CENTRAL NETWORKS AND TECHNOLOGIES LIMITED

KnowBe4

KnowBe4 is a cloud-based cybersecurity awareness and compliance training platform designed to help organizations manage the human element of security.

Features

• Phishing Simulations
• Interactive Training Modules
• Behavioural Analytics
• Gamification
• Policy Management

Benefits

• Campaign-Based Deployment
• Digital Sign-Offs
• Automated Workflows
• Centralized Tracking
• Customizable Content

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at Sales@centralnetworks.co.uk. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 15

Service ID

150060212088929

Contact

Tamar Waite
01706747474
Sales@centralnetworks.co.uk

About your service

• Service categories:

  Applications

  Production and operations

  • Other operations
• Multi cloud support: No

Service scope

• Software add-on or extension: Yes, but can also be used as a standalone service
• What software services is the service an extension to: Central Networks Security Operation Centre (SOC)
• Cloud deployment model: Public cloud
• Service constraints: No
• System requirements:
  • Per user license model
  • SaaS platform with no additional requirements

User support

• Email or online ticketing support: Yes
• Support response times: Response times are dependant on ticket categorisation and request type. Priority 1 Disaster, Response Time: 30 minutes, Target Fix: 4 hours. Priority 2 High, Response Time 1 hour, Target Fix: 8 hours. Priority 3 Medium, Response Time: 4 hours, Target Fix: 20 hours Priority 4 Low, Response Time: 10 hours, Target Fix: 30 hours Priority 5 informational, Response Time: 3 days, Target Fix: 90 days Out of hours service is available on request.
• User can manage status and priority of support tickets: Yes
• Online ticketing support accessibility: WCAG 2.2 AA
• Phone support: Yes
• Phone support availability: 24 hours, 7 days a week
• Web chat support: No
• Onsite support: Yes, at extra cost
• Support levels: Our operations team is broken down into two areas, Service Desk and Engineering. The Service Desk acts as the primary source of all activity, where calls are categorised, prioritised and filtered to the relevant specialist if required. Our calls are given a priority level from 1-5; whereas P1 is Disaster, business is non-operational all the way through to P5, of which could be a cosmetic incident, for example. Our response times and levels are summarised below: P1 - Urgent - 15mins Response Time (RT), 4 hrs Target Full Fix Time(TFFT) P2 - Critical - 30mins RT, 8 hrs TFFT P3 - Very Important - 4 hrs RT, 20 hrs TFFT P4 - Important - 10 hrs RT, 30 hrs TFFT P5 - Informational - 3 days RT, 90 days TFFT (never normally this long) The majority of activity will be remote based working, however we will send either a senior engineer to the client site, or a cloud specialist to a cloud hosting datacentre site, as and when required, depending on the incident. All priority incidents are included in our pricing, defined by customised SLA's and can be in unlimited numbers if required, depending on the client's needs.
• Support available to third parties: Yes

Onboarding and offboarding

• Getting started: All Knowbe4 customer have access to the Knowbe4 knowledge base which documents both how to use the system and gives access to self paced video training. Customer may also purchase Professional Services to support installation and delivery of the solution. Professional Services are an additional cost.
• Service documentation: Yes
• Documentation formats:
  • HTML
  • PDF
• End-of-contract data extraction: At end of contract KnowBe4 will destroy any data held within the system within 90 days of license expiry. If customer would like to extract data contract KnowBe4 Support or Account Manager to discuss options. Professional Services charges may apply for data extraction
• End-of-contract process: At end of contract KnowBe4 will destroy any data held within the system within 90 days of license expiry. If customer would like to extract data contract KnowBe4 Support or Account Manager to discuss options. Professional Services charges may apply for data extraction
• Documentation accessibility standard: None or don’t know
• How the documentation is accessible: Documentation is accessible via the KnowBe4 website of on request from a Knowbe4 Account manager. Alternatively documentation and assistance can be proved by Central Networks.

