Prisma Access

Service scope

Software add-on or extension: No
Cloud deployment model: Public cloud
Service constraints: 1. Dependency on internet connectivity: Prisma-Access relies on a stable-and-reliable-internet connection for proper functionality.
2. Compatibility: It may have compatibility limitations with certain legacy systems or software.
3. Cost: Implementing and maintaining Prisma-Access may involve additional expenses for licensing/infrastructure/ongoing support.
4. Configuration and setup: Proper configuration and setup require technical expertise and time investment.
5. User training: Organizations may need to provide training to employees for effective and secure use of the service.
6. Geographic coverage: Availability and coverage of Prisma-Access may vary based on geographical-locations.
7. Service provider dependency: Organizations using Prisma-Access rely on the service provider's infrastructure/support.
System requirements: Compatible with Windows, macOS, Linux, iOS, and Android

Stable and reliable internet connection is required

User support

Email or online ticketing support: Email or online ticketing
Support response times: SLA for Support-related response times are dependant on the level of support purchased with the service.
User can manage status and priority of support tickets: Yes
Online ticketing support accessibility: None or don’t know
Phone support: Yes
Phone support availability: 24 hours, 7 days a week
Web chat support: No
Onsite support: No
Support levels: Palo Alto Networks offers three support levels: Standard, Premium, and Elite. The Standard level provides 8x5 access to technical support, software updates, and hardware replacement. The Premium level offers 24x7 access to technical support, along with additional features such as designated support engineers and proactive monitoring. The Elite level includes all Premium features, as well as faster response times and personalized support services. Each level is designed to meet varying customer needs and service level requirements.
Support available to third parties: Yes

Onboarding and offboarding

Getting started: Palo Alto Networks assists users in starting to use Prisma Access through comprehensive documentation, technical support, training programs, and professional services. They provide step-by-step guides for setup and configuration, offer assistance and troubleshooting, educate users through training resources, and offer consulting services for a smooth deployment. Additionally, they foster a user community for collaboration and knowledge sharing. These efforts ensure that users have the necessary resources and support to effectively implement and utilize Prisma Access.
Service documentation: Yes
Documentation formats: HTML

PDF
End-of-contract data extraction: When a Prisma Access contract ends, users have different options to extract their data and ensure a smooth transition. Here are some steps users can take:

1. Data Backup: Before the contract ends, it is crucial to perform a comprehensive data backup. This includes saving any configuration files, security policies, user profiles, and other relevant data associated with Prisma Access.

2. Export Logs and Reports: Users should extract logs, reports, and any other relevant data generated by Prisma Access during the contract period. This information can be essential for compliance, auditing, or historical analysis purposes.

3. Data Migration: If users plan to transition to a different solution or platform, they should explore data migration options. This may involve exporting and converting configurations, policies, and user data to a format compatible with the new platform.

4. Vendor Assistance
End-of-contract process: "At the end of a Prisma Access contract, the services provided by Prisma Access will cease. The contract will reach its agreed-upon end date, and the customer will no longer have access to the Prisma Access platform and its associated features and benefits. The customer will need to make alternative arrangements for their network security needs.

Prior to the contract end date, the customer and the service provider may engage in discussions regarding contract renewal. If both parties agree, they may negotiate new terms and conditions for a renewed contract. If no agreement is reached, the contract will terminate as scheduled.

During the contract termination process, the customer may be required to complete certain tasks. These tasks may include retrieving any data or information stored within the Prisma Access system, ensuring that critical information is not lost. The customer will need to transition to an alternative solution or provider for their network security requirements.

It is important for the customer to review the contract terms and conditions to understand the specific obligations and requirements at the end of the Prisma Access contract. Each contract may have its own provisions and procedures for termination or renewal."

