Barrier Networks Centri for Vulnerability Management Service (Qualys Cloud Platform and VMDR)

Service scope

Software add-on or extension: No
Cloud deployment model: Public cloud

Private cloud
Service constraints: N/a
System requirements: ...

...

User support

Email or online ticketing support: Email or online ticketing
Support response times: The Qualys Technical Support team are available 24/7/365. For further details on response times please visit this link that includes SLAs: https://www.qualys.com/support/sla/
User can manage status and priority of support tickets: Yes
Online ticketing support accessibility: None or don’t know
Phone support: Yes
Phone support availability: 24 hours, 7 days a week
Web chat support: Web chat
Web chat support availability: 24 hours, 7 days a week
Web chat support accessibility standard: None or don’t know
How the web chat support is accessible: ...
Web chat accessibility testing: N/a
Onsite support: No
Support levels: ...
Support available to third parties: Yes

Onboarding and offboarding

Getting started: Certified online training is available, A dedicated Technical Account Manager is assigned to all accounts.
Service documentation: Yes
Documentation formats: HTML

PDF
End-of-contract data extraction: Reports and dashboards can be downloaded or exported via the API.
End-of-contract process: Upon termination of the agreement, Qualys will automatically delete all customer scan data within 13 months of termination. Customers can request that Qualys delete all online subscription data within one month. Subscription data will remain on encrypted backup tapes for up to one year. The data can be downloaded using the reports or via the API.

Using the service

Web browser interface: Yes
Supported browsers: Internet Explorer 11

Microsoft Edge

Firefox

Chrome

Safari
Application to install: Yes
Compatible operating systems: Android

IOS

Linux or Unix

MacOS

Windows
Designed for use on mobile devices: Yes
Differences between the mobile and desktop service: N/A
Service interface: Yes
User support accessibility: None or don’t know
Description of service interface: Qualys' Software-as-a-Service (SaaS) delivery model, allows users to access Qualys from any Web browser. This unique SaaS platform enables organisations to assess and manage its security exposures freeing them from the substantial cost, resource and deployment issues associated with traditional software products.
Accessibility standards: None or don’t know
Description of accessibility: ...
Accessibility testing: None
API: Yes
What users can and can't do using the API: Qualys CSP customers can access the platform for UI and API calls via HTTPs.
For more information, please refer to our API documentation at https://www.qualys.com/docs/qualys-api-quick-reference.pdf
API documentation: Yes
API documentation formats: PDF
API sandbox or test environment: No
Customisation available: No

Scaling

Independence of resources: We have over 12 Datacentres around the world carrying out over 6+billion scans a year, 13+ trillion data points indexed on Elasticsearch giving 2 second visibility. We can scale Qualys as your needs grow. We just add more capacity to meet the scanning, analysis and reporting needs of your business.

Analytics

Service usage metrics: Yes
Metrics types: License count/usage - Can be tracked from within the Qualys console
Reporting types: Real-time dashboards

Regular reports

Resellers

Supplier type: Reseller providing extra support
Organisation whose services are being resold: Qualys

Staff security

Staff security clearance: Other security clearance
Government security clearance: Up to Developed Vetting (DV)

Asset protection

Knowledge of data storage and processing locations: Yes
Data storage and processing locations: United Kingdom

European Economic Area (EEA)

Other locations
User control over data storage and processing locations: Yes
Datacentre security standards: Complies with a recognised standard (for example CSA CCM version 3.0)
Penetration testing frequency: At least once a year
Penetration testing approach: ‘IT Health Check’ performed by a Tigerscheme qualified provider or a CREST-approved service provider
Protecting data at rest: Physical access control, complying with CSA CCM v3.0

Encryption of all physical media

Scale, obfuscating techniques, or data storage sharding
Data sanitisation process: Yes
Data sanitisation type: Explicit overwriting of storage before reallocation

Deleted data can’t be directly accessed
Equipment disposal approach: Complying with a recognised standard, for example CSA CCM v.30, CAS (Sanitisation) or ISO/IEC 27001

Data importing and exporting

Data export approach: Dashboards, Reports and openAPI
Data export formats: CSV
Data import formats: Other
Other data import formats: HTML

XML

PDF

Data-in-transit protection

Data protection between buyer and supplier networks: TLS (version 1.2 or above)
Data protection within supplier network: TLS (version 1.2 or above)

