Bytes Software Services

Zscaler for users

Zscaler for users provides fast, secure, and reliable access to applications and the internet from anywhere. Zscaler delivers policy-based, secure access to private applications and assets without the cost, or security risks of a VPN. bssgc

Features

• Secure private application access, without exposing applications to the Internet
• Decouples private internal applications from the physical network
• No VPN client to launch, or exit
• Global visibility for users and applications
• Single console for policy definition and management
• Secure Web Gateway - on any device, in any location
• URL and Content Filtering - with granular policy rules
• Cloud Sandboxing - Protection against Advanced Persistent Threats (APTs)
• Easily scale Data Loss Prevention (DLP) to all users
• Quickly and easily scale protection to all offices or users

Benefits

• Secure internet access, including roaming users and mobile devices
• No hardware or software to purchase and administer, reduces expenses
• Eliminate backhauling data for fast experience with Office 365
• Over 120,000 security updates/day - unrivalled intelligence
• Integrated Sandboxing, Cloud Firewall, URL Content Filtering, DLP, CASBs
• SSL inspection stops threats, data leaks in encrypted traffic
• No need to buy excess capacity— Zscaler cloud scales elastically
• Users get application access without network access
• Users only see apps/resources they are authorised to access
• No need to buy, maintain, or upgrade VPN hardware

£178 a user

• Education pricing available
• Free trial available

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at tenders@bytes.co.uk. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 14

Service ID

280293626115333

Contact

Chris Swani
+44 (0) 7951 326815
tenders@bytes.co.uk

Service scope

• Software add-on or extension: No
• Cloud deployment model: Private cloud
• Service constraints: There are no operational constraints to the service
• System requirements:
  • For offices, set-up a GRE/IPsec router-tunnel to the closest Zscaler-DC
  • For mobile employees, forward traffic via the ZscalerApp or PACfile

User support

• Email or online ticketing support: Email or online ticketing
• Support response times: Response time will be dependent on severity, 30 minutes for P1, 1hr for P2, 3hrs for P3 and 4hrs for P4.
• User can manage status and priority of support tickets: Yes
• Online ticketing support accessibility: None or don’t know
• Phone support: Yes
• Phone support availability: 24 hours, 7 days a week
• Web chat support: No
• Onsite support: Yes, at extra cost
• Support levels: Our support options can be found here - https://www.zscaler.com/legal/sla-support
• Support available to third parties: Yes

Onboarding and offboarding

• Getting started: "Documentation on deployment guides, help portals can be found on Zscaler Help: https://help.zscaler.com/; All online training can be accessed by Zscaler Academy: https://www.zscaler.com/zscaler-academy"
• Service documentation: Yes
• Documentation formats:
  • HTML
  • PDF
• End-of-contract data extraction: The reports here give different options to extract data from the tenants: https://help.zscaler.com/zia/dashboard-analytics/reports
• End-of-contract process: Data generated by the use of the service can be streamed directly in real time to the customer. If, at the end of contract, the customer requests all data, 6 months will be made available.

Using the service

• Web browser interface: Yes
• Supported browsers:
  • Microsoft Edge
  • Firefox
  • Chrome
• Application to install: Yes
• Compatible operating systems:
  • MacOS
  • Windows
• Designed for use on mobile devices: Yes
• Differences between the mobile and desktop service: None
• Service interface: No
• User support accessibility: None or don’t know
• API: Yes
• What users can and can't do using the API: API is available on request, documentation can be found at https://help.zscaler.com/zia/api
• API documentation: Yes
• API documentation formats: HTML
• API sandbox or test environment: Yes
• Customisation available: Yes
• Description of customisation: Administrators can customise all policies to manage and control users. Acceptable use policy prompts and user messaging frameworks can be highly customised.

Scaling

• Independence of resources: "Zscaler has architected its platform from scratch in order to create a solution that is unparalleled in its scalability.; ; All ZIA Public Service Edges use multi-core architecture to intelligently load-balance tasks within the Public Service Edge. As a result, there is no need for any external load balancing. This inherent scalability differentiates our solution in its ability to provide the service at a unique price point and also have points of presence in numerous locations across the world.; ; We boast the largest cloud deployment for security as a service with over 150+ nodes distributed across the world.

Analytics

• Service usage metrics: Yes
• Metrics types: Service usage, threats detected and stopped, types of threats blocked, Bandwidth, SSL inspedction, license usage, latency, top cloud applications,traffic volume trends, Office365 usage, potential sensitive files being uploaded and more. Please note these will be reviewed during QBR sessions but are accessible as a powerpoint presentation for your own assesment and playback within the organisation.
• Reporting types:
  • API access
  • Real-time dashboards

Resellers

• Supplier type: Reseller (no extras)
• Organisation whose services are being resold: Zscaler

Staff security

• Staff security clearance: Other security clearance
• Government security clearance: None

