Standardizing Security: MEF’s Framework for SASE and Zero Trust

The enterprise networking landscape has undergone significant transformation in recent years, driven by the shift toward cloud-based infrastructure, remote work adoption, and evolving security threats. Amid this rapid evolution, the market for Secure Access Service Edge (SASE) solutions has experienced explosive growth, yet this expansion has come with substantial challenges. Vendors across the industry have introduced diverse offerings with inconsistent terminology, making it increasingly difficult for organizations to compare solutions, understand capabilities, and make informed procurement decisions. Recognizing these market inefficiencies, the MEF (Metro Ethernet Forum) has introduced standardized frameworks designed to bring clarity, consistency, and interoperability to the enterprise security ecosystem.

Understanding the Market Fragmentation Challenge

The SASE market represents one of the most dynamic segments within cybersecurity infrastructure today. Industry analysts project significant growth trajectories, with market valuations expected to reach substantial figures in the coming years. However, this rapid expansion has created an environment where vendor definitions, service attributes, and architectural approaches vary considerably. Organizations attempting to evaluate SASE solutions face a bewildering array of options, each marketed with unique terminology and feature sets that may or may not align with their specific security requirements.

This fragmentation stems from several interconnected factors. First, the SASE concept itself is relatively recent, having emerged as organizations grappled with securing distributed workforces and cloud-native applications. Second, the diverse backgrounds of vendors entering this space—from traditional network equipment manufacturers to cloud-native security firms—has resulted in different architectural philosophies and implementation approaches. Third, the absence of universally accepted definitions for core SASE components has allowed vendors considerable flexibility in how they position and package their offerings.

The consequences of this fragmentation are tangible and significant. Enterprise procurement teams struggle to establish meaningful comparisons between competing solutions. Technical teams find it difficult to communicate requirements using consistent terminology. Integration challenges arise when attempting to select complementary solutions from different vendors. Perhaps most critically, organizations may inadvertently select solutions that appear to meet their needs but actually provide incomplete coverage, leaving security gaps that could be exploited by determined attackers.

The MEF Standardization Initiative: Establishing Common Ground

In response to these market challenges, the MEF has undertaken a comprehensive standardization effort to establish clear definitions, consistent terminology, and unified architectural frameworks for SASE and zero-trust implementations. This initiative represents a significant undertaking, as it requires consensus among diverse stakeholders including vendors, service providers, and enterprise customers. The MEF, as an industry consortium with established credibility in network standards, positioned itself as an appropriate body to facilitate this consensus-building process.

The standardization initiative has produced two complementary standards that work together to address different aspects of the enterprise security landscape. These standards represent the culmination of extensive industry collaboration and technical analysis, incorporating input from multiple stakeholders to ensure practical relevance and broad applicability.

MEF 117: Defining SASE Architecture and Attributes

MEF 117 establishes the foundational framework for SASE services, providing clear definitions and standardized terminology that enable consistent communication throughout the industry. This standard addresses a critical gap by defining what constitutes a SASE service, moving beyond marketing language to technical specifications that have practical implications for implementation and evaluation.

The standard encompasses several key dimensions:

• Service Definition: MEF 117 provides a precise definition of SASE, clarifying what components and capabilities must be present for a solution to legitimately claim SASE functionality. This definition helps distinguish genuine SASE implementations from solutions that may incorporate some relevant capabilities without providing complete SASE functionality.
• Terminology Standardization: The standard establishes consistent terminology for critical SASE components and concepts. Terms such as SASE Agent, Identity and Access Management, SASE Edge, and Network Termination Point are defined with precision, ensuring that when industry participants discuss these elements, they reference the same concepts and capabilities.
• Service Attributes: MEF 117 delineates the key attributes that should characterize SASE services, including security functions such as threat protection and data loss prevention, connectivity options for accessing services, and policy frameworks for managing access and behavior. These attributes provide a structured way to evaluate and compare offerings from different vendors.
• Subscriber Expectations: The standard clarifies what enterprises should expect when engaging with SASE service providers, establishing baseline expectations for service levels, capabilities, and operational characteristics.

MEF 118: Establishing Zero-Trust Principles and Requirements

Concurrent with the SASE standardization effort, the MEF released MEF 118, which establishes a comprehensive framework for zero-trust security architectures. Zero-trust represents a fundamental shift in security philosophy, abandoning traditional perimeter-based approaches in favor of continuous verification and conditional access based on comprehensive context analysis.

