Trend Micro One

Service scope

Service constraints: No constraints regarding maintenance arrangements or specific hardware configurations. All supported platforms can be found at docs.trendmicro.com
System Requirements are based on the service that the customer requires. For example if End User Protection is the requirement then the client operating system will need to be either Windows, Linux or Mac to a minimum build requirement which can be found at trendmicro.com
System requirements: System Requirements are based on the service that endusers requires

Minimum build requirement which can be found at trendmicro.com

User support

Email or online ticketing support: Email or online ticketing
Support response times: Trend Micro will make a commercially reasonable effort to ensure that its technical staff promptly answer Customer’s calls, respond to Customer’s questions, and correct software/service deficiencies, according to the severity definitions and target initial response times identified in the following link: https://success.trendmicro.com/dcx/s/solution/000285802?language=en_US
User can manage status and priority of support tickets: Yes
Online ticketing support accessibility: WCAG 2.1 AAA
Phone support: Yes
Phone support availability: 9 to 5 (UK time), 7 days a week
Web chat support: Web chat
Web chat support availability: 9 to 5 (UK time), 7 days a week
Web chat support accessibility standard: WCAG 2.1 AAA
Web chat accessibility testing: Web chat is accessible via the online chat portal login or via https://success.trendmicro.com/contact-support-europe

Full testing such as short hand word identification
Onsite support: Yes, at extra cost
Support levels: Standard 9-6.30pm 5 days a week support is complimentary to Trend Micro customers.

Premium Support is 24x7 and charged based upon which solution is being supported. Further information can be requested from Account Manager.
Support available to third parties: Yes

Onboarding and offboarding

Getting started: Complimentary online customer training courses are available for all of our porfolio, as well as chargeable onsite training. Our customer success function is committed to helping customers get the most from Trend Micro solutions. Geeting started guides can be found here https://www.trendmicro.com/en_gb/business/europe/get-started-with-trend-micro.html
Service documentation: Yes
Documentation formats: HTML

PDF
End-of-contract data extraction: "Data will be automatically deleted one month after the grace period of your license expires.

After data is deleted, Cloud App Security does not protect your service any more.All information regarding customer data collection can be found here https://success.trendmicro.com/dcx/s/data-collection-disclosure?language=en_US "
End-of-contract process: Trend Micro will work proactively with the customer to ensure timely renewal is in place to avoid any issues to the customer's security services

Using the service

Web browser interface: Yes
Using the web interface: N/A
Web interface accessibility standard: WCAG 2.1 AAA
Web interface accessibility testing: Full testing such as short hand word identification
API: Yes
What users can and can't do using the API: Details can be found here https://automation.deepsecurity.trendmicro.com/article/20_0/
API automation tools: Ansible

Chef

Puppet

Other
Other API automation tools: Technology Alliance Partners and descriptions can be found here

https://www.trendmicro.com/en_be/partners/alliance-partners/explore-alliance-partners.html
API documentation: Yes
API documentation formats: HTML
Command line interface: Yes
Command line interface compatibility: Linux or Unix

Windows

MacOS
Using the command line interface: Command Line interfaces and action vary across the Trend Micro portfolio. For example all information regarding Deep Security Command Line interfaces can be found here https://help.deepsecurity.trendmicro.com/20_0/on-premise/command-line-interface.html

Scaling

Scaling available: Yes
Scaling type: Automatic
Independence of resources: Autoscaling is in place
Usage notifications: Yes
Usage reporting: Email

Analytics

Infrastructure or application metrics: Yes
Metrics types: CPU

Disk

Memory

Network

Number of active instances
Reporting types: Reports on request

Resellers

Supplier type: Reseller providing extra support
Organisation whose services are being resold: Trend Micro

Staff security

Staff security clearance: Conforms to BS7858:2019
Government security clearance: Up to Developed Vetting (DV)

Asset protection

Knowledge of data storage and processing locations: Yes
Data storage and processing locations: United Kingdom

European Economic Area (EEA)

Other locations
User control over data storage and processing locations: Yes
Datacentre security standards: Complies with a recognised standard (for example CSA CCM version 3.0)
Penetration testing frequency: At least once a year
Penetration testing approach: Another external penetration testing organisation
Protecting data at rest: Physical access control, complying with CSA CCM v3.0
Data sanitisation process: Yes
Data sanitisation type: Deleted data can’t be directly accessed
Equipment disposal approach: Complying with a recognised standard, for example CSA CCM v.30, CAS (Sanitisation) or ISO/IEC 27001

Backup and recovery

Backup and recovery: Yes
What’s backed up: Databases for SaaS services
Backup controls: This is automated and used in the event of any loss of service. This is not manually configured by the end user but is available on request from support depending on the service used.
Datacentre setup: Multiple datacentres with disaster recovery
Scheduling backups: Supplier controls the whole backup schedule
Backup recovery: Users contact the support team

