TURNKEY CONSULTING (UK) LIMITED

GRC for SAP Managed Service (SAP GRC, ARM, Pathlock AAG)

A managed service for GRC Access Governance (Sailpoint / SAP / Pathlock) in the cloud via a subscription. This helps smooth upfront implementation costs reducing capital expenditure.

Our offering includes a fully managed support service, managing existing GRC solutions, on-premise or cloud-hosted (public/private), or providing one for them.

Features

• Access GRC from a secure, cloud-based environment
• Plan budgets more effectively with a more predictable cost model
• Relieve the burden of technical support and maintenance
• Leverage GRC best practice & knowledge transfer
• Access to the full portfolio of GRC products
• Ensure your business is supported by GRC & risk experts
• Operate internal controls with efficiency and effectiveness

Benefits

• Reduced requirement to hire and retain specialist skills
• Improve operational resilience and control for access governance
• Predictable costs using an opex model
• On-demand access to GRC security & controls experts
• Best-practice deployment & operation of GRC
• Automate cumbersome internal control activities
• Facilitate controlled access to admin tasks

• Education pricing available

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at finance@turnkeyconsulting.com. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 15

Service ID

381365987812980

Contact

Jo Chuter
02072882578
finance@turnkeyconsulting.com

About your service

• Service categories:

  Application Development and Deployment

  Application platforms

  • Model driven application platforms
  • Robotic process automation
• Multi cloud support: No

Service scope

• Software add-on or extension: Yes, but can also be used as a standalone service
• What software services is the service an extension to: SAP GRC, Sailpoint ARM, Pathlock AAG product implementations and ongoing support. We continue to support these processes so the business can focus on it's performance objectives.
• Cloud deployment model:
  • Public cloud
  • Private cloud
  • Hybrid cloud
• Service constraints: Use of supported underlying technology partners; SAP, Sailpoint or Pathlock.
• System requirements: Ability to connect to Tech Vendor Data Services

User support

• Email or online ticketing support: Yes
• Support response times: Severity 1 <30mins, Severity 2 <1hr, Severity 3 <2 hrs, Severity 4 <4hrs
• User can manage status and priority of support tickets: Yes
• Online ticketing support accessibility: WCAG 2.2 AA
• Phone support: Yes
• Phone support availability: 9 to 5 (UK time), Monday to Friday
• Web chat support: No
• Onsite support: Yes
• Support levels: Varies according to business requirement and bespoke services required. Generally, clients are provided with a quota of capacity that can be called upon to support their needs. If this requires on-site presence, this will be managed as a request and fulfilled within lead times and communicated accordingly.
• Support available to third parties: Yes

Onboarding and offboarding

• Getting started: Onboarding is handled through a specific process to get accounts setup and connectivity established as well as operational and non-functional stakeholder engagement. The user training is often a project outcome prior to engaging support teams but top up training and enablement can be delivered via the service. SOPs and process documents are provided with contacting and escalation information and service operation guides.
• Service documentation: Yes
• Documentation formats:
  • PDF
  • Other
• Other documentation formats: MS Office documentation
• End-of-contract data extraction: Once completed, system connectivity is removed and any information that ceases to have an ongoing requirement for processing / retention is destroyed. Any client data that is returnable is returned or removed.
• End-of-contract process: Cessation of the services and connectivity removal.
• Documentation accessibility standard: WCAG 2.2 AA

Using the service

• Web browser interface: No
• Application to install: Yes
• Compatible operating systems:
  • Android
  • IOS
  • Linux or Unix
  • MacOS
  • Windows
  • ChromeOS
• Designed for use on mobile devices: No
• Service interface: No
• User support accessibility: WCAG 2.2 AA
• API: No
• Customisation available: Yes
• Description of customisation: Clients can request a tailored or bespoke support service to cater for nuances as required. Examples include UK Nationals or security clearances or operation of defined end to end processes or expertise on demand services.

Scaling

• Independence of resources: Resilience provided by UK Support teams scaled by GCC Resourcing from Offshore hubs and call on the consulting team if required.

