IAM EXPERTS

SailPoint Identity Security Cloud

SailPoint Identity Security Cloud (ISC) is a cloud-native identity governance and security platform that helps organizations manage and secure user and machine identities, access, and entitlements with AI-driven automation, compliance controls, and broad integrations. It streamlines lifecycle management, access requests, and risk reduction across complex enterprise environments.

Features

• AI-driven Access Modeling
• Automated Identity Lifecycle Management
• Access Certification & Governance
• Cloud Infrastructure Entitlement Management (CIEM)
• AI-Powered Application Onboarding
• Machine Identity Security
• Data Access Security
• Access Recommendations & Insights
• Activity & Risk Monitoring
• Extensive Integrations/Connectors

Benefits

• Improved security posture
• AI-driven decisions
• Automation of identity lifecycle
• Regulatory compliance support
• Operational efficiency
• Risk visibility
• Unified identity view
• Cloud governance
• Faster onboarding
• Scalability & flexibility

• Education pricing available

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at anthony.mornet@iamexpert.co.uk. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 15

Service ID

897134380937255

Contact

Anthony MORNET
07907499947
anthony.mornet@iamexpert.co.uk

About your service

• Service categories:

  Systems Infrastructure Software

  Security

  • Security analytics
  • Governance, risk and compliance

  Identity and access management

  • Access
  • Privilege

  Data security

  • Information protection
  • Digital trust
• Multi cloud support: Yes

Service scope

• Software add-on or extension: No
• Cloud deployment model:
  • Public cloud
  • Private cloud
• Service constraints: No specific constraint
• System requirements:
  • Web Browsers: Firefox, Internet Explorer, Microsoft Edge, Chrome or Safari
  • Hypervisor for Virtual Appliances housing our connectivity layer
  • SaaS solution. Other components are managed in AWS by SailPoint

User support

• Email or online ticketing support: Yes
• Support response times: Up to 15 min SLA response time
• User can manage status and priority of support tickets: Yes
• Online ticketing support accessibility: WCAG 2.2 A
• Phone support: Yes
• Phone support availability: 24 hours, 7 days a week
• Web chat support: Yes
• Web chat support availability: 24 hours, 7 days a week
• Web chat support accessibility standard: WCAG 2.2 A
• Web chat accessibility testing: Teams integration with all our customers
• Onsite support: Yes
• Support levels: We offer Premium support for our customers, up to 24x7 support. ; ; Standard support (our customer's office hours) is at no additional cost; 24x7 support is available at an additional cost. Please contact us for more details.; ; You will be assigned to a dedicated account manager and subject matter expert with weekly and monthly meeting and MI reporting.
• Support available to third parties: Yes
• AI chatbot: No

Onboarding and offboarding

• Getting started: IAM EXPERTS has been a recognised SailPoint partner in the UK for more than 10 years. With over 100 successful implementations, we are uniquely equipped to guide customers through their SailPoint adoption and provide long-term support.
• Service documentation: Yes
• Documentation formats:
  • HTML
  • PDF
  • Other
• Other documentation formats: Video
• End-of-contract data extraction: Either as a SQL Server or Dataverse database OR a CSV bulk export.
• End-of-contract process: We agree with our customer on the timeline to decommission the solution, including data export and the decommissioning of the software.
• Documentation accessibility standard: WCAG 2.2 A

Using the service

• Web browser interface: Yes
• Supported browsers:
  • Microsoft Edge
  • Firefox
  • Chrome
  • Safari
  • Opera
• Application to install: No
• Designed for use on mobile devices: Yes
• Differences between the mobile and desktop service: There is no difference between the mobile and the desktop service. This is the same application leveraging the Microsoft Power platform capabilities to adapt automatically to the device.
• Service interface: Yes
• User support accessibility: WCAG 2.2 A
• Description of service interface: A flexible and easy to navigate web interface. The solution is meant to be simple and fit perfectly SME (Small Medium Enterprise) requirements.
• Accessibility standards: WCAG 2.2 A
• Accessibility testing: Continuous Quality Assurance framework is in place internally with both internal QA engineers and regular feedback from our customers.
• API: Yes
• What users can and can't do using the API: All integration, including API integration efforts are fully covered by us as part of the service (no additional cost). We do not authorise customers or third party to utilise the API.
• API documentation: No
• API sandbox or test environment: Yes
• Customisation available: No

Scaling

• Independence of resources: We proactively recruit and train additional engineers to respond to the demand.

