NETWORK INTEGRATION TECHNOLOGIES LTD

Osirium Privileged Access Management (PAM)

Osirium’s PAM suite provides Privileged Access Management & Task Automation to protect your IT infrastructure, cloud services and critical assets. By separating users from privileged credentials Osirium enforces a " least privilege" policy which controls, monitors and audits authorised employees and third-party access.

Features

• Protect and delegate Privileged Access with 1-click access
• Separate users from automatically managed and rotated privileged credentials
• Delegate automated pre-packaged and custom privileged tasks
• Searchable audit: screen and keylogging every session on every device
• Real-time shadowing and ability to remotely terminate active access sessions
• Privileged Behaviour analytics to report on common and unusual activity
• Out of the box connections to over 150 target devices
• Integrated with ITSM platforms including Service Now
• Fine grained, role-based access and permissions via configurable polices
• Complete integration and support of multi-Active Directories

Benefits

• Protect Critical Infrastructure & Devices from Cyber Attack and Insider-Threat
• Satisfy audit and compliance with control and recording of privileged-access
• Delegate automated Privileged tasks to reduce burden on IT Admins
• Rapid deployment and ease of use
• Control & Audit Vendor Access to your IT systems
• Automatic credential-injection eliminates need for users seeing and knowing passwords
• Pre-built adapters for SIEM, Incident Response, ITSM and IAM platforms
• Increase productivity of your IT Admins and Service Desk

£22 a device a year

• Education pricing available
• Free trial available

Service documents

• Pricing document

  PDF

• Skills Framework for the Information Age rate card

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at tim@itogether.co.uk. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 14

Service ID

101497582773698

Contact

Tim Ripper
01133410123
tim@itogether.co.uk

Service scope

• Software add-on or extension: Yes, but can also be used as a standalone service
• What software services is the service an extension to: Active Directory, Service Now & ITSM, Radius MFA, SIEM, IT Infrastructure Systems, & more.
• Cloud deployment model:
  • Private cloud
  • Hybrid cloud
• Service constraints: No Service Constraints
• System requirements: No System Requirements

User support

• Email or online ticketing support: Email or online ticketing
• Support response times: "If we are unable to provide a solution at the time of the first notification, we will provide our first considered response and continually update the person who raised the support request (and/or the Customer) as per the following:; ; P1 - First Considered Response: 1 hour, Progress Update: 3 hours, Solution Delivery: 48 hours; P2 - First Considered Response: 3 hours, Progress Update: 8 hours, Solution Delivery: 72 hours; P3 - First Considered Response: 8 hours, Progress Update: 24 hours, Solution Delivery: 96 hours; P4 - First Considered Response: 24 hours, Progress Update: 24 hours, Solution Delivery: 120 hours"
• User can manage status and priority of support tickets: Yes
• Online ticketing support accessibility: None or don’t know
• Phone support: Yes
• Phone support availability: 24 hours, 7 days a week
• Web chat support: Web chat
• Web chat support availability: 24 hours, 7 days a week
• Web chat support accessibility standard: None or don’t know
• How the web chat support is accessible: N/A
• Web chat accessibility testing: N/A
• Onsite support: Yes, at extra cost
• Support levels: "P1 – Mission Critical : Software or product fault preventing the Customer’s business from carrying out its normal operations.; P2 – Severe Disruption : Software or product fault causing operating problems for the Customer’s business and its normal activities.; P3 – Problematic : Software or product failing on a regular basis or problems occurring within specific functions or facilities.; P4 – Non Critical : Occasional software or product failures/problems that can be overcome without undue difficulty or disruption to the Customer’s business operations."
• Support available to third parties: Yes

Onboarding and offboarding

• Getting started: Many pieces of documentation are available to get using the service including: Install and Setup Guides, Admin Guide, Template Guide and several tutorial videos on YouTube (search for Osirium). Instructor lead product training is also available.
• Service documentation: Yes
• Documentation formats:
  • HTML
  • PDF
• End-of-contract data extraction: All data from PAM can be saved as CSV or PDF format exports.
• End-of-contract process: The Osirium PAM platform is provided as a subscription controlled by a time-stamped license key. Unless the subscription is renewed the license key will expire and access to the system will no longer be possible.