Data-in-transit protection

Data protection between buyer and supplier networks: TLS (version 1.2 or above)
Data protection within supplier network: TLS (version 1.2 or above)

Availability and resilience

Guaranteed availability: Trend Micro Service Levels can be found here https://success.trendmicro.com/dcx/s/solution/000285802?language=en_US
Approach to resilience: As a global organization that protects customers in over 150 countries, Trend Micro understands there are requirements for data protection and privacy that make the location of a security offering important. That's why we've invested in making sure the solutions that make up our Trend Vision One™ unified cybersecurity platform are available in key locations around the world. We've also prioritized making sure these locations are secure, as demonstrated by our global certifications. These certifications can be found here https://www.trendmicro.com/en_us/about/trust-center/compliance.html
Outage reporting: "Email Alerts- Maintenance and upgrade of Trend Micro services normally occur without any impact to our customers. Periodically, service-impacting maintenance may be required. For customers that are unable to access Trend Micro services and may not have noticed the scheduled maintenance notifications, you can check the real-time service status using the following website:
https://status.trendmicro.com/s/trend-vision-one"

Identity and authentication

User authentication: 2-factor authentication

Username or password

Other
Other user authentication: Trend adheres to the following password polices and standards: Passwords must be changed at least on a bi-annual basis. Passwords must not be inserted into email messages or other forms of electronic communications. Passwords must not be shared or revealed to anyone. Passwords must be changed immediately if compromise is suspected. Passwords must be encrypted during transmission and stored hashed with a salt. Passwords must be at least eight alphanumeric characters long. Passwords must contain both upper and lower-case characters (e.g., a-z, A-Z). Password reuse prevention is enforced. Passwords must not be based on personal information, names of family, etc.
Access restrictions in management interfaces and support channels: 2-factor authentication and Username or password
Access restriction testing frequency: At least once a year
Management access authentication: 2-factor authentication

Identity federation with existing provider (for example Google Apps)

Username or password

Other
Description of management access authentication: Remote access to Trend Micro’s infrastructure is strictly controlled and monitored. All authentication methods used adhere to industry best practices/standards such ascertificate-based and/or multi-factor authentication. Where appropriate, single sign-on (SSO) leveraging the corporate directory is used.
Devices users manage the service through: Directly from any device which may also be used for normal business (for example web browsing or viewing external email)

Audit information for users

Access to user activity audit information: Users receive audit information on a regular basis
How long user audit data is stored for: At least 12 months
Access to supplier activity audit information: Users receive audit information on a regular basis
How long supplier audit data is stored for: At least 12 months
How long system logs are stored for: At least 12 months

Standards and certifications

ISO/IEC 27001 certification: Yes
Who accredited the ISO/IEC 27001: SGS UK Ltd
ISO/IEC 27001 accreditation date: 28/12/2021
What the ISO/IEC 27001 doesn’t cover: N/A
ISO 28000:2007 certification: No
CSA STAR certification: No
PCI certification: Yes
Who accredited the PCI DSS certification: Coalfire Systems, Inc.
PCI DSS accreditation date: 22/09/2021
What the PCI DSS doesn’t cover: N/A
Cyber essentials: No
Cyber essentials plus: No
Other security certifications: Yes
Any other security certifications: ISO 20000, 27001, 27014, 27017, 27034

SOC 2 Type II

FIPS 140-2

Common Criteria EAL2+

FedRAMP

ICSA Labs Certification

NetSecOPEN

HIPAA

Security governance

Named board-level person responsible for service security: Yes
Security governance certified: Yes
Security governance standards: ISO/IEC 27001

Other
Other security governance standards: Industry and government regulations are increasing as well as an increasing number of threats. To help, Trend Micro has invested in certifications and assessments that can help you better understand how we secure our offerings and protect your data.
Information security policies and processes: https://www.trendmicro.com/en_us/about/trust-center/compliance.html

