TURNKEY CONSULTING (UK) LIMITED

SAP Security Managed Service

A managed service for SAP Security (Roles and Authorisations) via a subscription. This helps smooth upfront implementation costs reducing capital expenditure. Our offering includes a fully managed support service, managing existing SAP solutions, on-premise or cloud-hosted (public/private),

Features

• Plan budgets more effectively with a more predictable cost model
• Relieve the burden of technical support and maintenance
• Leverage best practice & knowledge transfer
• Deliver SAP Security changes and updates
• Supported by SAP Security & risk experts
• Align SAP Security to business needs

Benefits

• Reduced requirement to hire and retain specialist skills
• Improve operational resilience and control for SAP Security
• Reduce the impact severity of Cyber attacks to SAP
• Predictable costs using an opex model
• On-demand access to SAP security & controls experts
• Best-practice deployment & operation of SAP Security
• Automate cumbersome internal control activities
• Facilitate controlled access to business users

• Education pricing available

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at finance@turnkeyconsulting.com. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 15

Service ID

304349062095889

Contact

Jo Chuter
02072882578
finance@turnkeyconsulting.com

About your service

• Service categories:

  Application Development and Deployment

  Software quality and life cycle

  • Software change, configuration and process management
• Multi cloud support: No

Service scope

• Software add-on or extension: Yes, but can also be used as a standalone service
• What software services is the service an extension to: SAP
• Cloud deployment model:
  • Public cloud
  • Private cloud
• Service constraints: Deployment of SAP Technology. Remote connections for Turnkey staff to your SAP systems
• System requirements:
  • Licences to chosen Software
  • Connectivity to external software hubs

User support

• Email or online ticketing support: Yes
• Support response times: Severity 1 <30mins, Severity 2 <1hr, Severity 3 <2 hrs, Severity 4 <4hrs
• User can manage status and priority of support tickets: Yes
• Online ticketing support accessibility: WCAG 2.2 AA
• Phone support: Yes
• Phone support availability: 24 hours, 7 days a week
• Web chat support: No
• Onsite support: Yes
• Support levels: Varies according to business requirement and bespoke services required. Generally, clients are provided with a quota of capacity that can be called upon to support their needs. If this requires on-site presence, this will be managed as a request and fulfilled within lead times and communicated accordingly.
• Support available to third parties: Yes

Onboarding and offboarding

• Getting started: Onboarding is handled through a specific process to get accounts setup and connectivity established as well as operational and non-functional stakeholder engagement. The user training is often a project outcome prior to engaging support teams but top up training and enablement can be delivered via the service. SOPs and process documents are provided with contacting and escalation information and service operation guides.
• Service documentation: Yes
• Documentation formats:
  • ODF
  • PDF
• End-of-contract data extraction: Once completed, system connectivity is removed and any information that ceases to have an ongoing requirement for processing / retention is destroyed. Any client data that is returnable is returned or removed.
• End-of-contract process: Cessation of the services and connectivity removal
• Documentation accessibility standard: WCAG 2.2 AA

Using the service

• Web browser interface: Yes
• Supported browsers:
  • Microsoft Edge
  • Firefox
  • Chrome
  • Safari
  • Opera
• Application to install: Yes
• Compatible operating systems:
  • Linux or Unix
  • Windows
• Designed for use on mobile devices: Yes
• Differences between the mobile and desktop service: Launchpad applications work on both mobile and desktops and where installed on virtual machines, it can be accessed via that medium regardless of the connectivity profile.
• Service interface: Yes
• User support accessibility: WCAG 2.2 AA
• Description of service interface: Zendesk used to facilitate ticket management, but otherwise the services are accessed via web-browsers based upon vendor technology.
• Accessibility standards: WCAG 2.2 AA
• Accessibility testing: N/a
• API: No
• Customisation available: Yes
• Description of customisation: Clients can request a tailored or bespoke support service to cater for nuances as required. Examples include UK Nationals or security clearances or operation of defined end to end processes or expertise on demand services. Additionally, customer specific vulnerability analysis and pattern definition to be alerted in each case.

Scaling

• Independence of resources: Solutions operate on a single tenant basis with load balancing and scaling.