Using the service

• Web browser interface: Yes
• Supported browsers:
  • Internet Explorer 11
  • Microsoft Edge
  • Firefox
  • Chrome
  • Safari
  • Opera
• Application to install: No
• Designed for use on mobile devices: Yes
• Differences between the mobile and desktop service: HTML5 Browser based with no differentiation of access device
• Service interface: Yes
• User support accessibility: None or don’t know
• Description of service interface: A web based interface for configuration and administration of the Privileged Access Manage solution
• Accessibility standards: None or don’t know
• Description of accessibility: N/A
• Accessibility testing: N/A
• API: Yes
• What users can and can't do using the API: "Osirium PAM has a full read only API to both configuration and vaulted credentials.; A full read/write API is on the roadmap"
• API documentation: Yes
• API documentation formats:
  • HTML
  • PDF
• API sandbox or test environment: Yes
• Customisation available: Yes
• Description of customisation: Osirium PAM support for devices is based on 'Device Knowledge Templates'. This is an open part of the configuration and allows customers to add any new devices to be supported by PAM beyond the out of the box 150+ templates.

Scaling

• Independence of resources: N/A - PRIVATE CLOUD - SINGLE TENANT

Analytics

• Service usage metrics: Yes
• Metrics types: Many metrics are available including user stats, device stats, connection stats.; Account state information is also available.
• Reporting types:
  • API access
  • Real-time dashboards

Resellers

• Supplier type: Reseller (no extras)
• Organisation whose services are being resold: Osirium LTD

Staff security

• Staff security clearance: Other security clearance
• Government security clearance: Up to Security Clearance (SC)

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations: United Kingdom
• User control over data storage and processing locations: Yes
• Datacentre security standards: Managed by a third party
• Penetration testing frequency: At least once a year
• Penetration testing approach: ‘IT Health Check’ performed by a Tigerscheme qualified provider or a CREST-approved service provider
• Protecting data at rest: Encryption of all physical media
• Data sanitisation process: Yes
• Data sanitisation type: Deleted data can’t be directly accessed
• Equipment disposal approach: A third-party destruction service

Data importing and exporting

• Data export approach: All data from PAM can be saved as CSV or PDF format exports.
• Data export formats: CSV
• Data import formats: CSV

Data-in-transit protection

• Data protection between buyer and supplier networks: TLS (version 1.2 or above)
• Data protection within supplier network: TLS (version 1.2 or above)

Availability and resilience

• Guaranteed availability: The Osirium PAM platform is provided as a subscription and can be deployed in the customer's preferred Cloud platform which will determine the SLA.
• Approach to resilience: This information is available on request
• Outage reporting: The Osirium PAM platform is provided as a subscription and can be deployed in the customer's preferred Cloud platform which will determine the service outage response.

Identity and authentication

• User authentication needed: Yes
• User authentication:
  • 2-factor authentication
  • Identity federation with existing provider (for example Google Apps)
• Access restrictions in management interfaces and support channels: Via Authentication options listed above
• Access restriction testing frequency: At least every 6 months
• Management access authentication:
  • 2-factor authentication
  • Identity federation with existing provider (for example Google Apps)

Audit information for users

• Access to user activity audit information: Users have access to real-time audit information
• How long user audit data is stored for: User-defined
• Access to supplier activity audit information: You control when users can access audit information
• How long supplier audit data is stored for: User-defined
• How long system logs are stored for: User-defined

Standards and certifications

• ISO/IEC 27001 certification: No
• ISO 28000:2007 certification: No
• CSA STAR certification: No
• PCI certification: No
• Cyber essentials: Yes
• Cyber essentials plus: No
• Other security certifications: No

Security governance

• Named board-level person responsible for service security: Yes
• Security governance certified: No
• Security governance approach: This information is available on request
• Information security policies and processes: This information is available on request

