CLOUD 21 LIMITED

Qualys Software Licensing and Renewals

Delivering our focused cyber security services to the NHS and healthcare, we work in partnership with Qualys to offer licensing, renewals, initial discovery/readiness, solution design, migration/adoption, support/optimisation and management of their Qualys VMDR software, including licensing consultancy services to help our clients get the most from their Qualys deployment.

Features

• All-in-One Vulnerability Management, Detection, and Response (VMDR) platform
• Web App Scanning (WAS)
• Free Global Asset inventory App
• Focus on most urgent threats
• Automated patch deployment - Patch Management (PM)
• File Integrity Monitoring (FIM)
• Enterprise TruRisk Managment (ETM)
• CyberSecurity Asset Management (CSAM)
• External Attack Surface Management (EASM)
• Policy Compliance (PC)

Benefits

• Industry leading vulnerability scanning software
• Support critical infrastructure services
• Reduce and eliminate downtime
• Efficiently manage and optimise IT infrastructure performance
• Free-up IT teams' resources
• Transform from a 'Reactive' to 'Proactive' IT organisation
• Installation support from experienced and qualified engineers
• Configured offering NHS compliance reporting, administration for CareCERTs and DSPT
• Reduce Cyber Security Attack Surface
• Desktop CIS baseline configuration assessment

• Free trial available

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at bids@cloud21.net. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 15

Service ID

858860106973576

Contact

Steve Tope
0845 838 8694
bids@cloud21.net

About your service

• Service categories:

  Systems Infrastructure Software

  Security

  • Endpoint security
  • Security analytics
  • Governance, risk and compliance

  Network security

  • Active application security
• Multi cloud support: No

Service scope

• Software add-on or extension: Yes, but can also be used as a standalone service
• What software services is the service an extension to: Qualys software can be used as a stand-alone SaaS or integrated into Cloud21's Vulnerability Management services (as a Managed Service).
• Cloud deployment model: Public cloud
• Service constraints: Depending on the modules procured, there may be the need for an on-premise server - Qualys Virtual Scanner Appliance
• System requirements:
  • 1 x vCPU up to 16x
  • 40GB virtual HDD
  • 1.5 GB RAM up to 16GB RAM

User support

• Email or online ticketing support: Yes
• Support response times: Qualys Customer Service and Technical Support is available 24/7/365 should any issues arise, and tickets follow specific SLAs. Technical Account Managers/Sales Managers can also escalate tickets if the need arises. For further details including links to Qualys SLAs please visit https://www.qualys.com/support/
• User can manage status and priority of support tickets: No
• Phone support: Yes
• Phone support availability: 24 hours, 7 days a week
• Web chat support: Yes
• Web chat support availability: 9 to 5 (UK time), Monday to Friday
• Web chat support accessibility standard: EN 301 549
• Web chat accessibility testing: Chat Support is available only for Authenticated users on Qualys Support portal, and this support portal is hosted on Salesforce.; As part of Pre-Deployment stage Penetration testing was been performed for the Support.; ; Testing is based on general product knowledge along hybrid testing with accessibility testing tools such as text-to-speech and web accessibility evaluation tool.
• Onsite support: Yes, at extra cost
• Support levels: No on-site support provided for shared cloud platform. Cloud21 provides on-site support and technical support service levels. These are chargeable additions.
• Support available to third parties: No
• AI chatbot: No

Onboarding and offboarding

• Getting started: Qualys offer a range of support and training facilities provided to help new and existing users. These range from free of charge on-demand fully certified training through to professional services offered remotely and onsite. Online support portals and customers community forums are also available.; ; Pre-Sales and Post-Sales Technical Account Managers are available to support onboarding and using subscription to fullest.
• Service documentation: Yes
• Documentation formats:
  • ODF
  • Other
• Other documentation formats:
  • Online Training
  • Classroom on-site training
• End-of-contract data extraction: Customer has rights to perform purging/deletion operation during subscription, the data further cannot be recovered. Apart from that; Upon request by Customer made within 60 days after the effective date of termination or expiration of the Agreement, Qualys will make Customer Data available to Customer for export or download. After such 60-day period, Qualys will have no obligation to maintain or provide any Customer Data, and will thereafter delete or destroy all copies of Customer Data in its systems or otherwise in its possession or control, unless legally prohibited.
• End-of-contract process: Each Order will automatically renew for an additional one (1) year terms unless Customer provides written notice that it does not intend to renew the Order not later than sixty (60) days prior to the end of the then-current Subscription Term.
• Documentation accessibility standard: EN 301 549

