Trustmarque Palo Alto Prisma Access

Service scope

Software add-on or extension: No
Cloud deployment model: Public cloud
Service constraints: 1. Dependency on internet connectivity: relies on a stable and reliable internet connection for proper functionality.
2. Compatibility: with certain legacy systems or software.
3. Cost: may involve additional expenses for licensing, infrastructure, and ongoing support.
4. Configuration and setup: configuration and setup require technical expertise and time investment.
5. User training: may need to provide training for effective/secure use of the service.
6. Geographic coverage: Availability/coverage may vary based on geographical locations.
7. Service provider dependency: rely on the service provider's infrastructure and support.

Review the product documentation and with Palo Alto Networks for specific constraints and limitations.
System requirements: Windows, macOS, Linux, iOS, and Android

A stable and reliable internet connection

Google Chrome, Mozilla Firefox, Microsoft Edge, and Safari

Compatible network infrastructure

VPN Client Software

Contact Trustmarque for latest compatibility

User support

Email or online ticketing support: Email or online ticketing
Support response times: SLA for Support-related response times are dependant on the level of support purchased with the service.
User can manage status and priority of support tickets: Yes
Online ticketing support accessibility: None or don’t know
Phone support: Yes
Phone support availability: 24 hours, 7 days a week
Web chat support: No
Onsite support: No
Support levels: Palo Alto Networks offers three support levels: Standard, Premium, and Elite. The Standard level provides 8x5 access to technical support, software updates, and hardware replacement. The Premium level offers 24x7 access to technical support, along with additional features such as designated support engineers and proactive monitoring. The Elite level includes all Premium features, as well as faster response times and personalized support services. Each level is designed to meet varying customer needs and service level requirements.
Support available to third parties: Yes

Onboarding and offboarding

Getting started: Palo Alto Networks assists users in starting to use Prisma Access through comprehensive documentation, technical support, training programs, and professional services. They provide step-by-step guides for setup and configuration, offer assistance and troubleshooting, educate users through training resources, and offer consulting services for a smooth deployment. Additionally, they foster a user community for collaboration and knowledge sharing. These efforts ensure that users have the necessary resources and support to effectively implement and utilize Prisma Access.
Service documentation: Yes
Documentation formats: HTML

PDF
End-of-contract data extraction: When a Prisma Access contract ends, users have different options to extract their data and ensure a smooth transition. Here are some steps users can take:

1. Data Backup: Before the contract ends, it is crucial to perform a comprehensive data backup. This includes saving any configuration files, security policies, user profiles, and other relevant data associated with Prisma Access.

2. Export Logs and Reports: Users should extract logs, reports, and any other relevant data generated by Prisma Access during the contract period. This information can be essential for compliance, auditing, or historical analysis purposes.

3. Data Migration: If users plan to transition to a different solution or platform, they should explore data migration options. This may involve exporting and converting configurations, policies, and user data to a format compatible with the new platform.

4. Vendor Assistance
End-of-contract process: At the end of a Prisma Access contract, the services provided by Prisma Access will cease. The contract will reach its agreed-upon end date, and the customer will no longer have access to the Prisma Access platform and its associated features and benefits. The customer will need to make alternative arrangements for their network security needs.

Prior to the contract end date, the customer and the service provider may engage in discussions regarding contract renewal. If both parties agree, they may negotiate new terms and conditions for a renewed contract. If no agreement is reached, the contract will terminate as scheduled.

During the contract termination process, the customer may be required to complete certain tasks. These tasks may include retrieving any data or information stored within the Prisma Access system, ensuring that critical information is not lost. The customer will need to transition to an alternative solution or provider for their network security requirements.

It is important for the customer to review the contract terms and conditions to understand the specific obligations and requirements at the end of the Prisma Access contract. Each contract may have its own provisions and procedures for termination or renewal.