Analytics

• Service usage metrics: Yes
• Metrics types: MI reporting available in various ways and formats. Service Usage metrics includes number of identities, number of requests, number of incidents and SLA coverage... please contact us for a full list.
• Reporting types:
  • API access
  • Real-time dashboards
  • Regular reports
  • Reports on request
• Resource tagging: Yes
• FOCUS resource tagging: No

Resellers

• Supplier type: Reseller providing extra features and support
• Organisation whose services are being resold: SailPoint

Staff security

• Staff security clearance: Conforms to BS7858:2019
• Government security clearance: Developed Vetting (DV)

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations:
  • United Kingdom
  • European Economic Area (EEA)
• User control over data storage and processing locations: Yes
• Datacentre security standards: Complies with a recognised standard (for example CSA CCM version 4.0)
• Penetration testing frequency: At least every 6 months
• Penetration testing approach: Another external penetration testing organisation
• Protecting data at rest:
  • Physical access control, complying with SSAE-18 / ISAE 3402
  • Physical access control, complying with another standard
  • Encryption of all physical media
  • Other
• Other data at rest protection approach: Customer data at rest is encrypted with the AES256 algorithm by using the AWS Key Management Service (KMS).
• Data sanitisation process: Yes
• Equipment disposal approach: Complying with a recognised standard, for example CSA CCM v4.0, CAS (Sanitisation) or ISO/IEC 27001
• Data sanitisation type: Explicit overwriting of storage before reallocation / Secure Erase

Data importing and exporting

• Data export approach: We work with our customer to automate data exports whether as a file dump or through our API.
• Data export formats:
  • CSV
  • Other
• Other data export formats: Database file
• Data import formats: CSV

Data-in-transit protection

• Data protection between buyer and supplier networks:
  • TLS (version 1.2 or above)
  • Legacy SSL and TLS (under version 1.2)
• Data protection within supplier network:
  • TLS (version 1.2 or above)
  • Legacy SSL and TLS (under version 1.2)

Availability and resilience

• Guaranteed availability: The SaaS Services will achieve System Availability of at least 99.9% during each calendar month of the Subscription Term. “System Availability” means the number of minutes in a month that the key components of the SaaS Services in a Customer production environment are operational as a percentage of the total number of minutes in such month, excluding downtime resulting from (a) scheduled maintenance, (b) events of Force Majeure, (c) malicious attacks on the system, (d) issues associated with the Customer’s computing devices, local area networks or internet service provider connections, or (e) inability to deliver services because of acts or omissions of Customer or any Identity Cube user.; ; If SailPoint fails to meet System Availability in an individual month, upon written request by Customer within 30 days after the end of the month, SailPoint will issue a credit in Customer’s next invoice in an amount equal to ten percent (10%) of the monthly fee for the affected SaaS Services for each 1% loss of System Availability below stated SLA per SaaS Service, up to a maximum of fifty percent (50%) of the Customer’s monthly fee for the affected SaaS Services.
• Approach to resilience: SailPoint’s IdentityNow solution is provided utilizing Amazon Web Services with each primary hosting location providing full redundancy of hardware, software, and network infrastructure across three AWS Availability Zones. SailPoint provides fully automated failover and advanced backup and recovery measures to ensure that IAM services are available for operation and use. Additionally, controls are in place to provide quick restoration capabilities from backup, in the event that a site or overall service experiences a critical failure.
• Outage reporting: IdentityNow is a pure SaaS solution and IdentityNow service components are monitored by SailPoint DevOps personnel. There is a public status dashboard, http://status.identitynow.com/.; ; For issues broadly impacting all customers, notice and updates would be posted to the Compass portal. You can elect to receive email notification when such notices are posted to Compass. For serious issues, your customer success manager will reach out to you via email and/or phone. SailPoint Assigns a Customer Success Manager to every client. The Customer Success Manager serves as your primary point of contact and your advocate within SailPoint.

