SYSGROUP TRADING LIMITED

Zscaler

Zscaler is a cloud-native security platform delivering Zero Trust access to internet and private applications. It replaces traditional VPNs and firewalls with cloud-based inspection and policy enforcement, enabling secure access for users anywhere while reducing attack surface and infrastructure complexity.

Features

• Cloud-native Zero Trust access for users, devices, and applications
• Secure internet access with inline traffic inspection and threat protection
• Private application access without exposing services to the internet
• Centralised policy management via web-based administrative console
• Real-time logging, monitoring, and security reporting dashboards
• Multi-cloud support across public, private, and hybrid cloud environments
• Remote user access without traditional VPN infrastructure
• Integration with identity providers for authentication and access control
• Scalable global cloud platform with no on-premise security appliances
• Continuous updates delivering new security features without customer downtime

Benefits

• Securely access applications from any location without VPN complexity
• Reduce security incidents through continuous cloud-based threat inspection
• Simplify remote working by removing reliance on legacy network infrastructure
• Improve productivity with fast, direct access to internet and applications
• Centralise security management, reducing administrative effort and duplication
• Enable consistent security policies across multi-cloud environments
• Support hybrid workforces without performance degradation or access delays
• Accelerate incident response using real-time visibility and reporting
• Reduce operational overhead by eliminating on-premise security appliances
• Improve compliance through centralised logging and access controls

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at hello@sysgroup.com. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 15

Service ID

594240519387154

Contact

Matt Woudberg
0333 101 9000
hello@sysgroup.com

About the service

• Service categories:
  • Applications
    • Production and operations
      • Other operations
        • Other operations
• Multi cloud support: Yes

Service scope

• Software add-on or extension: No
• Cloud deployment model: Public cloud
• Service constraints: Zscaler is delivered as a cloud-based SaaS and does not require buyer-owned hardware. The service is delivered primarily as a remote managed service and depends on internet connectivity and supported client devices. SysGroup manages the Zscaler software and its configuration only, in line with the defined service description, and does not manage underlying host platforms or customer infrastructure. Any services or activities outside the documented scope are not included as standard and will be reviewed on a case-by-case basis. Planned maintenance and platform updates are vendor-managed and typically carried out transparently, with advance notification provided where customer impact is expected.
• System requirements:
  • Windows
  • MAC OS
  • Android
  • IOS
  • Linux

User support

• Email or online ticketing support: Yes
• Support response times: We aim to respond to questions and problems within a period of 30 minute to 4 hours depending on the severity and the scale of the issue. This service is 24/7
• User can manage status and priority of support tickets: Yes
• Online ticketing support accessibility: EN 301 549
• Phone support: Yes
• Phone support availability: 24 hours, 7 days a week
• Web chat support: No
• Onsite support: Yes
• Support levels: Support for Zscaler is provided through defined support levels aligned to incident severity. Priority 1 (critical) incidents receive an initial response within 30 minutes, Priority 2 within 1 hour, Priority 3 within 3 hours and Priority 4 within 4 hours. Support is available 24/7/365, including weekends and public holidays, with consistent response targets.; ; Pricing for support is linked to the Zscaler licences procured and scales with the size and complexity of the deployment. Support is typically bundled within the subscription or provided as an enhanced support tier (for example premium support), rather than charged per incident. Any service credits or pricing adjustments are applied in line with agreed service levels and contractual terms.; ; Customers are supported by experienced cloud security engineers with Zscaler expertise, who handle incident diagnosis, troubleshooting and coordination with the vendor where required. A named service or technical account contact is provided for service coordination, escalation management and ongoing relationship oversight, supported by regular service reviews where applicable.
• Support available to third parties: No