Analytics

• Service usage metrics: Yes
• Metrics types: Alerts highlighted. ; Uptime, ; Consumption of planned/allocated effort
• Reporting types:
  • Real-time dashboards
  • Regular reports
  • Reports on request
• Resource tagging: No
• FOCUS resource tagging: No

Resellers

• Supplier type: Not a reseller

Staff security

• Staff security clearance: Conforms to BS7858:2019
• Government security clearance: Security Clearance (SC)

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations:
  • United Kingdom
  • European Economic Area (EEA)
  • Other locations
• User control over data storage and processing locations: Yes
• Datacentre security standards: Managed by a third party
• Penetration testing frequency: At least once a year
• Penetration testing approach: NCSC approved service provider
• Protecting data at rest:
  • Physical access control, complying with CSA CCM v4.0
  • Physical access control, complying with SSAE-18 / ISAE 3402
  • Physical access control, complying with another standard
  • Encryption of all physical media
  • Scale, obfuscating techniques, or data storage sharding
• Data sanitisation process: Yes
• Equipment disposal approach: A third-party destruction service
• Data sanitisation type:
  • Deleted data can’t be directly accessed / Cryptographic Erasure
  • Data Erasure

Data importing and exporting

• Data export approach: Direct Download
• Data export formats:
  • CSV
  • ODF
• Data import formats:
  • CSV
  • ODF

Data-in-transit protection

• Data protection between buyer and supplier networks:
  • TLS (version 1.2 or above)
  • IPsec or TLS VPN gateway
• Data protection within supplier network:
  • TLS (version 1.2 or above)
  • IPsec or TLS VPN gateway

Availability and resilience

• Guaranteed availability: Availability is the responsibility of the vendor tooling and thus is transferred to them.
• Approach to resilience: This is the Vendor's responsibility for the technology. Turnkey provides resilience via scalability of supporting resources and their ability to work from multiple locations globally.
• Outage reporting: Vendor published availability reporting.

Identity and authentication

• User authentication needed: Yes
• User authentication:
  • Multi-Factor Authentication (MFA)
  • Public key authentication (including by TLS client certificate)
  • Identity federation with existing provider (for example Google Apps)
  • Limited access network (for example PSN)
  • Username or password
• Access restrictions in management interfaces and support channels: Direct connectivity to the underlying vendor technology via direct network access supported by vendor driven authentication. Information in Turnkey's supporting systems protected by encryption and authentication as well as access to resolver groups by need.
• Access restriction testing frequency: At least once a year
• Management access authentication:
  • Multi-Factor Authentication (MFA)
  • Public key authentication (including by TLS client certificate)
  • Identity federation with existing provider (for example Google Apps)
  • Limited access network (for example PSN)
  • Username or password

Audit information for users

• Access to user activity audit information: Users have access to real-time audit information
• How long user audit data is stored for: At least 12 months
• Access to supplier activity audit information: Users have access to real-time audit information
• How long supplier audit data is stored for: At least 12 months
• How long system logs are stored for: User-defined

Security governance

• Named board-level person responsible for service security: Yes
• Security governance certified: Yes
• Security governance standards: ISO/IEC 27001
• Information security policies and processes: ISMS formally documented to support ISO Certification.
• Software Security Code of Practice: Yes

Operational security

• Configuration and change management standard: Supplier-defined controls
• Configuration and change management approach: Software Vendor provides configuration and change management controls. Turnkey provides add-on services
• Vulnerability management type: Undisclosed
• Vulnerability management approach: Vendor provided SOC2 and ISO certifications
• Protective monitoring type: Undisclosed
• Protective monitoring approach: Vendor provided reporting and monitoring processes
• Incident management type: Supplier-defined controls
• Incident management approach: Tickets submitted in Zendesk with defined processes and resolver groups based upon ticket severity and contract type.
• Post-quantum cryptography secure: No

Secure development

• Approach to secure software development best practice: Conforms to a recognised standard, but self-assessed

Public sector networks

• Connection to public sector networks: No

Pricing

• Discount for educational organisations: Yes
• Free trial available: No

Discount percentage by annual call-off contract value (excluding VAT)