Using the service

• Web browser interface: Yes
• Supported browsers:
  • Microsoft Edge
  • Firefox
  • Chrome
  • Safari
  • Other
• Application to install: No
• Designed for use on mobile devices: Yes
• Differences between the mobile and desktop service: Outlook Plugins for alerting are not present on mobile platform.
• Service interface: Yes
• User support accessibility: WCAG 2.2 AA
• Description of service interface: Web interface
• Accessibility standards: WCAG 2.2 AA
• Accessibility testing: Completed by Knowbe4
• API: Yes
• What users can and can't do using the API: Reporting; Our reporting APIs allow you to pull phishing, training, user, and group data from your KSAT console.; User Events; Our user event APIs allow you to push your users' security-related events or training activities from external sources and push them into or pull them from your KSAT console.; Graph API function is also available
• API documentation: Yes
• API documentation formats: HTML
• API sandbox or test environment: Yes
• Customisation available: Yes
• Description of customisation: KnowBe4 allows organizations to customize their training content and notifications to fit their specific needs. Users can upload their own SCORM-compliant training and video content, add branded content to training modules, and create personalized training notifications. The platform also offers features like mobile-first modules, industry benchmarking assessments, and compliance training content. Additionally, KnowBe4 provides a way to manage IT security problems related to social engineering, spear phishing, and ransomware attacks through its integrated Security Awareness Training and Simulated Phishing platform.

Scaling

• Independence of resources: KnowBe4 use the AWS Fargate platform as a service. AWS Fargate is a serverless computer engine for Amazon Elastic Container Service (Amazon ECS) that allows KnowBe4 to run containers without having to provision, configure, and scale clusters of virtual machines (VMs). AWS Fargate manages the underlying infrastructure and clusters. It also automatically scales the application based on demand. AWS Fargate eliminates the need to scale, monitor, patch, and secure EC2 instances.

Analytics

• Service usage metrics: Yes
• Metrics types: You can use the Reporting feature to view actionable metrics and insights into the effectiveness of your security awareness training. From the Reports tab of your KnowBe4 console, you can create and customize reports to meet your organization's needs. These reports will help you understand where you need to improve your security awareness program to strengthen your human firewall.; ; You can filter each report by specific criteria and download your reports as PDF files or CSV files. The timestamp on our reports is in UTC format.
• Reporting types:
  • Real-time dashboards
  • Regular reports
• Resource tagging: Yes
• FOCUS resource tagging: No

Resellers

• Supplier type: Reseller providing extra support
• Organisation whose services are being resold: KnowBe4

Staff security

• Staff security clearance: Other security clearance
• Government security clearance: Baseline Personnel Security Standard (BPSS)

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations: United Kingdom
• User control over data storage and processing locations: Yes
• Datacentre security standards: Complies with a recognised standard (for example CSA CCM version 4.0)
• Penetration testing frequency: At least every 6 months
• Penetration testing approach: Another external penetration testing organisation
• Protecting data at rest: Physical access control, complying with SSAE-18 / ISAE 3402
• Data sanitisation process: Yes
• Equipment disposal approach: Complying with a recognised standard, for example CSA CCM v4.0, CAS (Sanitisation) or ISO/IEC 27001
• Data sanitisation type: Data Erasure

Data importing and exporting

• Data export approach: The platform includes options for exporting data from the environment.
• Data export formats: CSV
• Data import formats: CSV

Data-in-transit protection

• Data protection between buyer and supplier networks: Private network or public sector network
• Data protection within supplier network: TLS (version 1.2 or above)

Availability and resilience

• Guaranteed availability: All SLA terms are cascaded from KnowBe4 master agreement for https://www.knowbe4.com/legal/service-level-agreement. Service credits are available.
• Approach to resilience: The International Organization for Standardization 27001 Standard (ISO 27001) is an information security standard that ensures office sites, development centers, support centers and data centers are securely managed. KnowBe4 is audited against a variety of standards in the International Organization for Standardization 27001 (ISO 27001) family by its independent third party ANSI-ASQ National Accreditation Board (ANAB) accredited certifier. These standards which KnowBe4 has successfully been audited against include:; ; The International Organization for Standardization 27001:2022 Standard covering information security controls; The International Organization for Standardization 27701:2019 Standard covering privacy information management; The International Organization for Standardization 27017:2015 Standard covering information security controls for cloud computing; The International Organization for Standardization 27018:2019 Standard covering protecting PII in the public cloud for data processors
• Outage reporting: All service impacting issues are reported on https://status.knowbe4.com/ and a subscription to this feed is available.

Identity and authentication

• User authentication needed: Yes
• User authentication:
  • Multi-Factor Authentication (MFA)
  • Identity federation with existing provider (for example Google Apps)
  • Username or password
• Access restrictions in management interfaces and support channels: Access is based on username and password with MFA. Access to functions is control via RBAC.
• Access restriction testing frequency: At least once a year
• Management access authentication:
  • Multi-Factor Authentication (MFA)
  • Public key authentication (including by TLS client certificate)
  • Identity federation with existing provider (for example Google Apps)
  • Username or password

Audit information for users

• Access to user activity audit information: Users have access to real-time audit information
• How long user audit data is stored for: At least 12 months
• Access to supplier activity audit information: Users have access to real-time audit information
• How long supplier audit data is stored for: At least 12 months
• How long system logs are stored for: At least 12 months

