CENTRAL NETWORKS AND TECHNOLOGIES LIMITED

Keeper

Keeper is a cybersecurity platform focused on password management, secrets management, and privileged access management (PAM). It helps organisations prevent password-related breaches by storing credentials in a zero-knowledge, zero-trust encrypted vault, ensuring only the end user can decrypt their data.

Features

• Password Vaults
• SSO & SCIM Integration
• Dark Web Monitoring
• Cross-Platform Access
• Compliance Ready

Benefits

• Productivity Gains
• Every user has their own, encrypted vault
• High-strength passwords are randomly generated
• Every user gets keeper on unlimited devices
• Keeper scans vaults for exposed passwords on the dark web

• Free trial available

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at Sales@centralnetworks.co.uk. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 15

Service ID

456598030058907

Contact

Tamar Waite
01706747474
Sales@centralnetworks.co.uk

About your service

• Service categories:

  Applications

  Production and operations

  • Other operations
• Multi cloud support: Yes

Service scope

• Software add-on or extension: Yes, but can also be used as a standalone service
• What software services is the service an extension to: Central Networks Security Operation Centre (SOC)
• Cloud deployment model: Hybrid cloud
• Service constraints: No
• System requirements:
  • Windows, MAC OS Linux platforms, Apple IOS or Andriod
  • https://docs.keeper.io/en/user-guides/system-requirements

User support

• Email or online ticketing support: Yes
• Support response times: Response times are dependant on ticket categorisation and request type. Priority 1 Disaster, Response Time: 30 minutes, Target Fix: 4 hours. Priority 2 High, Response Time 1 hour, Target Fix: 8 hours. Priority 3 Medium, Response Time: 4 hours, Target Fix: 20 hours Priority 4 Low, Response Time: 10 hours, Target Fix: 30 hours Priority 5 informational, Response Time: 3 days, Target Fix: 90 days Out of hours service is available on request.
• User can manage status and priority of support tickets: Yes
• Online ticketing support accessibility: WCAG 2.2 AA
• Phone support: Yes
• Phone support availability: 24 hours, 7 days a week
• Web chat support: No
• Onsite support: Yes, at extra cost
• Support levels: Our operations team is broken down into two areas, Service Desk and Engineering. The Service Desk acts as the primary source of all activity, where calls are categorised, prioritised and filtered to the relevant specialist if required. Our calls are given a priority level from 1-5; whereas P1 is Disaster, business is non-operational all the way through to P5, of which could be a cosmetic incident, for example. Our response times and levels are summarised below: P1 - Urgent - 15mins Response Time (RT), 4 hrs Target Full Fix Time(TFFT) P2 - Critical - 30mins RT, 8 hrs TFFT P3 - Very Important - 4 hrs RT, 20 hrs TFFT P4 - Important - 10 hrs RT, 30 hrs TFFT P5 - Informational - 3 days RT, 90 days TFFT (never normally this long) The majority of activity will be remote based working, however we will send either a senior engineer to the client site, or a cloud specialist to a cloud hosting datacentre site, as and when required, depending on the incident. All priority incidents are included in our pricing, defined by customised SLA's and can be in unlimited numbers if required, depending on the client's needs.
• Support available to third parties: Yes

Onboarding and offboarding

• Getting started: All Keeper customers have access to the knowledge base which documents both how to use the system and gives access to self paced video training. Customer may also purchase Professional Services to support installation and delivery of the solution. Professional Services are an additional cost.
• Service documentation: Yes
• Documentation formats:
  • HTML
  • PDF
• End-of-contract data extraction: At end of contract Keeper will destroy any data held within the system within 90 days of license expiry. If customer would like to extract data there are built in export tools within the platform or Account Manager to discuss options. Professional Services charges may apply for data extraction
• End-of-contract process: At end of contract Keeper will destroy any data held within the system within 90 days of license expiry.
• Documentation accessibility standard: WCAG 2.2 AA

Using the service

• Web browser interface: Yes
• Supported browsers:
  • Microsoft Edge
  • Firefox
  • Chrome
  • Safari
  • Opera
  • Other
• Application to install: Yes
• Compatible operating systems:
  • Android
  • IOS
  • MacOS
  • Windows
  • ChromeOS
• Designed for use on mobile devices: Yes
• Differences between the mobile and desktop service: N/A
• Service interface: Yes
• User support accessibility: WCAG 2.2 A
• Description of service interface: The interface is designed to provide a seamless and secure way to manage and protect sensitive information. It offers a fully managed, cloud-based platform that eliminates the need for hosting software and simplifies the management of infrastructure secrets.
• Accessibility standards: WCAG 2.2 A
• Accessibility testing: Completed by Vendor
• API: Yes
• What users can and can't do using the API: Keeper provide extensive documentation on the use of the API function. This documentation is maintained at https://www.keepersecurity.com/en_GB/developer/; https://docs.keeper.io/en/enterprise-guide/developer-tools
• API documentation: Yes
• API documentation formats:
  • HTML
  • PDF
• API sandbox or test environment: Yes
• Customisation available: No

