CDW Zscaler for users

Service scope

Software add-on or extension: No
Cloud deployment model: Private cloud
Service constraints: There are no operational constraints to the service
System requirements: For offices, set-up a GRE/IPsec router-tunnel to the closest Zscaler-DC

For mobile employees, forward traffic via the ZscalerApp or PACfile

User support

Email or online ticketing support: Email or online ticketing
Support response times: Response time will be dependent on severity, 30 minutes for P1, 1hr for P2, 3hrs for P3 and 4hrs for P4.
User can manage status and priority of support tickets: Yes
Online ticketing support accessibility: None or don’t know
Phone support: Yes
Phone support availability: 24 hours, 7 days a week
Web chat support: No
Onsite support: Yes, at extra cost
Support levels: Our support options can be found here - https://www.zscaler.com/legal/sla-support
Support available to third parties: Yes

Onboarding and offboarding

Getting started: "Documentation on deployment guides, help portals can be found on Zscaler Help: https://help.zscaler.com/
All online training can be accessed by Zscaler Academy: https://www.zscaler.com/zscaler-academy"
Service documentation: Yes
Documentation formats: HTML

PDF
End-of-contract data extraction: The reports here give different options to extract data from the tenants: https://help.zscaler.com/zia/dashboard-analytics/reports
End-of-contract process: Data generated by the use of the service can be streamed directly in real time to the customer. If, at the end of contract, the customer requests all data, 6 months will be made available.

Using the service

Web browser interface: Yes
Supported browsers: Microsoft Edge

Firefox

Chrome
Application to install: Yes
Compatible operating systems: MacOS

Windows
Designed for use on mobile devices: Yes
Differences between the mobile and desktop service: None
Service interface: No
User support accessibility: None or don’t know
API: Yes
What users can and can't do using the API: API is available on request, documentation can be found at https://help.zscaler.com/zia/api
API documentation: Yes
API documentation formats: HTML
API sandbox or test environment: Yes
Customisation available: Yes
Description of customisation: Administrators can customise all policies to manage and control users. Acceptable use policy prompts and user messaging frameworks can be highly customised.

Scaling

Independence of resources: "Zscaler has architected its platform from scratch in order to create a solution that is unparalleled in its scalability.

All ZIA Public Service Edges use multi-core architecture to intelligently load-balance tasks within the Public Service Edge. As a result, there is no need for any external load balancing. This inherent scalability differentiates our solution in its ability to provide the service at a unique price point and also have points of presence in numerous locations across the world.

We boast the largest cloud deployment for security as a service with over 150+ nodes distributed across the world.

Analytics

Service usage metrics: Yes
Metrics types: Service usage, threats detected and stopped, types of threats blocked, Bandwidth, SSL inspedction, license usage, latency, top cloud applications,traffic volume trends, Office365 usage, potential sensitive files being uploaded and more. Please note these will be reviewed during QBR sessions but are accessible as a powerpoint presentation for your own assesment and playback within the organisation.
Reporting types: API access

Real-time dashboards

Reports on request

Resellers

Supplier type: Reseller providing extra support
Organisation whose services are being resold: Zscaler

Staff security

Staff security clearance: Conforms to BS7858:2019
Government security clearance: Up to Baseline Personnel Security Standard (BPSS)

Asset protection

Knowledge of data storage and processing locations: Yes
Data storage and processing locations: United Kingdom

European Economic Area (EEA)
User control over data storage and processing locations: Yes
Datacentre security standards: Complies with a recognised standard (for example CSA CCM version 3.0)
Penetration testing frequency: At least once a year
Penetration testing approach: Another external penetration testing organisation
Protecting data at rest: Other
Other data at rest protection approach: Log data (with personal data) is tokenised at source and the token database is encrypted and held on another system.
Data sanitisation process: Yes
Data sanitisation type: Deleted data can’t be directly accessed
Equipment disposal approach: A third-party destruction service

Data importing and exporting

Data export approach: With Zscaler Internet Access (ZIA), you can download data in CSV format, for any specified date/time range, within theavailable 6-month window. Audit Logs can also be retrieved via API, enabling easy integration to SIEM and third-party auditing tools. To learn more, see: https://help.zscaler.com/zia/audit-log-use-cases
Data export formats: CSV
Data import formats: CSV

Data-in-transit protection

Data protection between buyer and supplier networks: TLS (version 1.2 or above)
Data protection within supplier network: TLS (version 1.2 or above)

