XMA LIMITED

Riverbed Aternity

Aternity transforms DEX with real-time visibility, AI-driven automation, and DXI benchmarking. From click-to-render insights to Intelligent Service Desk and performance-sentiment correlation, Aternity gives IT and Service Desk teams the power to fix issues faster, elevate performance, and deliver world-class hybrid work—at scale.

Features

• Enhancing employee and customer experience
• Reducing support tickets through automatic remediation and reducing support MTTR
• Enable self-service and remediation
• Measuring experience over time
• Continual service improvement
• IT Sustainability
• Capture user sentiment
• Improve application performance and reliability
• Create XLA's
• De-risk IT changes

Benefits

• Enhancing employee and customer experience
• Reducing support tickets through automatic remediation and reducing support MTTR
• Enable self-service and remediation
• Measuring experience over time
• Continual service improvement
• IT Sustainability
• Capture user sentiment
• Improve application performance and reliability
• Create XLA's
• De-risk IT changes

• Education pricing available
• Free trial available

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at bidteam@xma.co.uk. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 15

Service ID

356137227065955

Contact

Nancy Clayton-Schofield
0115 846 4000
bidteam@xma.co.uk

About your service

• Service categories:

  Systems Infrastructure Software

  Endpoint management

  Output management

  • Device Management

  Client endpoint management

  • Unified Endpoint Management
  • PC Life-Cycle Management
• Multi cloud support: No

Service scope

• Software add-on or extension: No
• Cloud deployment model: Private cloud
• Service constraints: No
• System requirements:
  • Windows 10, 11, server 2016, 2019, 2022 & 2025
  • Mac OS 26, 15.2, 14.1, 13, 12.3, 12, and 11
  • IOS
  • Android
  • Citrix Virtual Application or desktop Servers
  • Amazon Workspaces (AWS) - Windows 11 & Windows 10
  • Microsoft AVD

User support

• Email or online ticketing support: Yes
• Support response times: Dependant on severity and support contract (standard support business hours Mon - Friday):; ; 1. Critical Within 1 Hour; 2. High Within 4 Hours; 3. Minor Within 8 Hours; 4. Informational Within 24 Hours
• User can manage status and priority of support tickets: No
• Phone support: Yes
• Phone support availability: 9 to 5 (UK time), Monday to Friday
• Web chat support: No
• Onsite support: No
• Support levels: Service includes business hours support Mon - Friday, additional support options are available on application.
• Support available to third parties: Yes

Onboarding and offboarding

• Getting started: 1. Training workshops (online); 2. On line help documentation
• Service documentation: Yes
• Documentation formats:
  • HTML
  • PDF
• End-of-contract data extraction: 1. Using the REST API.; 2. Exporting data from dashboards
• End-of-contract process: Data will be deleted, included as part of the service.
• Documentation accessibility standard: WCAG 2.2 AA

Using the service

• Web browser interface: Yes
• Supported browsers:
  • Microsoft Edge
  • Firefox
  • Chrome
  • Safari
  • Opera
  • Other
• Application to install: Yes
• Compatible operating systems:
  • Android
  • IOS
  • MacOS
  • Windows
  • ChromeOS
• Designed for use on mobile devices: Yes
• Differences between the mobile and desktop service: 1. Custom data can be implemented on desktop, but not mobile.; 2. Data captured varies due to differences in OS's themselves
• Service interface: No
• User support accessibility: WCAG 2.2 AA
• API: Yes
• What users can and can't do using the API: The API may be used for data egress only. You can send REST API queries to directly extract and analyse Aternity's data without Aternity's dashboards. You can combine the data with other data sources if needed, or transform it as required, then view it in Microsoft Excel, Power BI, or your own data application.; ; The API may also be used to run sentiment surveys and/or remediations
• API documentation: Yes
• API documentation formats:
  • HTML
  • PDF
• API sandbox or test environment: Yes
• Customisation available: Yes
• Description of customisation: 1. Dashboards may be created using the Tableau tools, provided with the solution; 2. Create their own Remediations; 3. Create their own Run Books; 4. Create their own sentiment surveys; 5. Add their branding / logos

Scaling

• Independence of resources: The agent running on the end user device does not interact with other devices, as such other; users will not be impacted. ; The Aternity tenant is configured to support all devices reprting based on the licences purchased.

