Charterhouse Voice & Data

Proofpoint Security Awareness Training - Pentesec

Proofpoint Security Awareness Training helps you deliver the right
training to the right people at the right time. It turns your end users into
a strong last line of defense in identifying cyber attacks and protecting
your organization.

Features

• Threat Sim Phishing Simulations
• Cyber Strength Knowledge Assessments
• Interactive Training Modules
• Customisation Center
• Security Awarness Materials
• Phish Alarm Button (End User Email Reporting)
• Phish Alarm Analyzer (Abuse Mailbox Automation)
• Reporting Dashboards
• Auto Enrolment

Benefits

• Assess susceptibility to phishing and measure risk
• Measure understanding of critical cybersecurty topics and track progress
• Customizable cybersecurity content covers a broad range of security risks
• Edit preexisting content to increase relevance to audience
• Library of videos, posters and articles to embed security culture
• Lets users report suspicious messages with a single mouse click
• Prioritises reporting phishing emails and improves incident response
• Identify vulnerable users and track training progress
• Automaticaly enrol users who need training into relevant courses

£11.98 to £46.02 a unit

• Education pricing available
• Free trial available

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at publicsector@cvdgroup.com. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 13

Service ID

211485346391526

Contact

Liz Holmes
02076137441
publicsector@cvdgroup.com

Service scope

• Software add-on or extension: No
• Cloud deployment model: Community cloud
• Service constraints: No
• System requirements: None

User support

• Email or online ticketing support: Email or online ticketing
• Support response times: "P1 First Response - 1 hour; P2 First Response - 4 business hours; P3 First Response - 8 business hours; P4 First Response - 16 business hours"
• User can manage status and priority of support tickets: Yes
• Online ticketing support accessibility: None or don’t know
• Phone support: Yes
• Phone support availability: 24 hours, 7 days a week
• Web chat support: No
• Onsite support: No
• Support levels: Support is included in quotes provided for the related Proofpoint products. There is Self Service Support, Platinum Support and Premium Support. Customers with Platinum Support or Premium Support also have the ability to purchase the optional Global Add-On. A Technical Account Manager can also be provided at an extra cost.
• Support available to third parties: Yes

Onboarding and offboarding

• Getting started: Proofpoint Professional Services provides an implementation service. Each customer is aligned with a Professional Services consultant who will onbaord them. There is also online training and documentation provided as well as access to the articles, forums, etc. in the Proofpoint community portal.
• Service documentation: Yes
• Documentation formats:
  • HTML
  • PDF
• End-of-contract data extraction: Data extraction tools driven by customer.
• End-of-contract process: Implementation is included in the price of the contract and there is no additional charge for offboarding. At the end of the contract the service ceases to function.

Using the service

• Web browser interface: Yes
• Supported browsers:
  • Internet Explorer 11
  • Microsoft Edge
  • Firefox
  • Chrome
  • Safari
  • Opera
• Application to install: No
• Designed for use on mobile devices: Yes
• Differences between the mobile and desktop service: The experience of the Proofpoint email filtering service will be the same no matter how email is accessed (e.g. via desktop or mobile mail clients).
• Service interface: Yes
• User support accessibility: None or don’t know
• Description of service interface: Administrators can connect to an admin GUI to configure settings.
• Accessibility standards: None or don’t know
• Description of accessibility: Using a web browser
• Accessibility testing: Access is via a web browser, so standard web browser accessibility options apply.
• API: Yes
• What users can and can't do using the API: Admins can configure an API so that reporting details from Proofpoint email filtering are fed into a SIEM tool.
• API documentation: Yes
• API documentation formats:
  • HTML
  • PDF
• API sandbox or test environment: No
• Customisation available: No

Scaling

• Independence of resources: Each customer has a separate email filtering cluster just for them as well as their own decicaed IP addresses. The cluster for each customer is sized according to the compute resources needed to handle their mail flow and this can be adjusted if mail flow volumes change.

Analytics

• Service usage metrics: Yes
• Metrics types: Various reports are generated on things such Inbound Email Summary, Inbound Spam and Bulk Summary, Inbound Threat Summary, Outbound Email Summary.
• Reporting types:
  • API access
  • Real-time dashboards
  • Regular reports
  • Reports on request

Resellers

• Supplier type: Reseller providing extra support
• Organisation whose services are being resold: Proofpoint

Staff security

• Staff security clearance: Other security clearance
• Government security clearance: Up to Security Clearance (SC)

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations:
  • European Economic Area (EEA)
  • Other locations
• User control over data storage and processing locations: Yes
• Datacentre security standards: Complies with a recognised standard (for example CSA CCM version 3.0)
• Penetration testing frequency: At least once a year
• Penetration testing approach: Another external penetration testing organisation
• Protecting data at rest: Other
• Other data at rest protection approach: AES 256 bit encryption
• Data sanitisation process: Yes
• Data sanitisation type:
  • Explicit overwriting of storage before reallocation
  • Deleted data can’t be directly accessed
• Equipment disposal approach: In-house destruction process