Onboarding and offboarding

• Getting started: Zscaler users are supported in starting the service through a structured onboarding process designed to ensure secure access and a smooth transition into live operation.; ; Onboarding begins following contract signature and confirmation of Zscaler licence procurement. A formal service initiation request is agreed with the buyer to confirm scope, responsibilities and timelines. Role-based access is then configured to the Zscaler administrative interface, ensuring appropriate permissions, audit logging and least-privilege controls are in place.; ; Service contacts, escalation paths and approved service callers are set up so users know how to access support and raise queries. Where required, a customer-controlled test user can be created within the buyer’s identity provider to support validation and troubleshooting. Incident reporting, change management and communication processes are verified to ensure users understand how to interact with the service.; ; Users are supported through online documentation, vendor guidance and access to support channels during onboarding. No onsite training is required, as the service is cloud-based and administered remotely through a web interface. Once onboarding activities are completed, the service transitions into business-as-usual operation, governed by defined service levels, escalation procedures and ongoing support arrangements.
• Service documentation: Yes
• Documentation formats: PDF
• Documentation accessibility standard: EN 301 549
• End-of-contract data extraction: • All customer data remains the property of the customer; • On termination, SysGroup will provide reasonable assistance to support data retrieval; • Any requested data extracts or reports will be provided in commonly used electronic formats, where applicable
• End-of-contract process: At the end of the contract, support for Zscaler may conclude at contract expiry, early termination or by mutual agreement. Service offboarding is handled through a structured and auditable process to ensure security, continuity and data protection are maintained throughout the exit period.; ; Offboarding begins with formal notification of service termination and agreement of an offboarding plan with the buyer. All SysGroup access to the customer’s Zscaler administrative interface is then removed or revoked, and any SysGroup-managed service accounts or credentials are decommissioned. Customer data is handled and disposed of securely in line with contractual, regulatory and data protection obligations. Where requested, final service reporting is provided, and reasonable cooperation is offered to support transition to an alternative supplier.; ; Included in the contract price:; Standard offboarding activities, including access removal, account decommissioning, secure data handling, and reasonable transition support within agreed exit service levels, are included as part of the contracted service.; ; Additional costs:; Any offboarding activities outside the agreed scope or exit service levels—such as extended support periods, bespoke reporting, or enhanced transition assistance—may incur additional costs, subject to prior agreement with the buyer.

Using the service

• Web browser interface: Yes
• Supported browsers:
  • Microsoft Edge
  • Firefox
  • Chrome
  • Safari
• Application to install: No
• Designed for use on mobile devices: Yes
• Differences between the mobile and desktop service: Zscaler provides consistent security policies across mobile and desktop platforms. Desktop devices typically support broader traffic inspection and configuration options, while mobile devices use lightweight client connectors with mobile-optimised controls and operating-system restrictions, focusing on secure connectivity, application access and policy enforcement within mobile platform limitations.
• Service interface: Yes
• Description of service interface: The main interface is the SysGroup support desk
• Accessibility standards: EN 301 549
• Accessibility testing: We use Zoho Desk to provide this offering.
• User support accessibility: EN 301 549
• API: No
• Customisation available: Yes
• Description of customisation: Zscaler enables customers to customise the service to align with organisational security, access and operational requirements.; ; What can be customised:; Customers can configure security and access policies, user and group definitions, application access rules, internet filtering controls, threat protection settings, data protection policies, authentication methods, reporting dashboards and alerting thresholds. Integration settings with identity providers and cloud services can be tailored to suit the customer environment.; ; How users can customise:; Customisation is carried out through Zscaler’s secure, web-based administrative console. This interface allows authorised users to create, modify and manage policies using role-based configuration tools and predefined policy frameworks. Where required, configuration and reporting activities can be supported through programmatic interfaces, enabling automation and integration with operational workflows.; ; Who can customise:; Only buyer-authorised administrators with appropriate role-based permissions can make configuration changes. Administrative roles and privileges are defined and controlled by the buyer to ensure governance, segregation of duties and compliance with internal security policies. End users do not have the ability to alter security or access configurations, ensuring consistent policy enforcement across the organisation.

Scaling

• Independence of resources: Sysgroup delivers its products with a guarantee that users won't be affected by the demand other users are placing on our services. To do this we have a 24/7 UK-based operations team, defined SLAs and service credit regimes, Proactive monitoring and capacity planning, and Scalable operational staffing aligned to customer demand. In addition, we are committed to hiring sufficient staff and scaling operational tooling to meet increasing customer demand and to maintain service quality

Analytics

• Service usage metrics: Yes
• Metrics types: Zscaler provides service metrics through its web-based management interface and reporting tools. Metrics include service availability and uptime, traffic volumes, latency and performance indicators, security events and threat detections, policy enforcement actions, and user access activity. Administrative metrics cover configuration changes, authentication events and audit logs. These metrics support operational monitoring, security assurance, compliance reporting and performance reviews. Data is available in near real time and can be exported in machine-readable formats to support analysis, reporting and integration with external monitoring or governance tools.
• Resource tagging: No
• FOCUS resource tagging: No

Supplier type

• Supplier type: Reseller providing extra features and support
• Organisation whose services are being resold: Zscaler

Staff security

• Staff security clearance: Other security clearance
• Government security clearance: Security Clearance (SC)

