Service-Specific Terms

Last updated: June 02, 2026

These Service-Specific Terms supplement the applicable master agreement(s) located at https://www.cloudflare.com/legal/terms/ (the “Agreement”), which govern your access to and use of Cloudflare's Service(s) and the provision of Professional Services. Unless defined below, all capitalized terms have the definitions given to them in the Agreement. All references to “you” and “your” in the Service-Specific Terms below refer to the Customer named in the applicable Order Form, Statement of Work, or other ordering document.

Please click on the following links to navigate to the Service-Specific Terms applicable to your specific Cloudflare Services.

Professional Services Terms

Advisory

Deployment

Optimization

Forward Deployed Engineer

Advisory - Bot Protection

1. Service Definition

Service Name: Bot Protection - Advisory Services

Service Goal/Objective: This service delivers a technical Configuration Blueprint that defines a multi-layered security strategy for up to two (2) zones. This service provides the specific architectural specifications for WAF, Bot Management, and Rate Limiting necessary for the Customer's internal teams to independently execute an expert-vetted security deployment.

Service Scope:

The primary output of this service is a Configuration Blueprint document for up to two (2) zones. This document serves as the technical roadmap for the Customer's implementation and includes:

WAF Design: Technical specifications for the security perimeter, defining:
- Cloudflare Managed Rulesets: Sensitivity levels and action settings (Block/Challenge) for Cloudflare Default and OWASP rulesets.
- Custom Rule Logic: Precise "If/Then" expressions and actions for up to five (5) custom rules per zone.
Bot Management Strategy: A traffic categorization and mitigation plan, defining:
- Detection Tuning: Recommended score thresholds and actions for verified vs. unverified bots.
- Exemption Logic: Specifications for allowing legitimate automation and third-party crawlers.
Rate Limiting Design: Architectural recommendations for protecting high-value endpoints, defining:
- Rule Logic: Target endpoints, matching expressions and counting characteristics.
- Starting Threshold & Tuning Methodology: Recommend initial request thresholds, mitigation actions for up to five (5) rate limiting rules per zone.

The service also includes the following consultative sessions and reviews:

Planning Session: One (1) 60-minute session to finalize target zones and align security policies with traffic profiles.
Validation: An expert review of the Customer-implemented rules while in "Logging Mode" to ensure alignment with the Blueprint.
Operational Handover: One (1) 60-minute recorded session to review the configuration, document any tuning changes made during validation and equip the Customer's internal team to own ongoing management, monitoring and threshold tuning.

Out of Scope:

Break/fix support, production incident response, and ad-hoc troubleshooting.

Any requests beyond the defined scope of this engagement require a formal change order and may result in additional fees.

2. Delivery Model & Methodology

This service is delivered in a structured methodology, completed within up to thirty-five (35) days.

Phase	Key Activities
Phase 1: Planning	Planning call to finalize requirements and identify 2 target zones. Read-only access to the Cloudflare environment established.
Phase 2: Strategy Design	Delivery of Configuration Blueprint. Customer executes the technical configuration.
Phase 3: Validation	Traffic monitoring in logging mode. Review of the implementation with tuning recommendations.
Phase 4: Go-Live	Customer makes DNS changes to cut traffic over and transitions rules to enforcement mode.
Phase 5: Handover	Knowledge transfer session. Formal engagement closure.

Resources: This service is delivered by a Cloudflare consultant. It does not include project management services.

Duration/Timeline:

This service is delivered over a fixed period of thirty-five (35) days. The Cloudflare consultant is allocated to this engagement for the duration of this delivery window. All work is performed during standard business hours (9:00 AM to 5:00 PM, Monday through Friday, based on the Customer's local time). After-hours, holiday, or weekend work is explicitly excluded from this engagement.

3. Deliverables

Deliverable	Description	Acceptance Criteria
Configuration Blueprint	A detailed technical design document containing the recommended logic for WAF, Bot Management, and Rate Limiting features for the two (2) zones	Delivery of Configuration Blueprint, subject to the five (5) business day review and deemed acceptance period defined in Section 5.
Validation Review	Expert review of Customer-implemented zones	Completion of technical review of the Customer's independently executed configurations to ensure alignment with the Blueprint, with validation and/or suggestions for improvement provided via email. This deliverable is subject to the five (5) business day review and deemed acceptance period defined in Section 5.
Knowledge Transfer	1 hour recorded technical session	Delivery of a single (1) consolidated session covering dashboard management of the configured zones. This deliverable is deemed accepted upon the earlier of: (i) completion of the session, or (ii) delivery of a recording of the session (or a recording of the attempted session if the Customer fails to attend the scheduled time or fails to provide the necessary consents required for a live recording).

4. Customer Responsibilities

Configuring and activating all rules within the Cloudflare dashboard.
Identifying priority application URLs and high-value endpoints during the Planning phase.
Reviewing traffic logs and moving rules from "logging" to "enforcement."
Providing read-only access to the Cloudflare environment.
Appointing a dedicated technical lead who will participate in scheduled calls and has the authority to configure the recommended design logic within the Cloudflare environment.
Identifying two target zones that will receive the Configuration Blueprint.
Obtaining all necessary consents from its employees, contractors, or other attendees prior to the recording of the Knowledge Transfer session, as required by applicable law.

5. Delivery Timelines, Acceptance

This is an outcome-based, fixed-fee engagement delivered within a thirty-five (35) day window. Cloudflare's ability to deliver the defined outcomes is dependent upon the Customer's timely completion of its responsibilities.

Project Holds & Expiration: If Customer dependencies, including but not limited to stakeholder availability for scheduled sessions or read-only access grants, remain outstanding for more than five (5) consecutive business days, Cloudflare reserves the right to place the project on "Hold" status. Resuming a project from "Hold" may require a Change Order and additional fees. Notwithstanding any holds or delays, this engagement expires automatically ninety (90) days from the Order Form Effective Date. Upon expiration, Cloudflare will deliver the Configuration Blueprint based on the information provided to date. At that time, the project is deemed fully complete, all fees are deemed fully earned, and Cloudflare will have no obligation to provide any additional services or deliverables.

Rolling Acceptance: Customer shall have five (5) business days after the delivery of each deliverable to review it for compliance with the acceptance criteria outlined in Section 3. Failure to provide written notice of material defects within this five (5) business day period will result in automatic deemed acceptance of that deliverable. Once all deliverables identified in Section 3 are accepted (or deemed accepted), the project will be considered complete.

6. Benefits

This service provides customers with the following key outcomes:

Expert-Led Strategy: Benefit from consultant expertise designed to help minimize false positives.
Internal Capability Building: Empowers the Customer's team through "learning by doing" under expert supervision.
Risk Mitigation: Assists in reducing the attack surface for key endpoints through an expert-vetted architectural approach.

Basic CDN & WAF Setup - Advisory Services

1. Service Definition

Service Name: Basic CDN & WAF Setup - Advisory Services

Service Goal/Objective: This service delivers a technical Configuration Blueprint that defines a standardized performance and security baseline for up to two (2) zones. This service provides the specific architectural specifications, including caching logic, SSL/TLS requirements, and WAF rule expressions, necessary for the Customer's internal teams to execute a best-practice Cloudflare deployment independently.

Service Scope:

The primary output of this service is a Configuration Blueprint document for up to two (2) zones. This document serves as the technical roadmap for the Customer's implementation and includes:

CDN Design - Technical specifications for performance optimization, defining:
- Caching Logic: Global Time-to-Live (TTL) settings and specific bypass or "cache-everything" rules.
- SSL/TLS Requirements: The specific encryption mode (e.g., Full, Strict) and required certificate types.
- Traffic Routing: A defined mapping of Rules to optimize origin pathing.
WAF Design - A security configuration plan for immediate protection, defining:
- Managed Rulesets: Sensitivity levels and action settings for Cloudflare Default and OWASP rulesets.
- Custom Rule Logic: Precise "If/Then" expressions and actions for up to three (3) custom rules per zone.

The service also includes the following consultative sessions and reviews:

Planning Session: One (1) 60-minute session to finalize target zones and technical requirements.
Implementation Validation: An expert audit of the zone configurations to ensure alignment with the Blueprint recommendations.
Operational Handover: One (1) 60-minute recorded session to review the final security posture and transition management to the Customer's internal team.

Out of Scope:

Translation of vendor configurations.
Break/fix support, production incident response, and ad-hoc troubleshooting.

Any requests beyond the defined scope of this engagement require a formal change order and may result in additional fees. Furthermore, the following services are explicitly out of scope for this engagement but are available for purchase under a separate Order Form and/or Statement of Work:

Bot Protection which includes deployment of Cloudflare's Bot Management, Rate Limiting, and WAF services.
Health Check & Remediation for reviews of existing Cloudflare configurations.

2. Delivery Model & Methodology

This service is delivered through a structured four-phase methodology over a fixed twenty-one (21) day period. The engagement is designed to provide the Customer with the expert design required to independently manage their Cloudflare environment.

Phase	Key Activities
Phase 1: Planning	Planning call to finalize requirements and target zones. Read-only access to the Cloudflare environment granted.
Phase 2: Configuration	Delivery of Configuration Blueprint. Customer executes the technical configuration.
Phase 3: Testing & Validation	Traffic monitoring in logging mode. Review of the implementation with tuning recommendations.
Phase 4: Go-Live	Customer transition of rules to enforcement mode. Final review session and formal engagement closure.

Resources: This service is delivered by a Cloudflare consultant and a Project Coordinator.

Duration/Timeline:

This service is delivered over a fixed active period of twenty-one (21) days. The Cloudflare consultant is allocated to this engagement for the duration of this delivery window. All work is performed during standard business hours (9:00 AM to 5:00 PM, Monday through Friday, based on the Customer's local time). After-hours, holiday, or weekend work is explicitly excluded from this engagement.

3. Deliverables

Deliverable	Description	Acceptance Criteria
Configuration Blueprint	A detailed technical design document containing the recommended logic for CDN and WAF settings for up to 2 zones	Delivery of Configuration Blueprint, subject to the five (5) business day review and deemed acceptance period defined in Section 5.
Validation Review	Expert review of Customer-implemented zones	Completion of technical review of the Customer's independently executed configurations to ensure alignment with the Blueprint, with validation and/or suggestions for improvement provided via email. This deliverable is subject to the five (5) business day review and deemed acceptance period defined in Section 5.
Knowledge Transfer	1 hour recorded technical session	Delivery of a single (1) consolidated session covering dashboard management of the configured zones. This deliverable is deemed accepted upon the earlier of: (i) completion of the session, or (ii) delivery of a recording of the session (or a recording of the attempted session if the Customer fails to attend the scheduled time or fails to provide the necessary consents required for a live recording).

4. Customer Responsibilities

Configuring and activating all rules within the Cloudflare dashboard.
Providing read-only access to the Cloudflare dashboard at project kickoff and removing access at the conclusion of the engagement.
Identifying priority application URLs and high-value endpoints during the Planning phase.
Reviewing traffic logs and moving rules from "logging" to "enforcement."
Managing all internal networking, backend origin modifications, and DNS changes. This includes securing origin infrastructure and the manual upload of any third-party SSL/TLS certificates directly to the Cloudflare platform (mTLS and custom certificates).
Performing all final application compatibility, performance, and end-to-end testing to ensure origin compatibility with Cloudflare proxy settings.
Configuring any requirements outside the baseline setup, including Role-Based Access Control (RBAC), SSO integration, custom data logging/retention, or custom Workers.
Developing any Workers scripts to achieve requirements.
Appointing a dedicated technical lead who will participate in scheduled calls and has the authority to execute and configure the recommended design logic within the Cloudflare environment.
Identifying two target zones that will receive the Configuration Blueprint.
Obtaining all necessary consents from its employees, contractors, or other attendees prior to the recording of the Knowledge Transfer session, as required by applicable law.

5. Delivery Timelines, Acceptance

This is an outcome-based, fixed-fee engagement delivered within a twenty-one (21) day window. Cloudflare's ability to deliver the defined outcomes is dependent upon the Customer's timely completion of its responsibilities.

Project Holds & Expiration: If Customer dependencies, including but not limited to stakeholder availability for scheduled sessions, remain outstanding for more than five (5) consecutive business days, Cloudflare reserves the right to place the project on "Hold" status. Resuming a project from "Hold" may require a Change Order and additional fees. Notwithstanding any holds or delays, this engagement expires automatically ninety (90) days from the Order Form Effective Date. Upon expiration, Cloudflare will deliver the Configuration Blueprint based on the information provided to date. At that time, the project is deemed fully complete, all fees are deemed fully earned, and Cloudflare will have no obligation to provide any additional services or deliverables.

6. Benefits

This service provides customers with several key outcomes:

Expert-Led Strategy: Benefit from consultant expertise designed to help minimize false positives.
Internal Capability Building: Empowers the Customer's team through "learning by doing" under expert supervision.
Risk Mitigation: Assist in reducing the attack surface for key endpoints through an expert-vetted architectural approach.

Advisory Only Layer 3 DDos Protection Configuration Service

1. Service Definition

Service Name: Layer 3 DDoS Prevention - Advisory

Service Goal/Objective: The Cloudflare Layer 3 DDoS Prevention Advisory service is designed to provide the Customer with the advisory guidance and recommendations needed to validate that the organization is properly protected against Layer 3 DDoS attacks. The service is designed to provide the Customer with the guidance necessary to configure and validate their Magic Transit deployment in line with the latest recommendations for security, performance, and reliability. The result is the delivery of Magic Transit to help harden the security perimeter against L3 DDoS attacks, accelerate time to value, and facilitate operational excellence.

In scope

This service provides advisory guidance for the configuration of up to 20 network sites and up to 30 prefixes. While the underlying Magic Transit service is billed by bandwidth, this advisory engagement is strictly capped at these maximum quantities. The specific sites and prefixes to be configured will be mutually agreed upon during the Plan & Design phase prior to the start of implementation. As an advisory-only service, the Cloudflare Professional Services team's guidance will be strictly limited to the Cloudflare Dashboard during the Pilot Migration & Testing and Production Rollout & Testing phases. The Customer is delivered key outputs which will result in a successful deployment of Magic Transit services:

Technical discovery of Customer environment and alignment to Cloudflare Magic Transit requirements
Verification and validation of prefixes and sites
Cloudflare Firewall Rules review & configuration guidance
Advisory guidance for the verification and validation of site/prefix activations strictly adhering to the fixed Sprint Schedule (defined in Delivery & Methodology section).
CNI Configuration (if necessary)
Advisory support for Pre-flight checks per prefix
Advisory support for customer Go-Live and Deployment
Monitoring & Steady State Review

Out of Scope

Configuration of Customer routers, firewalls, or other CPE
Configuration of other Cloudflare products (i.e., Zero Trust, Cloudflare WAN, App Services, Cloudflare Account Management)
Advisory guidance for any network sites, tunnels, routes, or related architecture that exceed the maximum sites and prefixes allocated for this service
Any third-party prefixes that the Customer does not explicitly have authorization to advertise
Hands on execution of the Cloudflare settings, policy changes, or network configuration.
Any items not identified in the In Scope section above

Disclaimer: This Service is strictly advisory in nature. Cloudflare's recommendations are based on a point-in-time assessment of the Customer's configuration and industry best practices. Implementation of any recommendations is at the Customer's sole discretion and risk. Cloudflare does not guarantee that the recommendations will prevent all security breaches or uninterrupted performance.

2. Delivery Model & Methodology

This service is delivered in a structured four-phase methodology, completed within a 90-day timeline, depending on the project size and complexity.

Phase	Key Activities
Phase 1: Plan & Design	Kickoff call to confirm scope and goals. Current network infrastructure assessment. Magic Transit Workshop. Discussion of any known configuration challenges. LOA and IRR verification. Cloudflare account creation and entitlement. Migration plan development.
Phase 2: Implementation Guidance	Guidance or advisory support for the following: Determination of number of required sprints. Pilot sprint deployment. Pilot configuration and set up. Pilot preflight checks and verification. Pilot deployment go-live call. Go-live and monitoring session. Post go-live review and adjustments. Sprint closeout. Production phase roll out. Production configuration and set up. Production preflight checks and verification. Production deployment go-live call. Production go-live and monitoring session. Post go-live review and adjustments. Production sprint closeout.
Phase 3: Monitoring & Optimization	Review of current environment. Guidance on determining appropriate DDoS protection thresholds. Guidance on adjustment and review. Acceptance of current state.
Phase 4: Architecture Review Presentation & Closeout	Presentation of the final Configuration As-Built Document. Discussion of findings and next steps for remediation strategy. Final project closeout meeting.

Service Execution & Tooling: Cloudflare focuses on streamlined, outcome-based delivery. To accelerate time to value, Cloudflare may, in its sole discretion, utilize proprietary automation, internal tools, and scripts to perform technical discovery, data validation (such as LOA, IRR, and RPKI checks), and the generation of deliverables.

Included Resources: Network Services Consultant.

Duration/Timeline: This service will be delivered within a 90-day timeframe.

3. Deliverables

Deliverable	Acceptance Criteria
Configuration As-Built Document	Delivery of a detailed technical document detailing recommended configurations, subject to the five (5) business day review and deemed acceptance period defined in Section 5.
Phased Migration and Testing Plan	Delivery of the Phased Migration Plan, subject to the five (5) business day review and deemed acceptance period defined in Section 5.
Enablement and Knowledge Transfer Workshop	Delivery of a single (1) consolidated Enablement Workshop. This deliverable is deemed accepted upon the earlier of: (i) completion of the session, or (ii) delivery of a recording of the session (or a recording of the attempted session if the Customer fails to attend the scheduled time or fails to provide the necessary consents required for a live recording).

4. Customer Responsibilities

Providing a minimum of five (5) business days' notice in advance of any desired pilot testing, traffic cutover, or scheduled session where Cloudflare advisory support or participation is required. The parties acknowledge that enterprise network changes frequently require off-hours or weekend support. Such support is included within the scope of this service, provided it is scheduled and mutually agreed upon in advance.
Providing the Cloudflare team with required documentation such as Existing Network Diagram and Architecture Documents, Letters of Authorization (LOA), or Resource Public Key Infrastructure (RPKI) information to validate that the Customer has the authority to grant Cloudflare permission to advertise specific Autonomous System Number (ASN) information to the wider Internet.
Managing internal Change Management Readiness to facilitate adherence to the project timeline.
Actively configuring the Cloudflare settings, policy changes, and network routing based on Cloudflare's advisory guidance.
Managing all internal firewalls, routers, networking, and associated Customer premise equipment (CPE).
Providing Read-Only access to the Cloudflare dashboard at project kickoff to allow Cloudflare to review and validate configurations, with the Customer retaining full responsibility for executing the advertisement of prefixes via the Cloudflare dashboard or API.
Providing service testers for critical applications during prefix cutover change windows.
Ensuring the availability of key stakeholders (including but not limited to Security, Networking, and Infrastructure leads) for all scheduled workshops and sessions.
Coordinating all sessions through the assigned Cloudflare technical resource, with the understanding that Cloudflare is only obligated to conduct one (1) primary instance of each scheduled session and will not provide duplicate or 'catch-up' sessions for absent stakeholders.
Obtaining all necessary consents from its employees, contractors, or other attendees prior to the recording of the Enablement Workshop, as required by applicable law.

