SYSGROUP TRADING LIMITED

CyberArk Managed Operational Services

Cyberark is a Privilaged access management platform designed to secure, control, monitor, and audit acess to an organisations privilaged systems. Delivered as a managed service, it enforces least privilege, protects credentials, records sessions, supports compliance, reduces cyber risk, and removes the operational burden of managing sensitive administrative access securely centrally.

Features

• Centralised secure vault protecting privileged credentials across the organisation
• Automated password rotation eliminating static credentials and reducing cyber risk
• Least privilege and just in time privileged access enforcement controls
• Privileged session isolation with monitoring recording and oversight
• Comprehensive audit logs supporting compliance investigations and governance
• Continuous monitoring with incident detection response and escalation
• Platform patching upgrades and health management by specialists
• Supports on premises cloud and multi cloud environments
• Integrates with identity providers MFA ITSM and SIEM
• Managed onboarding offboarding governance reporting and service reviews

Benefits

• Reduce time managing privileged access through automated controls
• Eliminate manual password handling and associated operational delays
• Enable faster secure access using just in time permissions
• Simplify investigations with recorded sessions and searchable audit logs
• Improve resilience through continuous monitoring and proactive incident response
• Reduce internal workload by removing need for specialist PAM skills
• Accelerate onboarding and changes using standardised access workflows
• Manage access consistently across on premises and multi cloud environments
• Improve compliance reporting with clear auditable evidence
• Allow IT teams to focus on delivery not security maintenance

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at hello@sysgroup.com. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 15

Service ID

427133737577274

Contact

Matt Woudberg
0333 101 9000
hello@sysgroup.com

About the service

• Service categories:
  • Application Development and Deployment
    • Application platforms
      • Model driven application platforms
        • Model driven application platforms
• Multi cloud support: Yes

Service scope

• Software add-on or extension: Yes
• What software services is the service an extension to: This software is an add on to the standard Cyberark system with additional support services.
• Cloud deployment model: Hybrid cloud
• Service constraints: The service requires network connectivity between customer systems and the CyberArk platform. Certain administrative tasks depend on agreed change windows and maintenance schedules. Operating system patching for customer-owned servers remains the buyer’s responsibility. User provisioning is typically managed by the customer’s identity provider. Custom development and major architectural changes fall outside the standard managed service and require separate professional services.
• System requirements:
  • Valid CyberArk licence and active maintenance agreement
  • Secure internet connectivity for Privilege Cloud access
  • Corporate identity provider (e.g. Active Directory or Entra ID)
  • Multi-factor authentication integrated with identity provider
  • Supported web browser for CyberArk Privilege Cloud portal access

User support

• Email or online ticketing support: Yes
• Support response times: Managed Operations Service operates on a 24x7 basis so incidents can be logged at any time.
• User can manage status and priority of support tickets: Yes
• Online ticketing support accessibility: EN 301 549
• Phone support: Yes
• Phone support availability: 24 hours, 7 days a week
• Web chat support: No
• Onsite support: Yes
• Support levels: The service provides fully managed, SLA-backed support delivered by a UK-based CyberArk operations team operating 24/7/365. Support is structured around incident management, service requests, and change management, aligned to ITIL best practice.; ; Incident support is delivered across four severity levels: Critical, Serious, Moderate, and Minor. Each severity has defined response targets, ranging from one hour for critical incidents to twelve hours for minor issues, and applies at all times, including evenings and weekends. The service also supports Standard, Normal, and Emergency service requests and change requests, governed by agreed procedures, approval routes, and response targets. Proactive support is included, covering continuous monitoring, system health checks, patching, upgrades, reporting, and vendor coordination.; ; All support levels are included within a fixed managed service fee, scaled according to size, complexity, and number of privileged accounts and integrations in scope. There are no per-incident charges. Activities outside the standard scope, such as major architectural changes or custom development, are delivered via separately priced professional services.; ; Customers are supported by named CyberArk cloud support engineers, with escalation through an operations manager. A dedicated account manager provides service governance, reporting, and quarterly service review meetings.
• Support available to third parties: No