Availability and resilience

Guaranteed availability: Qualys Cloud platform is highly available, and referenced in the MCSA and through our SLA reference material. The Cloud Services will be available to Customers, as measured from the Qualys SOC connection to the Internet, twenty-four (24) hours a day, seven (7) days a week, with a 99.5% uptime, calculated on a quarterly basis, excluding scheduled maintenance.
Approach to resilience: The Qualys Cloud Platform resides behind network-based, redundant, highly-available firewalls and intrusion monitoring solutions. In addition, each host runs a localized firewall on top of the customized, hardened Linux distribution, which is unique to Qualys. Qualys is available 24x7x365 and can be accessed anytime from anywhere through a Web browser. Qualys consistently maintains 99% availability. The service is constantly updated transparently, without any interruption to users, and is only taken off-line once a quarter for maintenance and updates. This process usually lasts a few hours in duration.
Outage reporting: "Incase the customer is impacted by a security Breach, Qualys shall notify the customer within 24 Hrs.
Additionally, Customers may subscribe to receive email notifications of Qualys service status and Breach / scheduled maintenance / Outage: https://status.qualys.com/"

Identity and authentication

User authentication needed: Yes
User authentication: 2-factor authentication

Public key authentication (including by TLS client certificate)

Username or password
Access restrictions in management interfaces and support channels: Qualys CSP customers can access the platform for UI and API calls via HTTPs. Qualys has user based password authentication, active directory integration, single sign on.
Access restriction testing frequency: At least once a year
Management access authentication: 2-factor authentication

Public key authentication (including by TLS client certificate)

Username or password

Audit information for users

Access to user activity audit information: Users have access to real-time audit information
How long user audit data is stored for: User-defined
Access to supplier activity audit information: Users have access to real-time audit information
How long supplier audit data is stored for: User-defined
How long system logs are stored for: User-defined

Standards and certifications

ISO/IEC 27001 certification: Yes
Who accredited the ISO/IEC 27001: Schellman Compliance
ISO/IEC 27001 accreditation date: Jan 2024
What the ISO/IEC 27001 doesn’t cover: ...
ISO 28000:2007 certification: No
CSA STAR certification: Yes
CSA STAR accreditation date: Feb 2024
CSA STAR certification level: Level 2: CSA STAR Attestation
What the CSA STAR doesn’t cover: ...
PCI certification: Yes
Who accredited the PCI DSS certification: PCI Security Standards Council LLC
PCI DSS accreditation date: 06/02/2024
What the PCI DSS doesn’t cover: The certification covers being an Approved Scanning Vendor (ASV) Employee as defined by in the Payment Card Industry (PCI) Data Security Standard Qualification Requirements for Approved Scanning Vendors (ASV).
Cyber essentials: Yes
Cyber essentials plus: Yes
Other security certifications: Yes
Any other security certifications: FedRAMP

ISO/IEC 27017

ISO/IEC 27018

Security governance

Named board-level person responsible for service security: Yes
Security governance certified: Yes
Security governance standards: CSA CCM version 3.0

ISO/IEC 27001

Other
Other security governance standards: 1. CSA CCM v3.0
2. Qualys ISO/IEC 27001:2013
3. Qualys ISO/IEC 27017:2015
4. Qualys ISO/IEC 27018:2019
5. SOC 2 Type II
6. PCI Approved Scanning Vendor - search for company name 'Qualys'.
7. EU-U.S. Privacy Shield Framework and Swiss-U.S.
8. FedRAMP Authorized (Impact - Moderate)
9. Regulated by SEC
Information security policies and processes: Qualys has policies and procedures to ensure compliance with applicable legislative, regulatory and contractual requirements.
Qualys information Security Policies and Procedures are in adherence with FedRAMP and follows NIST 800-53 controls and ISO27001 standards.

Operational security

Configuration and change management standard: Conforms to a recognised standard, for example CSA CCM v3.0 or SSAE-16 / ISAE 3402
Configuration and change management approach: Qualys Configuration Management Policy and procedures are established to define Qualys’s formal approach to configuration changes as it relates to the Qualys information system.

Qualys has a Change Management process that adds oversight, transparency, and controls changes to the production environment. It establishes guidelines and standards to authorize, manage, test, document, monitor, and implement system changes in production environments.