5. Delivery Timelines, Acceptance

This is an outcome-based, fixed-fee project delivered within a 90-day window. Cloudflare's ability to deliver the defined outcomes is dependent upon the Customer's timely completion of its responsibilities.

Project Holds & Expiration: If Customer dependencies, including but not limited to stakeholder availability for scheduled sessions, remain outstanding for more than ten (10) consecutive business days, Cloudflare reserves the right to place the project on "Hold" status. Resuming a project from "Hold" may require a Change Order and additional fees. Notwithstanding any holds or delays, the services expire 90 days from the Order Form Effective Date. Upon expiration, Cloudflare will deliver the Configuration As-Built Document based on the information provided to date. At that time, the project is deemed completed, all fees are deemed fully earned, and Cloudflare will have no obligation to provide any additional services or deliverables.

Rolling Acceptance: Customer shall have five (5) business days after delivery of each deliverable to review them for compliance with the acceptance criteria outlined in Section 3. Failure to provide written notice of material defects within this five (5) business day period will result in automatic deemed acceptance of that deliverable. Once all of the deliverables identified in Section 3 are accepted (or deemed accepted), the project will be considered complete.

6. Benefits

This service provides customers with several key outcomes:

World-Class L3 DDoS Prevention & Mitigation: Leverage one of the largest DDoS mitigation providers in the world to help harden Customer's networks. Gain confidence that Customer's configuration aligns with Cloudflare's latest security, performance, and reliability recommendations.
Training & Enablement: Detailed training and enablement on Cloudflare Magic Transit platform are provided to help familiarize Customer teams with platform operations and best practices.
Accelerated Time to Value: Engaging with Cloudflare Professional Services is designed to accelerate time to value by assisting the Customer in validating that their investment in Magic Transit provides the L3 DDoS prevention and mitigation protection they require.

Advisory Only Network Connectivity Configuration Service

1. Service Definition

Service Name: Network Connectivity Implementation Service - Advisory

Service Goal/Objective: The Cloudflare Network Deployment service is designed to provide Customer with the guidance and recommendations designed to assist the organization in securely providing high performing inter-site connectivity using Cloudflare WAN. The Cloudflare WAN service will be configured and validated in line with recommended practices for security, performance, and reliability. The objective is to help simplify network connectivity across the Customer infrastructure while prioritizing security and reliability.

In Scope:

This service provides advisory guidance for the configuration of up to thirty (30) network sites and their corresponding routes and tunnels. While the underlying Cloudflare WAN service is billed by bandwidth, this advisory engagement is strictly capped at the maximum quantities defined during the Plan & Design phase. As an advisory-only service, the Cloudflare Professional Services team's guidance will be strictly limited to the Cloudflare Dashboard during the Pilot Migration & Testing and Production Rollout & Testing phases. Cloudflare will not perform configurations on Customer premise equipment (“CPE”) or third-party systems. Cloudflare will provide the Customer with the following key outputs to facilitate the deployment of Cloudflare WAN services:

Technical discovery of Customer environment and alignment to Cloudflare WAN requirements.
Verification and validation of sites.
Cloudflare Network Firewall Rules review and configuration.
Configuration of Cloudflare WAN Appliance as necessary.
Configuration of Cloudflare Network Interconnect as necessary.
Advisory support for site activations strictly adhering to the agreed project schedule (defined in the Delivery & Methodology section), where unready sites are automatically deferred to the final remediation wave.
Advisory support during Customer Go-Live and Deployment.
Monitoring and Steady State Review.

Out of Scope

Configuration of Customer routers, firewalls, or other CPE.
Configuration of other Cloudflare products (e.g., Cloudflare One, Magic Transit, App Services, Cloudflare Account Management).
Advisory support for any network sites, tunnels, routes, or related architecture that are not explicitly contracted.
Any items not identified in the In Scope section above.

2. Delivery Model & Methodology

This service is delivered in a structured four-phase methodology, completed within up to 120 days, depending on the project size and complexity.

Phase	Key Activities
Phase 1: Plan & Design	Kickoff call to confirm scope and goals. Current network infrastructure assessment. Cloudflare WAN Workshop. Discussion of any known configuration challenges, including verification of CPE compatibility. Cloudflare account creation and entitlement. Migration plan development.
Phase 2: Implementation & Rollout (Executed via a phased rollout methodology, not to exceed 8 deployment waves)	Rollout Planning, determined by the number of sites, tunnels, and routes that need to be onboarded as explicitly contracted. Pilot wave (1-2 sites). Pilot configuration and set up. Pilot deployment go-live call. Go-live and monitoring session. Post go-live review and adjustments. Wave closeout. Production phase rollout. Production configuration and set up. Production deployment go-live call. Production go-live and monitoring session. Post go-live review and adjustments. Production wave closeout.
Phase 3: Monitoring & Optimization	Review of current environment under full load. Adjustment and review of current state. Acceptance of current state. Handover to Customer Success and/or Account teams, as applicable.
Phase 4: Architecture Review Presentation & Closeout	Presentation of the final As-Built Configuration Guide. Discussion of findings and next steps for remediation strategy. Final project closeout meeting.

Included Resources: Network Services Consultant, Project Manager.

Duration/Timeline: This service will be delivered within a 120-day timeframe.

3. Deliverables

Deliverable	Description	Acceptance Criteria
Configuration As-Built Document	A comprehensive technical record detailing the validated technical state of the deployed environment. This document includes final site inventories, Cloudflare WAN Connector hardware specifications (if applicable), tunnel details, and routing tables, as implemented in the final state.	Delivery of document, subject to the five (5) business day review and deemed acceptance period defined in Section 5.
Knowledge Transfer	1 hour recorded technical session	Delivery of a single (1) consolidated session covering dashboard management of the configured sites, routes, and tunnels. This deliverable is deemed accepted upon the earlier of: (i) completion of the session, or (ii) delivery of a recording of the session (or a recording of the attempted session if the Customer fails to attend the scheduled time or fails to provide the necessary consents required for a live recording).

4. Customer Responsibilities

Providing a minimum of five (5) business days' notice in advance of any desired go-live or network change event. The parties acknowledge that enterprise network changes frequently require off-hours or weekend support. Such support is included within the scope of this service, provided it is scheduled and mutually agreed upon in advance.
Appointing a primary technical point of contact to participate in the kickoff call, review configuration choices, and attend the final enablement session.
Providing the Cloudflare team with a technical point of contact to attend configuration meetings and make necessary adjustments to CPE as required for the establishment of connectivity back to Cloudflare's network.
Providing the Cloudflare team with a technical point of contact who understands which applications and other resources must be explicitly permitted or otherwise excluded from being sent via Cloudflare WAN tunnels.
Managing all internal firewalls, routers, networking, and associated equipment.
Providing Read-Only access to the Cloudflare dashboard at project kickoff to allow Cloudflare to provide configuration guidance, and ensuring Customer personnel are available to execute the establishment of tunnel connectivity and routing of Customer traffic through Cloudflare's network.
Managing internal change requests and associated documentation, and communicating the change window requests to the Cloudflare team.
Preparing any documentation required for internal acceptance into service.
Performing internal Project Management.
Providing service testers for critical applications during site and routing cutover change windows.
Configuring any requirements outside the baseline setup, including Role-Based Access Control (RBAC), SSO integration, custom data logging/retention, or custom Workers.
Developing any Workers scripts to achieve requirements.
Validating the accuracy and completeness of the technical details (including all required sites, routes, and tunnels) during the Phase 1 kickoff. Any material changes to the project scope beyond the thirty (30) network sites defined in Section 1 may require a Change Order and applicable supplemental fees.
Ensuring the availability of key stakeholders (including but not limited to Security, Networking, and Infrastructure leads) for all scheduled workshops and sessions.
Coordinating all sessions through the assigned Cloudflare technical resource, with the understanding that Cloudflare is only obligated to conduct one (1) primary instance of each scheduled session and will not provide duplicate or 'catch-up' sessions for absent stakeholders.
Obtaining all necessary consents from its employees, contractors, or other attendees prior to the recording of the Knowledge Transfer session, as required by applicable law.

5. Delivery Timelines, Acceptance

This is an outcome-based, fixed-fee engagement delivered within a 120-day window. Cloudflare's ability to deliver the defined outcomes is dependent upon the Customer's timely completion of its responsibilities.

Project Holds & Expiration: If Customer dependencies, including but not limited to stakeholder availability for scheduled sessions, remain outstanding for more than ten (10) consecutive business days, Cloudflare reserves the right to place the project on "Hold" status. Resuming a project from "Hold" may require a Change Order and additional fees. Notwithstanding any holds or delays, this engagement expires automatically 120 days from the Order Form Effective Date. Upon expiration, Cloudflare will deliver a Configuration As-Built Document based on the information provided to date. At that time, the project is deemed fully complete, all fees are deemed fully earned, and Cloudflare will have no obligation to provide any additional services or deliverables.

6. Benefits

This service provides customers with several key outcomes:

Secure & Performant Connectivity & Routing: Help reduce vendor confusion and lock-in while gaining secure, reliable connectivity across all sites.
Phased deployment approach: Onboarding of sites, tunnels, and IP space is done in a programmatic way to help minimize disruption to Customer environments.
Training & Enablement: Detailed training and enablement on Cloudflare WAN & CF1 platform to equip Customer teams with knowledge of best practices.
Accelerated Time to Value: Engaging with Cloudflare Professional Services is designed to help accelerate the Customer's time to value by assisting them in achieving secure and performant connectivity with their Cloudflare WAN investment.
Operational Readiness: Internal teams gain direct experience and platform familiarity through collaborative configuration review and expert-led knowledge transfer.

Advisory - SWG Migration Program

1. Service Definition

Service Name: SWG Migration Program - Advisory

Service Goal/Objective: The SWG Migration Program - Advisory Professional Service is a comprehensive, multi-phase engagement designed to strategically guide customers in migrating their web traffic from legacy on-premise proxy architectures to a cloud-native Secure Web Gateway (SWG) with Advanced Security capabilities. This service enables a phased migration that minimizes disruption and risk while maximizing security.

Cloudflare provides the architectural expertise and validation, while the Customer remains responsible for executing all configuration changes.

Service Scope

To facilitate project success and timely delivery, this advisory service is strictly limited to the following environment sizes:

Total User Count: Up to 10,000 Users.
Policy Complexity: Up to 50 SWG Policies.
Connectivity Model: This service covers endpoint-to-internet traffic via the Cloudflare One Client, DNS, and Proxy connectivity options. Sites-to-Internet (GRE/IPsec/CNI) is explicitly excluded (additional Professional Services to support these exclusions are available for an additional fee).

In Scope:

This service focuses on architectural expertise and validation, providing the following:

Technical Discovery: Review of current web proxy architecture and traffic flow diagrams.
Architecture Workshops: Sessions with stakeholders to design the SWG model (HTTPS inspection, DNS filtering, and data protection).
Migration Planning: Collaborative creation of a phased rollout plan (coexistence of legacy proxy and SWG).
Implementation Guidance: Advisory support during Customer-led configuration of the Cloudflare One Platform, including Gateway, DLP, and RBI.
Pilot Support: Provision of advisory support during pilot testing and troubleshooting for up to 1,000 users/devices.
Security Optimization: Strategic recommendations to optimize the Customer's SWG Policy Model.
Knowledge Transfer: Enablement workshops to equip the Customer's team can manage the platform independently.

Out of Scope

Configuration of third-party solutions (e.g., IdPs, EDRs, or MDM software).
Deployment of the Cloudflare One Client software to end-user endpoints.
Configuration of Customer Network Equipment like Routers or Firewalls.
Configuration of Site-to-Internet connectivity (Cloudflare WAN, GRE/IPsec tunnels).
Hands-on execution of the Cloudflare One settings and policy changes.
Advisory support for testing or troubleshooting of policies and endpoints outside the defined 'Service Scope'.

2. Delivery Model & Methodology (Advisory Focus)

This service follows a six-phase methodology, completed within up to 120 days.

Phase	Key Activities
Phase 1: Initiation	Kickoff call to identify Customer's requirements. Establishing business objectives and defining expected outcomes. Identifying the appropriate stakeholders and allocating roles across the team.
Phase 2: Discovery, Planning, and Design	Comprehensive discovery of current network architecture and technical requirements. Discovery of required integrations (IdP, Logging, EDR, MDM, etc.). Applications Inventory Discovery. Architecture Workshop sessions with the Customer's teams. Migration plan based on business priority and technical complexity. Architecture Validation and Documentation.
Phase 3: Baseline Configuration Guidance	Cloudflare provides guidance and best practices for the following components, while the Customer performs all active configuration: Baseline Networking and Cloudflare One Client Configuration. Integration with up to 1 Customer's Identity Provider. Integration with up to 3 Device Posture Providers. Integration with up to 5 LogPush Endpoints. Cloudflare One Client Posture Checks. Migration of up to 50 SWG Policies. Secure Web Gateway Policy Best Practices. DLP and RBI Policy Best Practices.
Phase 4: Pilot Testing	Customer deploys Cloudflare One Client to 5-10% of the end-user endpoints. Cloudflare provides advisory support to validate the configuration of all Cloudflare One Platform components, external integrations, and SWG Policies. Cloudflare provides advisory support for troubleshooting Cloudflare One Client and SWG policy validation.
Phase 5: Enablement	Enablement Workshops to Customer's teams. Knowledge transfer to Customer's teams.
Phase 6: Closure	Lessons Learned Workshop. Hand-off to Customer's Support and Success Teams.

Included Resources: Project Manager, Zero Trust Consultant.

Duration/Timeline: This service will be delivered within a 120-day timeframe.

3. Deliverables

Cloudflare Deliverables:

Deliverable	Acceptance Criteria
Phased Migration Plan Document	Delivery of the Phased Migration Plan (which must encompass the Architecture Diagram and Migration & Testing recommendations), subject to the five (5) business day review and deemed acceptance period defined in Section 5.
Baseline Configuration Blueprint	Delivery of a detailed technical document with the Recommended settings and Best Practices, subject to the five (5) business day review and deemed acceptance period defined in Section 5.
Enablement and Knowledge Transfer	Delivery of the single (1) consolidated 60-minute Enablement Workshop. This deliverable is deemed accepted upon the earlier of: (i) completion of the session, or (ii) delivery of a recording of the session (or a recording of the attempted session if the Customer fails to attend the scheduled time or fails to provide the necessary consents required for a live recording).

4. Customer Responsibilities

Client Inputs Required:

Providing a minimum of five (5) business days' notice in advance of any desired pilot testing, traffic cutover, or scheduled session where Cloudflare advisory support or participation is required.
Interviews with key Security, Networking, and Operations personnel.
Provide read-only access to existing SWG or Proxy configuration policies (explicitly excluding access to end-user traffic logs or PII).
Identify the list of 50 policies that require migration.
Network diagrams and an application inventory listing private applications.
Managing internal Change Management Readiness to facilitate adherence to the project timeline.

Customer Responsibilities (Hands-on Implementation)

Platform Configuration: Active configuration of the Cloudflare One Platform, including SWG policies and SaaS applications integration.
Software Deployment: Installing Cloudflare One Client on end-user devices.
Infrastructure Management: Configuration of routers, firewalls, and 3rd party services (Okta, Azure AD, Intune, etc.).
Customer shall ensure the availability of key stakeholders (including but not limited to Security, Networking, and Infrastructure leads) for all scheduled workshops and sessions. All sessions must be coordinated through the assigned Cloudflare technical resource. Cloudflare's obligation is limited to conducting one (1) primary instance of each scheduled session; Cloudflare is not obligated to provide duplicate or 'catch-up' sessions for absent stakeholders.
Obtaining all necessary consents from its employees, contractors, or other attendees prior to the recording of the Enablement Workshop, as required by applicable law.

5. Delivery Timelines, Acceptance

This is a fixed-fee project delivered within a 120-day window. Cloudflare's ability to deliver the defined outcomes is dependent upon the Customer's timely completion of its responsibilities.

Project Holds & Expiration: If Customer dependencies, including but not limited to stakeholder availability for scheduled sessions, remain outstanding for more than ten (10) consecutive business days, Cloudflare reserves the right to place the project on "Hold" status. Resuming a project from "Hold" may require a Change Order and additional fees. Notwithstanding any holds or delays, the services expire one hundred fifty (150) days from the Order Form Effective Date. Upon expiration, Cloudflare will deliver the Baseline Configuration Blueprint based on the information provided to date. At that time, the project is deemed completed, all fees are deemed fully earned, and Cloudflare will have no obligation to provide any additional services or deliverables.

6. Benefits

This service provides customers with several key outcomes:

Reduced Risk: Leverage Cloudflare experts to validate Customer's design and migration strategy.
Operational Readiness: By performing the implementation under expert guidance, Customer's internal teams gain direct hands-on experience and deep platform knowledge.
Strategic Modernization: A structured path from legacy web proxies to a performant cloud-native security model.

Advisory - Remote Access Modernization Program

1. Service Definition

Service Name: Remote Access Modernization Program - Advisory

Service Goal/Objective: The Remote Access Modernization Program - Advisory Professional Service is a comprehensive, multi-phase advisory engagement designed to strategically guide customers to move away from outdated, risk-prone legacy VPN architectures toward a modern, secure, and performant Zero Trust Network Access (ZTNA) model.

This service enables a phased migration from traditional VPN to Zero Trust Network Access (ZTNA), minimizing disruption and risk while maximizing security.

Cloudflare provides the architectural expertise and validation, while the Customer remains responsible for executing all configuration changes.

Service Scope

To facilitate project success and timely delivery, this deployment service is strictly limited to the following environment sizes:

Total User Count: Up to 10,000 Users.
Policy Complexity: Up to 50 ZTNA Policies.
Connectivity Model: Up to 4 Cloudflare Tunnels or Cloudflare Mesh connectors. Sites-to-Internet (GRE/IPsec/CNI) is explicitly excluded (additional Professional Services to support these exclusions are available for an additional fee).