Onboarding and offboarding

• Getting started: We help users start using the service through a structured onboarding and enablement approach.; ; Users are supported during initial setup with guided onboarding, configuration workshops, and validation of access, policies, and integrations. We provide online documentation, runbooks, and operational guides covering day-to-day use, reporting, and support processes. Remote training sessions are available for administrators and security teams, focusing on platform usage, best practice, and operational workflows.; ; Where required, onsite training can be provided by prior agreement, typically for larger or regulated environments. Ongoing support includes knowledge transfer during service reviews and access to technical specialists for questions as users become familiar with the service.
• Service documentation: Yes
• Documentation formats: PDF
• Documentation accessibility standard: EN 301 549
• End-of-contract data extraction: At the end of the contract, users extract their data through a formal and controlled off-boarding process designed to ensure security, continuity, and regulatory compliance.; ; The off-boarding process begins with agreement of an exit plan and data-handover scope. Users can request the export of all customer-owned data held within the service, including configuration settings, safe structures, account metadata, access policies, audit logs, compliance reports, and privileged session recordings. Data is provided in standard, non-proprietary formats where possible to support reuse and migration to another provider or in-house solution.; ; Data extraction is carried out by authorised engineers and transferred to the buyer using secure delivery methods, such as encrypted file transfer or secure download links. Throughout the process, access controls and audit logging remain in place to prevent unauthorised access or data loss.; ; Following confirmation that data extraction has been completed successfully, all customer data, service accounts, credentials, and access permissions are securely removed from the service environment. Where required, formal confirmation of data deletion is provided. The service provider offers reasonable cooperation during transition to another supplier, ensuring an orderly and auditable exit with minimal operational disruption.
• End-of-contract process: At the end of the contract, the service follows a structured off-boarding and exit process designed to ensure security, continuity, and compliance. An exit plan is agreed with the buyer, setting out timelines, responsibilities, and data handover requirements. Customer-owned data is prepared for return, including configuration information, audit logs, reports, and session records. Access for the service provider is then revoked, service accounts are decommissioned, and customer data is securely deleted from the platform in line with contractual and regulatory obligations. Where required, confirmation of data deletion is provided, and support is given to assist transition to another supplier.; ; What’s included in the contract price; The contract price includes delivery of the managed service for the agreed term, covering operation, monitoring, incident management, service requests, change management within scope, platform patching and upgrades, reporting, service reviews, and standard off-boarding activities, including data export and access removal at contract end.; ; Additional costs; Additional charges may apply for services outside the standard scope. This includes major architectural changes, custom development, complex migrations, extended transition support, bespoke reporting beyond agreed limits, or professional services requested during or after contract termination. Any such costs are agreed in advance through a separate statement of work.

Using the service

• Web browser interface: Yes
• Supported browsers:
  • Microsoft Edge
  • Firefox
  • Chrome
  • Safari
• Application to install: No
• Designed for use on mobile devices: No
• Service interface: Yes
• Description of service interface: The service interface is a secure, browser-based management portal used to administer and monitor privileged access. It provides dashboards for system health, alerts, and activity, alongside workflows for access requests, approvals, and credential management. Administrators can view live and recorded sessions, run compliance reports, manage safes and accounts, and track incidents and changes. The interface integrates with identity providers and logging tools, supports role-based access controls, and is designed for secure, auditable day-to-day operations.
• Accessibility standards: EN 301 549
• Accessibility testing: SysGroup has not conducted bespoke user testing with assistive technology users for this service. Customer-facing service channels, documentation, and interfaces under SysGroup’s control are designed to align with WCAG 2.1 Level AA accessibility standards.; ; The primary service interfaces, including the CyberArk Privilege Cloud portal and associated administrative consoles, are provided and maintained by CyberArk. Accessibility testing for these interfaces is performed by the vendor as part of their product assurance processes.; ; SysGroup reviews accessibility considerations during service delivery, ensures documentation is provided in accessible formats where possible, and responds to reasonable adjustment requests raised by customers.
• User support accessibility: EN 301 549
• API: No
• Customisation available: Yes
• Description of customisation: Users can customise the service within controlled security and governance boundaries.; ; What can be customised; Users can customise access policies, safe structures, permission models, password rotation rules, session recording settings, reporting, alerts, integrations, and API-driven workflows. Branding and UI layout are not customisable.; ; How users can customise; Customisation is performed through the secure web interface and supported APIs. Changes follow role-based access controls and, where required, formal change management and approval workflows.; ; Who can customise; Customisation is carried out by authorised customer administrators and privileged security roles. The managed service provider can implement advanced or high-risk changes on the customer’s behalf following approval.

