SMS Firewall RFP & Evaluation Checklist

Confirm the platform detects the categories that leak the most revenue on your network.

• Grey-route / SS7 MT-bypass detection (A2P delivered as P2P to avoid termination fees).This is typically the largest single source of leaked A2P revenue.
• Sender-ID spoofing and impersonation of protected brands / short codes.
• SMS spam and unsolicited bulk detection with configurable thresholds.
• Smishing / phishing URL detection and category-based content filtering.
• SIM-farm and P2P-abuse patterns (velocity, fan-out, repeated content).Ask how the vendor distinguishes legitimate high-volume P2P from abuse.
• SS7/SIGTRAN-level signalling anomaly detection (SRI-SM probing, faked-MSC).Cross-reference against GSMA FS.11 category-1/2/3 signalling controls.
• Detection accuracy: ask for false-positive / false-negative rates and how they are measured.

• Supported modes: inline (SMSC MT proxy), offline/passive (mirror for analysis), and home-routing.Home-routing forces MT-terminating traffic through the firewall and closes the grey-route gap.
• High availability and geo-redundancy with no single point of failure.The firewall sits in the critical messaging path — HA is non-negotiable.
• Throughput headroom vs. your peak SMS/second, with published latency under load.
• On-premises, private-cloud, and managed-service options — inside your security perimeter.
• Integration with existing SMSC, STP, and signalling stack without vendor lock-in.
• Fail-open vs. fail-closed behaviour is configurable and documented.

• Rule engine supports allow/deny lists, regex/content rules, and per-sender commercial policy.
• Sender-ID registry / whitelist management with self-service enterprise onboarding.
• Simulation / shadow mode to test new rules against live traffic before enforcing.Insist on shadow mode — it prevents revenue-affecting false positives at go-live.
• Rule changes are versioned, auditable, and role-based-access controlled.

• Real-time dashboards for blocked traffic, revenue at risk, and top offending routes/senders.
• Configurable reports for regulators, wholesale partners, and internal RA teams.
• Per-route reconciliation to quantify leakage recovered after deployment.
• Exportable evidence packs (CDRs, signalling traces) for dispute resolution.Evidence quality determines whether you can charge back a fraudulent aggregator.
• Data-retention controls aligned to your regulatory and privacy obligations.

• Converts detected grey-route traffic into billable A2P through enforced termination.The core commercial case: block the bypass, then monetise the recovered traffic.
• Supports an A2P commercial model (per-message termination, tiered enterprise pricing).
• Provides a measurable before/after baseline of A2P revenue uplift.
• Commercial model for the firewall itself: capex, opex, or revenue-share — described transparently.

• Alignment with GSMA messaging-security guidance (IR.70/IR.71 family, FS.11).
• Vendor holds relevant security certifications (e.g. ISO 27001) and passes your InfoSec review.
• 24/7 NOC/SOC support, defined SLAs, and a managed threat-intelligence feed.
• References from operators of comparable size and traffic profile.Ask for anonymised deployment outcomes, not just logos.
• Clear roadmap for emerging threats (RCS abuse, AIT/SMS-pumping crossover).