In Scope:

This service includes comprehensive Design & Planning workshops, Baseline Configuration guidance for the ZTNA platform, advisory support during the Pilot Testing and Troubleshooting support, the Security Policy optimization recommendations, and Enablement workshops for knowledge transfer.

Technical Discovery of Current Architecture & Network Diagrams.
Architecture workshops with key Customer stakeholders (Networking, Security, and Operations) to design the ZTNA access model (identity-based, least-privilege).
Collaborative creation of a phased migration and testing plan (VPN and ZTNA can run side-by-side initially).
Implementation Guidance: Advisory support and troubleshooting guidance during the Customer-led configuration of the Cloudflare One Platform, including up to 4 Cloudflare Connectors, 50 ZTNA Policies, Cloudflare One Client Configuration for up to 10,000 users, and external integrations for up to 5 Logpush endpoints and 3 Device Posture providers.
Advisory Support during Pilot Testing to validate the configuration and troubleshoot issues for up to 1,000 users/devices.
Advice about Security Recommendations to optimize the ZTNA Policy Model.
Knowledge Transfer sessions to enable the Customer's team to manage and scale the platform independently.

Out of Scope

Configuration of third-party solutions such as Intune, Okta, and Azure AD.
Deployment of the Connectors Software on Customer servers.
Configuration of the Customer Network Equipment (Routers, Firewalls, etc.).
Deployment of the Cloudflare One Client software to the end-user endpoints.
Configuration of Site-to-Internet connectivity (Cloudflare WAN, GRE/IPsec tunnels).
Hands-on execution of the Cloudflare One settings and policy changes.
Configuration and Testing of the Policies and Connectors that are not in scope, based on the previous 'In Scope' section.

2. Delivery Model & Methodology (Advisory Focus)

This service follows a six-phase methodology, completed within up to 150 days.

Phase	Key Activities
Phase 1: Initiation	Kickoff call to identify Customer's requirements. Establishing business objectives and defining expected outcomes. Identifying the appropriate stakeholders and allocating roles across the team.
Phase 2: Discovery, Planning, and Design	Comprehensive discovery of current network architecture and technical requirements. Discovery of the integrations needed (IdP, Logging, EDR, MDM, etc.). Applications Inventory Discovery. Architecture Workshop sessions with the Customer's teams. Migration plan based on business priority and technical complexity. Architecture Validation and Documentation.
Phase 3: Baseline Configuration Guidance	Cloudflare provides guidance and best practices for the following components, while the Customer performs all active configuration: Baseline Networking and Cloudflare One Client Configuration. Integration with 1 Customer's Identity Provider. Up to 4 Cloudflare Tunnels. Integration with up to 3 Device Posture Providers. Integration with up to 5 LogPush Endpoints. Cloudflare One Client Posture Checks. Up to 50 ZTNA Policies. Secure Web Gateway Policy Best Practices.
Phase 4: Pilot Testing	Customer deploys Cloudflare One Client to 5-10% of the end-user endpoints. Cloudflare provides advisory support to validate the configuration of all the Cloudflare One Platform components, external integrations, and ZTNA Policies. Cloudflare provides advisory support for troubleshooting Cloudflare One Client and the Connectors setup.
Phase 5: Enablement	Enablement Workshops for Customer's teams. Knowledge transfer to the Customer's teams.
Phase 6: Closure	Lessons Learned Workshop. Hand-off to Customer's Support and Success Teams.

Included Resources: Project Manager, Zero Trust Consultant.

Duration/Timeline: This service will be delivered within a 150-day timeframe.

3. Deliverables

Cloudflare Deliverables:

Deliverable	Acceptance Criteria
Phased Migration Plan Document	Delivery of the Phased Migration Plan (which must encompass the Architecture Diagram and Migration & Testing recommendations), subject to the five (5) business day review and deemed acceptance period defined in Section 5.
Baseline Configuration Blueprint	Delivery of a detailed technical document with the recommended settings and Best Practices, subject to the five (5) business day review and deemed acceptance period defined in Section 5.
Enablement and Knowledge Transfer Workshop	Delivery of the single (1) consolidated 60-minute Enablement Workshop. This deliverable is deemed accepted upon the earlier of: (i) completion of the session, or (ii) delivery of a recording of the session (or a recording of the attempted session if the Customer fails to attend the scheduled time or fails to provide the necessary consents required for a live recording).

4. Customer Responsibilities

Customer Inputs Required:

Providing a minimum of five (5) business days' notice in advance of any desired pilot testing or network change event where Cloudflare advisory support is required.
Participating in interviews with key Security, Networking, and Operations personnel.
Providing access to current VPN configuration, user groups, and authentication flow documentation.
Providing network diagrams and an application inventory listing private applications.
Managing internal Change Management Readiness to facilitate adherence to the project timeline.

Customer Responsibilities (Hands-on Implementation)

Platform Configuration: Active configuration of the Cloudflare One Platform, including ZTNA policies and networking.
Software Deployment: Installing Cloudflare One Client on endpoints and deploying Cloudflare connector software on Customer-managed servers or Docker containers.
Infrastructure Management: Configuring routers, firewalls, and 3rd party services (Okta, Azure AD, Intune, etc.).
Providing troubleshooting support to end users.
Customer shall ensure the availability of key stakeholders (including but not limited to Security, Networking, and Infrastructure leads) for all scheduled workshops and sessions. All sessions must be coordinated through the assigned Cloudflare technical resource. Cloudflare's obligation is limited to conducting one (1) primary instance of each scheduled session; Cloudflare is not obligated to provide duplicate or 'catch-up' sessions for absent stakeholders.
Obtaining all necessary consents from its employees, contractors, or other attendees prior to the recording of the Enablement Workshop, as required by applicable law.

5. Delivery Timelines, Acceptance

This is an outcome-based, fixed-fee engagement delivered within a 150-day window. Cloudflare's ability to deliver the defined outcomes is dependent upon the Customer's timely completion of its responsibilities.

Project Holds & Expiration: If Customer dependencies, including but not limited to stakeholder availability for scheduled sessions, remain outstanding for more than ten (10) consecutive business days, Cloudflare reserves the right to place the project on "Hold" status. Resuming a project from "Hold" may require a Change Order and additional fees. Notwithstanding any holds or delays, this engagement expires automatically one hundred eighty (180) days from the Order Form Effective Date. Upon expiration, Cloudflare will deliver a Baseline Configuration Blueprint based on the information provided to date. At that time, the project is deemed fully complete, all fees are deemed fully earned, and Cloudflare will have no obligation to provide any additional services or deliverables.

6. Benefits

This service provides customers with several key outcomes:

Reduced Risk: Leverage Cloudflare experts to validate Customer's design and migration strategy.
Operational Readiness: By performing the implementation under expert guidance, Customer's internal teams gain hands-on experience and deep platform knowledge.
Strategic Modernization: A structured path from legacy VPN to a performant Zero Trust model.

Advisory - SASE Architecture & Configuration

1. Service Definition

Service Name: SASE Architecture & Configuration Guidance

Service Goal/Objective: The SASE Architecture & Configuration Guidance is a targeted advisory engagement designed to provide customers with the architectural blueprint and configuration best practices required to begin their SASE journey. Cloudflare provides technical expertise and validation for the design and initial setup phases, while the Customer remains responsible for executing all configuration changes.

Service Scope

To facilitate project success and timely delivery, this advisory service is strictly limited to the following environment sizes:

Total User Count: Up to 8,000 Users.
Policy Complexity: Up to a combined total of 10 ZTNA and SWG Policies.
Connectivity Model: Up to 4 Cloudflare Tunnels or Cloudflare Mesh connectors. Sites-to-Internet (GRE/IPsec/CNI) is explicitly excluded (additional Professional Services to support these exclusions are available for an additional fee).

In Scope:

Full SASE Architecture Discovery: Comprehensive discovery of current network architecture, technical requirements, and application inventory.
Integrated Design Workshops: Strategic sessions to design a unified SASE model, including Identity Provider (IdP) integration, private access (ZTNA), and secure Internet access (SWG).
Baseline Configuration Guidance: Expert guidance on best practices for the initial setup of the Cloudflare One Platform, including up to 4 Tunnels, up to a combined total of 10 ZTNA and SWG Policies, up to 3 Device Posture providers, and integration with up to 5 Logpush endpoints.
Advisory Testing & Troubleshooting Support: During the Closed Pilot phase (up to 50 users) to validate all components configurations, including Cloudflare One Clients, Connectors, External Integrations, and policies.

Out of Scope

Hands-on Implementation: Direct configuration or administrative changes within the Cloudflare dashboard.
Hands-on Troubleshooting: Direct intervention or active, hands-on troubleshooting of the Customer's network connectivity or infrastructure.
Software Deployment: Installation of Cloudflare Connector software or distribution of Cloudflare One Client software.
Third-Party Configuration: Setup of solutions such as Okta, Azure AD, or Intune.
End-User Support: Direct support for Customer's employees (Helpdesk).

2. Delivery Model & Methodology (Advisory Focus)

This accelerated service follows a five-phase methodology, completed within 90 days.

Phase	Key Activities
Phase 1: Initiation	Kickoff call to identify Customer's requirements and define expected outcomes.
Phase 2: Discovery, Planning, and Design	Technical workshops to analyze current architecture and develop the Target SASE Architecture (Cloudflare One Client, Tunnels, SWG, IdP).
Phase 3: Baseline Configuration Guidance	Cloudflare provides guidance and best practices for the following platform components, while the Customer performs all active configuration: Baseline Networking and Cloudflare One Client Configuration. Integration with up to 1 Customer's Identity Provider. Up to 4 Cloudflare Connectors. Integration with up to 5 LogPush endpoints. Integration with up to 3 Device Posture providers. Up to a combined total of 10 ZTNA and SWG Policy best practices. As implementer, the Customer must be ready to deploy the corresponding Network and Security changes according to the project timelines defined in Phase 2. The Customer is responsible for managing their internal Change Management processes to ensure project timelines are not delayed.
Phase 4: Closed Pilot Testing	Testing & Troubleshooting Support for up to 50 users. The Customer is responsible for deploying the Cloudflare One Client to the end-user endpoints. Advisory guidance to assist the Customer in validating the configuration of all Cloudflare One Platform components and external integrations. Advisory guidance to assist the Customer in conducting Policy Enforcement Validation for the ZTNA and SWG Policies. Cloudflare One Client Troubleshooting and Configuration Update. Connectors Troubleshooting and Configuration Update.
Phase 5: Enablement	Dedicated workshops to equip the Customer's teams to manage and maintain the established baseline architecture.

Included Resources: Project Manager, Zero Trust Consultant.

Duration/Timeline: This service will be delivered within a 90 day timeframe.

3. Deliverables

Cloudflare Deliverables:

Deliverable	Acceptance Criteria
Phased Deployment Plan Document	Delivery of the Phased Migration Plan, including Architecture Diagram and Migration & Testing processes recommendations, subject to the five (5) business day review and deemed acceptance period defined in Section 5.
Baseline Configuration Blueprint	Delivery of a detailed technical document with the recommended settings and Best Practices, subject to the five (5) business day review and deemed acceptance period defined in Section 5.
Enablement and Knowledge Transfer Workshop	Delivery of the single (1) consolidated 60-minute Enablement Session. This deliverable is deemed accepted upon the earlier of: (i) completion of the session, or (ii) delivery of a recording of the session (or a recording of the attempted session if the Customer fails to attend the scheduled time or fails to provide the necessary consents required for a live recording).

4. Customer Responsibilities

Customer Inputs Required:

Providing a minimum of five (5) business days' notice in advance of any desired pilot testing or scheduled session where Cloudflare advisory support or participation is required.
Participating in interviews with key Security, Networking, and Operations personnel.
Providing documentation, configuration exports, or read-only visibility into the current VPN configuration, user groups, and authentication flow documentation.
Providing network diagrams and an application inventory listing private applications.
Managing internal Change Management readiness to deploy the required network and security configurations without impacting project timelines.

Customer Responsibilities (Hands-on Implementation)

Platform Configuration: Active configuration of the Cloudflare One Platform, including ZTNA and SWG policies, and networking configuration.
Software Deployment: Installing Cloudflare One Client on endpoints and deploying Cloudflare connector software on Customer-managed servers or Docker containers.
Infrastructure Management: Configuring routers, firewalls, and 3rd party services (Okta, Azure AD, Intune, etc.).
Providing troubleshooting Support to the end users.
Customer shall ensure the availability of key stakeholders (including but not limited to Security, Networking, and Infrastructure leads) for all scheduled workshops and sessions. All sessions must be coordinated through the assigned Cloudflare technical resource. Cloudflare's obligation is limited to conducting one (1) primary instance of each scheduled session; Cloudflare is not obligated to provide duplicate or 'catch-up' sessions for absent stakeholders.
Obtaining all necessary consents from its employees, contractors, or other attendees prior to the recording of the Enablement Workshop, as required by applicable law.

5. Delivery Timelines, Acceptance

This is a fixed-fee engagement delivered within a 90-day window. Cloudflare's ability to deliver the defined outcomes is dependent upon the Customer's timely completion of its responsibilities.

Project Holds & Expiration: If Customer dependencies, including but not limited to stakeholder availability for scheduled sessions, remain outstanding for more than ten (10) consecutive business days, Cloudflare reserves the right to place the project on "Hold". Resuming a project from "Hold" may require a Change Order and additional fees. Notwithstanding any holds or delays, the services expire one hundred twenty (120) days from the Order Form Effective Date. Upon expiration, Cloudflare will deliver a Baseline Configuration Blueprint based on the information provided to date. At that time, the project is deemed completed, all fees are deemed fully earned, and Cloudflare will have no obligation to provide any additional services or deliverables.

6. Benefits

This engagement is designed to establish a strong architectural foundation and promote operational readiness within an accelerated timeframe:

Expert Architectural Foundation: Architect a validated SASE blueprint (ZTNA, SWG) designed by Cloudflare experts following least-privilege and identity-based best practices.
Accelerated Deployment Path: Transition from discovery to a baseline-ready environment in just 90 days with a clear, step-by-step configuration roadmap.
Operational Readiness: By performing the implementation under expert guidance, Customer's internal teams gain direct hands-on experience and deep platform knowledge.
Reduced Strategic Risk: Minimize architectural errors and integration gaps before rollout by validating the Customer's design against specific business and security requirements.

Advisory - Email Security Architecture & Configuration

1. Service Definition

Service Name: Email Security Architecture & Configuration Guidance

Service Goal/Objective: The Email Security Architecture & Configuration Guidance is a targeted advisory engagement designed to provide customers with the architectural blueprint and configuration best practices required to harden their email environment against Malware, Phishing, Business Email Compromise (BEC), and multi-channel attacks. Cloudflare provides technical expertise and validation for the design and initial setup, while the Customer remains responsible for executing all configuration changes.

Service Scope

To facilitate project success and timely delivery, this advisory service is strictly limited to the following environment sizes:

Total Domains: Up to 5 Email Domains.
Email Providers: 1 Email Platform Integration (M365 or Google Workspace).

In Scope:

Discovery & Architecture: Assessment of current email setup, domain/tenant inventory, and definition of target architecture.
- Pre-delivery (MX Inline) vs. Post-delivery (API-based) Remediation.
Integrated Configuration Guidance: Expert guidance on integrating with 1 Email Platform (M365 or Google Workspace) using API, BCC, or Journaling.
Security Baseline Setup: Guidance on allow/deny lists, detection settings, impersonation registries, and "Move" rules for email classification.
Advanced Capabilities: Setup guidance for Outbound DLP policies (Microsoft), Remote Browser Isolation (RBI) settings, and Zero Trust CWI.
Monitoring & Tuning: Assistance with PhishNet submission workflows, false-positive/negative tuning, and mail routing validation.

Out of Scope

Hands-on Implementation: Direct configuration or administrative changes within the Cloudflare dashboard or the Customer's email provider (M365/Google).
Third-Party Troubleshooting: Active troubleshooting of the Customer's internal mail servers or network infrastructure.

2. Delivery Model & Methodology (Advisory Focus)

This accelerated service follows a six-phase methodology, completed within up to 60 days.

Phase	Key Activities
Phase 1: Initiation	Kickoff call to identify Customer's requirements, define success criteria, and prioritize use cases.
Phase 2: Discovery, Planning, and Design	Technical workshops to analyze current architecture and develop the target architecture & deployment method (Pre-delivery or Post Delivery).
Phase 3: Baseline Configuration Guidance	Cloudflare provides guidance and best practices for the Cloudflare One platform components, while the Customer performs all active configuration: Integration with 1 Email Platform (Pre-delivery or Post Delivery). Baseline Configuration Best Practices. Logging, alerting, and notification. Security baseline tuning (Allow/Deny lists, Impersonation registry). PhishNet Submission Workflows. Outbound DLP Policy Best Practices (Microsoft). Browser Isolation Best Practices. As Implementer, the Customer must be ready to deploy the corresponding changes according to the project timelines defined in Phase 2.
Phase 4: Pilot Testing	Pilot Testing for up to 10 Email accounts using Post-Delivery setup with API-based. Monitoring and Investigation to check spam and detect false positives. Advisory support to validate the configuration of RBI and DLP functionality.
Phase 5: Production Rollout	Advisory guidance during the Customer's migration to pre-delivery to apply RBI, link defanging and link action to proactively prevent malware and phishing.
Phase 6: Enablement	Operational walkthrough, documentation review, and knowledge transfer to enable Customer self-sufficiency.

Included Resources: Project Coordinator, Professional Services Consultant.

Duration/Timeline: This service will be delivered within a 60-day timeframe.

3. Deliverables

Cloudflare Deliverables:

Deliverable	Acceptance Criteria
Phased Deployment Plan Document	Delivery of the Phased Migration Plan, Visual representation of the mail flow and Migration & Testing recommendations, subject to the five (5) business day review and deemed acceptance period defined in Section 5.
Baseline Configuration Blueprint	Delivery of a detailed technical document outlining recommended disposition-based rules (Malicious, Spam, Bulk), RBI policies, and DLP profiles, subject to the five (5) business day review and deemed acceptance period defined in Section 5.
Enablement and Knowledge Transfer Workshop	Delivery of the single (1) consolidated 60-minute Enablement Session. This deliverable is deemed accepted upon the earlier of: (i) completion of the session, or (ii) delivery of a recording of the session (or a recording of the attempted session if the Customer fails to attend the scheduled time or fails to provide the necessary consents required for a live recording).