Scaling

• Independence of resources: Sysgroup delivers its products with a guarantee that users won't be affected by the demand other users are placing on our services. To do this we have a 24/7 UK-based operations team, defined SLAs and service credit regimes, Proactive monitoring and capacity planning, and Scalable operational staffing aligned to customer demand. In addition, we are committed to hiring sufficient staff and scaling operational tooling to meet increasing customer demand and to maintain service quality

Analytics

• Service usage metrics: Yes
• Metrics types: The service provides usage and operational metrics including platform availability, incident volumes, response and resolution times, service request and change performance against SLAs, system health status, account activity, password rotation success, and privileged session usage. Compliance metrics such as audit log completeness and access review outcomes are also provided.
• Reporting types:
  • Real-time dashboards
  • Regular reports
  • Reports on request
• Resource tagging: No
• FOCUS resource tagging: No

Supplier type

• Supplier type: Reseller providing extra support
• Organisation whose services are being resold: CyberArk

Staff security

• Staff security clearance: Other security clearance
• Government security clearance: Security Clearance (SC)

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations: United Kingdom
• User control over data storage and processing locations: No
• Datacentre security standards: Complies with a recognised standard (for example CSA CCM version 4.0)
• Penetration testing frequency: Less than once a year
• Penetration testing approach: ‘IT Health Check’ performed by a CREST-approved service provider
• Protecting data at rest: Encryption of all physical media
• Data sanitisation process: Yes
• Data sanitisation type: Deleted data can’t be directly accessed / Cryptographic Erasure
• Equipment disposal approach: Complying with a recognised standard, for example CSA CCM v4.0, CAS (Sanitisation) or ISO/IEC 27001

Data importing and exporting

• Data export approach: Users export their data through a controlled off-boarding and data handover process. On request, authorised engineers extract customer-owned data including configuration settings, audit logs, reports, and session records. Data is provided in standard, non-proprietary formats and transferred securely using encrypted file transfer or secure download links. Access controls and audit logging remain active throughout export. Once users confirm successful receipt, all customer data and access are securely removed from the service in line with contractual and regulatory requirements.
• Data export formats:
  • CSV
  • ODF
  • Other
• Other data export formats:
  • .txt
  • .log
  • .xml
  • .json
  • .docx
• Data import formats:
  • CSV
  • ODF
  • Other
• Other data import formats:
  • .txt
  • .log
  • .zip
  • .xml
  • .json
  • .docx

Data-in-transit protection

• Data protection between buyer and supplier networks:
  • TLS (version 1.2 or above)
  • IPsec or TLS VPN gateway
• Data protection within supplier network:
  • TLS (version 1.2 or above)
  • IPsec or TLS VPN gateway