Data importing and exporting

• Data export approach: Data Extraction tools driven by customer.
• Data export formats: CSV
• Data import formats: CSV

Data-in-transit protection

• Data protection between buyer and supplier networks: TLS (version 1.2 or above)
• Data protection within supplier network: TLS (version 1.2 or above)

Availability and resilience

• Guaranteed availability: https://www.proofpoint.com/sites/default/files/general_terms_hosted_services_sla_-_mar_2016.pdf
• Approach to resilience: The services run in active/active mode between a pair of gegraphically-diverse co-location facilities.
• Outage reporting: https://www.proofpoint.com/sites/default/files/general_terms_hosted_services_sla_-_mar_2016.pdf

Identity and authentication

• User authentication needed: Yes
• User authentication: Identity federation with existing provider (for example Google Apps)
• Access restrictions in management interfaces and support channels: All access to the Proofpoint production environment, where services are hosted, is via a 2FA encrypted VPN and granted based on role.
• Access restriction testing frequency: At least once a year
• Management access authentication:
  • 2-factor authentication
  • Dedicated link (for example VPN)
  • Username or password

Audit information for users

• Access to user activity audit information: Users have access to real-time audit information
• How long user audit data is stored for: Between 1 month and 6 months
• Access to supplier activity audit information: Users have access to real-time audit information
• How long supplier audit data is stored for: Between 1 month and 6 months
• How long system logs are stored for: Between 1 month and 6 months

Standards and certifications

• ISO/IEC 27001 certification: Yes
• Who accredited the ISO/IEC 27001: British Assessment Bureau
• ISO/IEC 27001 accreditation date: 15/09/2021
• What the ISO/IEC 27001 doesn’t cover: N/a
• ISO 28000:2007 certification: No
• CSA STAR certification: No
• PCI certification: No
• Cyber essentials: Yes
• Cyber essentials plus: No
• Other security certifications: Yes
• Any other security certifications: SOC 2 Type II audit report, available here: https://go.proofpoint.com/soc2_report_request.html

Security governance

• Named board-level person responsible for service security: Yes
• Security governance certified: No
• Security governance approach: The Proofpoint security program is led by the Proofpoint CSO. The program is based on identifying and mitigating risk to our personnel, the organization and the customer.
• Information security policies and processes: NIST 800-53

Operational security

• Configuration and change management standard: Supplier-defined controls
• Configuration and change management approach: Proofpoint has a documented change management policy that includes requirements around documented change tickets and review and approval by the Change Review Board.
• Vulnerability management type: Supplier-defined controls
• Vulnerability management approach: Proofpoint performs internal and external vulnerability scanning and remediates applicable findings in line with the Proofpoint patch management policy.
• Protective monitoring type: Supplier-defined controls
• Protective monitoring approach: Proofpoint has distributed monitoring in place for availability, performance, capacity and security. Alerts are directed to a 24x7 NOC or SOC for review, remediation and/or escalation.
• Incident management type: Supplier-defined controls
• Incident management approach: Proofpoint has a documented Incident Response Plan that includes procedures to detect, investigate, remediate and communicate security incidents. A trained IRT team is responsible for the maintenance of the program.

Secure development

• Approach to secure software development best practice: Supplier-defined process

Public sector networks

• Connection to public sector networks: No

Social Value

• Fighting climate change:

  Fighting climate change

  At Charterhouse group are working hard to fight climate change, from Zero or offset carbon suppliers, to making sure we can use the circular economy and deploy tools and services that are carbon or energy reducing compared to the current platforms and services. Some examples are SIP from a carbon neutral company, to recycling old handsets and PBX equipment, and looking to displace handsets for power savings by using softphones on laptops and PC's that are already consuming power over physical handsets that draw power in addition to devices already being powered. We are empowering the business to look at this area closely and develop new policies and objectives as part of the business planning cycles. The Environment Policy of The Company is to ensure so far as it is reasonably practicable that its operations will be carried out with a commitment to protecting and enhancing the environment. As an office we know that we generate wastepaper products. However, as we strive for excellence in every aspect of our business, we are committed to minimising the environmental impacts of the business operation. Our stated aims are to: • Aim to continuously improve our environmental performance particularly with regards to our recycling and re-use of paper. • Where possible we will use recycled or ecologically friendly paper. • We will use 'waste' paper for notepads unless confidentiality may be compromised. • Reduce our consumption of resources and improve the efficiency of those resources by printing double sided where practicable. • Manage waste generated from my business operations according to the principles of reduction, re-use and recycling. • Recycle all paper products, ink or toner cartridges. • Comply as a minimum with all relevant environmental legislation as well as other environmental requirements.
• Covid-19 recovery:

  Covid-19 recovery

  Charterhouse is a growing group of companies, made up of several organisations from across the UK, we are continuing to employ staff from various backgrounds. We have created new employment opportunities, will re-train staff that find themselves in a position that their role is no longer available and support employment of those who left employment by COVID-19. Locally sourced staff is no longer the norm, we are embracing the work from anywhere culture, our staff current and new will have the option to work from home or an office and no longer need to be employed from the local area however, where new staff would like to work from a local office, they will be given that opportunity. Charterhouse will look to support businesses in the recovery from Covid by supporting them in new ways of working by implementing new technologies that support the new ways of working that decrees the need for travel and reduce the chance of infection rates. These new technologies and ways of working will support the recovery of our NHS and other organisations to levels pre-Covid. Our ability to bring together many technology stacks allows business to employ the right people as Charterhouse does and drive success through innovative ways of working. Implementing new health initiatives within Charterhouse will support mental and physical health for staff, maintaining the hybrid working environment will stop the spread of the COVID 19 within our workforce allowing economic growth. At Charterhouse, we feel strongly about being able to give back to our community. Each year we nominate an organisation doing great work with those in need and support them – both financially through our regular fundraising, and practically with our business technology expertise where they need help and support.
• Tackling economic inequality:

  Tackling economic inequality

  Charterhouse is growing, in the last 2 years we have purchased existing business to ensure group growth, these companies have brought growth to both their business and ours. These businesses are hiring within the group to ensure that we can continue organic growth to secure the future of staff and the wider group. Our ability to support SME’s is backed by our experience as an SME and one a family run business. Growth for our group comes from within and externally where your ability and attitude is more important than diversity or background. Employing the best person is key to growth, but more importantly equality. Our HR team look at the person and ability to carry out a role rather than disability or background. Our goal is to continue growth from organic, ethical and people centric sales. We allow people to be themselves, to thrive, to learn and grow in their role or for future roles. Our staff where needed will be accredited via vendors and suppliers as well as industry standard qualifications needed, backed by time and support from Charterhouse to achieve these skills and accreditations. Charterhouse are introducing more robust policies to promote a supply chain that is more sustainable and based on value than size. Smaller distributers and suppliers can deliver more value to the group, we can support smaller business by offering more opportunities to work with us and on behalf of our customers where we need 3rd party support or distribution. We work closely with suppliers to ensure that we can deliver on contracts sustainable, ethically and securely, working to many ISO standards though to Cyber essentials, our accreditations provide a framework for growth, improvement and security.
• Equal opportunity:

  Equal opportunity

  We have a robust recruitment policy that drives equality from the top down. Assessment criteria Our aim at Charterhouse Group, will be to always recruit the person who is most suited to each role, whether the candidate is internal or external. We recruit solely on the basis of the candidate’s skills, capabilities and individual merit as measured against the criteria for the role. Qualifications, experience, and skills may also be assessed at the level that is relevant to the job. Job descriptions and employee specifications Before initiating the recruitment process, the responsible Hiring Manager must ensure that there is an up-to-date job description for the role with clear employee specification. Advertisement of vacancies It is our policy that all vacancies be advertised on the company intranet. Equality, Diversity and Inclusion We are committed to applying our equality, diversity and inclusion policy at all stages of the recruitment and selection process. We always carry out shortlisting, interviewing and selection without regard to an applicant's sex, gender identity, sexual orientation, marital or civil partnership status, skin colour, race, nationality, ethnic or national origins, religion or belief, age, pregnancy or maternity leave. We will never exclude any candidate with a disability unless it is clear that the candidate is unable to perform a duty that is intrinsic to the role, having taken into account reasonable adjustments. To prevent any candidate from being disadvantaged because of a disability, the individual responsible for communicating with applicants should ask each candidate whether or not they require reasonable adjustments to be made. Interviews Hiring Managers conducting recruitment interviews will ensure that any questions asked during the interview is not in any way discriminatory or unnecessarily intrusive. The interview will focus on the role and the skills needed to perform it effectively.
• Wellbeing:

  Wellbeing

  Charterhouse take wellbeing seriously, not only do we ensure staff can work to a health work/life balance, but also can work from home when needed. The further deployment of Yu Life gives staff a set of tools and challenges to maintain both body and mental health. Teams, individuals and friends all compete in daily and weekly challenges to keep body fit, and allows for mental hearth checks and challenges. Annual company meetings and mental health first aiders all encourage staff to maintain mental health, but in a time of need they know they have help available. In addition to the above, Charterhouse offer all staff added benefits, for example Private Health care, free flu jabs and eye tests, a day off on your birthday each year, all to help boost mind and body health.

Pricing

• Price: £11.98 to £46.02 a unit
• Discount for educational organisations: Yes
• Free trial available: Yes
• Description of free trial: A limited time period to try the solution.

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at publicsector@cvdgroup.com. Tell them what format you need. It will help if you say what assistive technology you use.