4. Customer Responsibilities

Customer Inputs Required:

Providing a minimum of five (5) business days' notice in advance of any desired mail flow changes or MX record updates where Cloudflare advisory support is required.
Participating in interviews with key Security, Infrastructure, and Operations personnel.
Providing access to current Email Security configuration.
Providing email flow diagrams and email domains inventory.
Managing internal Change Management Readiness to facilitate adherence to the project timeline.

Customer Responsibilities (Hands-on Implementation)

Platform Configuration: Active setup of the Cloudflare Email Security dashboard and security rules.
DNS & Mail Routing: Executing MX record changes or mail flow rule updates in M365/Google Workspace, whitelisting the Cloudflare Egress IPs to enable ingress email traffic.
Infrastructure Access: Providing the consultant with necessary documentation regarding current SEG (Secure Email Gateway) configurations and user populations.
Change Management: Managing internal approval processes to ensure DNS and security changes meet project timelines.
End-User Support: Providing troubleshooting Support to the end users.
Customer shall ensure the availability of key stakeholders (including but not limited to Security, Networking, and Infrastructure leads) for all scheduled workshops and sessions. All sessions must be coordinated through the assigned Cloudflare technical resource. Cloudflare's obligation is limited to conducting one (1) primary instance of each scheduled session; Cloudflare is not obligated to provide duplicate or 'catch-up' sessions for absent stakeholders.
Obtaining all necessary consents from its employees, contractors, or other attendees prior to the recording of the Enablement Workshop, as required by applicable law.

5. Delivery Timelines, Acceptance

This is an outcome-based, fixed-fee engagement delivered within a 60-day window. Cloudflare's ability to deliver the defined outcomes is dependent upon the Customer's timely completion of its responsibilities.

Project Holds & Expiration: If Customer dependencies, including but not limited to stakeholder availability for scheduled sessions, remain outstanding for more than ten (10) consecutive business days, Cloudflare reserves the right to place the project on "Hold" status. Resuming a project from "Hold" may require a Change Order and additional fees. Notwithstanding any holds or delays, this engagement expires automatically ninety (90) days from the Order Form Effective Date. Upon expiration, Cloudflare will deliver a Baseline Configuration Blueprint based on the information provided to date. At that time, the project is deemed fully complete, all fees are deemed fully earned, and Cloudflare will have no obligation to provide any additional services or deliverables.

6. Benefits

This engagement provides a high-quality architectural foundation and operational readiness within an accelerated timeframe:

Expert Architectural Foundation: Secure a validated Email Security blueprint designed by Cloudflare experts following recommended best practices.
Validated Security Posture: Validate that your email security is configured against Cloudflare best practices for phishing and threat prevention.
Reduced Deployment Risk: Minimize disruption to mail flow by following a tested, phased migration plan.
Operational Readiness: By performing the implementation under expert guidance, Customer's internal teams gain direct hands-on experience and deep platform knowledge.

Deployment Services - Bot Protection

1. Service Definition

Service Name: Bot Protection - Deployment Services

Service Goal/Objective: This service provides the rapid and expert deployment of Cloudflare's core security features—Web Application Firewall (WAF), Rate Limiting, and Bot Management. The objective is to establish a robust security perimeter for the Customer's web assets on up to five (5) zones by configuring, testing and activating these solutions to minimize attack surfaces.

Service Scope:

Planning and Alignment: A single session to confirm project goals, identify the five (5) target zones, and review account access requirements. Up to 3 unique configurations per zone. If subdomains require separate configurations, each counts towards this limit.
WAF Deployment: Configuration and activation of the Cloudflare WAF on up to 5 zones, including managed rulesets and five (5) custom rules per zone.
Bot Management Implementation: Deployment and tuning of Bot Management on up to 5 zones to categorize traffic and challenge unwanted bots.
Rate Limiting Configuration: Design and configuration of up to 5 Rate Limiting rules per zone to protect key application endpoints (e.g., login pages, APIs).
Validation: Verification of deployed rules in logging/simulated mode and subsequent transition to enforcement mode following Customer approval.
Operational Handover: Up to 1-hour dedicated, recorded knowledge-transfer session designed to empower the Customer's operations team to independently manage, monitor, and adjust the security deployment following the engagement's conclusion.

Products & Features included:

Web Application Firewall, including the following features: Custom Rules, Managed Rules, WAF Attack Score, Account-level WAF.
Rate Limiting.
Bot Management including the following features: Bot Score, Javascript Detection, mobile SDK.
Turnstile and Turnstile Pre-Clearance.

Out of Scope:

Translation of any vendor specific configurations.
Any rules or requirements which require Workers.

Customer Pre-Requisites

Provide administrative access to the Cloudflare environment.
Identify specific application endpoints that are considered "high-value" which require protection, such as login pages.
Provide any existing security policies or specific traffic profiles for alignment.

2. Delivery Model & Methodology

This service is delivered through a structured four-phase methodology over a fixed 35-day period.

Phase	Key Activities
Phase 1: Planning	Consultant conducts a planning call to finalize requirements. Customer to identify security requirements and high-value endpoints. Customer to provide administrative access to the dashboard.
Phase 2: Configuration	Consultant creates accounts/zones. Consultant configures WAF, Bot Management and Rate Limiting rules based on best practices and Customer requirements. All rules are initially deployed in logging mode.
Phase 3: Testing & Validation	Customer to monitor traffic flow in logging mode for a minimum of 7 days. Consultant to perform fine tuning of rules to minimize false positives.
Phase 4: Go-Live	Customer provides written signoff for rule enforcement. Consultant transitions rules to enforcement mode. Final knowledge transfer and documentation handover.

Resources: This service is delivered by a Cloudflare consultant and a Project Manager.

Duration/Timeline: Cloudflare estimates a typical delivery timeline of 35 days.

3. Deliverables

Deliverable	Description	Acceptance Criteria
Security Product Activation	Activation of WAF, Bot Management, and Rate Limiting on up to 5 zones	(1) WAF, Bot Management, and Rate Limiting features are active on up to five zones. (2) All WAF Managed, Custom, Bot, and Rate Limiting rules are in enforcement mode or in logging mode if Customer has not provided approval to transition to enforcement within the 35-day project duration. Enforcement mode is where the rule's action is set to any of the following: Default, Block, Challenge.
Configuration As-Built Document	Technical record of final state settings	Delivery of document containing specific WAF, Bot Management, and Rate Limiting configurations deployed during the engagement, subject to the five (5) business day review and deemed acceptance period defined in Section 5.
Knowledge Transfer	1 hour recorded technical session	Delivery of the single (1) consolidated session covering dashboard management of the configured zones. This deliverable is deemed accepted upon the earlier of: (i) completion of the session, or (ii) delivery of a recording of the session (or a recording of the attempted session if the Customer fails to attend the scheduled time or fails to provide the necessary consents required for a live recording).

4. Customer Responsibilities

Providing a minimum of five (5) business days' notice in advance of any desired go-live, traffic cutover, or scheduled session where Cloudflare support or participation is required.
Providing the Cloudflare consultant with administrative access to the relevant Cloudflare accounts and zones required for configuration.
Appointing a primary technical point of contact to participate in the kickoff call, review configuration choices, and attend the final enablement session.
Identifying and providing all priority application URLs, high-value endpoints (e.g., login pages, APIs), and existing security policies during the Planning phase.
Reviewing traffic logs during Phase 3 and providing timely written approval to transition rules from "logging" to "enforcement" mode.
Managing all internal networking, DNS changes (if not managed by Cloudflare), and backend application modifications required to support the deployment.
Customer shall ensure the availability of key stakeholders (including but not limited to Security, Networking, and Infrastructure leads) for all scheduled workshops and sessions. All sessions must be coordinated through the assigned Cloudflare technical resource. Cloudflare's obligation is limited to conducting one (1) primary instance of each scheduled session; Cloudflare is not obligated to provide duplicate or 'catch-up' sessions for absent stakeholders.
Obtaining all necessary consents from its employees, contractors, or other attendees prior to the recording of the Knowledge Transfer session, as required by applicable law.

5. Delivery Timelines, Acceptance

This is an outcome-based, fixed-fee engagement delivered within a 35-day window. Cloudflare's ability to deliver the defined outcomes is dependent upon the Customer's timely completion of its responsibilities.

Project Holds & Expiration: If Customer dependencies, including but not limited to stakeholder availability for scheduled sessions, remain outstanding for more than ten (10) consecutive business days, Cloudflare reserves the right to place the project on "Hold" status. Resuming a project from "Hold" may require a Change Order and additional fees. Notwithstanding any holds or delays, this engagement expires automatically thirty-five (35) days from the Order Form Effective Date. Upon expiration, Cloudflare will deliver a Configuration As-Built Document based on the information provided to date. At that time, the project is deemed fully complete, all fees are deemed fully earned, and Cloudflare will have no obligation to provide any additional services or deliverables.

6. Benefits

This service provides customers with several key outcomes:

Immediate Security Posture: Rapid deployment of a multi-layered defense against common threats (WAF, bots, brute force).
Traffic Quality Improvement: Reduction of malicious and unwanted bot traffic, which frees up infrastructure resources for legitimate users.
Risk Mitigation: Minimizes the attack surface for key application endpoints.
Expert Tuning: Benefit from Cloudflare consultant expertise to minimize false positives and verify that security does not impact legitimate users.
Operational Readiness: Internal teams gain direct experience and platform familiarity through collaborative configuration review and expert-led knowledge transfer.

Deployment Services - Basic CDN & WAF Setup

1. Service Definition

Service Name: Basic CDN & WAF Setup - Deployment Services

Service Goal/Objective: This service provides a rapid, expert deployment of Cloudflare's core CDN and WAF capabilities for up to five (5) zones. The objective is to establish a standardized baseline for performance and security, so that web assets are onboarded according to Cloudflare best practices while maintaining a streamlined delivery timeline.

Service Scope:

Planning and Alignment: A single session to confirm project goals, identify the five (5) target zones, and review account access requirements. Each zone includes a maximum of three (3) unique configurations. Any separate configurations required for subdomains will each count toward this per-zone limit.
Basic CDN Configuration: Setup of core performance features including basic caching rules, SSL/TLS certificate creation, and basic routing rules for traffic optimization.
Foundational WAF Deployment: Activation of Cloudflare Managed Rulesets on up to five (5) zones to provide immediate protection against common web vulnerabilities.
Custom Rule Logic: Configuration of up to 5 custom WAF rules per zone.
Validation: Verification of proxy status and end-to-end connectivity checks for each zone.
Operational Handover: A 1-hour recorded session to review the configured settings and enable the Customer's team to manage the environment moving forward.

Out of Scope:

Translation of any vendor specific configurations.
Any rules or requirements which require Workers.

Bot Protection which includes deployment of Cloudflare's Bot Management, Rate Limiting, and WAF services.
Health Check & Remediation for reviews of existing configurations.

2. Delivery Model & Methodology

This service is delivered in a structured four-phase methodology, completed within up to 21 days.

Phase	Key Activities
Phase 1: Planning	Kickoff call to confirm scope and goals. Collect all security requirements and priority application URLs.
Phase 2: Configuration	Creation of accounts & zones. Activation of CDN and Managed Rules based on best practices and Customer requirements. Custom rules are created and initially deployed in logging mode.
Phase 3: Testing & Validation	Monitor traffic flow in logging mode for 3 days. Fine tuning of rules to minimize false positives.
Phase 4: Go-Live	Customer to provide written approvals to transition. Transition of rules to enforcement mode. Final knowledge transfer and Configuration As-Built documentation handover.

3. Deliverables

Deliverable	Description	Acceptance Criteria
Zone Activation	Activation of CDN & WAF on up to 5 zones	(1) Cloudflare proxy is active for the zones in scope. (2) WAF Manage Rulesets are in enforcement mode (Action set to any of the following: Default, Block, Challenge) or in logging mode if Customer has not provided approval to transition to enforcement within the 21-day project duration. (3) WAF Custom Rules are in enforcement mode (Action set to any of the following: Block, Challenge).
Configuration As-Built Document	Technical record of final state settings	Delivery of document containing a record of SSL settings, Caching levels, and a list of the 5 custom WAF rules per zone, subject to the five (5) business day review and deemed acceptance period defined in Section 5.
Knowledge Transfer	1 hour recorded technical session	Delivery of the single (1) consolidated session covering dashboard management of the configured zones. This deliverable is deemed accepted upon the earlier of: (i) completion of the session, or (ii) delivery of a recording of the session (or a recording of the attempted session if the Customer fails to attend the scheduled time or fails to provide the necessary consents required for a live recording).

4. Customer Responsibilities

Providing a minimum of five (5) business days' notice in advance of any desired go-live, traffic cutover, or scheduled session where Cloudflare support or participation is required.
Providing administrative access to the Cloudflare dashboard at project kickoff and delivering timely written approval to transition WAF rules from "Logging" to "Enforcement" mode during Phase 3.
Appointing a primary technical point of contact to participate in the kickoff call, review configuration choices, and attend the final enablement session.
Managing all internal networking, backend origin modifications, and DNS changes, including securing the origin infrastructure. If utilizing third-party SSL/TLS certificates (such as mTLS or custom certificates), the Customer is responsible for verifying their readiness and manually uploading them to the Cloudflare platform.
Identifying up to five (5) target zones for onboarding and providing a list of all priority application URLs.
Performing all final application compatibility, performance, and end-to-end testing to verify origin compatibility with Cloudflare proxy settings.
Configuring any requirements outside the baseline setup, including Role-Based Access Control (RBAC), SSO integration, custom data logging/retention, or custom Workers.
Development of any Workers scripts to achieve requirements.
Customer shall ensure the availability of key stakeholders (including but not limited to Security, Networking, and Infrastructure leads) for all scheduled workshops and sessions. All sessions must be coordinated through the assigned Cloudflare technical resource. Cloudflare's obligation is limited to conducting one (1) primary instance of each scheduled session; Cloudflare is not obligated to provide duplicate or 'catch-up' sessions for absent stakeholders.
Obtaining all necessary consents from its employees, contractors, or other attendees prior to the recording of the Knowledge Transfer session, as required by applicable law.

5. Delivery Timelines, Acceptance

This is an outcome-based, fixed-fee engagement delivered within a 21-day window. Cloudflare's ability to deliver the defined outcomes is dependent upon the Customer's timely completion of its responsibilities.

Project Holds & Expiration: If Customer dependencies, including but not limited to stakeholder availability for scheduled sessions, remain outstanding for more than ten (10) consecutive business days, Cloudflare reserves the right to place the project on "Hold" status. Resuming a project from "Hold" may require a Change Order and additional fees. Notwithstanding any holds or delays, this engagement expires automatically ninety (90) days from the Order Form Effective Date. Upon expiration, Cloudflare will deliver a Configuration As-Built Document based on the information provided to date. At that time, the project is deemed fully complete, all fees are deemed fully earned, and Cloudflare will have no obligation to provide any additional services or deliverables.

6. Benefits

This service provides customers with several key outcomes:

Rapid Onboarding: Quickly establish a Cloudflare presence using expert-vetted baseline configurations, all built to best practice.
Baseline Security: Immediate protection against common web attacks via the Cloudflare Managed Ruleset.
Improved Performance: Leverage Cloudflare's global network to reduce latency and origin load through standardized caching.
Foundational Knowledge: Facilitate Customer's team understands the basic dashboard operations through a dedicated enablement session.
Operational Readiness: Internal teams gain direct experience and platform familiarity through collaborative configuration review and expert-led knowledge transfer.

Deployment - Layer 3 DDos Protection Service

1. Service Definition

Service Name: Layer 3 DDoS Prevention Deployment Service

Service Goal/Objective: The Cloudflare Network Services Magic Transit deployment service is designed to provide customers with the guidance and recommendations needed to validate that the organization is properly protected against Layer 3 DDoS attacks. The Magic Transit service will be configured and validated in line with the latest recommendations for security, performance, and reliability. The result is the delivery of Magic Transit to help harden the security perimeter against L3 DDoS attacks, accelerate time to value, and facilitate operational excellence.

In Scope:

This service includes comprehensive design & planning workshops, and the configuration of up to [INSERT NUMBER] network sites and up to [INSERT NUMBER] prefixes. While the underlying Magic Transit service is billed by bandwidth, this deployment engagement is strictly capped at these maximum quantities. The specific sites and prefixes to be configured will be mutually agreed upon during the Plan & Design phase prior to the start of implementation. Hands-on keyboard implementation support is strictly limited to the Cloudflare Dashboard during the Pilot Migration & Testing and Production Rollout & Testing phases. The Customer is delivered key outputs which will result in a successful deployment of Magic Transit services:

Technical discovery of Customer environment and alignment to Cloudflare Magic Transit requirements.
Architecture & design workshops with key Customer stakeholders (Security, Network, Infrastructure, etc.).
Verification and validation of prefixes and sites.
Cloudflare Firewall Rules review & configuration.
Execution of site/prefix activations strictly adhering to the fixed Sprint Schedule (defined in Delivery & Methodology section), where unready sites are automatically deferred to the final remediation wave.
Post-deployment validation is limited to a one business day 'Hyper-care' window per site, verifying strictly against the Key Performance Indicators (KPIs) defined in the High-Level Design.
CNI Configuration (if necessary).
Pre-flight checks per prefix.
Go-Live and Deployment.
Cloudflare Network Flow configuration (if applicable).
Monitoring & Steady State Review.

Out of Scope

Configuration of Customer routers, firewalls, or other CPE.
Configuration of other Cloudflare products (i.e., Zero Trust, Cloudflare WAN, App Services, Cloudflare Account Management).
Configuration and deployment of any network sites, tunnels, routes, or related architecture that exceed the maximum [INSERT NUMBER] sites and [INSERT NUMBER] prefixes allocated for this service.
Configuration and deployment of third-party prefixes that the Customer does not explicitly have authorization to advertise.
Any items not identified in the In Scope section above.

Note: This service description contains placeholder values ([INSERT NUMBER]) for the maximum sites and prefixes that must be finalized before this content is published.

2. Delivery Model & Methodology

This service is delivered in a structured four-phase methodology, typically completed within 120 days, depending on the project size and complexity.