Availability and resilience

• Guaranteed availability: The service guarantees availability through defined service level agreements (SLAs) and a formal service credit regime, rather than a fixed uptime percentage (for example, 99.9%). The documentation does not state a numeric availability SLA.; ; Availability is managed through 24/7 monitoring, incident management, and defined response targets. SLAs are set for incident response, service requests, and change requests, with incidents classified by severity with correlating responce times. These SLAs apply continuously, including evenings and weekends.; ; Performance against SLAs is measured over a quarterly review period. If SysGroup fails to meet the agreed SLA targets during that period, customers may be eligible for service credits applied against quarterly service management charges. The service credit structure is explicitly defined as follows:; 0–10% below target: no service credit;; 11–25% below target: 10% credit;; 26–50% below target: 20% credit;; 51–75% below target: 50% credit;; 76–100% below target: 100% credit.; ; Service credits apply to service management charges only and are the contractual remedy for SLA failures. The document does not describe a separate refund mechanism or direct availability-based compensation outside this service credit regime.; ; Availability assurance is therefore delivered through operational SLAs, proactive monitoring, escalation processes, and defined service credits, rather than a guaranteed uptime percentage.
• Approach to resilience: The service is designed to be resilient through a combination of managed operational controls, continuous monitoring, and structured service management.; ; Resilience is supported by a 24/7 UK-based operations team that continuously monitors system health and performance. Incidents are detected proactively and managed through defined severity levels with agreed response targets, escalation routes, and dedicated incident management for critical issues. This approach reduces the impact and duration of service disruption and ensures issues are addressed quickly and consistently.; ; The service operates under ITIL-aligned incident, problem, and change management processes, helping to prevent avoidable outages and ensure changes are planned, reviewed, and implemented safely. Regular health checks, patching, and upgrades are performed to maintain platform stability and security over time. Service performance is reviewed quarterly, with a defined service credit regime applied where service levels are not achieved.; ; The service is delivered using cloud-based CyberArk infrastructure, with hosting and core platform resilience provided by the underlying cloud environment. However, the documentation does not explicitly describe datacentre architecture, redundancy models, geographic failover, or disaster recovery metrics such as RPO or RTO.; ; Further details on datacentre resilience and underlying infrastructure controls can be provided on request, subject to security and commercial constraints.
• Outage reporting: Outages are reported through direct operational communication and formal incident management processes, rather than through automated public status tooling.; ; When a service-affecting issue is detected, the Operations Team logs an incident within the service desk system and assigns a reference number. Customers are notified directly, with updates provided throughout the lifecycle of the incident. Communication is delivered through agreed support channels, including email, and customers can also contact the Operations Team by phone or via the support portal at any time to request updates. Incident progress, actions taken, and resolution status are tracked within the ticketing system to ensure accountability.; ; The service operates on a 24/7 basis, and incidents can be logged or escalated at any time. For critical or serious incidents, a dedicated incident manager coordinates communication, escalation, and resolution, ensuring timely updates to the customer.; ; The documentation does not explicitly describe a public service status dashboard. While APIs exist for operational functions, the documentation does not state that an API is used for outage notifications.; ; In summary, outages are reported through email alerts and direct service desk communication, supported by incident tracking, rather than public dashboards or automated status APIs.

Identity and authentication

• User authentication needed: Yes
• User authentication:
  • Identity federation with existing provider (for example Google Apps)
  • Username or password
• Access restrictions in management interfaces and support channels: Access to management interfaces and support channels is restricted through role-based controls and approved user lists.; ; Only authorised users are granted access to the management interface, with permissions limited to defined roles. Access is provisioned during onboarding and reviewed periodically. Administrative actions are logged and auditable.; ; Support access is restricted to approved service callers nominated by the customer. Only these contacts can raise incidents or service requests via phone, email, or the support portal. All interactions are authenticated, logged in the ticketing system, and tracked through to resolution. Personnel accessing customer systems are vetted, and access is removed during off-boarding.
• Access restriction testing frequency: At least every 6 months
• Management access authentication:
  • Identity federation with existing provider (for example Google Apps)
  • Username or password

Audit information for users

• Access to user activity audit information: Users contact the support team to get audit information
• How long user audit data is stored for: User-defined
• Access to supplier activity audit information: Users contact the support team to get audit information
• How long supplier audit data is stored for: User-defined
• How long system logs are stored for: User-defined