Using the service

Web browser interface: Yes
Supported browsers: Internet Explorer 11

Microsoft Edge

Firefox

Chrome

Safari

Opera
Application to install: Yes
Compatible operating systems: Android

IOS

Linux or Unix

MacOS

Windows

Windows Phone
Designed for use on mobile devices: Yes
Differences between the mobile and desktop service: N/A
Service interface: Yes
User support accessibility: None or don’t know
Description of service interface: The service interface for Prisma Access is primarily accessed and managed through the Strata Cloud Management console, which is a web-based interface. The management console provides a centralized platform for administrators to configure and monitor the Prisma Access service. Through this interface, administrators can manage security policies, view logs and analytics, configure user access, and perform other administrative tasks related to the Prisma Access service.
Accessibility standards: None or don’t know
Description of accessibility: Prisma Access Strata Cloud Manager is accessed via any web browser.
Accessibility testing: N/A
API: Yes
What users can and can't do using the API: With Prisma Access APIs, users can programmatically interact with and automate various aspects of the Prisma Access service. Here are some examples of what users can do with Prisma Access APIs:

1. Configuration Management: Users can use APIs to automate the configuration of various settings and policies within the Prisma Access service. This includes managing network and security policies, user access controls, and other configuration parameters.

2. User Provisioning and Authentication: APIs allow users to programmatically onboard and provision users, manage user roles and permissions, and authenticate users accessing the Prisma Access service.

3. Reporting and Analytics: Users can leverage APIs to retrieve logs, statistics, and other data related to network traffic, security events, and user activity. This enables custom reporting, analysis, and integration with third-party tools.

4. Integration with Security Ecosystem: Prisma Access APIs enable integration with other security solutions and services. Users can integrate Prisma Access with SIEM (Security Information and Event Management) systems, threat intelligence platforms, or custom security workflows to enhance their overall security posture.

5. Monitoring and Alerting: APIs allow users to monitor the health and performance of the Prisma Access service by retrieving real-time status, metrics, and alerts. This helps in proactive-monitoring and incident-response.
API documentation: Yes
API documentation formats: HTML
API sandbox or test environment: No
Customisation available: Yes
Description of customisation: Yes, users can customize the Prisma Access service to align with their specific requirements. They can define and customize security policies, user access controls, network segmentation, and integrate it with their existing security ecosystem. Additionally, users can customize reporting and analytics to generate insights based on their unique needs. It's important to note that the extent of customization may vary based on the specific features and licensing agreement. Users should refer to the documentation provided by Palo Alto Networks for detailed information on customization options and limitations.

Scaling

Independence of resources: Prisma Access utilizes a distributed architecture and scalable infrastructure to ensure that users are not affected by the demand placed by other users on the service. It dynamically allocates resources based on demand to maintain optimal performance and availability. Load balancing techniques are employed to distribute traffic evenly across multiple servers and data centers. Additionally, Prisma Access leverages advanced traffic management and prioritization mechanisms to ensure that critical applications and users receive the necessary resources and are not negatively impacted by other users' activities.

Analytics

Service usage metrics: Yes
Metrics types: 1. User activity and behavior monitoring.
2. Application usage and performance tracking.
3. Network bandwidth consumption analysis.
4. Threat detection and prevention metrics.
5. VPN tunnel utilization and performance monitoring.
6. User authentication and access control metrics.
7. Firewall rule effectiveness and usage metrics.
8. Web filtering and content inspection statistics.
9. Incident response and security incident metrics.
10. Compliance and regulatory reporting metrics.
Reporting types: API access

Real-time dashboards

Regular reports

Resellers

Supplier type: Reseller (no extras)
Organisation whose services are being resold: Palo Alto Networks

Staff security

Staff security clearance: Other security clearance
Government security clearance: Up to Developed Vetting (DV)

Asset protection

Knowledge of data storage and processing locations: Yes
Data storage and processing locations: United Kingdom

European Economic Area (EEA)

Other locations
User control over data storage and processing locations: Yes
Datacentre security standards: Complies with a recognised standard (for example CSA CCM version 3.0)
Penetration testing frequency: At least every 6 months
Penetration testing approach: Another external penetration testing organisation
Protecting data at rest: Physical access control, complying with CSA CCM v3.0

Physical access control, complying with SSAE-16 / ISAE 3402

Physical access control, complying with another standard

Encryption of all physical media

Scale, obfuscating techniques, or data storage sharding

Other
Other data at rest protection approach: Service are supplied from Google and Amazon Data centers (further information to follow)
Google Security statement
https://cloud.google.com/security/overview/
https://cloud.google.com/security/