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations: United Kingdom
• User control over data storage and processing locations: No
• Datacentre security standards: Complies with a recognised standard (for example CSA CCM version 4.0)
• Penetration testing frequency: At least once a year
• Penetration testing approach: Another external penetration testing organisation
• Protecting data at rest:
  • Physical access control, complying with CSA CCM v4.0
  • Physical access control, complying with SSAE-18 / ISAE 3402
  • Encryption of all physical media
  • Scale, obfuscating techniques, or data storage sharding
• Data sanitisation process: Yes
• Data sanitisation type:
  • Deleted data can’t be directly accessed / Cryptographic Erasure
  • Data Erasure
  • Explicit overwriting of storage before reallocation / Secure Erase
• Equipment disposal approach: Complying with a recognised standard, for example CSA CCM v4.0, CAS (Sanitisation) or ISO/IEC 27001

Data importing and exporting

• Data export approach: Upon request SysGroup will endeavour to provide what information is possible.
• Data export formats: CSV
• Data import formats: CSV

Data-in-transit protection

• Data protection between buyer and supplier networks:
  • TLS (version 1.2 or above)
  • IPsec or TLS VPN gateway
• Data protection within supplier network:
  • TLS (version 1.2 or above)
  • IPsec or TLS VPN gateway

Availability and resilience

• Guaranteed availability: Zscaler service availability is supported through defined response and service request SLAs, which govern how quickly incidents and requests are handled once logged. Availability is supported operationally through timely incident response and effective service restoration, rather than a fixed uptime percentage commitment.; ; All incidents are classified by severity. Priority 1 (Critical) incidents receive an initial response within 30 minutes, Priority 2 within 1 hour, Priority 3 within 3 hours, and Priority 4 within 4 hours. SysGroup aims to meet these response targets in at least 95% of cases, measured quarterly.; ; Service requests are managed through defined categories. Standard and Normal service requests are initiated or responded to within 8 working hours (Monday to Friday, 08:00–18:00) in at least 95% of cases per quarter. Emergency service requests are initiated within 4 hours, with a quarterly target of 99.5% compliance.; ; If agreed service levels are not met, service credits may be applied in line with contractual thresholds and performance over the review period. Credits are applied to subsequent invoices in accordance with the contract. This SLA framework ensures predictable service responsiveness, accountability, and a financial remedy where performance targets are not achieved.
• Approach to resilience: Zscaler is designed for resilience through a cloud-native, globally distributed architecture that minimises single points of failure and supports continuous service delivery. The platform operates across multiple geographically separated data centres, enabling traffic to be routed dynamically to available service nodes if a local component becomes unavailable.; ; Resilience is achieved through redundancy at multiple layers, including compute, networking and service nodes, with automated failover and load balancing to maintain availability during component failures or maintenance activities. Capacity is scaled elastically to absorb demand spikes without service degradation. Planned maintenance and platform updates are performed in a manner intended to be transparent to users, with advance notification where customer impact is expected.; ; Data in transit is protected using strong encryption, and access to administrative functions is controlled through role-based permissions and audit logging. Operational monitoring and health checks are continuously performed to detect and respond to service issues quickly.; ; Detailed information about specific data centre locations, redundancy models and resilience controls is commercially sensitive and available to buyers on request. This approach aligns with the government’s Asset Protection and Resilience principle by ensuring the service remains available, secure and recoverable in the event of failures or disruptions.
• Outage reporting: Zscaler reports service outages and availability issues through a structured and transparent communication approach designed to keep customers informed throughout the incident lifecycle.; ; Service status information is made available through a public service status dashboard, which provides visibility of current incidents, service degradation, and historical availability information across the platform. This allows users to independently check service health without raising a support request.; ; Customers can also receive email notifications for service incidents, outages and planned maintenance. These alerts are sent to registered service contacts and provide timely updates on the nature of the issue, affected services, progress of investigation, and expected resolution where known.; ; In addition to public communications, outage information is shared through the administrative interface and support channels when customers log incidents or service requests. Where supported by the underlying platform, status and incident information can be consumed programmatically to support integration with customer monitoring, service management or governance tools.; ; During significant incidents, regular updates are provided until service is restored, followed by confirmation of resolution. This approach ensures buyers have clear, timely and auditable information about service availability and outages, supporting operational awareness and incident management processes.