Using the service

Web browser interface: Yes
Supported browsers: Internet Explorer 11

Microsoft Edge

Firefox

Chrome

Safari

Opera
Application to install: Yes
Compatible operating systems: Android

IOS

Linux or Unix

MacOS

Windows

Windows Phone
Designed for use on mobile devices: Yes
Differences between the mobile and desktop service: Please consult Palo Alto documentation
Service interface: Yes
User support accessibility: None or don’t know
Description of service interface: The service interface for Prisma Access is primarily accessed and managed through the Strata Cloud Management console, which is a web-based interface. The management console provides a centralized platform for administrators to configure and monitor the Prisma Access service. Through this interface, administrators can manage security policies, view logs and analytics, configure user access, and perform other administrative tasks related to the Prisma Access service.
Accessibility standards: None or don’t know
Description of accessibility: Users have the ability to configure and manage security policies, monitor network/security events, view and manage user/device information, generate reports, and integrate with other security solutions and platforms. They can define policies for secure access, monitor logs/alerts, access user and device information, generate reports for insights, and integrate with other tools.

Users are restricted from modifying system-level configurations and settings, performing administrative tasks beyond their assigned roles and permissions, accessing or modifying system logs and audit trails, and accessing or modifying security controls and policies beyond their assigned scope. They cannot configure or manage third-party integrations without proper permissions.
Accessibility testing: The full VPAT / WCAG report can be provided on request.
API: Yes
What users can and can't do using the API: Users can programmatically interact with and automate various aspects of the Prisma Access service. Here are some examples of what users can do with Prisma Access APIs:

1. Configuration Management: Users can use APIs to automate the configuration of various settings and policies within the Prisma Access service. This includes managing network and security policies, user access controls, and other configuration parameters.

2. User Provisioning and Authentication: APIs allow users to programmatically onboard and provision users, manage user roles and permissions, and authenticate users accessing the Prisma Access service.

3. Reporting and Analytics: Users can leverage APIs to retrieve logs, statistics, and other data related to network traffic, security events, and user activity. This enables custom reporting, analysis, and integration with third-party tools.

4. Integration with Security Ecosystem: Prisma Access APIs enable integration with other security solutions and services. Users can integrate Prisma Access with SIEM (Security Information and Event Management) systems, threat intelligence platforms, or custom security workflows to enhance their overall security posture.

5. Monitoring and Alerting: APIs allow users to monitor the health and performance of the Prisma Access service by retrieving real-time status, metrics, and alerts. This helps in proactive monitoring and incident response.
API documentation: Yes
API documentation formats: HTML
API sandbox or test environment: No
Customisation available: Yes
Description of customisation: Yes, users can customize the Prisma Access service to align with their specific requirements. They can define and customize security policies, user access controls, network segmentation, and integrate it with their existing security ecosystem. Additionally, users can customize reporting and analytics to generate insights based on their unique needs. It's important to note that the extent of customization may vary based on the specific features and licensing agreement. Users should refer to the documentation provided by Palo Alto Networks for detailed information on customization options and limitations.

Scaling

Independence of resources: Prisma Access utilizes a distributed architecture and scalable infrastructure to ensure that users are not affected by the demand placed by other users on the service. It dynamically allocates resources based on demand to maintain optimal performance and availability. Load balancing techniques are employed to distribute traffic evenly across multiple servers and data centers. Additionally, Prisma Access leverages advanced traffic management and prioritization mechanisms to ensure that critical applications and users receive the necessary resources and are not negatively impacted by other users' activities.