Scaling

• Independence of resources: Keeper Secrets Manager is designed to scale with your organization's growth, ensuring that it can manage an increasing number of secrets securely. The platform's architecture allows for high availability, scalability, and robust disaster recovery, with a multi-region and multi-zone infrastructure on Amazon Web Services (AWS).

Analytics

• Service usage metrics: Yes
• Metrics types: There are build in dashboards and report s to display usage and adoption. There also a number of built in reports and dashboards reporting on security metrics withing the platform and the health of the data stored in the vaults.
• Reporting types:
  • API access
  • Real-time dashboards
  • Regular reports
• Resource tagging: No
• FOCUS resource tagging: No

Resellers

• Supplier type: Reseller providing extra support
• Organisation whose services are being resold: Keeper

Staff security

• Staff security clearance: Other security clearance
• Government security clearance: Baseline Personnel Security Standard (BPSS)

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations: United Kingdom
• User control over data storage and processing locations: Yes
• Datacentre security standards: Supplier-defined controls
• Penetration testing frequency: At least once a year
• Penetration testing approach: NCSC approved service provider
• Protecting data at rest: Physical access control, complying with SSAE-18 / ISAE 3402
• Data sanitisation process: Yes
• Equipment disposal approach: Complying with a recognised standard, for example CSA CCM v4.0, CAS (Sanitisation) or ISO/IEC 27001
• Data sanitisation type: Data Erasure

Data importing and exporting

• Data export approach: Import and export options are built into the platform. These include a number of tools for importing from browsers and other password management platforms along with options for CSV imports
• Data export formats: CSV
• Data import formats: CSV

Data-in-transit protection

• Data protection between buyer and supplier networks:
  • Private network or public sector network
  • TLS (version 1.2 or above)
• Data protection within supplier network: TLS (version 1.2 or above)

Availability and resilience

• Guaranteed availability: All SLA terms are cascaded from Keeper master agreement for https://www.keepersecurity.com/en_GB/termsofuse.html
• Approach to resilience: The International Organization for Standardization 27001 Standard (ISO 27001) is an information security standard that ensures office sites, development centers, support centers and data centers are securely managed. Keeper is audited against a variety of standards in the International Organization for Standardization 27001 (ISO 27001) family by its independent third party ANSI-ASQ National Accreditation Board (ANAB) accredited certifier. These standards which KnowBe4 has successfully been audited against include: The International Organization for Standardization 27001:2022 Standard covering information security controls The International Organization for Standardization 27701:2019 Standard covering privacy information management The International Organization for Standardization 27017:2015 Standard covering information security controls for cloud computing The International Organization for Standardization 27018:2019 Standard covering protecting PII in the public cloud for data processors
• Outage reporting: All service impacting issues are reported on https://statuspage.keeper.io and a subscription to this feed is available.

Identity and authentication

• User authentication needed: Yes
• User authentication:
  • Multi-Factor Authentication (MFA)
  • Public key authentication (including by TLS client certificate)
  • Identity federation with existing provider (for example Google Apps)
• Access restrictions in management interfaces and support channels: Access is based on username and password with MFA. Access to functions is control via RBAC.
• Access restriction testing frequency: At least once a year
• Management access authentication:
  • Multi-Factor Authentication (MFA)
  • Public key authentication (including by TLS client certificate)
  • Identity federation with existing provider (for example Google Apps)

Audit information for users

• Access to user activity audit information: Users have access to real-time audit information
• How long user audit data is stored for: At least 12 months
• Access to supplier activity audit information: Users have access to real-time audit information
• How long supplier audit data is stored for: At least 12 months
• How long system logs are stored for: At least 12 months

Security governance

• Named board-level person responsible for service security: Yes
• Security governance certified: Yes
• Security governance standards:
  • CSA CSM version 4.0
  • ISO/IEC 27001
• Information security policies and processes: Keepers' compliance posture includes: ; ISO 27001 / 27017 / 27018; SOC 2; FedRAMP High Authorization; HIPAA; GDPR; PCI DSS Level 1; These are publicly accessible on their main website.
• Software Security Code of Practice: Yes