Identity and authentication

• User authentication needed: Yes
• User authentication:
  • Multi-Factor Authentication (MFA)
  • Public key authentication (including by TLS client certificate)
  • Identity federation with existing provider (for example Google Apps)
  • Username or password
• Access restrictions in management interfaces and support channels: Zscaler restricts access to management interfaces and support channels using layered security controls. Management access is limited to buyer-authorised administrators through role-based access control, federated authentication and multi-factor authentication. Permissions are assigned on a least-privilege basis and all administrative actions are logged for audit purposes. Access to support channels is restricted to approved service contacts defined during onboarding. Requests are authenticated and tracked to ensure accountability. Regular reviews of access rights and audit logs help ensure controls remain effective and unauthorised access is prevented across management and support functions.
• Access restriction testing frequency: At least once a year
• Management access authentication:
  • Multi-Factor Authentication (MFA)
  • Public key authentication (including by TLS client certificate)
  • Identity federation with existing provider (for example Google Apps)
  • Username or password

Audit information for users

• Access to user activity audit information: Users contact the support team to get audit information
• How long user audit data is stored for: User-defined
• Access to supplier activity audit information: Users contact the support team to get audit information
• How long supplier audit data is stored for: User-defined
• How long system logs are stored for: Between 6 months and 12 months

Security governance

• Named board-level person responsible for service security: Yes
• Software Security Code of Practice: Yes
• Security governance certified: Yes
• Security governance standards: ISO/IEC 27001
• Information security policies and processes: Zscaler follows formal information security policies and processes designed to protect the confidentiality, integrity and availability of customer data and services.; ; Information security is governed through documented policies covering access control, incident management, change management, risk management, data protection and operations. These policies align with recognised industry standards and best practice for cloud-delivered services. Security controls are embedded into service design and procedures, including strong authentication, role-based access control, encryption of data in transit, audit logging and continuous monitoring.; ; Clear governance and reporting structures are in place. Responsibility for information security sits with senior management and designated security leadership, supported by operational teams responsible for day-to-day enforcement. Compliance with security policies is monitored through regular reviews, operational checks, and audit activities. Security incidents or policy breaches are logged, investigated and escalated through defined incident management and reporting processes.; ; Staff are required to follow documented procedures and are subject to security awareness and role-appropriate training. Access to systems and data is granted on a least-privilege basis and reviewed regularly. These controls ensure that information security policies are applied, monitored and enforced across the service, providing assurance to buyers that security risks are managed in a controlled and auditable manner.

Operational security

• Configuration and change management standard: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Configuration and change management approach: Zscaler applies structured configuration and change management aligned to recognised service management practices. Service components such as policies, access rules, users and integrations are tracked throughout their lifecycle using configuration records and audit logs. All configuration changes are logged, providing traceability and accountability. Changes are classified as standard, normal or emergency and assessed before implementation to understand operational and security impact. Security assessment considers access control, authentication, data protection, logging and compliance requirements. Emergency changes follow expedited approval and are subject to post-implementation review to ensure security controls remain effective.
• Vulnerability management type: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Vulnerability management approach: Zscaler operates a structured vulnerability management process to identify, assess and remediate security risks. Potential threats are assessed through continuous monitoring, vulnerability scanning and security analysis, with risks prioritised by severity and impact. As a cloud service, security patches are deployed centrally by the vendor, with critical vulnerabilities remediated rapidly and without customer intervention where possible. Non-critical updates follow controlled change processes. Threat intelligence is informed by vendor security research, vulnerability disclosures, industry threat feeds, security advisories and trusted external sources, ensuring emerging risks are identified and addressed promptly.
• Protective monitoring type: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Protective monitoring approach: Zscaler operates protective monitoring processes to detect and respond to security threats effectively. Potential compromises are identified through continuous monitoring of network traffic, user activity, authentication events and security logs, supported by automated alerting and threat detection. When suspicious activity is identified, incidents are logged, investigated and contained using defined incident management procedures, which may include blocking traffic, enforcing policies or escalating to specialist teams. Response actions are prioritised by severity. Incidents are responded to in line with agreed SLAs, with critical incidents receiving rapid initial response and escalation to minimise impact and restore secure operations promptly.
• Incident management type: Complies with a recognised standard, for example, CSA CCM v4.0 or ISO/IEC 27035:2011 or SSAE-18 / ISAE 3402
• Post-quantum cryptography secure: Yes
• Incident management approach: Zscaler follows defined incident management processes aligned to service management best practice. Pre-defined procedures are in place for common incident types, including service disruption, security events and configuration issues, enabling consistent handling and escalation. Users report incidents through agreed support channels such as email, online ticketing or telephone, depending on severity. All incidents are logged, categorised and prioritised, with progress tracked until resolution. Customers receive regular status updates during incident resolution. Where required, incident reports are provided, outlining the issue, actions taken, resolution achieved and any lessons learned or follow-up actions identified.