Security governance

• Named board-level person responsible for service security: Yes
• Security governance certified: Yes
• Security governance standards: ISO/IEC 27001
• Information security policies and processes: All security governance, security process and standard can be found at https://www.knowbe4.com/legal/security
• Software Security Code of Practice: Yes

Operational security

• Configuration and change management standard: Supplier-defined controls
• Configuration and change management approach: The KnowBe4 Research and Development (R&D) department leverages a Continuous Integration / Continuous Delivery (CI/CD) pipeline for managing code deployments. Code changes are peer reviewed, approved by separate QA staff, and tested in a staging environment before they are pushed into production. The staging and production environments are logically separated, and no data is shared between them
• Vulnerability management type: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Vulnerability management approach: The KnowBe4 information security team performs monthly web application vulnerability scans. These scans are configured to run as authenticated scans. Any vulnerabilities found during these scans or any other vulnerability discovery activities are added to a vulnerability tracking system. There, the vulnerabilities are verified, categorized, and evaluated for actual risk. Vulnerabilities are remediated in accordance with the schedule.
• Protective monitoring type: Supplier-defined controls
• Protective monitoring approach: KnowBe4 have designed highly scalable and resilient product architecture within AWS and Azure. Our products withstand sophisticated attacks and are highly adaptable. Systems’ performance within our products’ architecture is monitored for key metrics. Should any components become overloaded or experience a fault, automated processes will be executed to bring online additional temporary systems or to cycle out existing systems for new ones. Automation is built into the KnowBe4 architecture, so system monitoring, updates, and corrective actions can take place as needed. KnowBe4’s Risk Management Program is reviewed as part of KnowBe4’s annual third-party audits (FedRAMP, ISO 27001, and SOC2).
• Incident management type: Complies with a recognised standard, for example, CSA CCM v4.0 or ISO/IEC 27035:2011 or SSAE-18 / ISAE 3402
• Incident management approach: If KnowBe4 becomes aware of any unlawful access to any Customer Data stored on KnowBe4 equipment or in KnowBe4 facilities that results in the loss, disclosure or alteration of Customer Data (each a “Security Incident”), KnowBe4 will promptly (1) notify Customer of the Security Incident; (2) investigate the Security Incident; and (3) take reasonable steps to mitigate the effects of, and minimize any damage resulting from, the Security Incident. Security Incidents Notification(s) will be delivered to one or more Customer administrator by a means selected by KnowBe4, including via email.
• Post-quantum cryptography secure: Yes

Secure development

• Approach to secure software development best practice: Conforms to a recognised standard, but self-assessed

Public sector networks

• Connection to public sector networks: No

Pricing

• Discount for educational organisations: No
• Free trial available: No

Discount percentage by annual call-off contract value (excluding VAT)

• Less than £250,000: 0.25%
• Between £250,000 and £500,000: 0.5%
• Between £500,001 and £1,000,000: 0.75%
• Between £1,000,001 and £2,500,000: 1%
• Between £2,500,001 and £5,000,000: 1.25%
• Over £5,000,001: 1.5%

Non-mandatory Standards and certifications

• ISO/IEC 27001 certification: Yes
• Who accredited the ISO/IEC 27001: Citation
• ISO/IEC 27001 accreditation date: Monday 19 May 2025
• What the ISO/IEC 27001 doesn’t cover: None
• ISO 28000:2022 certification: No
• ISO 9001 certification: Yes
• Who accredited the ISO 9001 certification: Citation
• ISO 9001 accreditation date: Friday 3 January 2025
• What the ISO 9001 doesn’t cover: None
• Quality management systems (QMS): Yes
• CSA STAR certification: No
• PCI certification: No
• Cyber essentials: Yes
• Please provide your Cyber Essentials Certificate Number: 79646496-1330-4827-b087-691615c42291
• Cyber essentials plus: Yes
• Please provide your Cyber Essentials Plus Certificate Number: 106b321e-346f-4e5c-abd9-51b4fc523fa0
• Other security certifications: No

Social value

• Section B - Commitment for Future: Delivery:

  • Mission: Kick start economic growth. To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

    Policy Outcome 3: Resilient, innovative and flexible supply chains: Support economic growth through enabling resilient businesses, opportunities for small businesses and voluntary, community and social enterprises

    • Activities that demonstrate a collaborative way to work with a diverse range of businesses as part of the supply chain

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at Sales@centralnetworks.co.uk. Tell them what format you need. It will help if you say what assistive technology you use.