Cisco Security Cloud Control part numbers: firewall management and logging

What Security Cloud Control does

Cisco Security Cloud Control (formerly Cisco Defense Orchestrator) is Cisco's cloud management console for its firewalls and related security products. Its Firewall Management service manages Cisco Secure Firewall Threat Defense and ASA firewalls and includes the cloud-delivered Firewall Management Center, so you get the same management experience without running an on-premises management server. The same console also manages Multicloud Defense, Hypershield, Secure Workload (SaaS), Secure Access and AI Defense, each licensed under its own ordering guide. Firewall Management tenants are available in several regions, including the EU.

For what the console does day to day, see Cisco Security Cloud Control (opens in a new tab) on our Cisco security site. This page covers the part numbers for firewall management and logging.

How Security Cloud Control licensing works

Firewall Management needs two types of licence, both under the top-line subscription FWM-SEC-SUB, plus optional logging:

A few counting rules from Cisco's guide make a real difference to the quantity:

• High-availability pair: counts as one device, because only one firewall passes traffic at a time
• Cluster: every firewall in the cluster needs its own device licence
• Multi-instance: one device licence per appliance, however many container instances it runs
• ASA multiple context: licensed for the device itself, with the charge on the admin context only
• Firewall software: the device licence is the same whether the firewall runs Threat Defense or ASA

Subscriptions run for 12 to 60 months, defaulting to 36 and set to auto-renew. Basic Support (SVS-FWM-SUP-B) is included with the base subscription, and Solution Support (SVS-FWM-SUP-S) can be chosen instead. The firewall's own feature licences (Threat, Malware Defense and URL Filtering) are bought separately: see Cisco Secure Firewall part numbers.

Cisco Security Cloud Control part numbers

Firewall Management codes from Cisco's Security Cloud Control ordering guide. Order one FWM-SEC-SUB and one FWM-BASE per customer, then a device licence for each firewall you manage; device licences name the firewall model, so we confirm them at quote. SAL-SEC-SUB is the optional a-la-carte cloud logging subscription.

Part numbers from Cisco Security Cloud Control Firewall Management Ordering Guide (updated 5 May 2026) (opens in a new tab), checked 2026-11-08. Add the licences you need to your basket and request a quote: we confirm the right part numbers, quantities and terms when we quote.

Choosing between unlimited logging and a-la-carte logging

The device licence with unlimited logging suits most organisations whose firewalls are managed from Security Cloud Control: there is nothing to estimate, and every managed firewall keeps 90 days of logs in the cloud. Choose device-management-only licences with SAL-SEC-SUB when you need to keep logs for longer than 90 days, or when you already know your daily log volume and want a fixed amount of storage that can be changed later. Cisco suggests estimating volume with its performance estimator or from metrics in your current installation, such as NetFlow data.

A tenant used only for cloud logging needs no base tenant or device licences, and Cisco recommends that the logging term matches the base tenant term. If you are buying new firewalls at the same time, management and cloud logging can be attached to the firewall subscriptions in the same order; the base tenant subscription is still needed to provision the tenant.

What you can use without a subscription

If your firewalls are managed by an on-premises Firewall Management Center, you may not need a Firewall Management subscription at all. Cisco customers who buy Firewall Management Center licences are entitled to its cloud-assist features once the management center is linked to Cisco Security Cloud:

• Centralised object management and an inventory view of the management center
• Low-touch provisioning of new firewalls to the on-premises management center by serial number
• AIOps, the Policy Analyzer and Optimizer and the Cisco AI Assistant
• XDR automation workflows that change policy in response to threats
• Sending firewall events to the cloud, which needs a logging licence

We can tell you whether your plans need a paid tenant or whether the cloud-assist features and a logging licence cover them. If you run Cisco Meraki rather than Secure Firewall, Meraki's own cloud management is covered on our Meraki store: see Cisco Cloud Control (opens in a new tab).

How we help

Tell us how many firewalls you manage, whether any are in high-availability pairs or clusters, how long you need to keep logs, and when your current management or firewall subscriptions end. We match each firewall to its device licence, choose between unlimited and a-la-carte logging, and line up the term with your firewall subscriptions where Cisco's terms allow it.

Add the codes to your basket and send it, or describe your estate, and we reply with a quote showing each part number, quantity and term. Changes to products, quantities or term can be made during the subscription. Contact us to get started.