging and incident handling, and which responsibilities stay with you.
- Choose the buying route your procurement team advises, for example an existing framework or dynamic purchasing system, a further competition, or your own tender.
- Include a trial or proof of concept in the evaluation, as the NCSC recommends.
- Plan licensing and term: per user, per device or per site, the term length, and how numbers can change during the contract.
We can provide product information, help you prepare a pilot and quote the platforms we supply, with the buying route agreed with your procurement team.
How public sector SASE differs by organisation
| Organisation | Typical priorities | Read more |
|---|---|---|
| Councils and local authorities | Many buildings, hybrid staff, partner access, a mix of on-premises and cloud services | SASE implementation |
| NHS trusts, practices and health bodies | Working alongside HSCN, internet first, local breakout and SD-WAN at sites | SASE for the NHS |
| Schools and multi-academy trusts | The DfE filtering and monitoring standards, devices taken off site, multi-site trusts | SASE for schools |
| Colleges and universities | Large numbers of personal devices, research and administrative systems, guests | Zero trust for education (opens in a new tab) |
| Agencies and arm's-length bodies | Remote staff, SaaS adoption, contractor and supplier access | Secure remote access (opens in a new tab) |
Need help choosing?
We will recommend what fits your organisation and explain why, in plain English.
How Forever Systems helps public sector organisations
We supply several SASE and Security Service Edge (SSE) platforms, including Cisco Secure Access (opens in a new tab) and Cisco SASE, Check Point SASE (opens in a new tab), HPE Aruba Networking SASE and Barracuda SecureEdge, so we can compare them against your requirements. We can help with discovery, a requirements list, a pilot and a phased deployment, and support the platform afterwards, with scope confirmed at quote. Subscriptions can be billed monthly, terms confirmed at quote. Contact us to talk about SASE for your organisation.
Public sector SASE by sector
How Forever Systems helps with SASE
Forever Systems supplies several SASE and Security Service Edge (SSE) platforms, so we can recommend the one that fits your sites, your people and the network and security kit you already run.
- Assess first: we look at your current VPN, firewalls, WAN links and identity set-up, and the applications people need to reach
- Help you choose: single-vendor or dual-vendor SASE, or Security Service Edge (SSE) first and SD-WAN later, matched to what you need now
- Pilots and phased roll-out: we can help you start with one group of users or one site, then extend policy step by step
- Licensing in one place: subscriptions can be billed monthly, with terms confirmed at quote
We work with businesses, schools, charities and public sector organisations. Pricing depends on users, sites, components and term, so ask us for a quote.
Frequently asked questions
What is public sector SASE?
SASE (secure access service edge) used by councils, schools, colleges, health bodies and agencies: cloud-delivered ZTNA, web and SaaS security and firewall, combined with SD-WAN for sites, under one policy for staff, partners and buildings.
Is there NCSC guidance on SASE?
The NCSC's Zero Trust Network Access guidance names SASE and Security Service Edge (SSE) platforms as one way to provide ZTNA connectivity, and its anti-patterns warn against using SASE as a straight VPN swap. Its zero trust architecture design principles apply to public and private sectors.
How should a public body procure SASE?
Under its own procurement rules and the public procurement regime that applies to it. Write an outcome-based requirement, set evaluation criteria that reflect the NCSC's points on assessing providers, choose the buying route your procurement team advises and include a trial.
What does a public sector SASE implementation plan look like?
Discover users, devices and applications; put identity and device prerequisites in place; set requirements; procure; pilot; roll out in waves; retire legacy routes; then operate and review. Each phase maps to a section of the NCSC's guidance.
Can public sector organisations pay for SASE monthly?
Many SASE subscriptions can be billed monthly, terms confirmed at quote. Some organisations prefer an annual or multi-year term to match budget cycles; we can quote either where the vendor offers it.
Still have a question about Public sector SASE?
Ask us and a member of our team will get back to you.