Phase	Key Activities
Phase 1: Plan & Design	Kickoff call to confirm scope and goals. Current network infrastructure assessment. Magic Transit Workshop. Discussion of any known configuration challenges. LOA & IRR verification. CNI deployment strategy (if necessary). Cloudflare account creation & entitlement. HLD document preparation. Migration plan development.
Phase 2: Implementation (Executed via sprint-based methodology, not to exceed 8 sprints)	Sprint Planning - Determined by the specific sites, tunnels, and routes that need to be onboarded, up to the maximum sites and prefixes scoped for this engagement. Deployment of Pilot sprint (1-2 prefixes and 1 site). Traffic Analysis & Review. Pilot configuration & set up. Pilot preflight checks and verification. Pilot deployment go-live call. Go-live and monitoring session. Post go-live review and adjustments. Sprint close out. Production phase roll out. Traffic Analysis & Review. Production configuration & set up. Production preflight checks and verification. Production deployment go-live call. Production go-live and monitoring session. Post go-live review and adjustments. Production sprint close out.
Phase 3: Monitoring & Optimization	Review of current environment under full load. Configuration of Advanced TCP Protection. Adjustment and review of current state. Redundancy/failover testing as per design. Acceptance of current state. Handover to Customer Success/SOC/TAM teams.
Phase 4: Architecture Review Presentation & Closeout	Presentation of the final Configuration As-Built Document. Discussion of findings and next steps for remediation strategy. Final project closeout meeting.

Included Resources: Network Services Consultant, Project Manager.

Duration/Timeline: This service will be delivered within a 120-day timeframe.

3. Deliverables

Deliverable	Description	Acceptance Criteria
High Level Design Document	A strategic architectural definition document that establishes the logical framework for the Magic Transit deployment. This artifact defines the governing standards for prefix advertisement policies and traffic encapsulation methods (GRE/IPsec/CNI). It serves as the primary 'source of truth' defining how Inbound Traffic is ingested by Cloudflare and how Clean Traffic is delivered back to the Customer's origin infrastructure	(1) The elapse of five (5) business days following delivery without the submission of a material objection in writing. (2) Commencement of configuration of the specific sites, tunnels, or prefixes mutually agreed upon during the Plan & Design phase. (3) Formal Sign-off.
Configuration As-Built Document	An As-Built Configuration Guide detailing the validated technical state of the environment, including site inventories, tunnel specifications, and routing logic as implemented in the final state.	Delivery of document, subject to the five (5) business day review and deemed acceptance period defined in Section 5.
Knowledge Transfer	1 hour recorded technical session.	Delivery of the single (1) consolidated session covering dashboard management of the configured sites, tunnels, and prefixes. This deliverable is deemed accepted upon the earlier of: (i) completion of the session, or (ii) delivery of a recording of the session (or a recording of the attempted session if the Customer fails to attend the scheduled time or fails to provide the necessary consents required for a live recording).

4. Customer Responsibilities

Providing a minimum of five (5) business days notice in advance of any desired go-live or network change event. The parties acknowledge that enterprise network changes frequently require off-hours or weekend support. Such support is included within the scope of this service, provided it is scheduled and mutually agreed upon in advance.
Appointing a primary technical point of contact to participate in the kickoff call, review configuration choices, and attend the final enablement session.
Providing the Cloudflare team with required documentation such as Existing Network Diagram and Architecture Documents, Letters of Authorization (LOA), or Resource Public Key Infrastructure (RPKI) information to validate that the Customer has the authority to grant Cloudflare permission to advertise specific Autonomous System Number (ASN) information to the wider Internet.
Providing the Cloudflare team with existing network diagrams and architecture documents.
Managing all internal firewalls, routers, networking, and associated equipment.
Providing administrative access to the Cloudflare dashboard at project kickoff and delivering timely written approval to begin advertising prefixes via the Cloudflare dashboard or API.
Managing internal change requests and associated documentation, and communicating the change window requests with Cloudflare team.
Preparing any documentation required for internal acceptance into service.
Performing internal Project Management.
Providing service testers for critical applications during prefix cutover change windows.
Configuring any requirements outside the baseline setup, including Role-Based Access Control (RBAC), SSO integration, custom data logging/retention, or custom Workers.
Developing any Workers scripts to achieve requirements.
Validating the accuracy and completeness of the technical details (including all required sites, tunnels, and prefixes) mutually agreed upon during the Plan & Design phase prior to the start of implementation. Any material changes to these details after this point, or any request to expand scope beyond the maximum sites and prefixes, may require a Change Order and applicable supplemental fees.
Customer shall ensure the availability of key stakeholders (including but not limited to Security, Networking, and Infrastructure leads) for all scheduled workshops and sessions. All sessions must be coordinated through the assigned Cloudflare technical resource. Cloudflare's obligation is limited to conducting one (1) primary instance of each scheduled session; Cloudflare is not obligated to provide duplicate or 'catch-up' sessions for absent stakeholders.
Obtaining all necessary consents from its employees, contractors, or other attendees prior to the recording of the Knowledge Transfer session, as required by applicable law.

5. Delivery Timelines, Acceptance

Project Holds & Expiration: If Customer dependencies, including but not limited to stakeholder availability for scheduled sessions, remain outstanding for more than ten (10) consecutive business days, Cloudflare reserves the right to place the project on "Hold" status. Resuming a project from "Hold" may require a Change Order and additional fees. Notwithstanding any holds or delays, this engagement expires automatically 120 days from the Order Form Effective Date. Upon expiration, Cloudflare will deliver a Configuration As-Built Document based on the information provided to date. At that time, the project is deemed fully complete, all fees are deemed fully earned, and Cloudflare will have no obligation to provide any additional services or deliverables.

6. Benefits

This service provides customers with several key outcomes:

World-Class L3 DDoS Prevention & Mitigation: Customer corporate networks are protected by one of the largest DDoS mitigation providers in the world. Customer configuration aligns with Cloudflare's latest security, performance, and reliability recommendations.
Phased deployment approach: Onboarding of sites, tunnels, and prefixes is done in a programmatic way to ensure minimal disruption to Customer environments.
Training & Enablement: Detailed training and enablement on Cloudflare Magic Transit platform to ensure that Customer teams are knowledgeable on best practices.
Accelerated Time to Value: Engaging with Cloudflare Professional Services provides the fast path to validating that the investment in Magic Transit provides the L3 DDoS prevention and mitigation protection that the Customer requires.
Operational Readiness: Internal teams gain direct experience and platform familiarity through collaborative configuration review and expert-led knowledge transfer.

Deployment - Network Connectivity Service

1. Service Definition

Service Name: Network Connectivity Deployment Services

Service Goal/Objective: The Cloudflare Network Deployment service is designed to provide customers with the guidance and recommendations needed to enable the organization to securely provide high performing inter-site connectivity using Cloudflare WAN. The Cloudflare WAN service will be configured and validated in line with the latest recommendations for security, performance, and reliability. The result is the delivery of Cloudflare WAN to help simplify network connectivity across the Customer infrastructure while prioritizing security and reliability.

In Scope:

This service includes comprehensive design & planning workshops, and the configuration of the specific network sites, routes, and tunnels as detailed in the mutually agreed upon Configuration Form completed prior to the start of delivery of services. While the underlying Cloudflare WAN service is billed by bandwidth, this deployment engagement is strictly limited to the technical scope defined in that Configuration Form. Hands-on keyboard implementation support is strictly limited to the Cloudflare Dashboard during the Pilot Migration & Testing and Production Rollout & Testing phases. Cloudflare will not perform configurations on Customer premise equipment (“CPE”) or third-party systems. Cloudflare will provide the Customer with the following key outputs to facilitate a successful deployment of Cloudflare WAN services:

Technical discovery of Customer environment and alignment to Cloudflare WAN requirements.
Architecture & design workshops with key Customer stakeholders (Security, Network, Infrastructure, etc.).
Verification and validation of sites.
Cloudflare Network Firewall Rules review & configuration.
Execution of site activations strictly adhering to the fixed Sprint Schedule (defined in Delivery & Methodology section), where unready sites are automatically deferred to the final remediation wave.
Post-deployment validation is limited to a one business day 'Hyper-care' window per site, verifying strictly against the Key Performance Indicators (KPIs) defined in the High-Level Design.
Go-Live and Deployment.
Monitoring & Steady State Review.

Out of Scope

Configuration of Customer routers, firewalls, or other CPE.
Configuration of other Cloudflare products (i.e., Cloudflare One, Magic Transit, App Services, Cloudflare Account Management).
Configuration and deployment of any network sites, tunnels, routes, or related architecture that are not explicitly listed in the agreed-upon Configuration Form.
Configuration and deployment of third-party IP space or routes that the Customer does not explicitly have authorization to advertise.
Any items not identified in the In Scope section above.

2. Delivery Model & Methodology

This service is delivered in a structured four-phase methodology, typically completed within 120 days, depending on the project size & complexity.

Phase	Key Activities
Phase 1: Plan & Design	Kickoff call to confirm scope and goals. Current network infrastructure assessment. Cloudflare WAN Workshop. Discussion of any known configuration challenges, including verification of CPE compatibility. Cloudflare account creation & entitlement. HLD document preparation. Migration plan development.
Phase 2: Implementation & Rollout (Executed via sprint-based methodology, not to exceed 8 sprints)	Sprint Planning, determined by the number of sites, tunnels, and routes that need to be onboarded as specified in the Configuration Form. Pilot sprint (1-2 sites). Pilot configuration & set up. Pilot deployment go-live call. Go-live and monitoring session. Post go-live review and adjustments. Sprint close out. Production phase roll out. Production configuration & set up. Production preflight checks and verification. Production deployment go-live call. Production go-live and monitoring session. Post go-live review and adjustments. Production sprint close out.
Phase 3: Monitoring & Optimization	Review of current environment under full load. Adjustment and review of current state. Acceptance of current state. Handover to Customer Success/SOC/TAM teams.
Phase 4: Architecture Review Presentation & Closeout	Presentation of the final As-Built Configuration Guide. Discussion of findings and next steps for remediation strategy. Final project closeout meeting.

Included Resources: Network Services Consultant, Project Manager.

Duration/Timeline: This service will be delivered within a 120-day timeframe.

3. Deliverables

Deliverable	Description	Acceptance Criteria
High Level Design Document	A strategic architectural definition document that establishes the logical framework for the Cloudflare WAN deployment. This artifact defines the governing standards for network topology, and site connectivity methods (Connector/IPsec/GRE/CNI). It serves as the primary 'source of truth' defining how branch traffic is routed to Cloudflare and how sites communicate securely.	(1) The elapse of five (5) business days following delivery without the submission of a material objection in writing. (2) Commencement of configuration of the sites, routes, or tunnels defined in the Configuration Form. (3) Formal Sign-off.
Configuration As-Built Document	A comprehensive technical record detailing the validated technical state of the deployed environment. This document includes final site inventories, Cloudflare WAN Connector hardware specifications (if applicable), tunnel details, and routing tables as implemented in the final state.	Delivery of document, subject to the five (5) business day review and deemed acceptance period defined in Section 5.
Knowledge Transfer	1 hour recorded technical session	Delivery of the single (1) consolidated session covering dashboard management of the configured sites, routes, and tunnels. This deliverable is deemed accepted upon the earlier of: (i) completion of the session, or (ii) delivery of a recording of the session (or a recording of the attempted session if the Customer fails to attend the scheduled time or fails to provide the necessary consents required for a live recording).

4. Customer Responsibilities

Providing a minimum of five (5) business days' notice in advance of any desired go-live or network change event. The parties acknowledge that enterprise network changes frequently require off-hours or weekend support. Such support is included within the scope of this service, provided it is scheduled and mutually agreed upon in advance.
Appointing a primary technical point of contact to participate in the kickoff call, review configuration choices, and attend the final enablement session.
Providing the Cloudflare team with a technical point of contact to attend configuration meetings and make necessary adjustments to CPE as required for the establishment of connectivity back to Cloudflare's network.
Providing the Cloudflare team with a technical point of contact with the awareness of applications and other resources that must be white-listed or otherwise excluded from being sent via Cloudflare WAN tunnels.
Managing all internal firewalls, routers, networking, and associated equipment.
Providing administrative access to the Cloudflare dashboard at project kickoff and delivering timely written approval to begin establishing tunnel connectivity and routing Customer traffic through Cloudflare's network.
Managing internal change requests and associated documentation, and communicating the change window requests with Cloudflare team.
Preparing any documentation required for internal acceptance into service.
Performing internal Project Management.
Providing service testers for critical applications during site and routing cutover change windows.
Configuring any requirements outside the baseline setup, including Role-Based Access Control (RBAC), SSO integration, custom data logging/retention, or custom Workers.
Developing any Workers scripts to achieve requirements.
Validating the accuracy and completeness of the technical details (including all required sites, routes, and tunnels) provided in the Configuration Form prior to the start of delivery of services. Any material changes to the Configuration Form after this point may require a Change Order and applicable supplemental fees.
Customer shall ensure the availability of key stakeholders (including but not limited to Security, Networking, and Infrastructure leads) for all scheduled workshops and sessions. All sessions must be coordinated through the assigned Cloudflare technical resource. Cloudflare's obligation is limited to conducting one (1) primary instance of each scheduled session; Cloudflare is not obligated to provide duplicate or 'catch-up' sessions for absent stakeholders.
Obtaining all necessary consents from its employees, contractors, or other attendees prior to the recording of the Knowledge Transfer session, as required by applicable law.

5. Delivery Timelines, Acceptance

Project Holds & Expiration: If Customer dependencies, including but not limited to stakeholder availability for scheduled sessions, remain outstanding for more than ten (10) consecutive business days, Cloudflare reserves the right to place the project on "Hold" status. Resuming a project from "Hold" may require a Change Order and additional fees. Notwithstanding any holds or delays, this engagement expires automatically 120 days from the Order Form Effective Date. Upon expiration, Cloudflare will deliver a Configuration As-Built Document based on the information provided to date. At that time, the project is deemed fully complete, all fees are deemed fully earned, and Cloudflare will have no obligation to provide any additional services or deliverables.

6. Benefits

This service provides customers with several key outcomes:

Secure & Performant Connectivity & Routing: Eliminate vendor confusion & lock-in while gaining secure, reliable connectivity across all sites.
Phased deployment approach: Onboarding of sites, tunnels, and IP space is done in a programmatic way to ensure minimal disruption to Customer environments.
Training & Enablement: Detailed training and enablement on Cloudflare WAN & CF1 platform to equip Customer teams with knowledge of best practices.
Accelerated Time to Value: Engaging with Cloudflare Professional Services provides the fast path to ensuring that the investment in Cloudflare WAN provides the secure and performant connectivity that the Customer requires.
Operational Readiness: Internal teams gain direct experience and platform familiarity through collaborative configuration review and expert-led knowledge transfer.

Deployment - Remote Access Modernization Program

1. Service Definition

Service Name: Remote Access Modernization Program

Service Goal/Objective: The Remote Access Modernization Program Professional Service's offering is a comprehensive, multi-phase engagement designed to strategically help customers move away from outdated, risk-prone legacy VPN architectures toward a modern, secure, and performant Zero Trust Network Access (ZTNA) model.

This service enables a phased migration from traditional VPN to Zero Trust Network Access (ZTNA), minimizing disruption and risk while maximizing security.

Service Scope

To facilitate project success and timely delivery, this deployment service is strictly limited to the following environment sizes:

Total User Count: Up to 10,000 Users.
Policy Complexity: Up to 50 ZTNA Policies.
Connectivity Model: Up to 4 Cloudflare Tunnels or Cloudflare Mesh connectors. Sites-to-Internet (GRE/IPsec/CNI) is explicitly excluded (additional Professional Services to support these exclusions are available for an additional fee).

In Scope:

This service includes Design & Planning workshops, development of the Baseline Configuration of the ZTNA platform, Pilot Testing and Troubleshooting support, the Security Policy optimization recommendations, and Enablement Workshops for knowledge transfer.

Key outputs necessary for sustained success will be delivered to the Customer:

Technical Discovery of Current Architecture & Network Diagrams.
Architecture workshops with key Customer stakeholders (Networking, Security, and Operations) to design the ZTNA access model (identity-based, least-privilege).
Creation of a phased migration and testing plan (VPN and ZTNA can run side-by-side initially).
High Level Design document write-up.
Develop the Baseline Configuration for the Cloudflare One Platform for up to 10,000 users.
Develop the Configuration for up to 4 Connectors (Cloudflare Tunnel or Cloudflare Mesh Connectors) to establish connectivity with Customer Data Centers.
Develop the configuration for external integrations (IdP, logging, and device posture).
Develop up to 50 ZTNA Policies based on the Private Applications Inventory and Customer prioritization.
Configuration As-Built document write-up.
Advisory Support during Pilot Testing to validate the configuration and troubleshoot issues for up to 1,000 users/devices.
Knowledge Transfer sessions to enable the Customer's team to manage and scale the platform independently.

Out of Scope

Configuration of third-party solutions such as Intune, Okta, and Azure AD.
Deployment of the Connectors Software on Customer servers.
Configuration of the Customer Network Equipment (Routers, Firewalls, etc.).
Deployment of the Cloudflare One Client software to the end-user endpoints.
Configuration of Site-to-Internet connectivity (Cloudflare WAN, GRE/IPsec tunnels).
Support for testing or troubleshooting of policies and endpoints outside the defined 'Service Scope'.

2. Delivery Model & Methodology

This service is delivered in a structured six-phase methodology, to be completed within a 150-day timeframe.

Phase	Key Activities
Phase 1: Initiation	Kickoff call to identify Customer's requirements. Establishing business objectives and delineating anticipated outcomes. Identifying the appropriate stakeholders and allocating roles across the team.
Phase 2: Discovery, Planning, and Design	Requirements Gathering and Analysis. Technical Discovery of Current Architecture & Network Diagrams. Integrations Configuration needed (IdP, Logging, EDR, MDM, etc.). Applications Inventory Discovery. Architecture Workshop sessions with the Customer's teams. Developing the Target SASE Architecture (Cloudflare One Client, Tunnels, SWG, IdP). Migration plan based on business priority and technical complexity. Architecture Validation and Documentation.
Phase 3: Baseline Configuration Development	Baseline Networking and Cloudflare One Client Configuration. Integration with Customer's Identity Provider. The Customer is responsible for completing the configuration at the IdP side. Deployment of Cloudflare Tunnels. The Customer is responsible for deploying the software in their infrastructure. Integration with up to 3 Device Posture Providers. Integration with up to 5 LogPush Endpoints. Cloudflare One Client Posture Checks. Development or Migration of up to 50 ZTNA Policies. ZTNA Policy Best Practices.
Phase 4: Pilot Testing	Customer deploys Cloudflare One Client agents to 5-10% of the end-user endpoints. Cloudflare provides advisory support to validate the configuration of all the Cloudflare One Platform components and external integrations. Policy Enforcement Validation for the ZTNA and SWG Policies. Cloudflare One Client Troubleshooting and Configuration Update.
Phase 5: Enablement	Enablement Workshops to Customer's teams. Knowledge transfer to the Customer's teams.
Phase 6: Closure	Lessons Learned Workshop. Hand-off to Support and Success Teams.

