PRESIDIO SOLUTIONS UK LIMITED

SaaS - Action1 Agent

Action1 service provides the ability to manage Windows, Mac, Linux, and 3rd party application updates.

Features

• Patch Management
• Real-time Reporting
• Vulnerability Management
• Remote Scripting
• Software Deployment

Benefits

• Easy Patch Management
• Automation
• Centrally manage endpoints easily
• Custom scripting

• Education pricing available
• Free trial available

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at procurementuk@presidio.com. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 15

Service ID

446054109353650

Contact

Procurement UK
07717405567
procurementuk@presidio.com

About your service

• Service categories:

  Application Development and Deployment

  Software quality and life cycle

  • Software change, configuration and process management
• Multi cloud support: No

Service scope

• Software add-on or extension: No
• Cloud deployment model: Public cloud
• Service constraints: Endpoint Operating System. Action1 Supports Windows, Mac, and Debian Linux. Other OS support is listed on the roadmap.
• System requirements:
  • Latest versions of Chrome, Firefox, Microsoft Edge
  • Windows 8.1 or later
  • MacOS26, macOS15, macOS14, macOS13, macOS12
  • Ubuntu22.04LTS, 24.04LTS, Debian10, 11,12, Linux Mint22.2, LMDE7
  • Latest versions Apple Safari
  • Latest versions of Opera
  • Firewall: Protocols and ports required for Action1
  • JavaScript and cookies must be enabled
  • Minimum 50 MB RAM
  • Minimum 100 MB of free disk space

User support

• Email or online ticketing support: Yes, at extra cost
• Support response times: High A business-critical software component ; or an Action1 managed system is ; inoperable, unavailable or there is an ; emergency condition which requires an ; immediate workaround or solution.; 2 hours; Medium Adversely impacting production ; operations but the production system is ; not down; product operates but is ; restricted.; 12 business hours; Low A non-production issue; the majority of ; functions are still usable, a limited ; condition that can be readily ; circumvented. Minor issue or question ; that does not affect the product ; function and can be readily ; circumvented.; 24 business hour
• User can manage status and priority of support tickets: No
• Phone support: Yes
• Phone support availability: 24 hours, 7 days a week
• Web chat support: No
• Onsite support: Yes, at extra cost
• Support levels: We have a standard support program with different tiers for escalation as needed.
• Support available to third parties: Yes

Onboarding and offboarding

• Getting started: We do offer paid training, but we also have fully public facing documentation that shows how to use Action1 in depth
• Service documentation: Yes
• Documentation formats: Other
• Other documentation formats: Web based Documentation
• End-of-contract data extraction: CSV, HTML, API
• End-of-contract process: Except as otherwise stated in the Agreement or any documentation or link incorporated therein, and to the extent ACTION1 has possession, upon termination of the Services, ACTION1 will at its sole discretion return or delete any remaining copies of Personal Data on ACTION1 systems.; Customer is solely responsible for any Personal Data held or processed on Customer’s systems or environments, including those systems controlled or directed by Customer. Customer is advised to take appropriate action to back up or otherwise store and separately protection any Personal Data.
• Documentation accessibility standard: None or don’t know
• How the documentation is accessible: Via Web Based Documentation

Using the service

• Web browser interface: Yes
• Supported browsers:
  • Microsoft Edge
  • Firefox
  • Chrome
  • Safari
  • Opera
  • Other
• Application to install: Yes
• Compatible operating systems:
  • Linux or Unix
  • MacOS
  • Windows
• Designed for use on mobile devices: Yes
• Differences between the mobile and desktop service: Most Main functions will work as expected via the mobile version of the Action1 console - Remote access is the main exemption
• Service interface: Yes
• User support accessibility: None or don’t know
• Description of service interface: Service status can be found at https://status.action1.com/
• Accessibility standards: None or don’t know
• Description of accessibility: Action1 is accessible via browser with dark mode option.
• Accessibility testing: N/A
• API: Yes
• What users can and can't do using the API: All Action1 functions can be used via the API - via RBAC you can control what API credentials have access to.
• API documentation: Yes
• API documentation formats: Open API (also known as Swagger)
• API sandbox or test environment: No
• Customisation available: Yes
• Description of customisation: Reporting, Automation, scripting. This is configured by the customer and RBAC permissions would need to be provided by the customers enterprise admin

Scaling

• Independence of resources: Action1 hosts via AWS and can scale up server demand automatically as needed based on customer requirements

Analytics

• Service usage metrics: Yes
• Metrics types: Dashboards with user-defined SLA around patch installation. Built-in and custom reports for patch and computer information. Endpoint Online/Offline status.
• Reporting types:
  • API access
  • Real-time dashboards
  • Regular reports
  • Reports on request
• Resource tagging: No
• FOCUS resource tagging: No

Resellers

• Supplier type: Reseller providing extra support
• Organisation whose services are being resold: Action1

Staff security

• Staff security clearance: Other security clearance
• Government security clearance: None