Operational security

• Configuration and change management standard: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Configuration and change management approach: The Keeper Research and Development (R&D) department leverages a Continuous Integration / Continuous Delivery (CI/CD) pipeline for managing code deployments. Code changes are peer reviewed, approved by separate QA staff, and tested in a staging environment before they are pushed into production. The staging and production environments are logically separated, and no data is shared between them
• Vulnerability management type: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Vulnerability management approach: The Keeper information security team performs monthly web application vulnerability scans. These scans are configured to run as authenticated scans. Any vulnerabilities found during these scans or any other vulnerability discovery activities are added to a vulnerability tracking system. There, the vulnerabilities are verified, categorized, and evaluated for actual risk. Vulnerabilities are remediated in accordance with the schedule.
• Protective monitoring type: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Protective monitoring approach: Keeper have designed highly scalable and resilient product architecture within AWS. Our products withstand sophisticated attacks and are highly adaptable. Systems’ performance within our products’ architecture is monitored for key metrics. Should any components become overloaded or experience a fault, automated processes will be executed to bring online additional temporary systems or to cycle out existing systems for new ones. Automation is built into the architecture, so system monitoring, updates, and corrective actions can take place as needed. Risk Management Program is reviewed as part of annual third-party audits (FedRAMP, ISO 27001, and SOC2).
• Incident management type: Complies with a recognised standard, for example, CSA CCM v4.0 or ISO/IEC 27035:2011 or SSAE-18 / ISAE 3402
• Incident management approach: If Keeper becomes aware of any unlawful access to any Customer Data stored on Keeper equipment or in Keeper facilities that results in the loss, disclosure or alteration of Customer Data (each a “Security Incident”), Keeper will promptly (1) notify Customer of the Security Incident; (2) investigate the Security Incident; and (3) take reasonable steps to mitigate the effects of, and minimize any damage resulting from, the Security Incident. Security Incidents Notification(s) will be delivered to one or more Customer administrator by a means selected by Keeper, including via email.
• Post-quantum cryptography secure: Yes

Secure development

• Approach to secure software development best practice: Independent review of processes (for example CESG CPA Build Standard, ISO/IEC 27034, ISO/IEC 27001 or CSA CCM v4.0)

Public sector networks

• Connection to public sector networks: No

Pricing

• Discount for educational organisations: No
• Free trial available: Yes
• Description of free trial: Get set up in a few minutes ; Enforce strong password policies for all your users; Receive notifications for breached credentials; Encrypt file attachments and share them securely; Autofill credentials on websites and web apps ; Easy-to-use web vault and native apps across Windows, macOS, Linux, iOS and Android
• Link to free trial: https://www.keepersecurity.com/trial/start-business-trial/

Discount percentage by annual call-off contract value (excluding VAT)

• Less than £250,000: 0.25%
• Between £250,000 and £500,000: 0.5%
• Between £500,001 and £1,000,000: 0.75%
• Between £1,000,001 and £2,500,000: 1%
• Between £2,500,001 and £5,000,000: 1.25%
• Over £5,000,001: 1.5%

Non-mandatory Standards and certifications

• ISO/IEC 27001 certification: Yes
• Who accredited the ISO/IEC 27001: Citation
• ISO/IEC 27001 accreditation date: Monday 19 May 2025
• What the ISO/IEC 27001 doesn’t cover: None
• ISO 28000:2022 certification: No
• ISO 9001 certification: Yes
• Who accredited the ISO 9001 certification: Citation
• ISO 9001 accreditation date: Friday 3 January 2025
• What the ISO 9001 doesn’t cover: None
• Quality management systems (QMS): Yes
• CSA STAR certification: No
• PCI certification: No
• Cyber essentials: Yes
• Please provide your Cyber Essentials Certificate Number: 79646496-1330-4827-b087-691615c42291
• Cyber essentials plus: Yes
• Please provide your Cyber Essentials Plus Certificate Number: 106b321e-346f-4e5c-abd9-51b4fc523fa0
• Other security certifications: No

Social value

• Section B - Commitment for Future: Delivery:

  • Mission: Kick start economic growth. To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

    Policy Outcome 3: Resilient, innovative and flexible supply chains: Support economic growth through enabling resilient businesses, opportunities for small businesses and voluntary, community and social enterprises

    • Activities that demonstrate a collaborative way to work with a diverse range of businesses as part of the supply chain

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at Sales@centralnetworks.co.uk. Tell them what format you need. It will help if you say what assistive technology you use.