Included Resources: Project Manager, Zero Trust Consultant.

Duration/Timeline: This service will be delivered within a 150-day timeframe.

3. Deliverables

Deliverable	Acceptance Criteria
High Level Design Document	Delivery of the High Level Design Document (which must encompass the Phased Migration Plan, Architecture Diagram, and Migration & Testing processes), subject to the five (5) business day review and acceptance period defined in Section 5.
Configuration As-Built Document	Delivery of a detailed technical document detailing all configurations deployed for the solution, subject to the five (5) business day review and deemed acceptance period defined in Section 5.
Enablement and Knowledge Transfer Workshop	Delivery of one (1) consolidated 60-minute Enablement Workshop. This deliverable is deemed accepted upon the earlier of: (i) completion of the session; or (ii) delivery of a recording of the session (or a recording of the attempted session if the Customer fails to attend the scheduled time or fails to provide the necessary consents required for a live recording).

4. Customer Responsibilities

Customer Inputs Required:

Providing a minimum of five (5) business days' notice in advance of any desired go-live, traffic cutover, or scheduled session where Cloudflare support or participation is required.
Participating in interviews with key Security, Networking, and Operations personnel.
Providing access to current VPN configuration, user groups, and authentication flow documentation.
Providing network diagrams and an application inventory listing private applications.
Managing Change Management Readiness to deploy the corresponding Network and Security configurations accordingly to not impact the project timelines.

Customer Responsibilities (Hands-on Implementation)

Deploying Cloudflare One Client software on the end users devices.
Deploying Cloudflare connector software on the servers or containers used for this functionality.
Configuring the Customer Networking Equipment (Routers, Firewalls, etc.) to establish the IPSEC Connectors (if applicable).
Configuring the 3rd party services that need to be integrated with Cloudflare One Platform (IdP, Logging, Device Posture).
Customer shall ensure the availability of key stakeholders (including but not limited to Security, Networking, and Infrastructure leads) for all scheduled workshops and sessions. All sessions must be coordinated through the assigned Cloudflare technical resource. Cloudflare's obligation is limited to conducting one (1) primary instance of each scheduled session; Cloudflare is not obligated to provide duplicate or 'catch-up' sessions for absent stakeholders.
Obtaining all necessary consents from its employees, contractors, or other attendees prior to the recording of the Enablement Workshop, as required by applicable law.

5. Delivery Timelines, Acceptance

Project Holds & Expiration: If Customer dependencies, including but not limited to stakeholder availability for scheduled sessions, remain outstanding for more than ten (10) consecutive business days, Cloudflare reserves the right to place the project on "Hold" status. Resuming a project from "Hold" may require a Change Order and additional fees. Notwithstanding any holds or delays, this engagement expires automatically 180 days from the Order Form Effective Date. Upon expiration, Cloudflare will deliver a Configuration As-Built Document based on the information provided to date. At that time, the project is deemed fully complete, all fees are deemed fully earned, and Cloudflare will have no obligation to provide any additional services or deliverables.

6. Benefits

This service provides customers with several key outcomes:

Move to a Modern, Secure Architecture: The service is designed to strategically help customers move away from outdated, risk-prone legacy VPN architectures toward a modern, secure, and performant Zero Trust Network Access (ZTNA) model.
Minimized Disruption and Risk: It enables a phased migration from traditional VPN to ZTNA, which minimizes disruption and risk while maximizing security.
Comprehensive Support and Planning: The engagement provides comprehensive Design & Planning workshops, Baseline Configuration of the ZTNA platform, Pilot Testing, and advisory support during the Production Rollout.
Key Deliverables for Sustained Success: Customers receive key outputs necessary for sustained success, including a High Level Design Document, a Configuration As-Built Document, and a Phased Migration and Testing Plan.
Knowledge Transfer and Enablement: The process includes Enablement Workshops and Knowledge Transfer to Customer's teams to facilitate a smooth hand-off to Support and Success Teams.
Operational Readiness: Internal teams gain direct experience and platform familiarity through collaborative configuration review and expert-led knowledge transfer.

Deployment - SASE Architecture & Configuration

1. Service Definition

Service Name: SASE Architecture & Configuration Deployment

Service Goal/Objective: The SASE Architecture Design & Configuration Deployment is a targeted engagement designed to provide customers a rapid, expert deployment of Cloudflare One capabilities with the architectural blueprint and configuration best practices required to begin their SASE journey. Cloudflare provides technical expertise and validation for the design and executes the configurations, while the Customer remains responsible for the testing, agent production rollout, and end-user support.

Service Scope

To facilitate project success and timely delivery, this deployment service is strictly limited to the following environment sizes:

Total User Count: Up to 8,000 Users.
Policy Complexity: Up to 10 ZTNA/SWG Policies.
Connectivity Model: Up to 4 Cloudflare Tunnels or Cloudflare Mesh connectors. Sites-to-Internet (GRE/IPsec/CNI) is explicitly excluded (additional Professional Services to support these exclusions are available for an additional fee).

In Scope:

Full SASE Architecture Discovery: Comprehensive discovery of current network architecture, technical requirements, and application inventory.
Architecture Design Workshops: Strategic sessions to design a unified SASE model, including Identity Provider (IdP) integration, private access (ZTNA), and secure Internet access (SWG).
Configure the Baseline Configuration for the Cloudflare One Platform for up to 8,000 users.
Implement the Configuration for up to 4 Connectors (Cloudflare Tunnel or Cloudflare Mesh) to establish connectivity with Customer Data Centers.
Configure external integrations (up to 1 IdP, up to 5 LogPush Endpoints, and up to 3 Device Posture providers).
Configure up to 10 ZTNA Policies based on the Private Applications Inventory and Customer prioritization.
Configure up to 10 SWG Policies for Internet Traffic filtering.
Testing & Troubleshooting Support during the Close Pilot phase (up to 50 users) to validate all the components configurations, including Cloudflare One Clients, Connectors, External Integrations and policies.

Out of Scope

Software Deployment: Installation of Cloudflare Connector software or distribution of Cloudflare One Client software.
Third-Party Configuration: Setup of solutions such as Okta, Azure AD, or Intune.
Production Rollout Support: for Open Pilot and Production Rollout phases. Migration Program Service is available if needed.
End-User Support: Direct support for the Customer's employees (Helpdesk).

2. Delivery Model & Methodology

This accelerated service follows a five-phase methodology, typically completed within 90 days.

Phase	Key Activities
Phase 1: Initiation	Kickoff call to identify Customer's requirements and define expected outcomes.
Phase 2: Discovery, Planning, and Design	Technical workshops to analyze current architecture and develop the Target SASE Architecture (Cloudflare One Client, Tunnels, SWG, IdP).
Phase 3: Baseline Configuration	Baseline Networking and Cloudflare One Client Configuration. Integration with up to 1 Customer's Identity Provider. The Customer is responsible for completing the configuration at the IdP side. Deployment of Cloudflare Tunnels. The Customer is responsible for deploying the software in their infrastructure. Integration with up to 3 Device Posture Providers. Integration with up to 5 LogPush Endpoints. Cloudflare One Client Posture Checks. Up to 10 ZTNA Policy Configurations based on the recommended Best Practices. Up to 10 Secure Web Gateway Policies based on the recommended Best Practices.
Phase 4: Close Pilot Testing	Testing & Troubleshooting Support for up to 50 users. Customer deploys Cloudflare One Client to the end-user endpoints. Steady State Validation for all the Cloudflare One Platform components. Steady State Validation for all the external integrations. Policy Enforcement Validation for the ZTNA and SWG Policies. Cloudflare One Client Troubleshooting and Configuration Update. Connectors Troubleshooting and Configuration Update.
Phase 5: Enablement	Dedicated enablement workshops to transfer the knowledge and equip the Customer's teams to manage and continue with the deployment of the rest of the endpoints with the established baseline architecture.

Included Resources: Project Manager, Zero Trust Consultant.

Duration/Timeline: This service will be delivered within a 90-day timeframe.

3. Deliverables

Deliverable	Acceptance Criteria
High Level Design Document	Delivery of the document, including Phased Migration Plan, Architecture Diagram, and Migration & Testing processes, subject to the five (5) business day review and deemed acceptance period defined in Section 5.
Configuration As-Built Document	Delivery of a detailed technical document detailing all configurations deployed for the solution, subject to the five (5) business day review and deemed acceptance period defined in Section 5.
Enablement and Knowledge Transfer Workshop	Delivery of one (1) consolidated 60-minute Enablement Workshop. This deliverable is deemed accepted upon the earlier of: (i) completion of the session; or (ii) delivery of a recording of the session (or a recording of the attempted session if the Customer fails to attend the scheduled time or fails to provide the necessary consents required for a live recording).

4. Customer Responsibilities

Customer Inputs Required:

Providing a minimum of five (5) business days' notice in advance of any desired go-live, traffic cutover, or scheduled session where Cloudflare support or participation is required.
Participating in interviews with key Security, Networking, and Operations personnel.
Providing access to current VPN configuration, user groups, and authentication flow documentation.
Providing network diagrams and an application inventory listing private applications.
Managing Change Management Readiness to deploy the corresponding Network and Security configurations accordingly to not impact the project timelines.

Customer Responsibilities (Hands-on Implementation)

Software Deployment: Installing Cloudflare One Client on endpoints and deploying Cloudflare connector software on Customer-managed servers or Docker containers.
Infrastructure Management: Configuring routers, firewalls, and 3rd party services (Okta, Azure AD, Intune, etc.).
Providing troubleshooting Support to the end users.
Customer shall ensure the availability of key stakeholders (including but not limited to Security, Networking, and Infrastructure leads) for all scheduled workshops and sessions. All sessions must be coordinated through the assigned Cloudflare technical resource. Cloudflare's obligation is limited to conducting one (1) primary instance of each scheduled session; Cloudflare is not obligated to provide duplicate or 'catch-up' sessions for absent stakeholders.
Obtaining all necessary consents from its employees, contractors, or other attendees prior to the recording of the Enablement Workshop, as required by applicable law.

5. Delivery Timelines, Acceptance

This is an outcome-based, fixed-fee engagement delivered within a 90-day window. Cloudflare's ability to deliver the defined outcomes is dependent upon the Customer's timely completion of its responsibilities.

Project Holds & Expiration: If Customer dependencies, including but not limited to stakeholder availability for scheduled sessions, remain outstanding for more than ten (10) consecutive business days, Cloudflare reserves the right to place the project on "Hold" status. Resuming a project from "Hold" may require a Change Order and additional fees. Notwithstanding any holds or delays, this engagement expires automatically 120 days from the Order Form Effective Date. Upon expiration, Cloudflare will deliver a Configuration As-Built Document based on the information provided to date. At that time, the project is deemed fully complete, all fees are deemed fully earned, and Cloudflare will have no obligation to provide any additional services or deliverables.

6. Benefits

This engagement delivers a high-quality architectural foundation and operational readiness within an accelerated timeframe:

Expert Architectural Foundation: Secure a validated SASE blueprint (ZTNA, SWG) designed by Cloudflare experts following least-privilege and identity-based best practices.
Accelerated Deployment Path: Transition from discovery to a baseline-ready environment in just 90 days with a clear, step-by-step configuration roadmap.
Operational Readiness: Internal teams gain direct experience and platform familiarity through collaborative configuration review and expert-led knowledge transfer.
Reduced Strategic Risk: Minimize architectural errors and integration gaps before rollout by validating your design against specific business and security requirements.

Deployment - SWG Migration Program

1. Service Definition

Service Name: SWG Migration Program - Deployment

Service Goal/Objective: The SWG Migration Program - Deployment Professional Service is a comprehensive, multi-phase engagement designed to strategically help customers to accelerate the transition from legacy on-premises proxies to a cloud-native Secure Web Gateway with Advanced Security capabilities. This service enables a phased migration that minimizes disruption and risk while maximizing security.

Service Scope

To facilitate project success and timely delivery, this deployment service is strictly limited to the following environment sizes:

Total User Count: Up to 10,000 Users.
Policy Complexity: Up to 50 SWG Policies.
Connectivity Model: This service covers endpoint-to-internet traffic via the Cloudflare One Client, DNS and Proxy connectivity options. Sites-to-Internet (GRE/IPsec/CNI) is explicitly excluded (additional Professional Services to support these exclusions are available for an additional fee).

In Scope:

This service includes Design & Planning workshops, development and implementation of the Baseline Configuration for the SWG platform, Pilot Testing and Troubleshooting support, Security Policy optimization recommendations, and Enablement Workshops for Customer knowledge transfer.

Technical Discovery: Review of current web proxy architecture and traffic flow diagrams.
Architecture Workshops: Sessions with stakeholders to design the SWG model (HTTPS inspection, DNS filtering, and data protection).
Migration Planning: Collaborative creation of a phased rollout plan (temporary coexistence of legacy proxy and SWG during the migration).
Platform Configuration: Development and implementation of the configuration for the Cloudflare One Platform, including Gateway, DLP, and RBI policies.
Pilot Support: Advisory support to validate the configuration and troubleshoot issues during Pilot Testing for up to 1,000 users/devices.
Security Optimization: Strategic recommendations to optimize the Customer's SWG Policy Model.
Knowledge Transfer: Enablement workshops to equip the Customer's team to manage the platform independently.

Out of Scope

Configuration of third-party solutions (e.g., IdPs, EDRs, or MDM software).
Deployment of the Cloudflare One Client software to end-user endpoints.
Configuration of Customer Network Equipment like Routers or Firewalls.
Configuration of Site-to-Internet connectivity (Cloudflare WAN, GRE/IPsec tunnels).
Support for testing or troubleshooting of policies and endpoints outside the defined 'Service Scope'.

2. Delivery Model & Methodology

This service follows a six-phase methodology, completed within up to 120 days.

Phase	Key Activities
Phase 1: Initiation	Kickoff call to identify the requirements of the end Customer. Establishing business objectives and defining expected outcomes. Identifying the appropriate stakeholders and allocating roles across the team.
Phase 2: Discovery, Planning, and Design	Comprehensive discovery of current network architecture and technical requirements. Configuration of required integrations (IdP, Logging, EDR, MDM, etc.). Applications Inventory Discovery. Architecture Workshop sessions with the Customer's teams. Migration plan based on business priority and technical complexity. Architecture Validation and Documentation.
Phase 3: Baseline Configuration Development	Developing configurations and best practices for the following components, while Cloudflare performs the baseline configuration: Baseline Networking and Cloudflare One Client Configuration. Integration with up to 1 Customer's Identity Provider. Integration with up to 3 Device Posture Providers. Integration with up to 5 LogPush Endpoints. Cloudflare One Client Posture Checks. Migration of up to 50 SWG Policies. Secure Web Gateway Policy Best Practices. DLP and RBI Policy Best Practices.
Phase 4: Pilot Testing	Customer deploys Cloudflare One Client to 5-10% of the end-user endpoints. Cloudflare provides technical support to validate the configuration of all the Cloudflare One Platform components, external integrations, and SWG Policies. Cloudflare provides technical support for troubleshooting Cloudflare One Client and SWG policy validation.
Phase 5: Enablement	Enablement Workshops to Customer's teams. Knowledge transfer to Customer's teams.
Phase 6: Closure	Lessons Learned Workshop. Hand-off to Customer's Support and Success Teams.

Included Resources: Project Manager, Zero Trust Consultant.

Duration/Timeline: This service will be delivered within a 120-day timeframe.

3. Deliverables

Cloudflare Deliverables:

Deliverable	Acceptance Criteria
High Level Design Document	Delivery of the High Level Design Document (which must encompass the Phased Migration Plan, Architecture Diagram, and Migration & Testing processes), subject to the five (5) business day review and deemed acceptance period defined in Section 5.
Configuration As-Built Document	Delivery of a detailed technical document detailing all configurations deployed for the solution, subject to the five (5) business day review and deemed acceptance period defined in Section 5.
Enablement and Knowledge Transfer	Delivery of the single (1) consolidated 60-minute Enablement Workshop. This deliverable is deemed accepted upon the earlier of: (i) completion of the session, or (ii) delivery of a recording of the session (or a recording of the attempted session if the Customer fails to attend the scheduled time or fails to provide the necessary consents required for a live recording).

4. Customer Responsibilities

Client Inputs Required:

Providing a minimum of five (5) business days' notice in advance of any desired traffic cutover or go-live event.
Interviews with key Security, Networking, and Operations personnel.
Access to existing SWG or Proxy configuration.
Identify the list of 50 policies that require migration.
Network diagrams and an application inventory listing private applications.

Customer Responsibilities (Hands-on Implementation)

Software Deployment: Installing Cloudflare One Client on end-user devices.
Infrastructure Management: Configuration of routers, firewalls, and 3rd party services (Okta, Azure AD, Intune, etc.).
Change Management: Readiness to deploy configurations to facilitate adherence to project timelines.
Customer shall ensure the availability of key stakeholders (including but not limited to Security, Networking, and Infrastructure leads) for all scheduled workshops and sessions. All sessions must be coordinated through the assigned Cloudflare technical resource. Cloudflare's obligation is limited to conducting one (1) primary instance of each scheduled session; Cloudflare is not obligated to provide duplicate or 'catch-up' sessions for absent stakeholders.
Obtaining all necessary consents from its employees, contractors, or other attendees prior to the recording of the Enablement Workshop, as required by applicable law.

5. Delivery Timelines, Acceptance

This is a fixed-fee project delivered within a 120-day window. Cloudflare's ability to deliver the defined outcomes is dependent upon the Customer's timely completion of its responsibilities.

Project Holds & Expiration: If Customer dependencies, including but not limited to stakeholder availability for scheduled sessions, remain outstanding for more than ten (10) consecutive business days, Cloudflare reserves the right to place the project on "Hold" status. Resuming a project from "Hold" may require a Change Order and additional fees. Notwithstanding any holds or delays, the services expire one hundred fifty (150) days from the Order Form Effective Date. Upon expiration, Cloudflare will deliver the Configuration As-Built Document based on the information provided to date. At that time, the project is deemed completed, all fees are deemed fully earned, and Cloudflare will have no obligation to provide any additional services or deliverables.

6. Benefits

This service provides customers with several key outcomes:

Reduced Risk: Phased migration maintains security while maintaining user productivity.
Operational Readiness: Internal teams gain direct experience and platform familiarity through collaborative configuration review and expert-led knowledge transfer.
Strategic Modernization: Strategically move from legacy Internet Proxies to a modern Cloud-based SWG architecture.

