Is Single Sign-On included or sold as an extra?

Included. Single Sign-On is available out of the box on NORBr at no extra cost, and NORBr recommends turning it on. It sits alongside other design choices visible to operators, such as merchant documents kept inside the merchant file with every partner decision timestamped, instead of circulating by email.

Included, and recommended

Single Sign-On is available out of the box on NORBr at no extra cost. Operators connect their identity provider, and their users log in to the console with their corporate credentials, under the operator's own policies for multi-factor authentication, session length and offboarding. NORBr recommends enabling it for every operator.

Why it is not an upsell

• SSO is a security control, and security controls priced as extras tend not to be enabled.
• Offboarding a user from the identity provider removes console access at once, which is what acquirers and auditors expect.
• MFA enforced at the identity provider covers the console without a separate setup.

Other design choices in the same spirit

Merchant documents kept inside the merchant file rather than circulating by email, with every partner decision timestamped. Audit logs on by default, not configured on request. Retention periods enforced automatically. These are the controls assessors look for, and they are easier to evidence when the platform does them by construction. Operators evaluating infrastructure should ask which security features cost extra; the answer says something about how the provider thinks about compliance.