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations:
  • European Economic Area (EEA)
  • Other locations
• User control over data storage and processing locations: Yes
• Datacentre security standards: Complies with a recognised standard (for example CSA CCM version 4.0)
• Penetration testing frequency: At least once a year
• Penetration testing approach: Another external penetration testing organisation
• Protecting data at rest:
  • Physical access control, complying with CSA CCM v4.0
  • Encryption of all physical media
• Data sanitisation process: Yes
• Equipment disposal approach: Complying with a recognised standard, for example CSA CCM v4.0, CAS (Sanitisation) or ISO/IEC 27001
• Data sanitisation type:
  • Data Erasure
  • Physical Destruction / Hardware containing data is completely destroyed

Data importing and exporting

• Data export approach: This can be done via API to pull any data in the console
• Data export formats:
  • CSV
  • Other
• Other data export formats: Reports can be exported via HTML, CSV, or via API
• Data import formats: CSV

Data-in-transit protection

• Data protection between buyer and supplier networks: TLS (version 1.2 or above)
• Data protection within supplier network:
  • TLS (version 1.2 or above)
  • IPsec or TLS VPN gateway

Availability and resilience

• Guaranteed availability: For Action1, we ensure a robust level of service availability, guaranteeing 99% uptime. This commitment is supported by a network of cloud-based servers and advanced failover techniques, ensuring that the patch management system is continuously operational. This high availability is critical for maintaining the security and performance of your IT systems, as it ensures that all updates and patches can be applied promptly and efficiently, minimising potential vulnerabilities and disruptions to your business operations. Any downtime experience by the Customer will be credited through licensing term.
• Approach to resilience: Available upon request.
• Outage reporting: A public dashboard

Identity and authentication

• User authentication needed: Yes
• User authentication:
  • Multi-Factor Authentication (MFA)
  • Identity federation with existing provider (for example Google Apps)
  • Dedicated link (for example VPN)
  • Other
• Other user authentication: Conditional Access policies are in place
• Access restrictions in management interfaces and support channels: RBAC, Least Privilege
• Access restriction testing frequency: At least every 6 months
• Management access authentication:
  • Multi-Factor Authentication (MFA)
  • Identity federation with existing provider (for example Google Apps)
  • Dedicated link (for example VPN)
  • Username or password
  • Other
• Description of management access authentication: Conditional Access policies are in place

Audit information for users

• Access to user activity audit information: Users contact the support team to get audit information
• How long user audit data is stored for: At least 12 months
• Access to supplier activity audit information: Users contact the support team to get audit information
• How long supplier audit data is stored for: At least 12 months
• How long system logs are stored for: Between 6 months and 12 months

Security governance

• Named board-level person responsible for service security: Yes
• Security governance certified: Yes
• Security governance standards: ISO/IEC 27001
• Information security policies and processes: Action1 has a defined ISMS certified under ISO 27001 with policies and procedures defined. Action1 has clear roles and responsibilities defined, with a named ISMS Leader and Data Protection Officer. Our COO is accountable to the ISMS, with the Head of IT and IT Operations Lead responsible for the ISMS.
• Software Security Code of Practice: Yes

Operational security

• Configuration and change management standard: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Configuration and change management approach: Software Development Life Cycle with change control. Changes are tested, checked into a code repository, approved, and released.
• Vulnerability management type: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Vulnerability management approach: Action1 has a formal risk registrar where risks and threats are identified and managed. Patching is our business. We perform vulnerability assessments and deploy patches to software without undue delay. Action1 is very much in touch with NIST, CISA, and has partnerships within the patch management community to gather information about potential and emerging threats.
• Protective monitoring type: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Protective monitoring approach: Security Incident and Event Monitoring. Events are identified, categories, and responded to following our established Incident Response Procedure. Incidents are responded to immediately after reporting.
• Incident management type: Complies with a recognised standard, for example, CSA CCM v4.0 or ISO/IEC 27035:2011 or SSAE-18 / ISAE 3402
• Incident management approach: We have a documented incident response plan. Users report an incident via phone call or e-mail. An internal ticket is created for tracking. Incident reports are retained and are confidential.
• Post-quantum cryptography secure: No

Secure development

• Approach to secure software development best practice: Independent review of processes (for example CESG CPA Build Standard, ISO/IEC 27034, ISO/IEC 27001 or CSA CCM v4.0)

Public sector networks

• Connection to public sector networks: No

Pricing

• Discount for educational organisations: Yes
• Free trial available: Yes
• Description of free trial: Free for 200 endpoints
• Link to free trial: Www.action1.com/free-edition

Discount percentage by annual call-off contract value (excluding VAT)

• Less than £250,000: 0%
• Between £250,000 and £500,000: 2.5%
• Between £500,001 and £1,000,000: 5%
• Between £1,000,001 and £2,500,000: 7.5%
• Between £2,500,001 and £5,000,000: 10%
• Over £5,000,001: 10%