Analytics

• Service usage metrics: Yes
• Metrics types: Up time; Time consumed
• Reporting types:
  • Regular reports
  • Reports on request
• Resource tagging: Yes
• FOCUS resource tagging: Yes

Resellers

• Supplier type: Not a reseller

Staff security

• Staff security clearance: Conforms to BS7858:2019
• Government security clearance: Security Clearance (SC)

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations:
  • United Kingdom
  • European Economic Area (EEA)
  • Other locations
• User control over data storage and processing locations: Yes
• Datacentre security standards: Managed by a third party
• Penetration testing frequency: Never
• Protecting data at rest: Other
• Other data at rest protection approach: 3rd Party provider with attestations and reporting to comply
• Data sanitisation process: Yes
• Equipment disposal approach: A third-party destruction service
• Data sanitisation type:
  • Deleted data can’t be directly accessed / Cryptographic Erasure
  • Data Erasure
  • Explicit overwriting of storage before reallocation / Secure Erase
  • Degaussing

Data importing and exporting

• Data export approach: Direct Download.
• Data export formats:
  • CSV
  • ODF
• Data import formats:
  • CSV
  • ODF

Data-in-transit protection

• Data protection between buyer and supplier networks:
  • TLS (version 1.2 or above)
  • IPsec or TLS VPN gateway
• Data protection within supplier network:
  • TLS (version 1.2 or above)
  • IPsec or TLS VPN gateway

Availability and resilience

• Guaranteed availability: Availability is the responsibility of the vendor tooling and thus is transferred to them.
• Approach to resilience: This is the Vendor's responsibility for the technology. Turnkey provides resilience via scalability of supporting resources and their ability to work from multiple locations globally.
• Outage reporting: Vendor published availability reporting.

Identity and authentication

• User authentication needed: Yes
• User authentication:
  • Multi-Factor Authentication (MFA)
  • Public key authentication (including by TLS client certificate)
  • Identity federation with existing provider (for example Google Apps)
  • Dedicated link (for example VPN)
  • Username or password
• Access restrictions in management interfaces and support channels: Direct connectivity to the underlying vendor technology via direct network access supported by vendor driven authentication. Information in Turnkey's supporting systems protected by encryption and authentication as well as access to resolver groups by need.
• Access restriction testing frequency: At least once a year
• Management access authentication:
  • Multi-Factor Authentication (MFA)
  • Public key authentication (including by TLS client certificate)
  • Identity federation with existing provider (for example Google Apps)
  • Limited access network (for example PSN)
  • Username or password

Audit information for users

• Access to user activity audit information: Users have access to real-time audit information
• How long user audit data is stored for: At least 12 months
• Access to supplier activity audit information: Users have access to real-time audit information
• How long supplier audit data is stored for: User-defined
• How long system logs are stored for: User-defined

Security governance

• Named board-level person responsible for service security: Yes
• Security governance certified: Yes
• Security governance standards: ISO/IEC 27001
• Information security policies and processes: ISMS formally documented to support ISO Certification.
• Software Security Code of Practice: Yes

Operational security

• Configuration and change management standard: Supplier-defined controls
• Configuration and change management approach: Software Vendor provides configuration and change management controls. Turnkey provides add-on services.
• Vulnerability management type: Undisclosed
• Vulnerability management approach: Vendor provided SOC2 and ISO certifications
• Protective monitoring type: Undisclosed
• Protective monitoring approach: Vendor provided reporting and monitoring processes.
• Incident management type: Supplier-defined controls
• Incident management approach: Tickets submitted in Zendesk with defined processes and resolver groups based upon ticket severity and contract type.
• Post-quantum cryptography secure: No

Secure development

• Approach to secure software development best practice: Conforms to a recognised standard, but self-assessed

Public sector networks

• Connection to public sector networks: No

Pricing

• Discount for educational organisations: Yes
• Free trial available: No

Discount percentage by annual call-off contract value (excluding VAT)