Identity and authentication

• User authentication needed: Yes
• User authentication:
  • Multi-Factor Authentication (MFA)
  • Identity federation with existing provider (for example Google Apps)
• Access restrictions in management interfaces and support channels: Users must be pre-authorised and authenticated leveraging the Identity Provider (Azure tenant) of the registered customer.
• Access restriction testing frequency: At least every 6 months
• Management access authentication:
  • Multi-Factor Authentication (MFA)
  • Identity federation with existing provider (for example Google Apps)

Audit information for users

• Access to user activity audit information: Users have access to real-time audit information
• How long user audit data is stored for: At least 12 months
• Access to supplier activity audit information: Users have access to real-time audit information
• How long supplier audit data is stored for: Between 1 month and 6 months
• How long system logs are stored for: Between 1 month and 6 months

Security governance

• Named board-level person responsible for service security: Yes
• Security governance certified: Yes
• Security governance standards: ISO/IEC 27001
• Information security policies and processes: ISO 27001:2022 framework
• Software Security Code of Practice: Yes

Operational security

• Configuration and change management standard: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Configuration and change management approach: We maintain formal configuration and change management processes to control services throughout their lifecycle. Service components are identified, documented, and tracked using centralized inventories and version-controlled configuration repositories from deployment through retirement. All changes are formally requested, classified, and assessed for risk. Security impact assessments evaluate effects on confidentiality, integrity, availability, and compliance prior to approval. Changes are reviewed by appropriate technical and security stakeholders, tested where feasible, and logged for traceability. Emergency changes follow expedited approval and are subject to post-implementation review to ensure continued security and control.
• Vulnerability management type: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Vulnerability management approach: SailPoint completes both internal automated vulnerability scans, which are executed during regular verification cycles as part of each weekly release, and external penetration tests conducted by a third-party firm.; ; AWS performs regular vulnerability scans on the host operating system, web application, and databases in the AWS environment using a variety of tools.; ; SailPoint subscribes to vendor notification services with notifications of newly released patches and updates. Patches reviewed by SailPoint and deemed to be “Critical” are applied within 30 days of release. SailPoint generally upgrades IdentityNow on a weekly basis but can apply a patch within 24 hours if warranted.
• Protective monitoring type: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Protective monitoring approach: SailPoint leverages Amazon Web Services (AWS) to host IdentityNow. AWS monitoring tools are designed to detect unusual or unauthorized activities and conditions at ingress and egress communication points. These tools monitor server and network usage, port scanning activities, application usage, and unauthorized intrusion attempts. AWS security monitoring tools help identify several types of denial of service (DoS) attacks, including distributed, flooding, and software/logic attacks.; ; SailPoint uses a variety of tools to monitor the availability of the IdentityNow production environments for its clients, including alerts from AWS. These tools send alerts to the SailPoint DevOps team that trigger follow-up procedures.
• Incident management type: Complies with a recognised standard, for example, CSA CCM v4.0 or ISO/IEC 27035:2011 or SSAE-18 / ISAE 3402
• Incident management approach: Customers should report any issues with the IdentityNow service to SailPoint support via the Compass portal, email or telephone.; ; SailPoint maintains a Security Incident Response Policy and Procedure, which specify the steps and roles and responsibilities should such an incident occur. These policies address remediation and follow-through to ensure the issue is understood and fully addressed.; ; As it relates to a security issue with a SailPoint product or service broadly impacting all customers, notice and updates would be posted to the Compass portal. For serious issues, your customer success manager will reach out via email and/or phone.
• Post-quantum cryptography secure: No

Secure development

• Approach to secure software development best practice: Independent review of processes (for example CESG CPA Build Standard, ISO/IEC 27034, ISO/IEC 27001 or CSA CCM v4.0)

Public sector networks

• Connection to public sector networks: No

Pricing

• Discount for educational organisations: Yes
• Free trial available: No

Discount percentage by annual call-off contract value (excluding VAT)

• Less than £250,000: 5%
• Between £250,000 and £500,000: 10%
• Between £500,001 and £1,000,000: 15%
• Between £1,000,001 and £2,500,000: 20%
• Between £2,500,001 and £5,000,000: 20%
• Over £5,000,001: 20%