Non-mandatory Standards and certifications

• ISO/IEC 27001 certification: Yes
• Who accredited the ISO/IEC 27001: A-Lign Compliance and Security inc
• ISO/IEC 27001 accreditation date: Monday 1 September 2025
• What the ISO/IEC 27001 doesn’t cover: ISO/IEC 27001 provides assurance that our organisation operates a certified Information Security Management System (ISMS); however, it does not guarantee absolute security or address every security requirement in isolation.; ; Specifically, ISO/IEC 27001 does not:; ; Guarantee that security incidents will not occur, as it focuses on risk management rather than eliminating risk.; ; Prescribe specific technical security controls, tools, or configurations, allowing organisations to select controls based on risk and business context.; ; Validate the effectiveness of real-time operational security or prevent human error or misconfiguration.; ; Fully address sector-specific or regulatory requirements such as UK GDPR, NCSC Cloud Security Principles, or public sector data classification requirements.; ; Define customer responsibilities within shared responsibility models for cloud services.; ; To address these limitations, we supplement our ISO/IEC 27001-certified ISMS with service-specific security controls, alignment to relevant public-sector guidance, technical security standards, and ongoing operational monitoring and assurance.
• ISO 28000:2022 certification: No
• ISO 9001 certification: Yes
• Who accredited the ISO 9001 certification: British Assessment Bureau
• ISO 9001 accreditation date: Monday 26 January 2026
• What the ISO 9001 doesn’t cover: Scope limitation: Our QMS certification applies to the provision of cloud service resale and associated support activities delivered from our UK based operations team. It does not cover the design, development, or operation of the SaaS platforms themselves (e.g., Druva, CommVault, Veeam, Mimecast), as these are owned and managed by third-party vendors.; Non-applicable requirements: ISO 9001 clause 8.3 (Design & Development) is not applicable, as we do not design or develop software or cloud platforms; we act solely as a reseller and provide configuration and support services.; Third-party exclusions: Vendor-managed infrastructure, data centres, and security operations for the SaaS products are outside our certified QMS. These remain under the control of the respective vendors’ management systems.; Geographic exclusions: Our certification covers UK-based operations only; offshore vendor facilities and global support centres are not within scope.
• Quality management systems (QMS): Yes
• CSA STAR certification: No
• PCI certification: No
• Cyber essentials: Yes
• Please provide your Cyber Essentials Certificate Number: 54eff155-3b4c-4a81-9914-e6886f4fac17
• Cyber essentials plus: Yes
• Please provide your Cyber Essentials Plus Certificate Number: 7b547487-b146-4ebf-8af3-2f843e6350b2
• Other security certifications: Yes
• Any other security certifications: NHS DSP Toolkit

Social value

• Section B - Commitment for Future: Delivery:

  • Mission: Kick start economic growth. To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

    Policy Outcome 1: Fair work: That offers fair wages and good working conditions. Help people get a job, stay in work, and progress in their careers, with good employment opportunities across the country. Notes: Where there is a large proportion of labour costs in the contract, commercial teams should consider MAC in Outcome 1 as a priority

    • Providing opportunities for, and measuring and monitoring of, staff workforce conditions over time, including employee engagement, involvement in decision-making and satisfaction and adapting to any changes in the results, with clear processes for acting on issues identified
    • Plans to engage the contract workforce in deciding the most important workplace issues to address
    • Monitoring of employee engagement rates (by protected characteristic) and, where necessary, the development of actions to ensure all voices are heard across the diversity of the workforce
    • Employment contracts that reflect actual hours worked; steps taken to ensure employees understand their contracts and have the ability to review and adjust them if actual hours regularly exceed contracted hours
    • Activities that support an environment where staff are educated about, and feel empowered to, address their physical wellbeing
    • Activities that support an environment where staff are educated about and feel empowered to report and address bullying and harassment
    • Activities to cascade good practice on fair working conditions throughout the supply chain
    • Monitoring and reporting of gender and ethnicity pay gaps and plans to address them where necessary
    • Understanding of the modern slavery risks and issues affecting the market, industry, sector or country (of origin or of source) relevant to the contract, and the workforce in the supplier’s own organisation and those of its key subcontractors
    • Outline policies and practices to be applied to or put in place for the contract to mitigate and manage modern slavery risks, including: Pre-employment checks, recruitment practices. Workplace conditions, safeguarding plans and processes in place and regular monitoring with relevant groups considered, which may include sampling
    • How to ensure business decisions re: price/cost, short lead times, payment timescales do not create modern slavery risks in the supply chain

  • Mission: Make Britain a clean energy superpower: To cut bills, create jobs and deliver security with cheaper, zero-carbon electricity by 2030, accelerating to net zero

    Policy Outcome 4: Sustainable procurement practices: Reducing carbon footprints, minimising waste, and promoting the use of clean energy and green technologies.

    • Understanding of opportunities for additional environmental benefits delivery in the performance of the contract, including working towards net zero carbon emissions and use of clean energy and green technologies
    • Collaborative ways of working with the supply chain to deliver additional environmental benefits in the performance of the contract, including working towards net zero carbon emissions and use of clean energy and green technologies
    • Delivery of additional environmental benefits through the performance of the contract, including working towards net zero carbon emissions and use of clean energy and green technologies
    • Understanding of how to influence staff, suppliers, customers, communities and/or any other appropriate stakeholders through the delivery of the contract to support climate and nature protection and improvement

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at procurementuk@presidio.com. Tell them what format you need. It will help if you say what assistive technology you use.