Using the service

• Web browser interface: Yes
• Supported browsers:
  • Microsoft Edge
  • Firefox
  • Chrome
  • Safari
• Application to install: No
• Designed for use on mobile devices: No
• Service interface: Yes
• User support accessibility: EN 301 549
• Description of service interface: Qualys offers a service interface for all its products. The Qualys Cloud Platform is an integrated solution that provides businesses with asset discovery, network security, web application security, threat protection and compliance monitoring, among others. Customers can simply log into their account from any web browser to access the service interface and secure all their IT assets.
• Accessibility standards: EN 301 549
• Accessibility testing: Qualys uses "Siteimprove" plug-in to test accessibility compliance and continuously improving on the UI components.; Testing is based on general product knowledge along hybrid testing with accessibility testing tools such as text-to-speech and web accessibility evaluation tool.
• API: Yes
• What users can and can't do using the API: Using the Qualys API, users can integrate applications with Qualys cloud security and compliance solutions using an extensible XML interface. Users with a Qualys user account may access the API functions. When a subscription has multiple users, all users with any user role (except Contact) can use the Qualys API. Each user’s permissions correspond to their assigned user role.
• API documentation: Yes
• API documentation formats:
  • ODF
  • Other
• API sandbox or test environment: No
• Customisation available: Yes
• Description of customisation: Profiles for detecting vulnerabilities can be customized to show vulnerabilities specific to categories of device, infrastructures or O/S specific vulnerabilities. Also specific categories or types of vulnerability. Reporting and dashboards are fully customizable to show information relevant to the user, team or specific reporting requirement. Compliance frameworks can be customized to support bespoke requirements

Scaling

• Independence of resources: Qualys Cloud Platform supports a parallelised scanning architecture (i.e. load balancing a scan across more than one scanning device). This important engineering effort makes the scalability of Qualys Cloud Platform limitless. Most other solutions are limited to running one scan from one scanner at a time.

Analytics

• Service usage metrics: Yes
• Metrics types: Vulnerabilities, Assets, Criticality, Patch rates, Trends, Compliance trends, Number of elements, Number of transactions etc
• Reporting types:
  • API access
  • Real-time dashboards
  • Regular reports
  • Reports on request
• Resource tagging: No
• FOCUS resource tagging: No

Resellers

• Supplier type: Reseller providing extra features and support
• Organisation whose services are being resold: Qualys

Staff security

• Staff security clearance: Other security clearance
• Government security clearance: Baseline Personnel Security Standard (BPSS)

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations:
  • United Kingdom
  • Other locations
• User control over data storage and processing locations: Yes
• Datacentre security standards: Complies with a recognised standard (for example CSA CCM version 4.0)
• Penetration testing frequency: At least once a year
• Penetration testing approach: ‘IT Health Check’ performed by a CREST-approved service provider
• Protecting data at rest:
  • Physical access control, complying with CSA CCM v4.0
  • Physical access control, complying with SSAE-18 / ISAE 3402
  • Physical access control, complying with another standard
  • Encryption of all physical media
• Data sanitisation process: Yes
• Equipment disposal approach: Complying with a recognised standard, for example CSA CCM v4.0, CAS (Sanitisation) or ISO/IEC 27001
• Data sanitisation type:
  • Deleted data can’t be directly accessed / Cryptographic Erasure
  • Explicit overwriting of storage before reallocation / Secure Erase

Data importing and exporting

• Data export approach: Customer can download data including scan results, Activity logs in xml, csv, html, pdf and mht format.
• Data export formats:
  • CSV
  • Other
• Other data export formats:
  • XML
  • HTML
  • PDF
  • MHT
• Data import formats:
  • CSV
  • Other
• Other data import formats: API

Data-in-transit protection

• Data protection between buyer and supplier networks:
  • TLS (version 1.2 or above)
  • Other
• Other protection between networks: All ingress and egress traffic to and from the core switch infrastructure is port filtered by firewalls which are configured to deny by default and permit by exception. Additionally, traffic to and from the core switch passes through our Intrusion Prevention System (IPS) infrastructure. Flows in and out of the environment are closely monitored by our Security Operations (SecOps) Team on a 24x7 basis.
• Data protection within supplier network:
  • TLS (version 1.2 or above)
  • Other
• Other protection within supplier network: All Communication between the web, application, and database tiers is filtered by firewall infrastructure.; ; Production and Non-Production environment are segregated on networks.