AWS Security Statement
https://aws.amazon.com/compliance/data-center/controls/
https://d1.awsstatic.com/whitepapers/aws-security-whitepaper
https://aws.amazon.com/compliance/data-center/data-centers/

All logs are stored in the Cortex data lake, user activity is monitored and stored in the Cortex data lake for the agreed retention period.
Data sanitisation process: Yes
Data sanitisation type: Explicit overwriting of storage before reallocation

Deleted data can’t be directly accessed
Equipment disposal approach: Complying with a recognised standard, for example CSA CCM v.30, CAS (Sanitisation) or ISO/IEC 27001

Data importing and exporting

Data export approach: Users can export data from Prisma Access by logging into the management console, navigating to the desired data section, selecting the export format (e.g., CSV, PDF, JSON), specifying any parameters, and initiating the export process. Upon completion, users can download the exported file or receive a download link via email. Specific steps and options may vary, so it's advisable to consult the official documentation or Palo Alto Networks support for detailed instructions based on the specific setup.
Data export formats: CSV

Other
Other data export formats: PDF

JSON
Data import formats: CSV

Other
Other data import formats: JSON

XML

Data-in-transit protection

Data protection between buyer and supplier networks: Private network or public sector network

TLS (version 1.2 or above)

IPsec or TLS VPN gateway

Other
Other protection between networks: By utilising segmentation and micro-segmentation techniques to isolate and compartmentalise different parts of the network preventing lateral movement of threats and limits the impact of any potential security breaches.

Employs advanced firewall capabilities to monitor and control the traffic within the network. This includes deep packet inspection, intrusion prevention, and application-level controls to detect and prevent unauthorised access or malicious activities.

Incorporates robust encryption protocols to protect data at rest and in transit within our network. This ensures that even if unauthorised access occurs, the data remains unintelligible and protected from prying eyes.
Data protection within supplier network: TLS (version 1.2 or above)

IPsec or TLS VPN gateway

Legacy SSL and TLS (under version 1.2)

Other
Other protection within supplier network: Prisma Access protects data within the network through segmentation, advanced firewall controls, encryption, and threat detection. Segmentation isolates network parts to prevent threats from spreading. Advanced firewalls monitor and control traffic with intrusion prevention and deep packet inspection. Robust encryption secures data at rest and in transit. Threat intelligence and machine learning identify and mitigate risks. Prisma Access actively monitors traffic, detects anomalies, and responds to threats. These measures reduce the risk of data breaches, ensuring data confidentiality and integrity within the network.

Availability and resilience

Guaranteed availability: Palo Alto Networks aims to maintain at least 99.99% availability for Prisma Access. If this commitment is not met, customers may be eligible for a service credit. Monthly uptime availability is calculated by subtracting the percentage of downtime, excluding planned or emergency outages. To claim a service credit, customers must open a case within 24 hours of an outage and submit a claim within 5 business days. Palo Alto Networks will promptly review the claim within 15 days after determining the root cause and closing the case.
Approach to resilience: Prisma Access is designed with built-in resiliency to ensure continuous and reliable network security. It employs several key mechanisms to enhance its resilience.

Firstly, Prisma Access utilises a global network of Points of Presence (PoPs) strategically distributed across different regions. This distributed architecture enables load balancing and automatic failover, ensuring uninterrupted service even in the event of a localised failure.

Secondly, Prisma Access incorporates redundant components and multiple layers of fault tolerance. This includes redundant hardware, network connections, and power supplies, minimising the impact of hardware failures and ensuring high availability.

Thirdly, Prisma Access leverages dynamic routing protocols and intelligent traffic management algorithms. These mechanisms allow for efficient rerouting of traffic in the event of network congestion or failure, optimising performance and maintaining connectivity.

Moreover, Prisma Access employs proactive monitoring and alerting systems to promptly detect and respond to any issues or anomalies. This enables quick identification and resolution of potential problems, minimising downtime and maximising uptime.