Operational security

• Configuration and change management standard: Supplier-defined controls
• Configuration and change management approach: We use a form of Agile / Git process whereby all code changes are committed in code forks, vulnerability scanned (including CVE checks of third party packages), peer reviewed against 14 different criteria, merged into master, fully end to end automatically tested, published and then released.
• Vulnerability management type: Supplier-defined controls
• Vulnerability management approach: This information is available on request
• Protective monitoring type: Supplier-defined controls
• Protective monitoring approach: This information is available on request
• Incident management type: Supplier-defined controls
• Incident management approach: This information is available on request

Secure development

• Approach to secure software development best practice: Supplier-defined process

Public sector networks

• Connection to public sector networks: Yes
• Connected networks: Other
• Other public sector networks:
  • Osirium PAM is hosted in Customer's preferred Cloud vendor and
  • Can be configured to connect to any network

Social Value

• Social Value:

  Social Value

  • Fighting climate change
  • Covid-19 recovery
  • Tackling economic inequality
  • Equal opportunity
  • Wellbeing

  Fighting climate change

  At ITogether, we're committed to reducing our environmental impact and supporting our clients in their sustainability goals. Our G-Cloud services leverage energy-efficient cloud infrastructures to minimise carbon footprints. By optimising server utilisation and promoting remote work capabilities, we significantly reduce the need for physical hardware and office space, leading to lower energy consumption. Our cloud solutions also enable clients to monitor and manage their energy usage more effectively, helping them make informed decisions that contribute to a greener planet. Embracing cloud computing is a step forward in the fight against climate change, aligning with our mission for a sustainable future.

  Covid-19 recovery

  Our G-Cloud services play a crucial role in the recovery from the COVID-19 pandemic by enabling seamless remote work and maintaining business continuity. We provide secure, scalable cloud solutions that support remote collaboration, ensuring organisations can operate efficiently regardless of location. This adaptability is vital for businesses navigating the challenges posed by COVID-19, allowing them to sustain operations, safeguard jobs, and continue serving their communities. By facilitating a digital-first approach, we help organisations emerge stronger, more flexible, and ready for the future.

  Tackling economic inequality

  ITogether’s G-Cloud services contribute to tackling economic inequality by providing access to cutting-edge technology for all sectors, regardless of their size or financial capabilities. Our cloud solutions democratise technology, offering small to medium-sized enterprises (SMEs) the tools to compete on a level playing field with larger corporations. This access stimulates innovation, drives business growth, and supports job creation, directly addressing economic disparities. By offering scalable and affordable IT solutions, we empower organisations to focus on growth and development, fostering a more equitable economic landscape.

  Equal opportunity

  At ITogether, we believe technology should be accessible to everyone. Our G-Cloud services are designed to ensure equal opportunity, providing tools that support accessibility and inclusivity. By implementing solutions that cater to diverse needs, we help public sector organisations serve their communities more effectively, breaking down barriers to digital engagement. Our commitment extends to offering training and support, ensuring all users can fully leverage the benefits of cloud technology. This approach not only enhances service delivery but also promotes a culture of inclusivity and equal opportunity in the digital age.

  Wellbeing

  Our G-Cloud offerings are designed with wellbeing at their core. By facilitating remote work and flexible schedules through cloud-based solutions, we support a healthier work-life balance, reducing stress and increasing job satisfaction. Our services also enable organisations to provide their teams with the tools they need to collaborate effectively and securely from any location, fostering a positive work environment. Moreover, our commitment to reliable and efficient IT infrastructure means that employees can focus on their core tasks without the added pressure of technical issues, contributing to overall wellbeing in the workplace.

Pricing

• Price: £22 a device a year
• Discount for educational organisations: Yes
• Free trial available: Yes
• Description of free trial: PAM Express provides a fully functional PAM platform for 12 months with protection for 10 Target devices for up to 5 users.
• Link to free trial: https://www.osirium.com/privileged-access-security/pam-express-download

Service documents

• Pricing document

  PDF

• Skills Framework for the Information Age rate card

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at tim@itogether.co.uk. Tell them what format you need. It will help if you say what assistive technology you use.