Secure development

• Approach to secure software development best practice: Independent review of processes (for example CESG CPA Build Standard, ISO/IEC 27034, ISO/IEC 27001 or CSA CCM v4.0)

Public sector networks

• Connection to public sector networks: No

Pricing

• Discount for educational organisations: No
• Free trial available: No

Discount percentage by annual call-off contract value (excluding VAT)

• Less than £250,000: 0%
• Between £250,000 and £500,000: 0%
• Between £500,001 and £1,000,000: 0%
• Between £1,000,001 and £2,500,000: 0%
• Between £2,500,001 and £5,000,000: 0%
• Over £5,000,001: 0%

Standards and certifications

• ISO/IEC 27001 certification: Yes
• ISO/IEC 27001 accredited by: Citation ISO Certification Limited.
• ISO/IEC 27001 accreditation date: Wednesday 12 January 2022
• What the ISO/IEC 27001 doesn’t cover: Our ISO/IEC 27001 certification applies exclusively to the Information Security Management System (ISMS) supporting the provision of Managed IT Services, including Strategic Consultancy, IT Support, Cloud Services, Data Centre Services, Security Solutions and Connectivity.; ; Activities falling outside this defined scope are not covered. This includes any services not directly related to the delivery or management of these managed IT services, such as standalone hardware resale, third-party services delivered under the supplier’s own certifications, customer-managed environments not operated or administered by us, and internal corporate functions not impacting service delivery. Where third parties are involved, assurance is managed through contractual and supplier risk controls rather than our certification.
• ISO 28000:2022 certification: No
• ISO 9001 certification: Yes
• ISO 9001 certification accredited by: QMS International
• ISO 9001 accreditation date: Wednesday 23 February 2022
• What the ISO 9001 doesn’t cover: SysGroup’s ISO 9001 certification applies to the delivery of IT Managed Services, including Strategic Consultancy, IT Support, Cloud Services, Data Centre Services, Security Solutions, and Connectivity. Any services, activities, or offerings that fall outside these defined service areas are not covered by the ISO 9001 certification.
• Quality management systems (QMS): Yes
• CSA STAR certification: No
• PCI certification: Yes
• PCI DSS certification accredited by: Asa
• PCI DSS accreditation date: Tuesday 30 September 2025
• What the PCI DSS doesn’t cover: Our certification covers the below:; Hosting Services:; - hardware, infrastructure/networking, storage, security services, multi-tenant service provider; Managed Services:; - Systems security services, IT support
• Cyber essentials: Yes
• Cyber Essentials Certificate Number: 9fd2a9c4-5f8e-44de-90e6-8a2610a05278
• Cyber essentials plus: No
• Cyber Essentials Alternative: In relation to the services you do not have a current and valid Cyber Essentials Plus certificate which has been awarded by one of the government approved Cyber Essentials accreditation bodies but you are working towards gaining it, and will be in a position to confirm that you have been awarded a current and valid Cyber Essentials Plus certificate by one of the government approved accreditation bodies within 12 months of the date of award.
• Other security certifications: No

Social value

• Mission: Kick start economic growth:

  To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

  Policy Outcome 1: Fair work: That offers fair wages and good working conditions. Help people get a job, stay in work, and progress in their careers, with good employment opportunities across the country. Notes: Where there is a large proportion of labour costs in the contract, commercial teams should consider MAC in Outcome 1 as a priority

  • New apprenticeships on the contract workforce in the relevant area that meet the criteria set out in MAC 1b
• Mission: Build an NHS fit for the future:

  That is there when people need it; with fewer lives lost to the biggest killers; in a fairer Britain, where everyone lives well for longer.

  Policy Outcome 8: Increasing productivity through physical and mental wellbeing: In the supply chain and communities in the relevant area.

  • Understanding of issues relating to health and wellbeing, including physical and mental health, in the contract workforce
  • Inclusive and accessible recruitment practices, development practices and retention policies that support-focused activities including those provided in the Guide for line managers on recruiting, managing and developing which support people with a disability or health condition
  • Actions to invest in the physical and mental health and wellbeing of the contract workforce

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at hello@sysgroup.com. Tell them what format you need. It will help if you say what assistive technology you use.