Truststream Security Solutions

CyberArk Endpoint Privilege Manager SaaS

CyberArk Endpoint Privilege Manager, hosted by CyberArk and delivered as SaaS, helps to remove the barriers to enforcing least privilege and allows organizations to block and contain attacks at the endpoint, reducing the risk of information being stolen or encrypted and held for ransom.

Features

  • Privilege Management
  • Application Control
  • Just-in-time elevation
  • Credential theft blocking

Benefits

  • Privilege Management Prevent attacks by removing local admin rights.
  • Application Control - Whitelisting, Blacklisting, Greylisting
  • Just-in-time elevation - Access on a by-request basis
  • Credential theft blocking - Detect and block attempted credential

Pricing

£1.20 to £1.50 a device a month

  • Education pricing available
  • Free trial available

Service documents

Request an accessible format
If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at paul.sullivan@truststream.co.uk. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 13

Service ID

1 3 4 0 5 9 0 2 3 8 1 9 4 1 2

Contact

Truststream Security Solutions Paul Sullivan
Telephone: 07949 502 435
Email: paul.sullivan@truststream.co.uk

Service scope

Software add-on or extension
No
Cloud deployment model
Private cloud
Service constraints
Limited to Microsoft Windows and Apple Mac OS Endpoints
System requirements
  • Windows Desktop: minimum version MS Windows XP SP3
  • Windows Server: minimum version MS Windows Server 2003
  • Mac: minimum version High Sierra 10.13

User support

Email or online ticketing support
Email or online ticketing
Support response times
Critical event response times is 2 hours, Serious 4 hours, Moderate 6 hours
User can manage status and priority of support tickets
Yes
Online ticketing support accessibility
None or don’t know
Phone support
Yes
Phone support availability
24 hours, 7 days a week
Web chat support
No
Onsite support
No
Support levels
24x7 Helpdesk support
Professional Services for deployment and post-installation modifications
Technical Account Management as an ongoing service
Free Customer Success assistance to guide the PAM Program
Support available to third parties
Yes

Onboarding and offboarding

Getting started
CyberArk provides detailed documentation on the CyberArk Docs site. CyberArk and it's partners can also provide Professional Services to new and existing customers for this purpose.
Service documentation
Yes
Documentation formats
PDF
End-of-contract data extraction
Data can be extracted by the end user at any point using export functions, and can also be made available upon request.
End-of-contract process
After a specified period of time the tenant and the data is holds is deleted from the cloud service.

Using the service

Web browser interface
Yes
Supported browsers
  • Internet Explorer 11
  • Microsoft Edge
  • Firefox
  • Chrome
  • Safari
  • Opera
Application to install
Yes
Compatible operating systems
  • MacOS
  • Windows
Designed for use on mobile devices
No
Service interface
Yes
User support accessibility
None or don’t know
Description of service interface
Service interface is web based and accessed via a browser
Accessibility standards
None or don’t know
Description of accessibility
No constraints. Users can manage the platform via web interface
Accessibility testing
N/A
API
Yes
What users can and can't do using the API
The primary purpose of the API is to enable integration with Helpdesk/Ticketing and workflow solutions to automate the management of user requests. The API provides access to:
- Collect Events
- List, Create, update and delete policies
- Query Sets, Endpoints and Endpoint Groups
API documentation
Yes
API documentation formats
PDF
API sandbox or test environment
No
Customisation available
No

Scaling

Independence of resources
Each customer is provisioned a single tenant seperated by schema to ensure security and continuity of tenant. Tenants are hosted on an AWS cloud service which scales with demand. CyberArk makes use of 3 availability zones in AWS to ensure uptime. In addition, users can be segregated into sets based on their demands, each set is a discrete instance with associated resource.

Analytics

Service usage metrics
Yes
Metrics types
Service related MI
Reporting types
  • API access
  • Real-time dashboards
  • Regular reports

Resellers

Supplier type
Not a reseller

Staff security

Staff security clearance
Conforms to BS7858:2019
Government security clearance
Up to Baseline Personnel Security Standard (BPSS)

Asset protection

Knowledge of data storage and processing locations
Yes
Data storage and processing locations
  • United Kingdom
  • European Economic Area (EEA)
  • Other locations
User control over data storage and processing locations
Yes
Datacentre security standards
Supplier-defined controls
Penetration testing frequency
At least every 6 months
Penetration testing approach
Another external penetration testing organisation
Protecting data at rest
Encryption of all physical media
Data sanitisation process
Yes
Data sanitisation type
  • Explicit overwriting of storage before reallocation
  • Deleted data can’t be directly accessed
Equipment disposal approach
Complying with a recognised standard, for example CSA CCM v.30, CAS (Sanitisation) or ISO/IEC 27001