Overall, the combination of distributed architecture, redundancy, fault tolerance, intelligent routing, and proactive monitoring makes Prisma Access resilient to disruptions, ensuring continuous and reliable network security for organisations.
Outage reporting: Prisma Access provides various mechanisms to report service outages and communicate with customers regarding any disruptions or incidents.

Firstly, Palo Alto Networks maintains a dedicated status page or portal where customers can access real-time information about the status of Prisma Access services. This status page provides updates on any ongoing incidents, maintenance activities, or service outages.

Additionally, Prisma Access offers proactive monitoring and alerting capabilities. Palo Alto Networks monitors the service infrastructure and network health to promptly detect any issues or potential outages. In the event of a service outage, customers may receive automated notifications or alerts via email, SMS, or through the Prisma Access management console.

Furthermore, customers can also reach out to Palo Alto Networks' support team directly for assistance and information regarding service outages. The support team is available to provide timely updates, answer queries, and address any concerns related to service disruptions.

By utilising these reporting mechanisms, Prisma Access ensures transparent communication and keeps customers informed about any service outages or incidents, enabling them to take necessary actions and plan accordingly.

Identity and authentication

User authentication needed: Yes
User authentication: 2-factor authentication

Public key authentication (including by TLS client certificate)

Identity federation with existing provider (for example Google Apps)

Limited access network (for example PSN)

Dedicated link (for example VPN)

Username or password
Access restrictions in management interfaces and support channels: Access to Prisma Access management interfaces and support channels is restricted through role-based access control (RBAC) and two-factor authentication (2FA). RBAC ensures that only authorized users with specific roles and permissions can access and perform actions within these interfaces. 2FA adds an extra layer of security by requiring users to provide additional authentication factors such as one-time passwords (OTPs) or mobile authentication apps. These measures help restrict access to authorised personnel and protect sensitive functionalities and data.
Access restriction testing frequency: At least every 6 months
Management access authentication: 2-factor authentication

Public key authentication (including by TLS client certificate)

Identity federation with existing provider (for example Google Apps)

Limited access network (for example PSN)

Dedicated link (for example VPN)

Username or password

Audit information for users

Access to user activity audit information: Users have access to real-time audit information
How long user audit data is stored for: User-defined
Access to supplier activity audit information: Users contact the support team to get audit information
How long supplier audit data is stored for: User-defined
How long system logs are stored for: User-defined

Standards and certifications

ISO/IEC 27001 certification: Yes
Who accredited the ISO/IEC 27001: PECB MS
ISO/IEC 27001 accreditation date: 06/07/2020
What the ISO/IEC 27001 doesn’t cover: N/A
ISO 28000:2007 certification: No
CSA STAR certification: Yes
CSA STAR accreditation date: 31/03/2023
CSA STAR certification level: Level 1: CSA STAR Self-Assessment
What the CSA STAR doesn’t cover: N/A
PCI certification: No
Cyber essentials: Yes
Cyber essentials plus: Yes
Other security certifications: No

Security governance

Named board-level person responsible for service security: Yes
Security governance certified: Yes
Security governance standards: ISO/IEC 27001
Information security policies and processes: Palo Alto Networks has a formal Enterprise Risk Management program, which includes the performance of an annual risk assessment, with periodic updates, as applicable, to identify and assess key risks and their mitigation approaches. The scope of the program encompasses information security risks and product risks. Our security program consists of a risk-based approach that includes administrative, technical and physical safeguards reasonably designed to protect the confidentiality, integrity and availability of customer data. Palo Alto Network's information security program is aligned to ISO 27001/2, and includes key controls from HIPAA, PCI and SOC2.