Analytics

Service usage metrics: Yes
Metrics types: 1. User activity and behavior monitoring.
2. Application usage and performance tracking.
3. Network bandwidth consumption analysis.
4. Threat detection and prevention metrics.
5. VPN tunnel utilization and performance monitoring.
6. User authentication and access control metrics.
7. Firewall rule effectiveness and usage metrics.
8. Web filtering and content inspection statistics.
9. Incident response and security incident metrics.
10. Compliance and regulatory reporting metrics.
Reporting types: API access

Real-time dashboards

Regular reports

Resellers

Supplier type: Reseller providing extra support
Organisation whose services are being resold: Palo Alto

Staff security

Staff security clearance: Other security clearance
Government security clearance: Up to Developed Vetting (DV)

Asset protection

Knowledge of data storage and processing locations: Yes
Data storage and processing locations: United Kingdom

European Economic Area (EEA)

Other locations
User control over data storage and processing locations: Yes
Datacentre security standards: Supplier-defined controls
Penetration testing frequency: At least every 6 months
Penetration testing approach: In-house
Protecting data at rest: Physical access control, complying with CSA CCM v3.0

Physical access control, complying with SSAE-16 / ISAE 3402

Physical access control, complying with another standard

Encryption of all physical media

Scale, obfuscating techniques, or data storage sharding

Other
Other data at rest protection approach: Service are supplied from Google and Amazon Data centers (further information to follow)
Google Security statement
https://cloud.google.com/security/overview/
https://cloud.google.com/security/

AWS Security Statement
https://aws.amazon.com/compliance/data-center/controls/
https://d1.awsstatic.com/whitepapers/aws-security-whitepaper
https://aws.amazon.com/compliance/data-center/data-centers/

All logs are stored in the Cortex data lake, user activity is monitored and stored in the Cortex data lake for the agreed retention period.
Data sanitisation process: Yes
Data sanitisation type: Explicit overwriting of storage before reallocation

Deleted data can’t be directly accessed
Equipment disposal approach: Complying with a recognised standard, for example CSA CCM v.30, CAS (Sanitisation) or ISO/IEC 27001

Data importing and exporting

Data export approach: Users can export data from Prisma Access by logging into the management console, navigating to the desired data section, selecting the export format (e.g., CSV, PDF, JSON), specifying any parameters, and initiating the export process. Upon completion, users can download the exported file or receive a download link via email. Specific steps and options may vary, so it's advisable to consult the official documentation or Palo Alto Networks support for detailed instructions based on the specific setup.
Data export formats: CSV

Other
Other data export formats: PDF

JSON
Data import formats: CSV

Other
Other data import formats: XML

JSON

Data-in-transit protection

Data protection between buyer and supplier networks: Private network or public sector network

TLS (version 1.2 or above)

IPsec or TLS VPN gateway

Other
Other protection between networks: Segmentation/micro-segmentation techniques to isolate and compartmentalise different parts of the network preventing lateral movement of threats and limits impact of potential security breaches.

Employs advanced firewall capabilities to monitor/control traffic within the network. Includes deep packet inspection, intrusion prevention, and application-level controls to detect and prevent unauthorised access or malicious activities.

Robust encryption to protect data at rest and in transit.

Leverages threat intelligence and machine learning algorithms to identify and mitigate potential security risks. It actively monitors network traffic, analyses patterns, and identifies anomalies or suspicious behaviour, enabling proactive threat prevention and response.
Data protection within supplier network: TLS (version 1.2 or above)

IPsec or TLS VPN gateway

Other
Other protection within supplier network: Prisma Access protects data within the network through segmentation, advanced firewall controls, encryption, and threat detection. Segmentation isolates network parts to prevent threats from spreading. Advanced firewalls monitor and control traffic with intrusion prevention and deep packet inspection. Robust encryption secures data at rest and in transit. Threat intelligence and machine learning identify and mitigate risks. Prisma Access actively monitors traffic, detects anomalies, and responds to threats. These measures reduce the risk of data breaches, ensuring data confidentiality and integrity within the network.