Remediation Service - Optimization Services

1. Service Definition

Service Name: Remediation Service

Service Goal/Objective: This service addresses the findings identified in a preceding Cloudflare Configuration Assessment Report. The objective is to provide expert execution of remediations to improve the security and performance posture of the Cloudflare configuration.

Service Pre-Requisite: Customer must have a completed Cloudflare Configuration Assessment Report delivered within the last ninety (90) days prior to the Order Form Effective Date to qualify for this service.

In Scope:

Execution of remediation for configuration changes recommended in the Cloudflare Configuration Assessment Report.
Remediation of up to ten (10) High and/or Medium Priority actions selected and agreed upon during the Technical Discovery phase.
Dedicated Remediation Sessions with a Cloudflare Consultant focused on the execution of the agreed-upon enhancements.
Validation of the successfully implemented changes.

Out of Scope:

New architecture design or security policy design.
Review or documentation of environments not covered in the original Cloudflare Configuration Assessment Report.
Any continuous optimization, remediation, or configuration changes beyond the identified ten (10) agreed-upon targeted items.

For strategic planning, new architecture design, or security policy design, we recommend our Strategic Planning & Design service.
For review, documentation, or assessment activities of additional environments not covered in the original Cloudflare Configuration Assessment Report, we recommend our Health Check service.
For ongoing management, monitoring, and continuous optimization support, we recommend our Resident Consultant service.

Customer Pre-Requisites

Provide a completed Cloudflare Configuration Assessment Report delivered within the last ninety (90) days.
Provide Administrative Read/Write access to relevant accounts and zones.
Appoint a single point of contact with the authority to provide written approval for the targeted remediation actions.

2. Delivery Model & Methodology

This service is delivered in a structured four-phase methodology, typically completed within up to four (4) weeks.

Phase	Key Activities
Phase 1: Technical Discovery	Cloudflare and the Customer review the Configuration Assessment Report to select and document the 10 remediation targets.
Phase 2: Configuration Implementation	The Cloudflare Consultant executes the agreed-upon configuration changes within the Cloudflare dashboard.
Phase 3: Monitoring & Validation	The Cloudflare Consultant monitors traffic logs for a 3–5 day period to verify that changes have not introduced latency or false positives, and makes adjustments as necessary.
Phase 4: Final Review & Handover	The Cloudflare Consultant delivers a Remediation Summary confirming the resolution of the targeted findings. Cloudflare hosts the final project review session.

This service is delivered by a Cloudflare consultant. It does not include project management services.

Duration/Timeline: Cloudflare delivers this service over a commitment period of up to four (4) weeks, scheduling sessions as required to support the successful resolution and validation of all agreed-upon High and/or Medium Priority findings.

3. Deliverables

Key Deliverables:

Deliverable	Description	Acceptance Criteria
Remediation Execution	Technical resolution of 10 targeted High and/or Medium priority findings	The 10 targeted findings are confirmed in an Active State (enabled or enforcement mode), subject to the five (5) business day review and deemed acceptance period defined in Section 5.
Remediation Summary	Document containing final project review summary	Delivery of a formal summary confirming the resolution of the targeted findings, subject to the five (5) business day review and deemed acceptance period defined in Section 5.

4. Customer Responsibilities

Providing Administrative Read/Write access to the relevant Cloudflare account and zones within three (3) business days of the project kickoff.
Providing the primary Cloudflare Configuration Assessment Report (delivered within the last 90 days prior to the Order Form Effective Date) to serve as the baseline for remediation.
Appointing a single point of contact with the authority to review Cloudflare's implementation plan and provide written approval for the ten (10) targeted High and/or Medium Priority findings.
Managing all internal change control processes, maintenance window scheduling, and notifications to internal stakeholders regarding planned configuration changes.
Performing end-to-end testing of the affected applications following remediation actions to validate that security hardening has not adversely impacted legitimate application functionality.
Preparing origin servers and internal networking components for the recommended optimizations.
Ensuring the availability of relevant technical leads for the Phase 1 scoping call and the Phase 4 verification presentation.

5. Delivery Timelines, Acceptance

This service is delivered within a fixed four (4) week allocation window. The assigned Cloudflare consultant is allocated for this duration only. Failure to provide necessary administrative read/write access within three (3) business days may result in a condensed remediation window or premature conclusion of the engagement. If the Customer is unable to provide approvals or execute internal testing within the four-week window, the service will be deemed complete upon delivery of the Remediation Summary based on the changes implemented to date, which will serve as the technical record of the critical security and performance improvements achieved.

Remediation is deemed complete and accepted once the targeted configurations reach their intended Active State. This engagement does not include post-implementation application performance monitoring or long-term efficacy studies. Cloudflare's ability to deliver the defined outcomes is dependent upon the Customer's timely completion of its responsibilities.

Project Holds & Expiration: If Customer dependencies, including but not limited to stakeholder availability for scheduled sessions or administrative read/write access grants, remain outstanding for more than five (5) consecutive business days, Cloudflare reserves the right to place the project on "Hold" status. Resuming a project from "Hold" may require a Change Order and additional fees. Notwithstanding any holds or delays, this engagement expires automatically ninety (90) days from the Order Form Effective Date. Upon expiration, Cloudflare will deliver the Remediation Summary based on the information provided and changes implemented to date. At that time, the project is deemed fully complete, all fees are deemed fully earned, and Cloudflare will have no obligation to provide any additional services or deliverables.

6. Benefits

The Remediation Service provides the Customer with several focused and immediate outcomes:

Rapid Time-to-Security: Quickly address the most critical, High and/or Medium Priority findings from the Cloudflare Configuration Assessment Report.
Tangible Improvement: Achieve immediate, measurable improvements in the security and performance posture of the Cloudflare configuration.
Knowledge Transfer: Learn directly from a Cloudflare consultant during the dedicated Remediation Session, observing the execution and validation of changes.

Optimization - Configuration Assessment

1. Service Definition

Service Name: Optimization Services - Health Check

Service Goal/Objective: The Application Services Health Check is designed to review and validate the Customer's configuration against the latest recommendations for security, performance, and reliability. This service provides a detailed, objective assessment, using over 100 configuration checks to identify deviations from Cloudflare best practices. The result is actionable guidance that helps harden the security perimeter, accelerate application delivery, and support operational excellence. Please note that this service focuses strictly on assessment and documentation; remediation assistance is available as a separate service offering.

In Scope:

The primary output of this service is a Configuration Assessment Report for up to three (3) specified zones. This document serves as a comprehensive technical audit and optimization roadmap, defining:

Configuration Audit: An assessment of the current environment against 100+ best-practice checkpoints, including:
- Security Perimeter & Governance: Validation of WAF Managed Ruleset sensitivity, custom rule efficiency, API Shielding, and SSL/TLS encryption modes, alongside an audit of account-level RBAC and 2FA enforcement.
- Performance & Traffic Reliability: Assessment of CDN caching logic (TTLs, Tiered Cache), Argo Smart Routing, Load Balancing health checks, and origin optimization settings.
Prioritized Remediation Roadmap: A structured action plan that categorizes every identified deviation from best practices by:
- Priority Level: High, Medium, and Low risk classifications to guide immediate resource allocation.
- Technical Rationale: A detailed "why" for each recommendation and a description of the expected impact on security or performance.

The service also includes the following consultative sessions and reviews:

Discovery Session: One (1) 60-minute session to finalize target zones, identify high-priority applications, and confirm read-only access.
Assessment Findings Review: A dedicated technical session to present the report findings and assist the Customer in prioritizing the remediation strategy.
Operational Handover: Delivery of the final report and a 60-minute recorded session to transition the optimization roadmap to the Customer's internal team.

Out of Scope:

Remediation: This service focuses strictly on assessment and documentation; actual remediation of any findings is excluded. Remediation assistance is available as a separate service offering.
Break/fix support, production incident response and ad-hoc troubleshooting are outside the scope of this service.

Any requests beyond the defined scope of this engagement require a formal change order and may result in additional fees.

2. Delivery Model & Methodology

This service is delivered in a structured four-phase methodology, completed within up to 30 days.

Phase	Key Activities
Phase 1: Discovery	Consultant conducts a kickoff call to confirm the engagement scope and review the three (3) target zones identified by the Customer. Customer provides read-only access to the relevant Cloudflare accounts and the three (3) identified target zones. Customer provides context on the current state of the environment and any configuration challenges encountered to date.
Phase 2: Configuration Audit	Consultant conducts Configuration Audit of zones/accounts in scope, identifying areas where configuration does not meet Cloudflare-defined best practices. No live sessions are required during this phase unless clarification of existing infrastructure is needed.
Phase 3: Report Generation	Consultant generates a comprehensive Cloudflare Configuration Assessment Report, including a prioritized remediation action list.
Phase 4: Report Delivery & Review	Consultant delivers final Configuration Assessment Report to Customer. Consultant hosts an Assessment Findings session. Customer's key stakeholders attend the session to discuss findings and remediation strategy.

This service is delivered by a Cloudflare consultant and a Project Coordinator.

Duration/Timeline:

This service is delivered over a fixed active period of thirty (30) days. To ensure timely completion, the Configuration Assessment Report is expected to be delivered within the first twenty-one (21) days, and the Assessment Findings Review session should be scheduled by both parties within seven (7) days of report delivery. The Customer must provide the necessary read-only access within the first five (5) business days to avoid a condensed review window or project holds as defined in Section 5. The Cloudflare consultant is allocated to this engagement exclusively for the duration of this delivery window. All work is performed during standard business hours (9:00 AM to 5:00 PM, Monday through Friday, based on the Customer's local time). After-hours, holiday, or weekend work is explicitly excluded from this engagement.

3. Deliverables

Deliverable	Description	Acceptance Criteria
Configuration Assessment Report	A detailed audit report of up to three (3) zones that categorizes findings into High, Medium, and Low priority based on their impact on security, performance, and reliability. Each finding will include a 'Best Practice' recommendation and a 'Technical Rationale' for the suggested change	Delivery of the report, subject to the five (5) business day review and deemed acceptance period defined in Section 5.
Assessment Findings Review	A 60-minute recorded technical session	Delivery of a single (1) consolidated session covering a review of the prioritized findings. This deliverable is deemed accepted upon the earlier of: (i) completion of the session, or (ii) delivery of a recording of the session (or a recording of the attempted session if the Customer fails to attend the scheduled time or fails to provide the necessary consents required for a live recording).

4. Customer Responsibilities

Providing read-only administrative access to the relevant Cloudflare accounts and the three (3) specified zones.
Providing existing network topology diagrams or documentation upon request.
Ensuring key stakeholders are available for the Assessment Findings Review session.
Identifying three (3) target zones to be reviewed.
Obtaining all necessary consents from its employees, contractors, or other attendees prior to the recording of the Assessment Findings Review session, as required by applicable law.

5. Delivery Timelines, Acceptance

This is an outcome-based, fixed-fee engagement delivered within a thirty (30) day window. Cloudflare's ability to deliver the defined outcomes is dependent upon the Customer's timely completion of its responsibilities.

Project Holds & Expiration: If Customer dependencies, including but not limited to stakeholder availability for scheduled sessions or read-only access grants, remain outstanding for more than five (5) consecutive business days, Cloudflare reserves the right to place the project on "Hold" status. Resuming a project from "Hold" may require a Change Order and additional fees. Notwithstanding any holds or delays, this engagement expires automatically ninety (90) days from the Order Form Effective Date. Upon expiration, Cloudflare will deliver the Configuration Assessment Report based on the information provided to date. At that time, the project is deemed fully complete, all fees are deemed fully earned, and Cloudflare will have no obligation to provide any additional services or deliverables.

6. Benefits

This service provides customers with several key outcomes:

De-Risked Configuration: Designed to help validate that your configuration aligns with Cloudflare's latest security, performance, and reliability recommendations.
Actionable Insights: Receive an objective, detailed assessment identifying specific deviations from best practices.
Prioritized Action: Obtain a prioritized remediation action list as part of the comprehensive Cloudflare Configuration Assessment Report.
Clear Path Forward: Establish a clear strategy for addressing findings via the dedicated Assessment Findings Review session.

Optimization - Layer 3 DDos Prevention Service

1. Service Definition

Service Name: Layer 3 DDoS Prevention Optimization Services

Service Goal/Objective: The Cloudflare Layer 3 DDoS Optimization service is designed to provide customers with the guidance and recommendations needed to help validate that Cloudflare Magic Transit is optimally configured. A trained Professional Services Consultant will review the Customer's Magic Transit deployment and provide recommendations to align the configuration with Cloudflare best practices, aimed at enhancing security, performance, and reliability.

In Scope: This service includes a comprehensive review of the current Magic Transit deployment and its alignment with Cloudflare best practices. If additional sites or prefixes need to be onboarded or offboarded, the consultant will configure up to ten (10) additional contracted prefixes and five (5) additional sites. Cloudflare Network Interconnect (CNI) configuration will be performed as necessary. This engagement also includes planned migration, testing, and expert advisory guidance throughout the onboarding process. Cloudflare will deliver the following key outputs to assist the Customer:

A technical review of Customer's environment and its alignment with Cloudflare Magic Transit best practices.
Verification and validation of Customer infrastructure and sites using Cloudflare Dashboard tools.
An Updated Configuration As-Built Document detailing the validated technical state of the environment, including site inventories, tunnel engineering specifications, and routing logic.
Configuration and deployment of up to ten (10) additional prefixes and five (5) additional sites, as contracted.
Monitoring and adjustment of DDoS protection thresholds strictly during the defined phase window.

Out of Scope

Configuration of Customer routers, firewalls, or other Customer Premises Equipment (CPE).
Configuration of other Cloudflare products (e.g., Zero Trust, Magic WAN, App Services).
Configuration and deployment of additional prefixes or sites that have not been explicitly contracted.
Configuration and deployment of third-party prefixes that the Customer does not have explicit authorization to advertise.

2. Delivery Model & Methodology

This service is delivered in a structured four-phase methodology, completed within up to 30 days, depending on project size and complexity.

Phase	Key Activities
Phase 1: Review & Optimization	Kickoff call to confirm scope and goals. Current Magic Transit deployment assessment. Discussion of any known configuration challenges. Delivery of optimization and best practice guidance.
Phase 2: Additional Prefix or Site Onboarding (if necessary)	Execution of additional site deployments (up to 2 deployment waves max). Additional site configuration and set up. Preflight checks and verification. Deployment go-live and monitoring session. Post go-live review and adjustments. Additional site onboarding closeout.
Phase 3: Monitoring & Validation	Review of the current environment under load. Adjustment of current DDoS protection thresholds, if necessary. Acceptance of the current state.
Phase 4: Optimization Review Presentation & Closeout	Presentation of the final Updated Configuration As-Built Document to the Customer during the closeout meeting. Final project closeout meeting.

Included Resources: Network Services Consultant.

Duration/Timeline: This service will be delivered within a 30-day timeframe.

3. Deliverables

Deliverable	Description	Acceptance Criteria
Updated Configuration As-Built Document	A comprehensive technical record detailing the configured technical state of the deployed environment. This document includes final prefix and site inventories, tunnel details, ATP and ADP thresholds, and Cloudflare Firewall settings as implemented in the final state.	Delivery of the document, subject to the five (5) business day review and deemed acceptance period defined in Section 5.
Knowledge Transfer	A 1-hour recorded technical session.	Delivery of a single (1) consolidated session covering dashboard management of the configured prefixes, sites, tunnels, and protection thresholds. This deliverable is deemed accepted upon the earlier of: (i) completion of the session, or (ii) delivery of a recording of the session (or a recording of the attempted session if the Customer fails to attend the scheduled time or fails to provide the necessary consents required for a live recording).

4. Customer Responsibilities

Providing a minimum of five (5) business days' notice in advance of any desired go-live or network change event. The parties acknowledge that enterprise network changes frequently require off-hours or weekend support. Such support is included within the scope of this service, provided it is scheduled and mutually agreed upon in advance.
Appointing a primary technical point of contact to participate in the kickoff call, review configuration choices, and attend the final enablement session.
Providing the Cloudflare team with a technical point of contact to attend configuration meetings and make necessary adjustments to CPE as required for the establishment of connectivity back to Cloudflare's network.
Providing the Cloudflare team with a technical point of contact who understands which applications and other resources must be explicitly permitted or otherwise excluded from being sent via Cloudflare Magic Transit tunnels.
Managing all internal firewalls, routers, networking, and associated equipment.
Providing administrative access to the Cloudflare dashboard at project kickoff and delivering timely written approval to begin establishing tunnel connectivity and routing Customer traffic through Cloudflare's network.
Managing internal change requests and associated documentation, and communicating change window requests to the Cloudflare team.
Preparing any documentation required for internal acceptance into service.
Performing internal project management.
Providing service testers for critical applications during site and routing cutover change windows.
Configuring any requirements outside the baseline setup, including Role-Based Access Control (RBAC), SSO integration, and custom data logging/retention.
Validating the accuracy and completeness of the technical details (including all required sites, routes, and tunnels) established in the mutually agreed upon technical onboarding documentation prior to the start of delivery. Any material changes to this pre-defined scope after this point may require a Change Order and applicable supplemental fees.
Ensuring the availability of key stakeholders (including but not limited to Security, Networking, and Infrastructure leads) for all scheduled workshops and sessions.
Coordinating all sessions through the assigned Cloudflare technical resource, with the understanding that Cloudflare is only obligated to conduct one (1) primary instance of each scheduled session and will not provide duplicate or 'catch-up' sessions for absent stakeholders.
Obtaining all necessary consents from its employees, contractors, or other attendees prior to the recording of the Knowledge Transfer session, as required by applicable law.

5. Delivery Timelines, Acceptance

This is an outcome-based, fixed-fee engagement delivered within a 30-day window. Cloudflare's ability to deliver the defined outcomes is dependent upon the Customer's timely completion of its responsibilities.

Project Holds & Expiration: If Customer dependencies, including but not limited to stakeholder availability for scheduled sessions, remain outstanding for more than ten (10) consecutive business days, Cloudflare reserves the right to place the project on "Hold" status. Resuming a project from "Hold" may require a Change Order and additional fees. Notwithstanding any holds or delays, this engagement expires automatically 90 days from the Order Form Effective Date. Upon expiration, Cloudflare will deliver a Configuration As-Built Document based on the information provided to date. At that time, the project is deemed fully complete, all fees are deemed fully earned, and Cloudflare will have no obligation to provide any additional services or deliverables.

