Writing an SD-WAN RFP: the clauses Indian banks use

The RBI's Cybersecurity Directions of 31 July 2026 ask banks to review interconnections, use strong non-deprecated cryptography and report incidents on DAKSH within 6 hours of detection (see our summary of the 2026 Directions). CERT-In's 2022 Directions require ICT logs to be kept for 180 days within India (CERT-In). Five-year contracts explain the lifecycle and penalty clauses.

The four tenders below are public, recent and specific:

• J&K Bank, e-RFP JKB/CHQ/T&D/SD-WAN/2025-1489, 7 August 2025: supply, implementation and managed services of SD-WAN for 1,750+ branches and offices, switches and a NOC, on a 5-year OPEX model (PDF).
• Punjab National Bank, RFQ TCIL/DC&CS/PNB/SDWAN/RFQ, 18 September 2025, issued by TCIL for end-to-end SD-WAN implementation (PDF).
• Karnataka Gramin Bank and Kerala Gramin Bank, RFP KaGB/Project Office/RFP/01/2024-25, 27 May 2024: SD-WAN with NMS, NCCM, log management and NetFlow (PDF).
• ECGC Limited, RFP ECGC/Tender-06/IT/09/2024-25, 6 September 2024 (PDF).

• Topologies from day one. ECGC asks for hub-and-spoke, partial mesh and full mesh "from day 1", with the company choosing which to deploy. J&K Bank asks for both dynamic and static tunnels between branches and hubs.
• Encryption per site. J&K Bank requires dynamic IPsec tunnels using a DH group that "generate unique key for each site", support for both IPsec and GRE, SHA-512, SHA-384 and SHA-256 for integrity, and AES-256 and AES-GCM for transport.
• IPv6. J&K Bank asks for dual-stack IPv4 and IPv6 "on underlay and overlay". ECGC asks for the whole solution to be "IPv6 logo certified from day 1".
• Failover quality. J&K Bank asks the solution to reorder packets retransmitted during a failover. ECGC asks for traffic to load-balance across links even when the primary is not congested.
• Future SASE. J&K Bank requires the solution to be "SASE Ready" during the contract "without any change in CPE Hardware or licensing".

List your own transports explicitly (MPLS, ILL, broadband, 4G/5G, VSAT); J&K Bank, for example, still has remote branches on VSAT only.

This is where Indian bank RFPs differ most from global templates. Both J&K Bank and ECGC require every SD-WAN component to be on-premises, with no bank data going to the OEM's cloud "for any reason". J&K Bank also requires the controller to run in high availability "from day one" in both the primary DC and the DR site.

If you accept a hosted controller, state where it must run and who operates it.

J&K Bank's clauses are a good template:

• Control-plane and analytics logs retained "for 180 days", then archived to the bank's storage.
• The monitoring dashboard keeps 180 days of history, and ISP link quality history for at least 180 days.
• Backups of logs, reports and utilisation data kept for at least 7 years.
• Integration with the bank's NTP, SIEM and log management tools.

KGB adds device-management hygiene: SNMPv3 with AES-128 or AES-256 and SHA-2 or higher, SSH or HTTPS with TLS 1.2 or 1.3, and at least five AAA servers (RADIUS, TACACS+) with fallback.

J&K Bank closes a common gap: the SD-WAN licence "must be equivalent to the committed throughput of the Box from Day one". If the box supports 100 Mbps, the licence must be 100 Mbps from day one. It also says licences must not restrict the number of users, sessions, applications or WAN links. Add a clause that prices stay fixed for the contract term, as J&K Bank does for 5 years, and ask for licences registered in the bank's name, as PNB does.

J&K Bank asks the bidder to certify that products "shall not go end of support / End of Life for at least 7 years from the date of delivery", and to replace any product declared out of support with the same or a higher model at no cost. ECGC and PNB have similar replace-at-no-cost clauses, and PNB bars refurbished or reused hardware. Ask the OEM, not only the bidder, to sign the lifecycle undertaking.

PNB also sets RMA times by location: 4 hours in metro and urban areas, 6 hours semi-urban and 8 hours rural. Define how uptime is measured (PNB uses minutes in the month minus impacted minutes) and which outages are excluded, such as bank-side or carrier faults.

J&K Bank's eligibility clauses show what large banks expect:

• The bidder has supplied and implemented SD-WAN for at least 1,000 sites for a BFSI, government or PSU client in India within 7 years.
• The proposed SD-WAN solution runs in at least 1,000 sites in BFSI, government or PSU in the past 5 years.
• NOC services for a client with at least 1,000 branches or offices.
• Primary and secondary NOCs operating in India for at least 2 years, with ISO 27001 and ISO 9001 or TL 9000.
• An OEM authorisation, with OEM and partner not both bidding.

Technical scoring then awards more marks for more scheduled commercial bank references. Smaller banks can lower the thresholds but should keep comparable-scale Indian references with completion certificates.

KGB's RFP applies purchase preference for local suppliers under the Public Procurement (Make in India) order: a Class-I local supplier needs at least 50% local content, a Class-II local supplier at least 20%, and the purchase-preference margin is 20%. Above Rs 10 crore, the local-content percentage must be certified by a statutory or cost auditor or a practising accountant. Public-sector banks should include this section; ask bidders to state the local-content percentage and where value is added. See our explainer on Class-I local suppliers and PPP-MII.

To score bidders against these clauses side by side, use the SD-WAN and SASE vendor scorecard.

On quantum readiness: none of the four tenders asks for it yet. India's quantum-safe roadmap from DST expects buyers to request vendor CBOMs from FY 2026-27. Our post-quantum guide explains the milestones.

Nexapp is an Indian OEM whose SD-WAN Enterprise controller runs on-premises in your DC and DR with controller HA and DC–DR replication, or Nexapp-hosted in India. It supports hub-and-spoke, full-mesh (ADVPN) and site-to-site topologies; AES-256-GCM, AES-128-GCM or ChaCha20-Poly1305; hybrid ML-KEM key exchange with ML-DSA authentication; TACACS+ and RADIUS; configurable log retention with syslog export; and a multi-tenant REST API. Nexapp moved 2,500 ATM sites from VSAT to dual-LTE with day-1 zero-touch provisioning.

Some clauses need a written answer per tender rather than a web page: licence schedule, end-of-life commitment, uptime SLA bands and local-content percentage. Ask us for them in your RFP's format. Nexapp is a Class-I local supplier and supports bid teams with spec sheets, compliance statements and the local-content certificate for each tender; see Partners, the Trust page for certifications, and our BFSI and Government and PSU pages.

J&K Bank e-RFP (7 Aug 2025); PNB RFQ via TCIL (18 Sep 2025); Karnataka Gramin Bank and Kerala Gramin Bank RFP (27 May 2024); ECGC RFP (6 Sep 2024); SBI 4G LTE off-site ATM RFP (2022, via our ATM playbook); CERT-In Directions (28 April 2022); RBI Directions (31 July 2026).