Security governance

• Named board-level person responsible for service security: Yes
• Software Security Code of Practice: Yes
• Security governance certified: Yes
• Security governance standards: ISO/IEC 27001
• Information security policies and processes: Policies and processes followed; The documentation states that service delivery and support processes are aligned to ITIL best practice, covering incident management, problem management, change management, escalation, and service reviews. Information security is embedded within these processes through controlled access, role-based permissions, audit logging, and defined operational procedures for managing privileged access. Personnel security controls are in place, with engineers subject to vetting before working on customer systems.; ; Reporting structure; Security-related incidents, service issues, and non-conformances are logged and managed through the central service desk and ticketing system. Incidents are escalated through defined support levels, with critical incidents assigned a dedicated incident manager. Escalation routes are clearly defined up to senior operational management.; ; Ensuring policies are followed; Compliance with policies and processes is ensured through continuous monitoring, documented procedures, audit trails, and regular service review meetings. Performance against service levels is reviewed quarterly, supported by a formal service credit regime where SLAs are not met. The documentation does not explicitly name specific information security standards (such as ISO/IEC 27001), but confirms structured governance, accountability, and oversight throughout service delivery.

Operational security

• Configuration and change management standard: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Configuration and change management approach: The service uses documented, ITIL-aligned configuration and change management processes.; ; Component tracking; Service components are tracked through configuration records and service management tooling. Changes to platforms, connectors, safes, accounts, and configurations are logged, versioned, and auditable throughout their lifecycle. Service activity is recorded within the ticketing system, providing traceability from request through implementation.; ; Change assessment and security impact; All changes are classified as Standard, Normal, or Emergency. Normal and Emergency changes are reviewed through a Change Advisory Board (CAB) or Emergency CAB. Security impact is assessed before approval. Emergency changes follow expedited approval but remain logged and reviewed post-implementation.
• Vulnerability management type: Undisclosed
• Vulnerability management approach: The service operates a supplier-defined vulnerability management process.; ; Threat assessment; Potential threats are assessed through platform monitoring, incident detection, and review of security advisories relevant to the CyberArk service. Issues are logged, risk assessed, and prioritised through the service desk.; ; Patching and remediation; Patching and updates are deployed as part of managed operations. Updates follow change management processes, with emergency changes expedited where security risk requires urgent action. Deployment times depend on severity.; ; Threat intelligence sources; Information on potential threats is obtained from CyberArk security bulletins, vendor notifications, and operational monitoring.
• Protective monitoring type: Supplier-defined controls
• Protective monitoring approach: The service uses supplier-defined protective monitoring processes.; ; Identifying potential compromises; Potential compromises are identified through 24/7 monitoring of system health, privileged activity, alerts, and operational logs. Anomalies or suspicious activity are detected via monitoring tools and reviewed by the operations team.; ; Response to potential compromise; When a potential compromise is identified, an incident is logged, investigated, and managed through the formal incident management process. Issues are escalated, with critical incidents assigned a dedicated incident manager.; ; Response times; Response times are governed by defined incident SLAs, ranging from 1 hour for critical incidents to 12 hours for minor incidents, operating 24/7.
• Incident management type: Supplier-defined controls
• Post-quantum cryptography secure: Yes
• Incident management approach: The service operates documented, ITIL-aligned incident management processes.; ; Pre-defined processes; Yes. Incidents are classified by predefined severity levels (Critical, Serious, Moderate, Minor), with standard response and escalation procedures for common events.; ; Incident reporting; Users report incidents via phone, email, or the support portal. All incidents are logged in the service desk and assigned a reference number.; ; Incident reporting and updates; Incident progress and resolution are tracked within the ticketing system. Users receive updates during incident handling, and incident details can be provided through service desk communications and included in service review reports.