MEF 118 addresses the growing recognition that traditional network security models have become inadequate in contemporary threat environments. The standard provides:

• Conceptual Framework: A clear articulation of zero-trust principles and their implications for network architecture, security policy, and access control mechanisms.
• Identity and Authentication Requirements: Specifications for how different actors within a network should be identified and authenticated, moving beyond simple username-password combinations to encompass modern authentication mechanisms and multi-factor approaches.
• Policy-Based Access Control: Mechanisms for enforcing policy-based access decisions at appropriate enforcement points throughout the network, ensuring that access decisions reflect current context, threat intelligence, and organizational policies.
• Service Attributes: Clear definitions of the characteristics and capabilities that should define zero-trust implementations, enabling organizations to evaluate solutions based on standardized criteria.

The Interconnected Nature of SASE and Zero-Trust Standards

While MEF 117 and MEF 118 address different aspects of enterprise security architecture, they are fundamentally interconnected. SASE implementations increasingly incorporate zero-trust principles, and zero-trust frameworks inherently require the types of edge-based security and access control that SASE architectures provide. The MEF standards recognize this complementary relationship, positioning SASE and zero-trust as mutually reinforcing approaches to modern enterprise security.

This integration reflects the evolution of security thinking within the industry. Organizations that have adopted SASE solutions are discovering that implementing genuine zero-trust principles requires careful attention to policy frameworks, identity verification, and access control mechanisms. Conversely, organizations implementing zero-trust architectures are finding that SASE provides an effective delivery mechanism for zero-trust principles across distributed environments.

Industry Response and Market Implications

The introduction of MEF standards has generated substantial positive response from multiple stakeholder communities. Security researchers and industry analysts have acknowledged that standardization represents a necessary step toward market maturation. Vendors have begun aligning their offerings with the standards, recognizing that standardization provides frameworks within which they can differentiate through superior implementation, additional capabilities, or enhanced service delivery.

Enterprise customers have expressed appreciation for the standardization effort, recognizing that clear definitions and consistent terminology reduce procurement complexity and decision-making timelines. Organizations can now develop evaluation criteria based on standardized attributes rather than attempting to parse vendor marketing materials written in inconsistent terminology.

The standards also enable more effective multi-vendor SASE implementations, where organizations can select best-of-breed solutions from different vendors with greater confidence that components will interoperate effectively. This capability addresses a significant challenge in contemporary enterprise environments, where organizations rarely limit themselves to single-vendor solutions.

Addressing Ongoing Market Challenges

While standardization represents substantial progress, several challenges remain as the market continues to evolve. Customer education regarding SASE capabilities, architectural options, and implementation approaches remains incomplete. Many organizations lack sufficient technical understanding to effectively evaluate SASE solutions against their specific requirements. Additionally, as threat landscapes continue to evolve and new security challenges emerge, standards require ongoing updates to remain relevant and practical.

The certification programs that have emerged alongside standardization efforts represent important steps toward validating vendor compliance with standards and ensuring that marketed capabilities align with actual implementations. These certification initiatives add another layer of assurance for enterprise customers making significant technology investments.

Looking Forward: The Evolution of Standardized Security

The MEF standardization effort represents a maturing phase in the enterprise security market. As markets move from rapid innovation phases to consolidation phases, standardization becomes increasingly important as a mechanism for enabling effective competition, facilitating interoperability, and allowing customers to make informed decisions.

The standards established by the MEF will likely evolve as the market matures and new security challenges emerge. Organizations adopting SASE and zero-trust architectures should view these standards not as static requirements but as foundation frameworks that will be refined and extended over time. The standardization process itself has created mechanisms for ongoing industry collaboration that will facilitate continuous improvement of these frameworks.

For enterprise organizations, the availability of these standards provides significant practical benefits. Procurement processes can be simplified by using standardized evaluation criteria. Technology teams can use consistent terminology when communicating requirements and assessing solutions. Integration challenges can be reduced by selecting solutions from vendors committed to standards compliance. Over time, these standardized frameworks should reduce the total cost of ownership for enterprise security infrastructure while improving actual security outcomes.