Operational security

Configuration and change management standard: Conforms to a recognised standard, for example CSA CCM v3.0 or SSAE-16 / ISAE 3402
Configuration and change management approach: Trend Micro follows industry best practices for SaaS deployments, upgrades and changes. All software changes follow a rigorous validation and approval process through testing, staging and production system rollout. Changes are formally tracked and reviewed for complete traceability based on defined change management processes. More information can be found here www.trendmicro.com/en_gb/about/trust-center/privacy.html?modal=s3m-btn-learn-more-6545a5#tabs-bb27a0-3
Vulnerability management type: Conforms to a recognised standard, for example CSA CCM v3.0 or SSAE-16 / ISAE 3402
Vulnerability management approach: Vulnerabilities are continuously monitored and tracked via internal records. Each vulnerability is assigned a CVSS Score. Patching requirements enforce timelines of addressing a vulnerability according to CVSS. In addition, vulnerabilities found and responsibly disclosed to Trend Micro via external researchers are addressed and assigned CVEs as required through Trend Micro’s responsible disclosure program. More information can be found here www.trendmicro.com/en_gb/about/trust-center/privacy.html?modal=s3m-btn-learn-more-6545a5#tabs-bb27a0-3
Protective monitoring type: Conforms to a recognised standard, for example CSA CCM v3.0 or SSAE-16 / ISAE 3402
Protective monitoring approach: Security logs are reviewed for all systems on a daily basis by the service operations teams. Security event logs are also integrated with internal communication and alerting tools for real time oversight and event triage. If a security incident is suspected, it is immediately reported to the Trend Micro Infosec team, where a formal incident response plan is executed. In addition, InfoSec independently monitors Trend Micro services environment logs. More information can be found here www.trendmicro.com/en_gb/about/trust-center/privacy.html?modal=s3m-btn-learn-more-6545a5#tabs-bb27a0-3
Incident management type: Conforms to a recognised standard, for example, CSA CCM v3.0 or ISO/IEC 27035:2011 or SSAE-16 / ISAE 3402
Incident management approach: "If a security incident is discovered, the incident is prioritized based on severity. A dedicated team of technical experts is assigned to investigate, advise on containment procedures, perform forensics, and manage communication. Following an incident, the team examines the root cause, and revises the response plan accordingly.

In the event of a breach involving personal data of a European citizen, Trend Micro will follow its obligations under GDPR. For more information, see
https://www.trendmicro.com/en_us/about/trust-center/privacy/gdpr.html In the event of a breach involving personal data of residents in regions outside the European Union, Trend Micro will follow its obligations under applicable laws."

Secure development

Approach to secure software development best practice: Independent review of processes (for example CESG CPA Build Standard, ISO/IEC 27034, ISO/IEC 27001 or CSA CCM v3.0)

Separation between users

Virtualisation technology used to keep applications and users sharing the same infrastructure apart: No

Energy efficiency

Energy-efficient datacentres: Yes
Description of energy efficient datacentres: Our sustainability initiatives are a big part of our vision to help create of a world safe for exchanging digital information. By constantly innovating, we enable our clients with solutions that help create a positive impact on the world and the way we live.

https://www.trendmicro.com/en_us/about/corporate-social-responsibility/sustainability.html

Social Value

Fighting climate change
Covid-19 recovery

Fighting climate change

Our sustainability initiatives are a big part of our vision to help create of a world safe for exchanging digital information. By constantly innovating, we enable our clients with solutions that help create a positive impact on the world and the way we live.

https://www.trendmicro.com/en_us/about/corporate-social-responsibility/sustainability.html

Covid-19 recovery

The recent outbreak of COVID-19 has affected people’s lives across the globe. At Trend Micro, our number one priority is to ensure that our employees and their families are as safe as possible. We realize this situation remains very dynamic, as information continues to change day-to-day, and as such we will continue to provide updates as we learn more. In the meantime, we remain committed to providing the superior service and support that our customers, partners, and suppliers have come to expect of Trend Micro.

In some regions, like many other companies, we have shifted our workforce to virtual/remote wherever it is feasible, and we are maintaining critical onsite operations as needed. At this time we have not experienced any major impact to our business operations as a result of this temporary shift. We will continue to closely monitor and adjust as appropriate to ensure we continue to deliver world class security protection and service for our customers and partners.

Please read the message from our COO regarding Trend Micro’s Customer commitment during the global Coronavirus Pandemic (COVID-19) - https://blog.trendmicro.com/letter-from-our-coo/

Pricing

Price: £29.17 a licence
Discount for educational organisations: Yes
Free trial available: Yes
Description of free trial: 30 day free trials are available for many of our solutions
Link to free trial: https://www.trendmicro.com/en_us/business/products/trials.html

Features

Benefits

Service documents

Framework

Service ID

Contact

Service scope

User support

Onboarding and offboarding

Using the service

Scaling

Analytics

Resellers

Staff security

Asset protection

Backup and recovery

Data-in-transit protection

Availability and resilience

Identity and authentication

Audit information for users

Standards and certifications

Security governance

Operational security

Secure development

Separation between users

Energy efficiency

Pricing

Service documents

Cookies on Digital Marketplace

Trend Micro One

Features

Benefits

Pricing

Service documents

Framework

Service ID

Contact

Service scope

User support

Onboarding and offboarding

Using the service

Scaling

Analytics

Resellers

Staff security

Asset protection

Backup and recovery

Data-in-transit protection

Availability and resilience

Identity and authentication

Audit information for users

Standards and certifications

Security governance

Operational security

Secure development

Separation between users

Energy efficiency

Social Value

Pricing

Service documents