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations:
  • United Kingdom
  • European Economic Area (EEA)
• User control over data storage and processing locations: Yes
• Datacentre security standards: Complies with a recognised standard (for example CSA CCM version 3.0)
• Penetration testing frequency: At least every 6 months
• Penetration testing approach: Another external penetration testing organisation
• Protecting data at rest: Encryption of all physical media
• Data sanitisation process: Yes
• Data sanitisation type:
  • Explicit overwriting of storage before reallocation
  • Deleted data can’t be directly accessed
• Equipment disposal approach: A third-party destruction service

Data importing and exporting

• Data export approach: With Zscaler Internet Access (ZIA), you can download data in CSV format, for any specified date/time range, within theavailable 6-month window. Audit Logs can also be retrieved via API, enabling easy integration to SIEM and third-party auditing tools. To learn more, see: https://help.zscaler.com/zia/audit-log-use-cases
• Data export formats: CSV
• Data import formats: Other
• Other data import formats: N/a

Data-in-transit protection

• Data protection between buyer and supplier networks: TLS (version 1.2 or above)
• Data protection within supplier network: TLS (version 1.2 or above)

Availability and resilience

• Guaranteed availability: 99.999%, assured by contractual commitment
• Approach to resilience: Each Zscaler cloud has three key components - the Central Authority, Zscaler Enforcement Nodes and Nanolog clusters. The CA consists of one active server and two in passive standby mode. The active CA replicates data in real time to the two standby CAs, so any of them can become active at any time and each is hosted in separate locations. Zscaler Enforcement Nodes are inline Internet security gateways inspecting Internet traffic bi-directionally for malware and enforce security and compliance policies. When a user moves to a different location, the nearest Node downloads and enforces the appropriate policy for that user.
• Outage reporting: Zscaler monitors its cloud through proprietary monitoring systems and 3rd parties. Live stats and alerts are available here 24/7: https://trust.zscloud.net/

Identity and authentication

• User authentication needed: Yes
• User authentication:
  • 2-factor authentication
  • Public key authentication (including by TLS client certificate)
  • Identity federation with existing provider (for example Google Apps)
  • Username or password
• Access restrictions in management interfaces and support channels: "Management access is restricted per login and further with orchestrated access via individual accounts.; ; Support access is federated via vendor support and live chat."
• Access restriction testing frequency: At least every 6 months
• Management access authentication:
  • Dedicated link (for example VPN)
  • Username or password

Audit information for users

• Access to user activity audit information: Users have access to real-time audit information
• How long user audit data is stored for: Between 1 month and 6 months
• Access to supplier activity audit information: Users have access to real-time audit information
• How long supplier audit data is stored for: Between 1 month and 6 months
• How long system logs are stored for: Between 1 month and 6 months

Standards and certifications

• ISO/IEC 27001 certification: Yes
• Who accredited the ISO/IEC 27001: Schellman Compliance, LLC
• ISO/IEC 27001 accreditation date: 10/05/2023
• What the ISO/IEC 27001 doesn’t cover: No ISO/IEC 27001 control activities have been excluded from the scope of Zscaler’s ISMS and PIMS.
• ISO 28000:2007 certification: No
• CSA STAR certification: Yes
• CSA STAR accreditation date: 31/07/2023
• CSA STAR certification level: Level 2: CSA STAR Attestation
• What the CSA STAR doesn’t cover: No CSA STAR control activities have been excluded from the scope of Zscaler’s ISMS and PIMS.
• PCI certification: No
• Cyber essentials: Yes
• Cyber essentials plus: Yes
• Other security certifications: Yes
• Any other security certifications:
  • SOC 2 Type 2 Report
  • SOC 3 Type 2 Report
  • ISO 27017
  • ISO 27018
  • ISO 27701
  • Sensitive Data Handling Assessment
  • NIST Cybersecurity Framework
  • StateRAMP
  • FedRAMP
  • DOD Impact Level 2 & 5

Security governance

• Named board-level person responsible for service security: Yes
• Security governance certified: Yes
• Security governance standards:
  • CSA CCM version 3.0
  • ISO/IEC 27001
• Information security policies and processes: "Aligning with ISO27001, Zsclaer has defined its information security and privacy program as part of the scope of the ISMS and PIMS and supporting informaiton security and privacy policies to help define ISMS and PIMS ownership, accountability, and scope in alignment with relevant policies, standards, procedures, and guidelines. The head of global security compliance, the risk and compliance manager, and the legal department, are ultimately responsible for developing and maintaining the ISMS and PIMS program and therefore, have been delegated the following responsibilities: ; ; • Establishing the information security and privacy policies and objectives which are compatible with Zscaler’s strategic direction;; • Ensuring integration of ISMS and PIMS requirements into Zscaler’s processes;; • Ensuring resources are available for the support of the ISMS and PIMS;; • Communicating the importance of effective information security and privacy management and of conforming to the ISMS and PIMS requirements;; • Ensuring the ISMS and PIMS achieve its intended outcome(s);; • Directing and supporting persons to contribute to the effectiveness of the ISMS and PIMS;; • Promoting continual improvement; and; • Encouraging and supporting other management roles to demonstrate leadership within their areas or responsibility."

