Cisco Secure Access part numbers: annual and MSP codes

What you order for Cisco Secure Access

Every Cisco Secure Access order starts with one subscription line, SECURE-ACCESS-SUB, which sets the term and start date. Each customer has one subscription, and everything else is configured under it:

• Secure Internet Access (SIA): secure web gateway, DNS protection, cloud-delivered firewall, cloud access security broker controls and file sandboxing for internet and SaaS traffic
• Secure Private Access (SPA): zero trust network access and VPN as a service to private applications, with device posture checks
• DNS Defense: DNS-layer security, SaaS API data loss prevention and cloud malware scanning, for organisations that want DNS protection on Secure Access
• Add-ons and support: optional extras such as data loss prevention or remote browser isolation, plus a support level

SIA and SPA come in two tiers, Essentials and Advantage. You can buy SIA, SPA or both, but they must be in the same tier: a mix of Essentials and Advantage billing codes is an invalid configuration. DNS Defense is the exception. It cannot be combined with SIA, but it can sit beside SPA in either tier.

If you are moving from Umbrella, Cisco's EOL15975 notice maps each Umbrella code to a Secure Access code; our Umbrella part numbers page lists them. For what each tier does in practice, and what Advantage adds over Essentials, see Cisco Secure Access (opens in a new tab) and Cisco Secure Access licensing (opens in a new tab) on our Cisco Secure site. This page lists the part numbers and buying routes.

How Cisco Secure Access licensing works

Secure Access is licensed per covered user: each internet-connected employee, subcontractor or other authorised individual covered by the deployment. The subscription quantity should cover all of them.

Experience Insights (SA-INSIGHTS), digital experience monitoring, is added automatically to SIA and SPA orders. The Investigate API is included up to 2,000 queries a day; the Small, Medium and Large Investigate API add-ons raise the rate limit, and you buy one of them. Multi-org management is included in the SIA, SPA and DNS Defense packages with no extra code.

Cisco replaced the original SIA Essentials code, SA-SIA-ESS-K9, with SA-SIA-ESS on 18 February 2026 when it restructured the Essentials package; new orders and renewals use SA-SIA-ESS. Education customers can order DNS Defense variants that count faculty and students; we confirm those codes and counts at quote.

Source: Cisco Secure Access subscription ordering guide (opens in a new tab) (updated 20 October 2026).

Cisco Secure Access part numbers

Current Secure Access codes from Cisco's ordering guides. Order one SECURE-ACCESS-SUB (or PRP-SECACC-SUB) per customer, then the packages, add-ons and support under it. Price-list codes are billed annually or prepaid; Provider Pricing codes can also be billed monthly.

Secure Access price-list and Provider Pricing codes side by side

Each Provider Pricing code beside the price-list code for the same package. Add-ons, site licences and support are listed on the price-list route above; their Provider Pricing equivalents are confirmed at quote.

Part numbers from Cisco Secure-Access-Sub Ordering Guide (updated 20 October 2026) (opens in a new tab); Cisco Security Ordering Guide for Providers (updated 13 March 2026) (opens in a new tab); Cisco EOL15975, Umbrella SIG and DNS migration part numbers, including Provider Pricing for DNS Defense (updated 2 September 2026) (opens in a new tab), checked 2026-11-08. Add the licences you need to your basket and request a quote: we confirm the right part numbers, quantities and terms when we quote.

Site-based Secure Internet Access Essentials

For offices where it is simpler to license the site than count every person, Cisco offers SIA Essentials by site. Each site licence is sized by bandwidth group and comes with a monthly security service edge (SSE) data allowance:

Site licences cover people working on site. Remote and roaming users are licensed per covered user as normal, and you can mix site and user licences in one subscription. Site licences are available for SIA Essentials only; SPA and DNS Defense are licensed per covered user. Cisco's guide says the site package leaves out Experience Insights, the Secure Client and zero trust access client, remote browser isolation, reserved IPs and multi-org, and includes the other SIA capabilities. We can model both approaches for a multi-site estate and quote the mix that fits.

Provider Pricing: Cisco's programme for managed service providers

Cisco publishes a second set of Secure Access codes for providers in its Provider Pricing programme for Secure Access, XDR and security suites. The structure mirrors the price list: one PRP-SECACC-SUB subscription per customer, then PRP-SA-SIA-ESS, PRP-SA-SPA-ESS, PRP-SA-SIA-ADV or PRP-SA-SPA-ADV in a single tier, with a minimum of 50 users per billing code and terms of 12, 36 or 60 months. Cisco's EOL15975 notice also names PRP-SA-DNS-ESS and PRP-SA-DNS-ADV, Provider Pricing for DNS Defense Essentials and Advantage, as the replacements for the Umbrella DNS service-provider codes.

The differences are in how it is billed and supported:

• Billing: prepaid, annual or monthly. The subscription runs for the full term whichever billing frequency you choose.
• Rates: Cisco describes Provider Pricing as one flat rate across all customer deployments, without the user bands of the price list.
• Support: Provider Pricing includes Cisco's Solution Support for the provider; support arrangements are confirmed at quote.

The comparison table above puts each Provider Pricing code beside its price-list code. Monthly billing through Provider Pricing suits organisations that want Secure Access as an operating cost; the price-list route suits a fixed annual or prepaid budget. We can quote the route that suits you, with terms confirmed at quote.

Source: Cisco Security Ordering Guide for Providers (opens in a new tab) (updated 13 March 2026); DNS Defense Provider Pricing codes from Cisco EOL15975 (opens in a new tab).

Secure Client and what else is included

Every Secure Access package includes the right to download Cisco Secure Client for use with Secure Access. Secure Client is needed for VPN, client-based zero trust access, roaming internet security and Experience Insights, and there is a link to it in the Secure Access dashboard. Using Secure Client for anything else, such as remote access VPN to an on-premises Cisco firewall, needs its own licence: see Cisco Secure Client part numbers.

Browser-based SSH and RDP access to private servers needs the Advantage tier, with concurrent sessions up to the number of SPA Advantage licences. Secure Access is also part of Cisco's security suites, which bundle it with Duo, email and endpoint protection. Related reading: Cisco Secure Access DNS Defense (opens in a new tab), Cisco ZTNA (opens in a new tab), Cisco Umbrella part numbers and other SASE and ZTNA products.

How we help

Tell us how many people need internet and private app access, how many sites you have and whether you are moving from Umbrella or a VPN. We can choose the tier, check the configuration rules, size add-ons to the right user count and compare price-list and Provider Pricing routes, then place the order and help with changes and renewals. Add the part numbers you need to your basket and send them with your enquiry, or contact us and we can build the quote with you.