Availability and resilience

Guaranteed availability: 99.999%, assured by contractual commitment
Approach to resilience: Each Zscaler cloud has three key components - the Central Authority, Zscaler Enforcement Nodes and Nanolog clusters. The CA consists of one active server and two in passive standby mode. The active CA replicates data in real time to the two standby CAs, so any of them can become active at any time and each is hosted in separate locations. Zscaler Enforcement Nodes are inline Internet security gateways inspecting Internet traffic bi-directionally for malware and enforce security and compliance policies. When a user moves to a different location, the nearest Node downloads and enforces the appropriate policy for that user.
Outage reporting: Zscaler monitors its cloud through proprietary monitoring systems and 3rd parties. Live stats and alerts are available here 24/7: https://trust.zscloud.net/

Identity and authentication

User authentication needed: Yes
User authentication: 2-factor authentication

Public key authentication (including by TLS client certificate)

Identity federation with existing provider (for example Google Apps)

Username or password
Access restrictions in management interfaces and support channels: Zscaler has an Incident Response Plan (IRP) in place to ensure that we are prepared to manage cyber incidents in an effective and efficient manner and respond accordingly. The IRP identifies the structure, roles and responsibilities, types of common incidents, and the approach to preparing, identifying, containing, eradicating, recovering, and conducting lessons learned to minimize the impact of security incidents. Our Management team has defined the following types of incidents:
• Support Incidents: Customer-related incidents
• Security Incidents: These may include security weaknesses, Acceptable Use Policy (“AUP”) violations, suspected and actual data security breaches, or incidents resulting from vulnerability scans
Access restriction testing frequency: At least every 6 months
Management access authentication: 2-factor authentication

Public key authentication (including by TLS client certificate)

Identity federation with existing provider (for example Google Apps)

Username or password

Audit information for users

Access to user activity audit information: Users receive audit information on a regular basis
How long user audit data is stored for: User-defined
Access to supplier activity audit information: Users receive audit information on a regular basis
How long supplier audit data is stored for: User-defined
How long system logs are stored for: User-defined

Standards and certifications

ISO/IEC 27001 certification: Yes
Who accredited the ISO/IEC 27001: Schellman Compliance, LLC
ISO/IEC 27001 accreditation date: 10/05/2023
What the ISO/IEC 27001 doesn’t cover: N/A
ISO 28000:2007 certification: No
CSA STAR certification: Yes
CSA STAR accreditation date: 31/07/2023
CSA STAR certification level: Level 2: CSA STAR Attestation
What the CSA STAR doesn’t cover: No CSA STAR control activities have been excluded from the scope of Zscaler’s ISMS and PIMS.
PCI certification: No
Cyber essentials: Yes
Cyber essentials plus: No
Other security certifications: No

Security governance

Named board-level person responsible for service security: Yes
Security governance certified: Yes
Security governance standards: ISO/IEC 27001

Other
Other security governance standards: "Many certifications including ISO27001/2, CSA Star, SOC 2 Type II, Cyber Essentials
More certification information can be found here - https://www.zscaler.com/compliance/overview"
Information security policies and processes: "Aligning with ISO27001, Zsclaer has defined its information security and privacy program as part of the scope of the ISMS and PIMS and supporting informaiton security and privacy policies to help define ISMS and PIMS ownership, accountability, and scope in alignment with relevant policies, standards, procedures, and guidelines. The head of global security compliance, the risk and compliance manager, and the legal department, are ultimately responsible for developing and maintaining the ISMS and PIMS program and therefore, have been delegated the following responsibilities:

• Establishing the information security and privacy policies and objectives which are compatible with Zscaler’s strategic direction;
• Ensuring integration of ISMS and PIMS requirements into Zscaler’s processes;
• Ensuring resources are available for the support of the ISMS and PIMS;
• Communicating the importance of effective information security and privacy management and of conforming to the ISMS and PIMS requirements;
• Ensuring the ISMS and PIMS achieve its intended outcome(s);
• Directing and supporting persons to contribute to the effectiveness of the ISMS and PIMS;
• Promoting continual improvement; and
• Encouraging and supporting other management roles to demonstrate leadership within their areas or responsibility."