Availability and resilience

• Guaranteed availability: Cloud Services will be available to Customer twenty-four (24) hours a day, seven (7) days a week, with a 99.5% uptime, calculated on a monthly basis (“Cloud Services Uptime”).; Promptly after a notice from Customer regarding Qualys failure to meet the Cloud Services Uptime, Qualys, as its sole obligation and liability, will (a) perform a root-cause analysis to identify the cause of such failure; (b) attempt to correct such failure; and (c) if the root-cause analysis demonstrates that such failure was due to the fault of Qualys, provide Customer with a service credit (“Cloud Services Credit”) consisting of a one-week extension of any Cloud Services subscription impacted by the Cloud Services Uptime failure.
• Approach to resilience: Qualys has well defined Contingency Planning Policy including Contingency Planning procedure, Alternate Storage site, Alternate Processing site, Contingency Plan testing, Contingency Training, Information System backup, Recovery and Reconstitution, Telecommunication service.; Qualys platforms are also designed with multiple means of high availability which provides protection from various types of disasters and failures. Periodic Disaster Recovery Tests are performed to ensure the same.
• Outage reporting: Qualys services status, including any outages or scheduled maintenance, is posted on the Qualys Status page at https://status.qualys.com/; ; Customers may subscribe to receive email notifications of Qualys service status and scheduled maintenance: https://status.qualys.com/

Identity and authentication

• User authentication needed: Yes
• User authentication:
  • Multi-Factor Authentication (MFA)
  • Username or password
• Access restrictions in management interfaces and support channels: Qualys has well-defined access control procedure and follows access control matrix in which accesses are defined on the need-to-know basis, Least privilege and individual’s role and responsibility. Additionally, the Qualys Cloud Platform (QCP) System has been built to use Role Based Access Control (RBAC) standards. The Qualys Cloud Platform (QCP) System use security configuration standards documented and use of hardened configurations meeting CIS Benchmark Level 1. As part of the Server hardening, All unnecessary services are uninstalled or disabled.
• Access restriction testing frequency: At least once a year
• Management access authentication:
  • Multi-Factor Authentication (MFA)
  • Username or password

Audit information for users

• Access to user activity audit information: Users have access to real-time audit information
• How long user audit data is stored for: User-defined
• Access to supplier activity audit information: Users have access to real-time audit information
• How long supplier audit data is stored for: User-defined
• How long system logs are stored for: At least 12 months

Security governance

• Named board-level person responsible for service security: Yes
• Security governance certified: Yes
• Security governance standards: ISO/IEC 27001
• Information security policies and processes: Qualys has an information security policy in line with its ISO 27001 certified security standards. Its applicability extends to all the organisation's staff. the Policy is documented and reviewed at least annually.
• Software Security Code of Practice: Yes

Operational security

• Configuration and change management standard: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Configuration and change management approach: Qualys has a Change Management process that adds oversight, transparency, and control of all changes to the production environment. It establishes guidelines and standards to formally authorize, manage, test, document, monitor, and implement information system changes in the production environment.; All Changes to the Qualys Cloud Platform environment are approved by the Change Management Board before implementation in the production environment. Changes are tested in a development or staging environments prior to CMB approval and then released to the production environment.; Qualys employs a ticketing system for change management that is used to log changes throughout the change management process.
• Vulnerability management type: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Vulnerability management approach: Qualys adheres to and complies with FedRAMP security vulnerability assessment(s) in remediating/patching on a regularly basis.; Qualys uses three different severity categories for vulnerabilities as per the FedRAMP requirement.; Critical / High: Qualys aim to have patch rolled out under 30 days; Medium: Qualys aim to have patch rolled out under 60-90 days; Low: Qualys aim to have patch rolled out under 180 days.
• Protective monitoring type: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Protective monitoring approach: Approach Qualys uses SIEM along with other tools and compute system methods which are implemented for monitoring and assuring proactively incidents are prevented. The SIEM tool supporting Qualys Cloud Platform (QCP) is configured to use custom content and use case content to analyse audit log information coming into the system. Events that conform to current security use cases generate an incident ticket for further review and investigation.
• Incident management type: Complies with a recognised standard, for example, CSA CCM v4.0 or ISO/IEC 27035:2011 or SSAE-18 / ISAE 3402
• Incident management approach: Qualys has an Incident Response Plan that defines the requirements for responding to incidents, including detecting, analyzing, prioritizing, and handling of incidents. Security incidents are reported and monitored by Security and Operations teams 24x7.; Qualys uses SIEM along with other tools and compute system methods which are implemented for monitoring and assuring proactively incidents are prevented. The SIEM tool supporting Qualys Cloud Platform (QCP) is configured to use custom content and use case content to analyse audit log information coming into the system. Events that conform to current security use cases generate an incident ticket for further review and investigation.
• Post-quantum cryptography secure: Yes

Secure development

• Approach to secure software development best practice: Independent review of processes (for example CESG CPA Build Standard, ISO/IEC 27034, ISO/IEC 27001 or CSA CCM v4.0)