Secure development

• Approach to secure software development best practice: Conforms to a recognised standard, but self-assessed

Public sector networks

• Connection to public sector networks: No

Pricing

• Discount for educational organisations: No
• Free trial available: No

Discount percentage by annual call-off contract value (excluding VAT)

• Less than £250,000: 0%
• Between £250,000 and £500,000: 0%
• Between £500,001 and £1,000,000: 0%
• Between £1,000,001 and £2,500,000: 0%
• Between £2,500,001 and £5,000,000: 0%
• Over £5,000,001: 0%

Standards and certifications

• ISO/IEC 27001 certification: Yes
• ISO/IEC 27001 accredited by: Citation ISO Certification Limited.
• ISO/IEC 27001 accreditation date: Wednesday 12 January 2022
• What the ISO/IEC 27001 doesn’t cover: Our ISO/IEC 27001 certification applies exclusively to the Information Security Management System (ISMS) supporting the provision of Managed IT Services, including Strategic Consultancy, IT Support, Cloud Services, Data Centre Services, Security Solutions and Connectivity.; ; Activities falling outside this defined scope are not covered. This includes any services not directly related to the delivery or management of these managed IT services, such as standalone hardware resale, third-party services delivered under the supplier’s own certifications, customer-managed environments not operated or administered by us, and internal corporate functions not impacting service delivery. Where third parties are involved, assurance is managed through contractual and supplier risk controls rather than our certification.
• ISO 28000:2022 certification: No
• ISO 9001 certification: Yes
• ISO 9001 certification accredited by: QMS International
• ISO 9001 accreditation date: Wednesday 23 February 2022
• What the ISO 9001 doesn’t cover: SysGroup’s ISO 9001 certification applies to the delivery of IT Managed Services, including Strategic Consultancy, IT Support, Cloud Services, Data Centre Services, Security Solutions, and Connectivity. Any services, activities, or offerings that fall outside these defined service areas are not covered by the ISO 9001 certification.
• Quality management systems (QMS): Yes
• CSA STAR certification: No
• PCI certification: Yes
• PCI DSS certification accredited by: Asa
• PCI DSS accreditation date: Tuesday 30 September 2025
• What the PCI DSS doesn’t cover: Our certification covers the below:; Hosting Services:; - hardware, infrastructure/networking, storage, security services, multi-tenant service provider; Managed Services:; - Systems security services, IT support
• Cyber essentials: Yes
• Cyber Essentials Certificate Number: 9fd2a9c4-5f8e-44de-90e6-8a2610a05278
• Cyber essentials plus: No
• Cyber Essentials Alternative: In relation to the services you do not have a current and valid Cyber Essentials Plus certificate which has been awarded by one of the government approved Cyber Essentials accreditation bodies but you are working towards gaining it, and will be in a position to confirm that you have been awarded a current and valid Cyber Essentials Plus certificate by one of the government approved accreditation bodies within 12 months of the date of award.
• Other security certifications: No

Social value

• Mission: Kick start economic growth:

  To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

  Policy Outcome 1: Fair work: That offers fair wages and good working conditions. Help people get a job, stay in work, and progress in their careers, with good employment opportunities across the country. Notes: Where there is a large proportion of labour costs in the contract, commercial teams should consider MAC in Outcome 1 as a priority

  • New apprenticeships on the contract workforce in the relevant area that meet the criteria set out in MAC 1b
• Mission: Build an NHS fit for the future:

  That is there when people need it; with fewer lives lost to the biggest killers; in a fairer Britain, where everyone lives well for longer.

  Policy Outcome 8: Increasing productivity through physical and mental wellbeing: In the supply chain and communities in the relevant area.

  • Understanding of issues relating to health and wellbeing, including physical and mental health, in the contract workforce
  • Inclusive and accessible recruitment practices, development practices and retention policies that support-focused activities including those provided in the Guide for line managers on recruiting, managing and developing which support people with a disability or health condition
  • Actions to invest in the physical and mental health and wellbeing of the contract workforce

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at hello@sysgroup.com. Tell them what format you need. It will help if you say what assistive technology you use.