Operational security

Configuration and change management standard: Supplier-defined controls
Configuration and change management approach: "Both Palo Alto Networks and the end-user organisation are in full control of their relevant and respective change control processes.
Additional details are available upon request."
Vulnerability management type: Supplier-defined controls
Vulnerability management approach: Prisma Access follows a proactive vulnerability management process to identify, assess, prioritize, and mitigate vulnerabilities:

1. Identification: Regular scanning and assessment are conducted to identify vulnerabilities.
2. Assessment: Vulnerabilities are evaluated for severity and potential impact.
3. Prioritization: Vulnerabilities are assigned priority levels based on severity and impact.
4. Mitigation Planning: A plan is developed to address vulnerabilities.
5. Remediation: The plan is executed, coordinating with relevant teams.
6. Monitoring and Reporting: Ongoing monitoring and reporting track progress in vulnerability remediation efforts.
Protective monitoring type: Conforms to a recognised standard, for example CSA CCM v3.0 or SSAE-16 / ISAE 3402
Protective monitoring approach: 1. Event-Collection: Logs and events are centrally collected for analysis from various-sources, such as network-devices and endpoints.

2. Log-Analysis and Correlation: Logs are analyzed and correlated to identify-patterns, anomalies, and potential security-incidents.

3. Threat-Detection: Advanced security analytics and machine learning algorithms detect known and unknown threats.

4. Incident-Response: Automated actions may be taken to block malicious IPs or isolate compromised endpoints.

5. Incident-Investigation and Resolution: Security personnel investigate and analyze incidents to understand scope, impact, and root cause. Actions are taken to contain, mitigate, and remediate the incident.

6. Reporting and Improvement: Reports provide insights into Prisma Access's security posture.
Incident management type: Conforms to a recognised standard, for example, CSA CCM v3.0 or ISO/IEC 27035:2011 or SSAE-16 / ISAE 3402
Incident management approach: This information is available upon request

Secure development

Approach to secure software development best practice: Supplier-defined process

Public sector networks

Connection to public sector networks: No

Social Value

Fighting climate change
Covid-19 recovery
Tackling economic inequality
Equal opportunity
Wellbeing

Fighting climate change

Net-zero is no longer a compromise. Our commitment is to be a net-zero business by 2030, against all scope 1, 2, and 3 emissions as quickly as possible. As a service provider, we will also help our clients to fight climate change. Whether reporting energy and water usage, measuring waste reduction, or managing product lifecycle, our commitment is to support our customers to work towards any and every environmental goal. Our goal is to help clients to bring credibility to their assertions, helping them to demonstrate compliance with international standards, regulations and commitments. We will combine deep environmental expertise and rigorous methodology to verify all data and information an organisation tracks or publishes. We will certify our customers systems and processes against global standards, giving them the confidence that best practices are being implemented that maximise every opportunity to improve performance. This includes but is not limited to: • Supporting our customers with their ISO 14064 greenhouse gas (GHG) validation • Supporting our customers to verify their systems and processes against global standards • Supporting our customers to transition to sustainable, low carbon power generation. • Supporting our customers to transition from waste to energy, wind, tidal, nuclear to renewable capacity, hydrogen production, storage and distribution • Supporting our customers verify their water usage, • Supporting our customers verify their waste reduction • Supporting our customers verify their or product lifecycle • Supporting our customers to look beyond compliance, examining the resulting data and suggesting actions that put them in control of the areas that matter most to their business.

Covid-19 recovery

LRQA Nettitude actively contributes to the global recovery from the COVID-19 pandemic by endorsing and supporting vaccination initiatives. As an organisation grounded in science and evidence, we acknowledge the crucial role of vaccination and regular testing in safeguarding individuals and reinstating societal normalcy. While we respect individual choices regarding vaccination, it is anticipated that various authorities, clients, and travel providers may necessitate COVID-19 vaccination for entry or proof of a formal exception. Our commitment extends to supporting colleagues who choose to get vaccinated. LRQA Nettitude pledges to assist those receiving government-approved or World Health Organization-recognised COVID-19 vaccinations. In instances where an approved vaccine is not accessible through public or private healthcare providers, we will reimburse colleagues for the cost of an approved vaccination. Additionally, reasonable paid time off will be provided to facilitate vaccination for colleagues and their families. Respecting privacy, LRQA Nettitude will only inquire about a colleague's vaccine status when there is a legitimate business need, such as travel or working in high-risk environments. Colleagues' vaccine information will be stored securely for a defined period, in compliance with local data privacy legislation, and disclosed only with explicit consent. Recognising the ongoing importance of safety measures post-vaccination, LRQA Nettitude acknowledges that vaccination programs do not eliminate COVID-19 risk entirely. We commit to adhering to good practices and local legal requirements, acknowledging that certain safety measures will likely persist beyond the vaccination program. This comprehensive approach underscores LRQA Nettitude's dedication to supporting recovery and ensuring the well-being of our colleagues and the broader community.