Operational security

Configuration and change management standard: Supplier-defined controls
Configuration and change management approach: "Zscaler’s Configuration and Change Management process policies and procedures, part of our ISO 27001 and SOC 2 Type 2 certifications that are audited annually by an independent third party, contain confidential information and are not distributed publicly. However, compliance certificates and certification reports are available via download or through a request form link from our public-facing web page: https://www.zscaler.com/company/compliance
Vulnerability management type: Supplier-defined controls
Vulnerability management approach: Zscaler has a documented Security Audit and Vulnerability Management procedure, created in accordance with our ISO 27001 certification, that provides instructions for conducting security audits/vulnerability testing, evaluating information system technical vulnerability results, and remediating technical vulnerabilities or implementing appropriate measures to address associated risk. Zscaler has a full suite of policies audited by external auditors annually for compliance with SOC 2 Type II, ISO 27001, ISO 27701, ISO 27017, ISO 27018, CSA Star, and other major global frameworks, which can be reviewed on our public-facing compliance we page at: https://www.zscaler.com/compliance/overview
Protective monitoring type: Supplier-defined controls
Protective monitoring approach: Zscaler monitors the daily business and operational activities, including the internal control environment, as a routine part of business. Zscaler has implemented a set of logging and monitoring tools that are configured to collect data from system infrastructure components to monitor system performance, potential security threats and vulnerabilities, resource utilization and alert IT operations upon detection of unusual system activity or service requests. The in-scope systems are monitored using enterprise monitoring applications that track system performance, responsiveness, availability and vulnerabilities.
Incident management type: Supplier-defined controls
Incident management approach: Zscaler has an Incident Response Plan (IRP) in place to ensure that we are prepared to manage cyber incidents in an effective and efficient manner and respond accordingly. The IRP identifies the structure, roles and responsibilities, types of common incidents, and the approach to preparing, identifying, containing, eradicating, recovering, and conducting lessons learned to minimize the impact of security incidents. Our Management team has defined the following types of incidents:
• Support Incidents: Customer-related incidents
• Security Incidents: These may include security weaknesses, Acceptable Use Policy (“AUP”) violations, suspected and actual data security breaches, or incidents resulting from vulnerability scans

Secure development

Approach to secure software development best practice: Independent review of processes (for example CESG CPA Build Standard, ISO/IEC 27034, ISO/IEC 27001 or CSA CCM v3.0)

Public sector networks

Connection to public sector networks: No

Social Value

Fighting climate change
Covid-19 recovery
Tackling economic inequality
Wellbeing

Fighting climate change

"Fighting Climate Change:
-With the world’s largest security cloud, we’re poised to help lower environmental impacts associated with security worldwide. Switching to Zscaler from on-premises solutions can help organizations reduce IT waste, energy consumption, and their carbon footprint.
-To understand the holistic environmental impacts and benefits of the Zscaler platform vs. on-premises cybersecurity solutions, we worked with a third-party environmental expert to conduct a comparative life cycle assessment (LCA) following ISO principles. The LCA study, conducted in 2022, found that the Zscaler solution can deliver significant hardware reduction and up to 93% energy savings over on-premises solutions. Details may be found in our 2022 ESG Report https://www.zscaler.com/resources/industry-reports/Zscaler-ESG-Report-2022.pdf
-Zscaler prioritizes selecting data centers that already use renewable energy and supplements where
necessary with wind and solar power from local markets. In addition, Zscaler reached carbon neutral in 2022 and has a goal to be net zero by 2025. Additional environmental benefits may be found here: https://www.zscaler.com/corporate-responsibility/environmental-impact"

Covid-19 recovery

Our zero trust solution enables organisations to secure the workforce from anywhere, enabling business continuity both during Covid and beyond, with the new hybrid workforce.

Tackling economic inequality

Times of economic uncertainty present organizations the opportunity to seek new solutions that reduce costs and position them for future success.

Wellbeing

We offer a range employee benefits through a branded wellbeing platform

Pricing

Price: £178 a user
Discount for educational organisations: Yes
Free trial available: Yes
Description of free trial: Full product on qualified 30-day proof-of-concept trial. When organisations satisfy themselves that the product functions as specified, they usually proceed to purchase and the PoC trial is simply switched to production and the full production user-load added.
Link to free trial: https://help.zscaler.com/zcspm/free-trial

Features

Benefits

Service documents

Framework

Service ID

Contact

Service scope

User support

Onboarding and offboarding

Using the service

Scaling

Analytics

Resellers

Staff security

Asset protection

Data importing and exporting

Data-in-transit protection

Availability and resilience

Identity and authentication

Audit information for users

Standards and certifications

Security governance

Operational security

Secure development

Public sector networks

Pricing

Service documents

Cookies on Digital Marketplace

CDW Zscaler for users

Features

Benefits

Pricing

Service documents

Framework

Service ID

Contact

Service scope

User support

Onboarding and offboarding

Using the service

Scaling

Analytics

Resellers

Staff security

Asset protection

Data importing and exporting

Data-in-transit protection

Availability and resilience

Identity and authentication

Audit information for users

Standards and certifications

Security governance

Operational security

Secure development

Public sector networks

Social Value

Pricing

Service documents