Operational security

• Configuration and change management standard: Conforms to a recognised standard, for example CSA CCM v3.0 or SSAE-16 / ISAE 3402
• Configuration and change management approach: "Zscaler’s Configuration and Change Management process policies and procedures, part of our ISO 27001 and SOC 2 Type 2 certifications that are audited annually by an independent third party, contain confidential information and are not distributed publicly. However, compliance certificates and certification reports are available via download or through a request form link from our public-facing web page: https://www.zscaler.com/company/compliance The individual downloading the information will be prompted to go through the DocuSign page to acknowledge Zscaler’s terms and conditions for using our compliance reports. ; "
• Vulnerability management type: Conforms to a recognised standard, for example CSA CCM v3.0 or SSAE-16 / ISAE 3402
• Vulnerability management approach: Zscaler has a documented Security Audit and Vulnerability Management procedure, created in accordance with our ISO 27001 certification, that provides instructions for conducting security audits/vulnerability testing, evaluating information system technical vulnerability results, and remediating technical vulnerabilities or implementing appropriate measures to address associated risk. Zscaler has a full suite of policies audited by external auditors annually for compliance with SOC 2 Type II, ISO 27001, ISO 27701, ISO 27017, ISO 27018, CSA Star, and other major global frameworks, which can be reviewed on our public-facing compliance we page at: https://www.zscaler.com/compliance/overview
• Protective monitoring type: Conforms to a recognised standard, for example CSA CCM v3.0 or SSAE-16 / ISAE 3402
• Protective monitoring approach: Zscaler monitors the daily business and operational activities, including the internal control environment, as a routine part of business. Zscaler has implemented a set of logging and monitoring tools that are configured to collect data from system infrastructure components to monitor system performance, potential security threats and vulnerabilities, resource utilization and alert IT operations upon detection of unusual system activity or service requests. The in-scope systems are monitored using enterprise monitoring applications that track system performance, responsiveness, availability and vulnerabilities.
• Incident management type: Conforms to a recognised standard, for example, CSA CCM v3.0 or ISO/IEC 27035:2011 or SSAE-16 / ISAE 3402
• Incident management approach: Zscaler has an Incident Response Plan (IRP) in place to ensure that we are prepared to manage cyber incidents in an effective and efficient manner and respond accordingly. The IRP identifies the structure, roles and responsibilities, types of common incidents, and the approach to preparing, identifying, containing, eradicating, recovering, and conducting lessons learned to minimize the impact of security incidents. Our Management team has defined the following types of incidents:; • Support Incidents: Customer-related incidents; • Security Incidents: These may include security weaknesses, Acceptable Use Policy (“AUP”) violations, suspected and actual data security breaches, or incidents resulting from vulnerability scans

Secure development

• Approach to secure software development best practice: Supplier-defined process

Public sector networks

• Connection to public sector networks: No

Social Value

• Social Value:

  Social Value

  Fighting climate change

  Fighting climate change

  We take our environmental management and the impact we have on the environment very seriously. We have environmental policies in place and hold the ISO14001 accreditation. Our environmental assessments are conducted annually by an external Lead ESOS Assessor; they are signed-off by the board and compliance reported to the regulator (the Environment Agency). Our environmental policy is published on our website at https://www.bytes.co.uk/company/sustainability/environmental.; Bytes achieved carbon net zero in March 2022 through approved carbon offsetting schemes. We are always seeking to reduce our impact on the environment. We aim to minimise waste, reduce pollutants and use renewable materials. Our offices have recycling facilities for cans, plastic and paper. We aim to reduce our office printing to zero within the next few years. ; An Environmental Steering Committee has been established to coordinate environmental activities and drive change.; To drastically reduce our emissions, we have switched to renewable energy. Our Head Office has reached our first milestone of using a specialist 100% renewable electricity provider. We are also exploring options to install solar panels on our Headquarters building.; Other environmental initiatives include installing electric vehicle charging points and encouraging staff to commute to work without the car (setting up a car share network and installing secure cycle parking).; We produce a SECR (Streamlined Energy and Carbon Reporting) report that details the companies energy consumption and carbon emissions. This report is produced annually by an independent assessor. ; This report provides details of our emissions in Scope 1, 2 and 3 categories. It details the activities previously taken to reduce emissions and also recommendations for further improvements.; For scope 1,2 and 3 emissions we aim to reduce these by 50% by 2025-2026 from our 2021 baseline.; We aim to be Net Zero by 2040, covering our own operational emissions.

Pricing

• Price: £178 a user
• Discount for educational organisations: Yes
• Free trial available: Yes
• Description of free trial: Full product on qualified 30-day proof-of-concept trial. When organisations satisfy themselves that the product functions as specified, they usually proceed to purchase and the PoC trial is simply switched to production and the full production user-load added.

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at tenders@bytes.co.uk. Tell them what format you need. It will help if you say what assistive technology you use.