6. Benefits

This service is designed to help customers achieve several key outcomes:

World-Class L3 DDoS Prevention & Mitigation: Cloudflare Magic Transit is designed to help protect Customer corporate networks using one of the largest DDoS mitigation networks in the world. This service provides recommendations intended to align Customer configurations with Cloudflare's latest security, performance, and reliability best practices.
Phased deployment approach: The onboarding of any additional sites and prefixes is structured in a programmatic way intended to minimize potential disruption to Customer environments.
Training & Enablement: Training and enablement sessions on the Cloudflare Magic Transit platform are provided to help familiarize Customer teams with platform operations and best practices.
Accelerated Time to Value: Engaging with Cloudflare Professional Services is designed to accelerate time to value by assisting the Customer in efficiently configuring their Magic Transit deployment.
Operational Readiness: Collaborative configuration reviews and expert-led knowledge transfer provide opportunities for internal teams to build direct experience and platform familiarity.

Optimization - Network Connectivity Service

1. Service Definition

Service Name: Network Connectivity Optimization Services - Advisory

Service Goal/Objective: The Cloudflare Network Optimization service is designed to provide Customer with the guidance and recommendations needed to help the organization securely provide high performing inter-site connectivity using Cloudflare WAN. The Customer's Cloudflare WAN deployment will be reviewed by a trained Professional Services Consultant and recommendations will be given to align the Customer's deployment to best practices, resulting in enhanced security, performance, and reliability.

In Scope: This service includes a comprehensive review of the current Cloudflare WAN deployment, including the Cloudflare WAN Appliance if applicable, and its alignment to Cloudflare best practices. If additional sites or prefixes need to be onboarded, advisory guidance will be provided to assist with the onboarding of up to ten (10) additional sites. This engagement also includes planned migration, testing, and expert advisory guidance throughout the onboarding and implementation process. The Customer is delivered key outputs necessary for sustained success:

Technical discovery of Customer environment and alignment to Cloudflare WAN requirements.
Verification and validation of current and new (up to 10) sites.
Cloudflare Network Firewall Rules review and configuration.
Configuration of Cloudflare Network Interconnect (CNI) as necessary.
Configuration of Cloudflare WAN Appliance as necessary.
Advisory guidance for the execution of additional site activations (as contracted), strictly adhering to the fixed Sprint Schedule (defined in the Delivery & Methodology section), where unready sites are automatically deferred to the final remediation wave.
Advisory support during Customer Go-Live and Deployment.
Monitoring and Steady State Review.

Out of Scope

Configuration of Customer routers, firewalls, or other CPE.
Hands-On Keyboard work.
Configuration of other Cloudflare products (e.g., Zero Trust, Magic Transit, App Services).
Configuration and deployment of additional sites or connectors that have not been explicitly contracted.

2. Delivery Model & Methodology

This service is delivered in a structured four-phase methodology, typically completed within up to 30 days, depending on the project size and complexity.

Phase	Key Activities
Phase 1: Review & Optimization	Kickoff call to confirm scope and goals. Current Cloudflare WAN deployment assessment. Discussion of any known configuration challenges. Delivery of optimization and best practice guidance.
Phase 2: Additional Site Onboarding (as necessary)	Determination of number of required sprints. Additional site deployment sprint. Additional site configuration and set up. Preflight checks and verification. Deployment go-live and monitoring session. Post go-live review and adjustments. Additional site onboarding close out.
Phase 3: Monitoring & Optimization	Review of current environment. Adjustment and review. Acceptance of current state.
Phase 4: Architecture Review Presentation & Closeout	Presentation of the final Updated Configuration As-Built Document to Customer in a closeout meeting. Discussion of findings and next steps for remediation strategy. Final project closeout meeting.

Included Resources: Network Services Consultant.

Duration/Timeline: This service will be delivered within a 30-day timeframe.

3. Deliverables

Deliverable	Description	Acceptance Criteria
Updated Configuration As-Built Document	An updated comprehensive technical record detailing the validated technical state of the deployed environment. This document includes final site inventories, Cloudflare WAN Connector hardware specifications (if applicable), tunnel details, and routing tables as implemented in the final state.	Delivery of the document, subject to the five (5) business day review and deemed acceptance period defined in Section 5.
Knowledge Transfer	1 hour recorded technical session	Delivery of a single (1) consolidated session covering dashboard management of the configured sites, routes, and tunnels. This deliverable is deemed accepted upon the earlier of: (i) completion of the session, or (ii) delivery of a recording of the session (or a recording of the attempted session if the Customer fails to attend the scheduled time or fails to provide the necessary consents required for a live recording).

4. Customer Responsibilities

Providing a minimum of five (5) business days' notice in advance of any desired go-live or network change event. The parties acknowledge that enterprise network changes frequently require off-hours or weekend support. Such support is included within the scope of this service, provided it is scheduled and mutually agreed upon in advance.
Appointing a primary technical point of contact to participate in the kickoff call, review configuration choices, and attend the final enablement session.
Providing the Cloudflare team with a technical point of contact to attend configuration meetings and make necessary adjustments to CPE as required for the establishment of connectivity back to Cloudflare's network.
Providing the Cloudflare team with a technical point of contact who understands which applications and other resources must be explicitly permitted or otherwise excluded from being sent via Cloudflare WAN tunnels.
Managing all internal firewalls, routers, networking, and associated equipment.
Providing administrative access to the Cloudflare dashboard at project kickoff and delivering timely written approval to begin establishing tunnel connectivity and routing Customer traffic through Cloudflare's network.
Managing internal change requests and associated documentation, and communicating the change window requests to the Cloudflare team.
Preparing any documentation required for internal acceptance into service.
Performing internal Project Management.
Providing service testers for critical applications during site and routing cutover change windows.
Configuring any requirements outside the baseline setup, including Role-Based Access Control (RBAC), SSO integration, and custom data logging/retention, or custom Workers.
Developing any Workers scripts to achieve requirements.
Validating the accuracy and completeness of the technical details (including all required sites, routes, and tunnels) established in the mutually agreed upon technical onboarding documentation prior to the start of delivery of services. Any material changes to this pre-defined scope after this point may require a Change Order and applicable supplemental fees.
Ensuring the availability of key stakeholders (including but not limited to Security, Networking, and Infrastructure leads) for all scheduled workshops and sessions.
Coordinating all sessions through the assigned Cloudflare technical resource, with the understanding that Cloudflare is only obligated to conduct one (1) primary instance of each scheduled session and will not provide duplicate or 'catch-up' sessions for absent stakeholders.
Obtaining all necessary consents from its employees, contractors, or other attendees prior to the recording of the Knowledge Transfer session, as required by applicable law.

5. Delivery Timelines, Acceptance

This is an outcome-based, fixed-fee advisory-only engagement delivered within a 30-day window. Cloudflare's ability to deliver the defined outcomes is dependent upon the Customer's timely completion of its responsibilities.

Project Holds & Expiration: If Customer dependencies, including but not limited to stakeholder availability for scheduled sessions, remain outstanding for more than ten (10) consecutive business days, Cloudflare reserves the right to place the project on "Hold" status. Resuming a project from "Hold" may require a Change Order and additional fees. Notwithstanding any holds or delays, this engagement expires automatically 120 days from the Order Form Effective Date. Upon expiration, Cloudflare will deliver a Configuration As-Built Document based on the information provided to date. At that time, the project is deemed fully complete, all fees are deemed fully earned, and Cloudflare will have no obligation to provide any additional services or deliverables.

6. Benefits

This service provides customers with several key outcomes:

Secure & Performant Connectivity & Routing: Help reduce vendor confusion and lock-in while gaining secure, reliable connectivity across all sites.
Phased deployment approach: Onboarding of sites, tunnels, and IP space is done in a programmatic way to help minimize disruption to Customer environments.
Training & Enablement: Detailed training and enablement on Cloudflare WAN and CF1 platform to equip Customer teams with knowledge of best practices.
Accelerated Time to Value: Engaging with Cloudflare Professional Services helps ensure that the investment in Cloudflare WAN provides the secure and performant connectivity that the Customer requires.
Operational Readiness: Internal teams gain direct experience and platform familiarity through collaborative configuration review and expert-led knowledge transfer.

Optimization Services - SASE Architecture & Configuration Optimization

1. Service Definition

Service Name: SASE Architecture & Configuration Optimization

Service Goal/Objective: The SASE Architecture & Configuration Optimization service is designed to validate that Customer's Cloudflare One Platform is deployed and operating at peak efficiency, security, and performance. The objective of this service is to review the Customer's SASE architecture, identify misconfigurations or issues, and provide actionable documentation with recommendations and best practices.

In Scope:

A 2-hour conversation with the Customer's stakeholders to discuss ongoing challenges and recurring issues.
Review of the Customer's existing network diagrams and architecture documentation.
Detailed review of the existing Cloudflare One account configuration. If the Customer has more than one account, only one will be in scope.
A Cloudflare SASE Architecture Review Report containing a write-up of Cloudflare's analysis.
Review of the 10 most relevant ZTNA/SWG Policies. The list of relevant policies must be defined by the Customer.
A 1-hour Architecture Review session to present Cloudflare's findings and recommendations.

Out of Scope:

Review of third-party configurations like Intune, Okta, AzureAD, etc.
Execution of the Remediation Plan or any "hands-on-keyboard" configuration changes within the Customer's Cloudflare Dashboard or third-party environments.
Review of more than one (1) Cloudflare One account or more than ten (10) ZTNA/SWG policies.

2. Delivery Model & Methodology

This service is delivered in a structured four-phase methodology, completed within up to 60 days, by a Cloudflare consultant and does not include project management services.

Phase	Key Activities
Phase 1: Technical Discovery	Kickoff call with the Customer. Identification of main Customer objectives and use cases. Discussion of Zero Trust onboarding challenges.
Phase 2: Configuration Review	Conduct Configuration Review of the Cloudflare One Account. Gap Analysis to identify configuration misalignments with Cloudflare Best Practices. Documentation of the Configuration Review and Gap Analysis.
Phase 3: Assessment Report and Remediation Recommendations	Generate a comprehensive Cloudflare SASE Architecture Review Report including: Current State Target State Remediation Recommendations The report will include remediation recommendations that categorize every identified deviation from best practice by: Priority Level: High, Medium, and Low risk classifications to guide immediate resource allocation. Technical Rationale: A detailed "why" for each recommendation and a description of the expected impact on security or performance.
Phase 4: Architecture Review Presentation	Presentation of the final Configuration Assessment Report to the Customer in a 1-hour workshop. Discussion of findings and remediation strategy.

Duration/Timeline: Up to 60 days in total, including Architecture Review and Remediation Recommendations. This timeline is strictly dependent upon the Customer's timely provision of all required inputs and access. Delays by the Customer may result in an extended timeline or pause in delivery.

The Cloudflare SASE Architecture Review Report is expected to be delivered within forty-two (42) days following the completion of Phase 1 (Technical Discovery) and the Customer's provision of all required inputs.
The Architecture Review Presentation session should then be scheduled by both parties within fourteen (14) days after the report delivery.

3. Deliverables

Cloudflare Deliverables:

Deliverable	Description	Acceptance Criteria
SASE Architecture Review Report	A detailed Architecture & Configuration Assessment report for one Cloudflare Account. The Cloudflare SASE Architecture Review Report includes up to one (1) round of minor revisions or clarifications, provided the Customer submits all feedback within five (5) business days of the initial draft delivery. Any requests for revisions beyond this scope will require a formal Change Order.	Delivery of a document categorizing findings with High, Medium, Low priorities and associated best practice recommendations, subject to the five (5) business day review and deemed acceptance period defined in Section 5.
SASE Architecture Review Presentation	A 60-minute recorded presentation session	Delivery of the single (1) consolidated 60-minute session covering a review of the prioritized findings. This deliverable is deemed accepted upon the earlier of: (i) completion of the session, or (ii) delivery of a recording of the session (or a recording of the attempted session if the Customer fails to attend the scheduled time or fails to provide the necessary consents required for a live recording).

4. Customer Responsibilities

Client Inputs Required:

Providing a minimum of five (5) business days' notice in advance of any desired scheduled session where Cloudflare participation is required.
Interviews with the Customer's stakeholders that own the Cloudflare One platform.
Network Diagrams showing traffic flows.
Read-only access to the Cloudflare One Account is provided by the Customer.
Provide all requested documentation, access, and stakeholder availability within five (5) business days of Cloudflare's request to facilitate adherence to the delivery timeline.
Customer shall ensure the availability of key stakeholders (including but not limited to Security, Networking, and Infrastructure leads) for all scheduled workshops and sessions. All sessions must be coordinated through the assigned Cloudflare technical resource. Cloudflare's obligation is limited to conducting one (1) primary instance of each scheduled session; Cloudflare is not obligated to provide duplicate or 'catch-up' sessions for absent stakeholders.
Obtaining all necessary consents from its employees, contractors, or other attendees prior to the recording of the SASE Architecture Review Presentation, as required by applicable law.

5. Delivery Timelines, Acceptance

This is a fixed-fee engagement delivered within a 56-day window. Cloudflare's ability to deliver the defined outcomes is dependent upon the Customer's timely completion of its responsibilities.

Project Holds & Expiration: If Customer dependencies, including but not limited to stakeholder availability for scheduled sessions, remain outstanding for more than ten (10) consecutive business days, Cloudflare reserves the right to place the project on "Hold". Resuming a project from "Hold" may require a Change Order and additional fees. Notwithstanding any holds or delays, the services expire eighty-six (86) days from the Order Form Effective Date. Upon expiration, Cloudflare will deliver the SASE Architecture Review Report based on the information provided to date. At that time, the project is deemed completed, all fees are deemed fully earned, and Cloudflare will have no obligation to provide any additional services or deliverables.

6. Benefits

This service provides customers with several key outcomes:

De-Risked Configuration: Gain confidence that your configuration aligns with Cloudflare's latest security, performance, and reliability recommendations.
Actionable Insights: Receive an objective, detailed assessment identifying specific deviations from best practices.
Prioritized Action: Obtain a prioritized remediation action list within the comprehensive Cloudflare SASE Architecture Review Report.
Clear Path Forward: Establish a clear strategy for addressing findings via the dedicated Assessment Findings Review session, with a mature Zero Trust roadmap in alignment with industry standards.
Operational Readiness: Internal teams gain deep platform knowledge and architectural insights by reviewing Cloudflare's expert findings and remediation strategy.

Overview

Forward Deployed Engineer

A Forward Deployed Engineer (“FDE”) provides services including the following items: Solution Architecture & Design, Quarterly Proactive (On-Site) Workshops & Training, Product Demos & Prototyping, Special Event / On-boarding assistance, Best-Practice Assessments. Detailed descriptions of these Deliverables are available upon Customer request.

Coverage: Typical Business Hours (9am-5pm local time, local as defined at time of sale), with exception of pre-agreed out-of-hours coverage.

Hours draw down: Cloudflare will track hours for each activity. Unused hours will expire at the end of the term for the FDE services.

Onsite Assistance: FDEs will comply with Customer policies that apply to working at Customer’s office provided that such policies are provided in advance in writing or are clearly posted at the onsite location.

FDE Activities

Activities	Description
Solution & Architectural Design	By involving product specialists from different product areas, FDEs provide solutions and associated integration architectures tailored to achieve customer's business goals. A solution design outlining the architecture, required Cloudflare configuration, and implementation guidance of the proposed solution will be provided.
Proactive (On-Site) Workshops	On-Site engagements include - but are not limited to - technical Workshops around customer's purchased Cloudflare products. FDE workshops are designed for customer's technical and business stakeholders and shall enable customers to operate their Cloudflare environment in an informed and self-sufficient way.
Product Demos & Prototype Development	FDEs conduct Product Demos and - depending on the proposed solution - may provide Prototype implementations (Developer Platform) which help customers understand some of the more complex product areas of Cloudflare by referring to real-world examples. This may include Workers or Pages prototypes, Magic WAN or WARP / Zero Trust network topologies.
Special Event Preparation	Oftentimes customers on-board to Cloudflare prior to or in preparation for special events (e.g. Black Friday, new product releases, anticipated DDoS events ...). Customers require extra hand-holding during those events. FDEs provide special event assistance by being part of a customer's "war-room" and monitoring the implementation's health from a Cloudflare POV in order to provide immediate support. (Note: FDEs will partner with TAMs where assigned, but will drive design and architecture review, while the TAM will be focused on mitigating any issues.)
Best-Practice Assessments	Evaluation session to assess Customer's current implementation with Cloudflare-defined standards and proven methodologies. Identification of gaps between current state and optimal configuration. Actionable recommendations and potential risks when not implementing them - tailored to their current state - will be shared with customers.

Comparison Designated FDE & Dedicated FDE

	Designated FDE	Dedicated FDE
Customer Alignment	FDE shared between multiple (up to 2) customers	100% dedicated for 1 customer
Utilization caps	900 Hours per twelve (12) month term, including preparation meeting engagements and documentations (tracked with PSA tool: Cloud Coach)	1,800 Hours per twelve (12) month term, including preparation meeting engagements and documentations (tracked with PSA tool: Cloud Coach)
Coverage	Typical Business Hours (9am-5pm local time as defined at time of sale), with exception of pre-agreed out-of-hours coverage	Typical Business Hours (9am-5pm local time as defined at time of sale), with exception of pre-agreed out-of-hours coverage
Regular engagements / cadence	Bi-Weekly regular engagements (Health-Checks, Product Updates, ...)	Weekly regular engagements
On-site assistance	Up to 2 days a week with the number of days and the primary on-site location to be agreed between customer and Cloudflare at time of order. The cost of travel to / from the primary site is included in this offer.	Up to 5 days a week with the number of days and the primary on-site location to be agreed between customer and Cloudflare at time of order. The cost of travel to / from the primary site is included in this offer.

In Scope & Out of Scope

In Scope	Out of Scope
Strategic architecture and design guidance, expert consultation for evolving requirements	Deployment services for new Cloudflare features, products
Services to prototype new Cloudflare features or products	Maintenance of newly built / existing solutions
Long term solution planning aimed at minimising risk and maximising operational efficiency	Customer Trainings & QBRs
Resolution guidance on complex, high-impact issues, without handling troubleshooting customer Cloud / on-prem environments	Off Hours/Weekend Support
Driving initiatives to improve architecture by integrating new products	Runbook Ownerships
Comprehensive understanding of customer environment to support informed configuration changes	Escalation Management & Root Cause Analysis Coordination
Periodic debriefs to provide insights, track progress and align on key objectives	Daily or weekly progress reports
Continuous Best-Practice Assessments and performance optimization	Migration project work
	Proactive Alerting on Maintenance Schedules