Tackling economic inequality

We believe that every person deserves the right to work with dignity. Through our corporate social responsibility compliance, we help our clients discover and understand risks within their workplace and supply chain in order to enhance economic equality. Transparency is the fundamental building block to understanding risk. Without transparency, it is difficult for an audit to report on risk exposure associated with wage underpayment, excessive working hours, child labour, unauthorized subcontractors, compliance to social insurance, harassment, and prison labour, to name a few. Supplier transparency is part of our DNA. We will continually develop innovative solutions that uncover and manage risk from a social perspective. EiQ is our supply chain data analytics platform, to create predictive models to assess the likelihood of unauthorized subcontracting, human trafficking, and labour unrest, to name a few. We are innovators and thought partners. This includes but is not limited to creating better working conditions and tackling inequality for the following areas: • Wage underpayment • Excessive working hours • Child labour • Unauthorized subcontractors • Compliance to social insurance • Harassment • Prison labour

Equal opportunity

We believe that our responsibility as an employer, supplier, and customer is to treat people with respect, empathy, and kindness – to ensure people have the support they need to thrive and be at their best. Our promise is to support our people and every stakeholder that we work and interact with. We provide progressive advice and solutions for the following areas: • Fair and equal pay across gender, race, age, and disability • Fair and safe working hours • The restructuring of labour to protect children In addition to this, LRQA is committed to support young people from disadvantaged backgrounds to achieve their greatest potential. In 2022 we will launch “The Brightest Future”. The Brightest Future is LRQA’s philanthropic foundation that supports young people from disadvantaged backgrounds to build the brightest future for themselves, their community, and the planet With a focus on young people from disadvantaged backgrounds, we will support thousands of young people to receive high-quality education over the next seven years. Delivered by our employees in partnership with leading grassroot educational charities, our vision is to inspire young people to find their mighty purpose, curiosity, and courage to be part of building a better future for themselves, their community, and the planet.

Wellbeing

At LRQA Nettitude many of us are used to working from home, it is a new experience for lots of us and it may take some time to adjust. We always help to protect and look after our employee’s wellbeing and mental health; they can also reach out to one of our Mental Health First Aiders. Our Mental Health First Aiders (MHFAs) are the go-to people for anyone who wants to talk to someone. Additionally, all members of the Nettitude Leadership and Management Team have an Open Door Policy and are available if employees need someone to talk to, not necessarily their own manager. Nettitude Wellbeing – Objectives • To provide a safe place for all Nettitude employees to raise Mental Health challenges they may be experiencing. • To increase awareness of Mental Health within the Nettitude Group • To signpost all employees on what support is available to them. • To increase the ratio of MH First Aiders within the business. • To develop a well-being strategy. • Build a series of information/training to support employees with their wellbeing and those in their team.

Pricing

Price: £108.19 a user a year
Discount for educational organisations: No
Free trial available: No

Features

Benefits

Service documents

Framework

Service ID

Contact

Service scope

User support

Onboarding and offboarding

Using the service

Scaling

Analytics

Resellers

Staff security

Asset protection

Data importing and exporting

Data-in-transit protection

Availability and resilience

Identity and authentication

Audit information for users

Standards and certifications

Security governance

Operational security

Secure development

Public sector networks

Pricing

Service documents

Cookies on Digital Marketplace

Prisma Access

Features

Benefits

Pricing

Service documents

Framework

Service ID

Contact

Service scope

User support

Onboarding and offboarding

Using the service

Scaling

Analytics

Resellers

Staff security

Asset protection

Data importing and exporting

Data-in-transit protection

Availability and resilience

Identity and authentication

Audit information for users

Standards and certifications

Security governance

Operational security

Secure development

Public sector networks

Social Value

Pricing

Service documents