Analytics

• Service usage metrics: Yes
• Metrics types: Audit Log
• Reporting types:
  • API access
  • Regular reports
  • Reports on request
• Resource tagging: No
• FOCUS resource tagging: No

Resellers

• Supplier type: Reseller providing extra features and support
• Organisation whose services are being resold: Riverbed

Staff security

• Staff security clearance: Other security clearance
• Government security clearance: None

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations:
  • United Kingdom
  • European Economic Area (EEA)
• User control over data storage and processing locations: Yes
• Datacentre security standards: Complies with a recognised standard (for example CSA CCM version 4.0)
• Penetration testing frequency: At least once a year
• Penetration testing approach: Another external penetration testing organisation
• Protecting data at rest:
  • Physical access control, complying with another standard
  • Encryption of all physical media
• Data sanitisation process: Yes
• Equipment disposal approach: Complying with a recognised standard, for example CSA CCM v4.0, CAS (Sanitisation) or ISO/IEC 27001
• Data sanitisation type: Data Erasure

Data importing and exporting

• Data export approach: 1. Using the REST API. 2. Exporting data from dashboards
• Data export formats: CSV
• Data import formats:
  • CSV
  • Other
• Other data import formats: PNG (for logo import)

Data-in-transit protection

• Data protection between buyer and supplier networks: TLS (version 1.2 or above)
• Data protection within supplier network: Other
• Other protection within supplier network: Data is encrypted at rest using AES 256-bit encryption.

Availability and resilience

• Guaranteed availability: SERVICE AVAILABILITY. Riverbed will make the Aternity Cloud Service (“Cloud Service”) Available to Customer 99.50% of the time in any calendar month (“Service Availability Commitment”). If the Monthly Uptime Percentage does not meet the Service Availability Commitment in any calendar month, Customer will be eligible to receive the Service Credits described below.; Monthly Uptime Percentage:; Over 99.0% but below 99.50% 3 days credit; Over 98%.0% but below or equal to 99.0% 5 days credit; Over 95.0% but below or equal to 98.0% 10 days credit; Equal to or below 95.0% 30 days credit
• Approach to resilience: Data is hosted in AWS:; 1. highest network availability of any cloud provider; 2. Advanced DDoS protection and threat mitigation; 3. Automatic detection of hardware degradation and proactively replaces components before they fail
• Outage reporting: Yes on SaaS Platform Status dashboard

Identity and authentication

• User authentication needed: Yes
• User authentication:
  • Multi-Factor Authentication (MFA)
  • Username or password
• Access restrictions in management interfaces and support channels: Single Sign-On (SSO) brings the most secure access to Aternity by bypassing Aternity's sign; in screen, and authenticating with your enterprise's chosen identity provider (IdP) just once; using passwords, two-factor authentication (2FA), or even biometrics. ; SSO uses the secure SAML 2.0 protocol to delegate the entire authentication process to the IdP.
• Access restriction testing frequency: At least once a year
• Management access authentication: Multi-Factor Authentication (MFA)

Audit information for users

• Access to user activity audit information: You control when users can access audit information
• How long user audit data is stored for: At least 12 months
• Access to supplier activity audit information: Users contact the support team to get audit information
• How long supplier audit data is stored for: At least 12 months
• How long system logs are stored for: At least 12 months

Security governance

• Named board-level person responsible for service security: Yes
• Security governance certified: Yes
• Security governance standards: ISO/IEC 27001
• Information security policies and processes: Riverbed has an established incident management program that has been approved by management and communicated to relevant Riverbed personnel. The incident management program leverages centralized incident management processes and Aternity SaaS maintains a formal incident response plan, including guidance for: (i) feedback and lessons learned; (ii) applicable data breach notification requirements (including notification timing), (iii) escalation procedure, (iv) communication timelines and process, (v) procedures to collect and maintain a chain of custody for evidence during incident investigation, and (vi) actions to be taken in the event of a Security Incident. Testing of the Aternity SaaS incident response plan occurs at least annually and include end-to-end testing, and review of the test result by product management leadership and remediation if needed.
• Software Security Code of Practice: Yes