Availability and resilience

Guaranteed availability: Palo Alto Networks aims to maintain at least 99.99% availability for Prisma Access. If this commitment is not met, customers may be eligible for a service credit. Monthly uptime availability is calculated by subtracting the percentage of downtime, excluding planned or emergency outages. To claim a service credit, customers must open a case within 24 hours of an outage and submit a claim within 5 business days. Palo Alto Networks will promptly review the claim within 15 days after determining the root cause and closing the case.
Approach to resilience: Prisma Access is designed with built-in resiliency to ensure continuous and reliable network security. It employs several key mechanisms to enhance its resilience.

Firstly, Prisma Access utilises a global network of Points of Presence (PoPs) strategically distributed across different regions. This distributed architecture enables load balancing and automatic failover, ensuring uninterrupted service even in the event of a localised failure.

Secondly, Prisma Access incorporates redundant components and multiple layers of fault tolerance. This includes redundant hardware, network connections, and power supplies, minimising the impact of hardware failures and ensuring high availability.

Thirdly, Prisma Access leverages dynamic routing protocols and intelligent traffic management algorithms. These mechanisms allow for efficient rerouting of traffic in the event of network congestion or failure, optimising performance and maintaining connectivity.

Moreover, Prisma Access employs proactive monitoring and alerting systems to promptly detect and respond to any issues or anomalies. This enables quick identification and resolution of potential problems, minimising downtime and maximising uptime.

Overall, the combination of distributed architecture, redundancy, fault tolerance, intelligent routing, and proactive monitoring makes Prisma Access resilient to disruptions, ensuring continuous and reliable network security for organisations.
Outage reporting: Prisma Access provides various mechanisms to report service outages and communicate with customers regarding any disruptions or incidents.

Firstly, Palo Alto Networks maintains a dedicated status page or portal where customers can access real-time information about the status of Prisma Access services. This status page provides updates on any ongoing incidents, maintenance activities, or service outages.

Additionally, Prisma Access offers proactive monitoring and alerting capabilities. Palo Alto Networks monitors the service infrastructure and network health to promptly detect any issues or potential outages. In the event of a service outage, customers may receive automated notifications or alerts via email, SMS, or through the Prisma Access management console.

Furthermore, customers can also reach out to Palo Alto Networks' support team directly for assistance and information regarding service outages. The support team is available to provide timely updates, answer queries, and address any concerns related to service disruptions.

By utilising these reporting mechanisms, Prisma Access ensures transparent communication and keeps customers informed about any service outages or incidents, enabling them to take necessary actions and plan accordingly.

Identity and authentication

User authentication needed: Yes
User authentication: 2-factor authentication

Public key authentication (including by TLS client certificate)

Identity federation with existing provider (for example Google Apps)

Limited access network (for example PSN)

Dedicated link (for example VPN)

Username or password
Access restrictions in management interfaces and support channels: Access to Prisma Access management interfaces and support channels is restricted through role-based access control (RBAC) and two-factor authentication (2FA). RBAC ensures that only authorized users with specific roles and permissions can access and perform actions within these interfaces. 2FA adds an extra layer of security by requiring users to provide additional authentication factors such as one-time passwords (OTPs) or mobile authentication apps. These measures help restrict access to authorised personnel and protect sensitive functionalities and data.
Access restriction testing frequency: At least every 6 months
Management access authentication: 2-factor authentication

Public key authentication (including by TLS client certificate)

Identity federation with existing provider (for example Google Apps)

Limited access network (for example PSN)

Dedicated link (for example VPN)

Username or password

Audit information for users

Access to user activity audit information: Users have access to real-time audit information
How long user audit data is stored for: User-defined
Access to supplier activity audit information: Users contact the support team to get audit information
How long supplier audit data is stored for: User-defined
How long system logs are stored for: User-defined