Non-mandatory Standards and certifications

• ISO/IEC 27001 certification: Yes
• Who accredited the ISO/IEC 27001: Citation
• ISO/IEC 27001 accreditation date: Wednesday 30 April 2025
• What the ISO/IEC 27001 doesn’t cover: Nothing
• ISO 28000:2022 certification: No
• ISO 9001 certification: No
• Quality management systems (QMS): Yes
• CSA STAR certification: No
• PCI certification: No
• Cyber essentials: Yes
• Please provide your Cyber Essentials Certificate Number: Ae10d0e3-e20e-4f9f-9737-ec60e7557a5a
• Cyber essentials plus: No
• Cyber Essentials Alternative: In relation to the services you do not have a current and valid Cyber Essentials Plus certificate which has been awarded by one of the government approved Cyber Essentials accreditation bodies but you are working towards gaining it, and will be in a position to confirm that you have been awarded a current and valid Cyber Essentials Plus certificate by one of the government approved accreditation bodies within 12 months of the date of award.
• Other security certifications: No

Social value

• Section B - Commitment for Future: Delivery:

  • Mission: Kick start economic growth. To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

    Policy Outcome 1: Fair work: That offers fair wages and good working conditions. Help people get a job, stay in work, and progress in their careers, with good employment opportunities across the country. Notes: Where there is a large proportion of labour costs in the contract, commercial teams should consider MAC in Outcome 1 as a priority

    • Providing opportunities for, and measuring and monitoring of, staff workforce conditions over time, including employee engagement, involvement in decision-making and satisfaction and adapting to any changes in the results, with clear processes for acting on issues identified
    • Ensuring new workers are informed of their right to join a trade union
    • Monitoring of employee engagement rates (by protected characteristic) and, where necessary, the development of actions to ensure all voices are heard across the diversity of the workforce
    • Employment contracts that reflect actual hours worked; steps taken to ensure employees understand their contracts and have the ability to review and adjust them if actual hours regularly exceed contracted hours
    • Activities that support an environment where staff are educated about, and feel empowered to, address their physical wellbeing
    • Activities that support an environment where staff are educated about and feel empowered to report and address bullying and harassment
    • Activities to cascade good practice on fair working conditions throughout the supply chain
    • Offer a pay and leave entitlement to all eligible staff who become kinship carers, ideally equivalent to statutory adoption pay and leave
    • Payment of more than the National Minimum Wage or National Living Wage (as appropriate) to the contract workforce
    • Monitoring and reporting of gender and ethnicity pay gaps and plans to address them where necessary
    • Entitlement to sick pay for the contract workforce, with provision in place for any staff who do not meet the earnings threshold for statutory sick pay, payment of sick pay from day one of absence and payment of staff on the contract workforce who are off sick a replacement income of 100% of their usual earnings for as long as possible
    • Understanding of in-work progression issues affecting the market, industry or sector relevant to the contract, and in the supplier’s own organisation and those of its key sub-contractors
    • Volunteering opportunities for staff
    • Understanding of the modern slavery risks and issues affecting the market, industry, sector or country (of origin or of source) relevant to the contract, and the workforce in the supplier’s own organisation and those of its key subcontractors

  • Mission: Kick start economic growth. To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

    Policy Outcome 2: Skills for growth: Supporting growth sectors and addressing skills gaps.

    • Understanding of employment and relevant skills issues, and of the education and training issues relating to the contract. Illustrative examples: demographics, skills shortages, new opportunities in high growth sectors, geographic/local community and skills/employment challenges
    • Support for educational attainment relevant to the contract, including training schemes that address skills gaps and result in recognised qualifications
    • Activities to support relevant sector related skills growth and sustainability in the contract workforce. Illustrative examples: careers talks, curriculum support, literacy support, safety talks and volunteering
    • Delivery of apprenticeships, supported internships and T Level industry placement opportunities (Level 2, 3 and 4+) in relation to the contract

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at anthony.mornet@iamexpert.co.uk. Tell them what format you need. It will help if you say what assistive technology you use.