Operational security

• Configuration and change management standard: Supplier-defined controls
• Configuration and change management approach: Aternity SaaS maintains a documented change management / change control process that includes: ; 1. Change control procedures required for all changes to the production environment, ; 2. Testing prior to deployment, ; 3. Stakeholder communication and/or approvals, ; 4. Documentation for all system changes, ; 5. Version control for all software, ; 6. Logging of all change requests, ; 7. Backout procedures are required for production changes, ; 8. Access to make changes to source code is restricted to select Riverbed personnel.
• Vulnerability management type: Supplier-defined controls
• Vulnerability management approach: Uses advanced threat detection tools, to monitor and alert for suspicious activities, potential malware, viruses and/or malicious computer code. New anti-malware signature updates are deployed within 24 hours after release. Vulnerability scans are performed on a daily basis. ; Yearly, an independent consulting firm executes an application penetration test, a REST API penetration test and an external network penetration test. ; Identified vulnerabilities are mitigated or remediated within the following timelines based on applicable risk: critical (30 days), high (45 days), and medium (120 days) after discovery and identification. Vulnerabilities classified as low priority are added to the product roadmap.
• Protective monitoring type: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Protective monitoring approach: As governed by the ISO/IEC 27001:2013 Information Security Standard, Riverbed employs automated monitoring solutions that proactively alert upon production issues and security events, including: (i) verification of security updates on all servers, (ii) security events detected by A/V and IPS/IDS, and (iii) A/V scanning.
• Incident management type: Supplier-defined controls
• Incident management approach: Will investigate any security Incidents and/or personal data breaches of which Riverbed becomes aware and will define and execute an appropriate response plan. ; Customers may notify Riverbed of suspected vulnerability or incident by submitting a technical support case. ; Will notify customers of (a) security incidents as required by applicable law; and (b) personal data breaches without undue delay. Notification(s) of any security incident(s) or personal data breach(es) will be delivered to the customer’s contacts. Riverbed in its sole discretion will provide timely information and reasonable cooperation in order for a customer to fulfil its data breach reporting obligations.
• Post-quantum cryptography secure: No

Secure development

• Approach to secure software development best practice: Independent review of processes (for example CESG CPA Build Standard, ISO/IEC 27034, ISO/IEC 27001 or CSA CCM v4.0)

Public sector networks

• Connection to public sector networks: Yes
• Connected networks: Other
• Other public sector networks: AWS

Pricing

• Discount for educational organisations: Yes
• Free trial available: Yes
• Description of free trial: A Proof of Value is available ,limited to a subset of devices for one month.
• Link to free trial: N/A

Discount percentage by annual call-off contract value (excluding VAT)

• Less than £250,000: 0%
• Between £250,000 and £500,000: 0%
• Between £500,001 and £1,000,000: 0%
• Between £1,000,001 and £2,500,000: 0%
• Between £2,500,001 and £5,000,000: 0%
• Over £5,000,001: 0%

Non-mandatory Standards and certifications

• ISO/IEC 27001 certification: Yes
• Who accredited the ISO/IEC 27001: LRQA Limited
• ISO/IEC 27001 accreditation date: Thursday 27 November 2025
• What the ISO/IEC 27001 doesn’t cover: The certificate scope covers the full company business operations, across all business locations, applicable and relevant to the delivery, deployment and management of IT solutions, support and services in accordance with Statement of Applicability Version 4, and is audit against the new 2022 standard.
• ISO 28000:2022 certification: No
• ISO 9001 certification: Yes
• Who accredited the ISO 9001 certification: LRQA Limited
• ISO 9001 accreditation date: Monday 17 February 2025
• What the ISO 9001 doesn’t cover: The certificate scope covers the full company business operations, across all business locations, applicable and relevant to the Delivery, Deployment and Management of IT Solutions, Support and Services.
• Quality management systems (QMS): Yes
• CSA STAR certification: No
• PCI certification: Yes
• Who accredited the PCI DSS certification: Barclaycard
• PCI DSS accreditation date: Thursday 9 January 2025
• What the PCI DSS doesn’t cover: Our PCI DSS certification applies exclusively to payment processing systems and hosted payment gateways and does not extend to non‑payment systems, corporate IT infrastructure, or business applications outside the cardholder data environment.
• Cyber essentials: Yes
• Please provide your Cyber Essentials Certificate Number: B5f066ef-ff99-48a9-94b0-23f1f0ee595b
• Cyber essentials plus: Yes
• Please provide your Cyber Essentials Plus Certificate Number: 2d75659c-9df3-4d75-9406-9052a6e68c4b
• Other security certifications: Yes
• Any other security certifications: IASME CYBER ASSURANCE LEVEL ONE

Social value

• Section B - Commitment for Future: Delivery:

  • Mission: Make Britain a clean energy superpower: To cut bills, create jobs and deliver security with cheaper, zero-carbon electricity by 2030, accelerating to net zero

    Policy Outcome 4: Sustainable procurement practices: Reducing carbon footprints, minimising waste, and promoting the use of clean energy and green technologies.

    • Understanding of opportunities for additional environmental benefits delivery in the performance of the contract, including working towards net zero carbon emissions and use of clean energy and green technologies

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at bidteam@xma.co.uk. Tell them what format you need. It will help if you say what assistive technology you use.