Standards and certifications

ISO/IEC 27001 certification: Yes
Who accredited the ISO/IEC 27001: Certified by PECB MS, Canada
ISO/IEC 27001 accreditation date: 22/08/2023
What the ISO/IEC 27001 doesn’t cover: https://www.paloaltonetworks.com/content/dam/pan/en_US/assets/pdf/legal/technical-certifications/iso-27001.pdf
ISO 28000:2007 certification: No
CSA STAR certification: Yes
CSA STAR accreditation date: 16/07/2020
CSA STAR certification level: Level 1: CSA STAR Self-Assessment
What the CSA STAR doesn’t cover: N/a
PCI certification: No
Cyber essentials: Yes
Cyber essentials plus: Yes
Other security certifications: Yes
Any other security certifications: NCSC Foundation Grade Certification

SOC2

FedRAMP

Common Criteria

FIPS 140-2

Telecom Security Act Code of Practice

https://www.paloaltonetworks.com/legal-notices/trust-center/technical-certifications

Security governance

Named board-level person responsible for service security: Yes
Security governance certified: Yes
Security governance standards: ISO/IEC 27001
Information security policies and processes: Palo Alto Networks has a formal Enterprise Risk Management program, which includes the performance of an annual risk assessment, with periodic updates, as applicable, to identify and assess key risks and their mitigation approaches. The scope of the program encompasses information security risks and product risks. Our security program consists of a risk-based approach that includes administrative, technical and physical safeguards reasonably designed to protect the confidentiality, integrity and availability of customer data. Palo Alto Network's information security program is aligned to ISO 27001/2, and includes key controls from HIPAA, PCI and SOC2.

Operational security

Configuration and change management standard: Supplier-defined controls
Configuration and change management approach: Both Palo Alto Networks and the end-user organisation are in full control of their relevant and respective change control processes.
Additional details are available upon request.
Vulnerability management type: Supplier-defined controls
Vulnerability management approach: Prisma Access follows a proactive vulnerability management process to identify, assess, prioritize, and mitigate vulnerabilities:

1. Identification: Regular scanning and assessment are conducted to identify vulnerabilities.
2. Assessment: Vulnerabilities are evaluated for severity and potential impact.
3. Prioritization: Vulnerabilities are assigned priority levels based on severity and impact.
4. Mitigation Planning: A plan is developed to address vulnerabilities.
5. Remediation: The plan is executed, coordinating with relevant teams.
6. Monitoring and Reporting: Ongoing monitoring and reporting track progress in vulnerability remediation efforts.
Protective monitoring type: Conforms to a recognised standard, for example CSA CCM v3.0 or SSAE-16 / ISAE 3402
Protective monitoring approach: Prisma Access employs continuous monitoring and analysis of system activities, network traffic, and user behavior to detect and respond to potential security incidents:

1. Event Collection: Logs and events are centrally collected for analysis from various sources, such as network devices and endpoints.

2. Log Analysis and Correlation: Logs are analyzed and correlated to identify patterns, anomalies, and potential security incidents.

3. Threat Detection: Advanced security analytics and machine learning algorithms detect known and unknown threats using threat intelligence feeds and behavioral analytics.

4. Incident Response

5. Incident Investigation and Resolution

6. Reporting and Improvement
Incident management type: Conforms to a recognised standard, for example, CSA CCM v3.0 or ISO/IEC 27035:2011 or SSAE-16 / ISAE 3402
Incident management approach: This information is available upon request

Secure development

Approach to secure software development best practice: Supplier-defined process

Public sector networks

Connection to public sector networks: No

Social Value

Fighting climate change
Covid-19 recovery
Tackling economic inequality
Equal opportunity
Wellbeing

Fighting climate change

Trustmarque's Environmental Policy and Carbon Reduction Plan include delivering and supporting actions on reducing our carbon footprint and our impact on climate change. We have set a target to achieve net zero by 2035. Our policies include 'Virtual First 'meetings, energy reduction plans, flexible working, green software solutions and associated services from innovative suppliers to promote digital environmental innovation, promoting sustainable procurement. Please contact Trustmarque to discuss the provision of Social Value. Any Social Value deliverable must be agreed with Trustmarque and be proportionate to the contract value and scope.