Data importing and exporting

Data export approach
Data can be extracted by the end user at any point using export functions, and can also be made available upon request.
Data export formats
CSV
Data import formats
CSV

Data-in-transit protection

Data protection between buyer and supplier networks
  • Private network or public sector network
  • TLS (version 1.2 or above)
Data protection within supplier network
TLS (version 1.2 or above)

Availability and resilience

Guaranteed availability
99.5%
Approach to resilience
Deployed on an AWS platform and resides in three different Availability Zones (AZ), in case of outages in one of the AZ data-centers. Each AZ includes the application and all the supported entities that are required for the proper functionality of the solution, and monitoring
Outage reporting
Public dashboard (https://status.epm.cyberark.com/) and Email Alert

Identity and authentication

User authentication needed
Yes
User authentication
  • 2-factor authentication
  • Public key authentication (including by TLS client certificate)
  • Username or password
Access restrictions in management interfaces and support channels
Management interface is controlled by RBAC. Support access with CyberArk requires users to be registered and also take have completed training and passed the appropriate examinations
Access restriction testing frequency
At least every 6 months
Management access authentication
  • 2-factor authentication
  • Identity federation with existing provider (for example Google Apps)
  • Username or password

Audit information for users

Access to user activity audit information
Users have access to real-time audit information
How long user audit data is stored for
User-defined
Access to supplier activity audit information
Users have access to real-time audit information
How long supplier audit data is stored for
User-defined
How long system logs are stored for
User-defined

Standards and certifications

ISO/IEC 27001 certification
Yes
Who accredited the ISO/IEC 27001
The Standards Institute Israel
ISO/IEC 27001 accreditation date
04/01/2020
What the ISO/IEC 27001 doesn’t cover
ISO/IEC 27001:2013 issued by The Standards Institute Israel
Certificate is Applicable to Business processes: Research, development, sales and support of information security solutions and technologies.
ISO 28000:2007 certification
No
CSA STAR certification
No
PCI certification
No
Cyber essentials
Yes
Cyber essentials plus
No
Other security certifications
Yes
Any other security certifications
  • ISO9001
  • NSA Certified
  • VPAT 508
  • FIPS 140-2
  • SOC2

Security governance

Named board-level person responsible for service security
Yes
Security governance certified
Yes
Security governance standards
ISO/IEC 27001
Information security policies and processes
The InfoSec Department provide direction and technical expertise to ensure that CyberArk’s information is properly protected. This includes consideration of confidentiality, integrity, and availability of information and the systems that handle it. They act as liaison on InfoSec matters between all departments, and must be the focal point for all InfoSec activities throughout CyberArk. The Department performs risk-assessments, prepares action-plans, evaluates vendor-products, participates on in-houseIT system development projects, Implementations, investigates information security breaches, trains staff members. The InfoSec Department has the authority to create and periodically modify both technical standards and standard operating procedures that supports the InfoSec policy. When approved by appropriate CyberArk management, new requirements have the same scope and authority as if they were included in existing policy documents.

An information security steering committee, consisting of the CEO, GM, CIO and CISO must meet bi-weekly to review the current status of information security at CyberArk, approve and later review information security projects, and perform other necessary high-level information security management activities. Other employees may join the committee according to necessity and relevance. An information security Audit committee is being updated with information security work plan and risks management on a bi-quarterly basis.

Operational security

Configuration and change management standard
Supplier-defined controls
Configuration and change management approach
Supplier-defined controls
Vulnerability management type
Supplier-defined controls
Vulnerability management approach
Supplier-defined controls
Protective monitoring type
Supplier-defined controls
Protective monitoring approach
Supplier-defined controls
Incident management type
Supplier-defined controls
Incident management approach
Supplier-defined controls

Secure development

Approach to secure software development best practice
Supplier-defined process

Public sector networks

Connection to public sector networks
No

Social Value

Fighting climate change

Fighting climate change

Truststream is committed to fighting climate change through various directives such as being paperless, being part of the UK Gov cycling to work scheme and supporting hybrid working

Pricing

Price
£1.20 to £1.50 a device a month
Discount for educational organisations
Yes
Free trial available
Yes
Description of free trial
Free trials can be requested by contacting Truststream

Service documents

Request an accessible format
If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at paul.sullivan@truststream.co.uk. Tell them what format you need. It will help if you say what assistive technology you use.