All Changes to the Qualys Cloud Platform (QCP) environment are approved by the Change Management Board (CMB) before implementation in the production environment. Changes are tested in a development /staging environment prior to CMB approval and released to the production environment
Vulnerability management type: Conforms to a recognised standard, for example CSA CCM v3.0 or SSAE-16 / ISAE 3402
Vulnerability management approach: Qualys has documented policies based on NIST 800-53, which address vulnerability management.
Qualys adheres to and complies with FedRAMP security vulnerability assessment(s) in remediating/patching on a regularly basis.
Qualys uses three different severity categories for vulnerabilities as per the FedRAMP requirement.
critical / High: - Qualys aim to have patch rolled out under 30 days
Medium: - Qualys aim to have patch rolled out under 90 days
Low: - Qualys aim to have patch rolled out under 180 days
Protective monitoring type: Conforms to a recognised standard, for example CSA CCM v3.0 or SSAE-16 / ISAE 3402
Protective monitoring approach: Qualys has an Incident Response Plan (IR Plan) that defines the minimum requirements for responding to incidents in an efficient and effective manner, including detecting, analyzing, prioritizing, and handling of incidents. Security incidents are reported and monitored by Security and Operations teams 24x7.
Incident management type: Conforms to a recognised standard, for example, CSA CCM v3.0 or ISO/IEC 27035:2011 or SSAE-16 / ISAE 3402
Incident management approach: Qualys has an Incident Response Plan (IR Plan) that defines the minimum requirements for responding to incidents in an efficient and effective manner, including detecting, analyzing, prioritizing, and handling of incidents. Security incidents are reported and monitored by Security and Operations teams 24x7.

Secure development

Approach to secure software development best practice: Independent review of processes (for example CESG CPA Build Standard, ISO/IEC 27034, ISO/IEC 27001 or CSA CCM v3.0)

Public sector networks

Connection to public sector networks: No

Social Value

Equal opportunity
Wellbeing

Equal opportunity

• To create an environment in which individual differences and the contributions of all our staff are recognised and valued.
• Every employee is entitled to a working environment that promotes dignity and respect to all. No form of intimidation, bullying or harassment will be tolerated.
• Training, development and progression opportunities are available to all staff.
• To promote equality in the workplace which we believe is good management practice and makes sound business sense.
• We will review all our employment practices and procedures to ensure fairness.
• Breaches of our Equality Policy will be regarded as misconduct and could lead to disciplinary proceedings.
• This policy is fully supported by Senior Management.
• The policy will be monitored and reviewed regularly.

Wellbeing

• We promote an open, supportive company culture where employees look out for one another and feel comfortable discussing any difficulties. Mental health is valued equally to physical health.
• Employees have access to confidential counselling, therapy, and other mental health resources through our employee assistance program.
• We encourage taking time off when needed for mental health days in addition to sick days. Employees are trusted to manage their time off responsibly.
• Training is provided to managers on recognizing signs of burnout,
work overload, and other mental health concerns. Managers work to
proactively address issues and reduce employee stress.
• Employee workloads and schedules are designed to be reasonable
and sustainable.
• Wellness initiatives like meditation breaks, stress management
workshops, mindfulness programs, and social events are offered
throughout the year.

Pricing

Price: £18.75 to £61.58 a device a year
Discount for educational organisations: Yes
Free trial available: Yes
Description of free trial: 1. Community Edition - Provides a complete, continuously updated, and instant view of monitored IT assets and Web applications from a single-pane of glass interface. 2. SSL Labs - Check whether your SSL website is properly configured. 3. CertView - Identify certificate grades, issuers, expirations and more
Link to free trial: https://www.qualys.com/free-services

Barrier Networks Centri for Vulnerability Management Service (Qualys Cloud Platform and VMDR)

Features

Benefits

Service documents

Framework

Service ID

Contact

Service scope

User support

Onboarding and offboarding

Using the service

Scaling

Analytics

Resellers

Staff security

Asset protection

Data importing and exporting

Data-in-transit protection

Availability and resilience

Identity and authentication

Audit information for users

Standards and certifications

Security governance

Operational security

Secure development

Public sector networks

Pricing

Service documents

Cookies on Digital Marketplace

Barrier Networks Centri for Vulnerability Management Service (Qualys Cloud Platform and VMDR)

Features

Benefits

Pricing

Service documents

Framework

Service ID

Contact

Service scope

User support

Onboarding and offboarding

Using the service

Scaling

Analytics

Resellers

Staff security

Asset protection

Data importing and exporting

Data-in-transit protection

Availability and resilience

Identity and authentication

Audit information for users

Standards and certifications

Security governance

Operational security

Secure development

Public sector networks

Social Value

Pricing

Service documents