Public sector networks

• Connection to public sector networks: No

Pricing

• Discount for educational organisations: No
• Free trial available: Yes
• Description of free trial: Qualys trials offer free access and unlimited scope, for up to 30 days. Prospects can try the entire suite of Qualys Cloud Apps to discover all assets ins scope and gain visibility — whether on premises, in cloud instances or remote endpoints.
• Link to free trial: https://www.qualys.com/free-trial/

Discount percentage by annual call-off contract value (excluding VAT)

• Less than £250,000: 0%
• Between £250,000 and £500,000: 0%
• Between £500,001 and £1,000,000: 0%
• Between £1,000,001 and £2,500,000: 0%
• Between £2,500,001 and £5,000,000: 0%
• Over £5,000,001: 0%

Non-mandatory Standards and certifications

• ISO/IEC 27001 certification: Yes
• Who accredited the ISO/IEC 27001: British Assessment Bureau
• ISO/IEC 27001 accreditation date: Monday 16 December 2024
• What the ISO/IEC 27001 doesn’t cover: Our certification covers us for the provision of professional IT services and IT support providing Consultancy, Product Development and Managed services including IT Service Desk, Cyber Security and SOC within the Healthcare, Local Authorities, Education and Professional Service Sectors. This is in accordance with the Statement of Applicability Version 2.0 Dated Nov 24. Further clarifications regarding the scope of this certificate and the applicability of requirements may be obtained by consulting the certifier.
• ISO 28000:2022 certification: No
• ISO 9001 certification: Yes
• Who accredited the ISO 9001 certification: British Assessment Bureau
• ISO 9001 accreditation date: Monday 16 December 2024
• What the ISO 9001 doesn’t cover: Our certification cover us for the provision of professional IT services and IT support providing Consultancy, Product Development and Managed services including IT Service Desk, Cyber Security and SOC within the Healthcare, Local Authorities, Education and Professional Service Sectors within the UK Further clarifications regarding the scope of this certificate and the applicability of requirements may be obtained by consulting the certifier.
• Quality management systems (QMS): Yes
• CSA STAR certification: No
• PCI certification: No
• Cyber essentials: Yes
• Please provide your Cyber Essentials Certificate Number: 39be0c4b-eb9d-482d-9872-7592bb16ff68
• Cyber essentials plus: Yes
• Please provide your Cyber Essentials Plus Certificate Number: F722bb84-8c4e-4fd5-b845-e1f414b75f0c
• Other security certifications: No

Social value

• Section B - Commitment for Future: Delivery:

  • Mission: Make Britain a clean energy superpower: To cut bills, create jobs and deliver security with cheaper, zero-carbon electricity by 2030, accelerating to net zero

    Policy Outcome 4: Sustainable procurement practices: Reducing carbon footprints, minimising waste, and promoting the use of clean energy and green technologies.

    • Understanding of opportunities for additional environmental benefits delivery in the performance of the contract, including working towards net zero carbon emissions and use of clean energy and green technologies
    • Delivery of additional environmental benefits through the performance of the contract, including working towards net zero carbon emissions and use of clean energy and green technologies
    • Understanding of how to influence staff, suppliers, customers, communities and/or any other appropriate stakeholders through the delivery of the contract to support climate and nature protection and improvement
    • Activities to reconnect people with the environment and increase awareness of ways to protect and enhance it

  • Mission: Break down barriers to opportunity: By reforming our childcare and education systems, to make sure there is no class ceiling on the ambitions of young people in Britain

    Policy Outcome 6: Employment and training: For those who face barriers to employment

    • Understanding of employment and skills issues, and of the skills and employment shortages of high growth sectors relating to the contract
    • Delivery of training schemes and programmes to address any identified skills gaps and under-representation in the workforce for the contract (e.g. prison leavers, care leavers, kinship carers, disabled people)
    • Understanding of the issues affecting the representation of disabled people in the workforce in the market, industry or sector relevant to the contract, and in the supplier’s own organisation and those of its key sub-contractors
    • Inclusive and accessible recruitment practices, and retention-focused activities, including those provided in the Guide for line managers on recruiting, managing and developing people with a disability or health condition
    • Introducing transparency to pay and reward processes
    • Working conditions which promote an inclusive working environment and promote retention and progression
    • Other measures to provide equality of opportunity for disabled people and those with health conditions into employment, including becoming a Disability Confident employer and inclusion of supported businesses in the contract supply chain
    • Understanding of the issues affecting inequality in employment, skills and pay in the market, industry or sector relevant to the contract, and in the supplier’s own organisation and those of its key sub-contractors. Measures to tackle inequality in employment, skills and pay in the contract workforce
    • Inclusive and accessible development practices, including guidance for line managers on recruiting, managing and developing people with a disability or health condition

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at bids@cloud21.net. Tell them what format you need. It will help if you say what assistive technology you use.