• Less than £250,000: 0%
• Between £250,000 and £500,000: 5%
• Between £500,001 and £1,000,000: 5%
• Between £1,000,001 and £2,500,000: 10%
• Between £2,500,001 and £5,000,000: 10%
• Over £5,000,001: 15%

Non-mandatory Standards and certifications

• ISO/IEC 27001 certification: Yes
• Who accredited the ISO/IEC 27001: Pyramid
• ISO/IEC 27001 accreditation date: Friday 22 August 2025
• What the ISO/IEC 27001 doesn’t cover: Supplier dependent activities
• ISO 28000:2022 certification: No
• ISO 9001 certification: No
• Quality management systems (QMS): Yes
• CSA STAR certification: No
• PCI certification: No
• Cyber essentials: Yes
• Please provide your Cyber Essentials Certificate Number: 67643976-d4e8-4f50-9205-74416dba89b4
• Cyber essentials plus: No
• Cyber Essentials Alternative: You do not have a current and valid Cyber Essentials Plus certificate, or will not have in place within 12 months of the date of award but have an IASME certified equivalent.
• Other security certifications: Yes
• Any other security certifications: Cyber Assurance Level 1

Social value

• Section B - Commitment for Future: Delivery:

  • Mission: Kick start economic growth. To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

    Policy Outcome 1: Fair work: That offers fair wages and good working conditions. Help people get a job, stay in work, and progress in their careers, with good employment opportunities across the country. Notes: Where there is a large proportion of labour costs in the contract, commercial teams should consider MAC in Outcome 1 as a priority

    • New or retained jobs on the contract workforce in the relevant area that meet the criteria set out in MAC 1b, 1c and 1d
    • Providing opportunities for, and measuring and monitoring of, staff workforce conditions over time, including employee engagement, involvement in decision-making and satisfaction and adapting to any changes in the results, with clear processes for acting on issues identified
    • Plans to engage the contract workforce in deciding the most important workplace issues to address
    • Monitoring of employee engagement rates (by protected characteristic) and, where necessary, the development of actions to ensure all voices are heard across the diversity of the workforce
    • Activities that support an environment where staff are educated about, and feel empowered to, address their physical wellbeing
    • Activities that support an environment where staff are educated about and feel empowered to report and address bullying and harassment
    • Activities to cascade good practice on fair working conditions throughout the supply chain
    • Offer a pay and leave entitlement to all eligible staff who become kinship carers, ideally equivalent to statutory adoption pay and leave
    • Payment of more than the National Minimum Wage or National Living Wage (as appropriate) to the contract workforce
    • Monitoring and reporting of gender and ethnicity pay gaps and plans to address them where necessary
    • Plans for an appropriate income replacement policy for staff who are required to spend time away from work to care for a sick dependent or close relative
    • Understanding of in-work progression issues affecting the market, industry or sector relevant to the contract, and in the supplier’s own organisation and those of its key sub-contractors
    • Measures to support in-work progression to help people in the contract workforce, to move into higher paid work by developing new skills relevant to the contract
    • Support for educational attainment relevant to the contract, including training schemes that address skills gaps and result in recognised qualifications
    • Volunteering opportunities for staff
    • Understanding of the modern slavery risks and issues affecting the market, industry, sector or country (of origin or of source) relevant to the contract, and the workforce in the supplier’s own organisation and those of its key subcontractors
    • Outline policies and practices to be applied to or put in place for the contract to mitigate and manage modern slavery risks, including: Pre-employment checks, recruitment practices. Workplace conditions, safeguarding plans and processes in place and regular monitoring with relevant groups considered, which may include sampling
    • How these flow down the supply chain and are monitored Illustrative examples include reporting, site visits, audits, etc.
    • How to ensure business decisions re: price/cost, short lead times, payment timescales do not create modern slavery risks in the supply chain
    • Means of influencing staff, suppliers, customers, communities and/or any other appropriate stakeholders with respect to modern slavery risks relating to the contract

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at finance@turnkeyconsulting.com. Tell them what format you need. It will help if you say what assistive technology you use.