Covid-19 recovery

Trustmarque can provide re-training for those left disadvantaged by Covid-19 through skills training, CV and interview workshops. We promote employment and skills by working with Buyers to identify individuals who can benefit from our incentives, which can include workshops to develop and help those who face barriers to employment and increase digital accessibility for communities and hard to reach groups. We can also provide access to apply for apprenticeship and work experience opportunities. Please contact Trustmarque to discuss the provision of Social Value. Any Social Value deliverable must be agreed with Trustmarque and be proportionate to the contract value and scope.

Tackling economic inequality

Trustmarque tackles economic inequality through operating a diverse supply chain including many SMEs and micro businesses. Our access to a broad range of suppliers ensures both resilience and capacity. Trustmarque is continuously refining our supply chain to meet the ever-changing needs of our customers and to ensure we can always offer the best solution through capability, capacity and resilience at the best price. Our vendor agnostic approach among suppliers allows us to support innovation and disruptive technologies to deliver lower cost and/or higher quality goods and services to customers. Please contact Trustmarque to discuss the provision of Social Value. Any Social Value deliverable must be agreed with Trustmarque and be proportionate to the contract value and scope.

Equal opportunity

Trustmarque operates an Equal Opportunities policy that outlines our commitments including creating a workforce that reflects the diversity of our communities. Other initiatives include supporting disabled people to develop skills and supporting in-work progression. Trustmarque is a Level 1 Disability Confident employer, demonstrating our commitment to employing a diverse workforce so all can flourish. We are committed to a policy of treating all its employees and applicants equally. We are committed to creating an environment where diversity is valued and respected and where our people can bring their different perspectives, and whole selves to work. Inclusivity and equal opportunities for all colleagues are paramount. Trustmarque is a Living wage employer, and we offer 14–18-month apprenticeships. In February 2024 we launched Encircle our DEI network – made by colleagues, for colleagues to support Diversity, Equity, and Inclusion in the workplace. Please contact Trustmarque to discuss the provision of Social Value. Any Social Value deliverable must be agreed with Trustmarque and be proportionate to the contract value and scope.

Wellbeing

We align our approach to mental wellbeing to the six standards in the Mental Health at Work commitment, including staff work and wellbeing sessions, flexible working, speak-up policy, etc. We have a dedicated team of qualified Mental Health First Aiders who offer support to all Trustmarque Group Colleagues to offer advice regarding how to support and signpost – this is linked to the ALGEE mental health action plan. The Work+Wellbeing team also facilitate workshops or share resources to support wellbeing within the workplace, this can be found on our Work+Wellbeing team via the Trustmarque Hub. We have an Employee Assistance Programme which is available 24/7 to all Trustmarque Group Colleagues. Please contact Trustmarque to discuss the provision of Social Value. Any Social Value deliverable must be agreed with Trustmarque and be proportionate to the contract value and scope.

Pricing

Price: £1,000 a unit
Discount for educational organisations: No
Free trial available: No

Trustmarque Palo Alto Prisma Access

Features

Benefits

Service documents

Framework

Service ID

Contact

Service scope

User support

Onboarding and offboarding

Using the service

Scaling

Analytics

Resellers

Staff security

Asset protection

Data importing and exporting

Data-in-transit protection

Availability and resilience

Identity and authentication

Audit information for users

Standards and certifications

Security governance

Operational security

Secure development

Public sector networks

Pricing

Service documents

Cookies on Digital Marketplace

Trustmarque Palo Alto Prisma Access

Features

Benefits

Pricing

Service documents

Framework

Service ID

Contact

Service scope

User support

Onboarding and offboarding

Using the service

Scaling

Analytics

Resellers

Staff security

Asset protection

Data importing and exporting

Data-in-transit protection

Availability and resilience

Identity and authentication

Audit information for users

Standards and certifications

Security governance

Operational security

Secure development

Public sector networks

Social Value

Pricing

Service documents