• Less than £250,000: 0%
• Between £250,000 and £500,000: 5%
• Between £500,001 and £1,000,000: 5%
• Between £1,000,001 and £2,500,000: 10%
• Between £2,500,001 and £5,000,000: 10%
• Over £5,000,001: 15%

Non-mandatory Standards and certifications

• ISO/IEC 27001 certification: Yes
• Who accredited the ISO/IEC 27001: Pyramid
• ISO/IEC 27001 accreditation date: Friday 22 August 2025
• What the ISO/IEC 27001 doesn’t cover: Supplier dependent activities
• ISO 28000:2022 certification: No
• ISO 9001 certification: No
• Quality management systems (QMS): Yes
• CSA STAR certification: No
• PCI certification: No
• Cyber essentials: Yes
• Please provide your Cyber Essentials Certificate Number: 67643976-d4e8-4f50-9205-74416dba89b4
• Cyber essentials plus: No
• Cyber Essentials Alternative: You do not have a current and valid Cyber Essentials Plus certificate, or will not have in place within 12 months of the date of award but have an IASME certified equivalent.
• Other security certifications: Yes
• Any other security certifications: Cyber Assurance Level 1

Social value

• Section B - Commitment for Future: Delivery:

  • Mission: Kick start economic growth. To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

    Policy Outcome 1: Fair work: That offers fair wages and good working conditions. Help people get a job, stay in work, and progress in their careers, with good employment opportunities across the country. Notes: Where there is a large proportion of labour costs in the contract, commercial teams should consider MAC in Outcome 1 as a priority

    • New or retained jobs on the contract workforce in the relevant area that meet the criteria set out in MAC 1b, 1c and 1d
    • Providing opportunities for, and measuring and monitoring of, staff workforce conditions over time, including employee engagement, involvement in decision-making and satisfaction and adapting to any changes in the results, with clear processes for acting on issues identified
    • Plans to engage the contract workforce in deciding the most important workplace issues to address
    • Monitoring of employee engagement rates (by protected characteristic) and, where necessary, the development of actions to ensure all voices are heard across the diversity of the workforce
    • Activities that support an environment where staff are educated about, and feel empowered to, address their physical wellbeing
    • Activities that support an environment where staff are educated about and feel empowered to report and address bullying and harassment
    • Activities to cascade good practice on fair working conditions throughout the supply chain
    • Offer a pay and leave entitlement to all eligible staff who become kinship carers, ideally equivalent to statutory adoption pay and leave
    • Payment of more than the National Minimum Wage or National Living Wage (as appropriate) to the contract workforce
    • Monitoring and reporting of gender and ethnicity pay gaps and plans to address them where necessary
    • Plans for an appropriate income replacement policy for staff who are required to spend time away from work to care for a sick dependent or close relative
    • Understanding of in-work progression issues affecting the market, industry or sector relevant to the contract, and in the supplier’s own organisation and those of its key sub-contractors
    • Measures to support in-work progression to help people in the contract workforce, to move into higher paid work by developing new skills relevant to the contract
    • Support for educational attainment relevant to the contract, including training schemes that address skills gaps and result in recognised qualifications
    • Volunteering opportunities for staff
    • Understanding of the modern slavery risks and issues affecting the market, industry, sector or country (of origin or of source) relevant to the contract, and the workforce in the supplier’s own organisation and those of its key subcontractors
    • Outline policies and practices to be applied to or put in place for the contract to mitigate and manage modern slavery risks, including: Pre-employment checks, recruitment practices. Workplace conditions, safeguarding plans and processes in place and regular monitoring with relevant groups considered, which may include sampling
    • How these flow down the supply chain and are monitored Illustrative examples include reporting, site visits, audits, etc.
    • How to ensure business decisions re: price/cost, short lead times, payment timescales do not create modern slavery risks in the supply chain
    • Means of influencing staff, suppliers, customers, communities and/or any other appropriate stakeholders with respect to modern slavery risks relating to the contract

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at finance@turnkeyconsulting.com. Tell them what format you need. It will help if you say what assistive technology you use.