Six Degrees Technology Group Limited

Mimecast Web Security

Mimecast helps companies protect their employees, intellectual property, customer data, and brand reputations by providing comprehensive, cloud-based security and compliance solutions that mitigate risk and reduce the cost and complexity of creating a cyber-resilient organisation.

Features

• Cloud-based web protection at DNS level.
• Control of web-based applications on corporate devices.
• Works with Mimecast Secure Email Gateway to remediate local files.

Benefits

• Protects against malicious web activity.
• Blocks business-inappropriate websites.
• Helps mitigate shadow-IT risks caused by uncontrolled cloud app use.
• Easily managed to utilise the full product capabilities efficiently.
• Delivered in the most cost-effective and least complex way possible.

£10.60 to £26.50 a user a year

• Education pricing available
• Free trial available

Service documents

• Pricing document

  PDF

• Skills Framework for the Information Age rate card

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at Publicsector.sales@6dg.co.uk. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 14

Service ID

577515968830151

Contact

Six Degrees' Public Sector team
08000128060
Publicsector.sales@6dg.co.uk

Service scope

• Software add-on or extension: Yes, but can also be used as a standalone service
• What software services is the service an extension to: N/A
• Cloud deployment model: Private cloud
• Service constraints: Please refer to Mimcaster Central for further information: https://community.mimecast.com/s/article/Mimecast-Web-Security-Overview-1393091459
• System requirements:
  • Internet access on corporate devices.
  • Windows, OSX, or iOS for application support.

User support

• Email or online ticketing support: Email or online ticketing
• Support response times: Dependant on incident/request and priority level - please see attached Service Description for details.
• User can manage status and priority of support tickets: Yes
• Online ticketing support accessibility: WCAG 2.1 A
• Phone support: Yes
• Phone support availability: 24 hours, 7 days a week
• Web chat support: No
• Onsite support: Yes, at extra cost
• Support levels: Please see Service Description for support levels.
• Support available to third parties: Yes

Onboarding and offboarding

• Getting started: Mimecast provides four implementation options; Core Connect (internet based wizard & Email support), Managed Connect (Wizard & Implementation assistance contactable by phone and email), Managed Implementation (Dedicated implementation engineer proactively driving your implementation), Advanced Implementation (Proactive dedicated implementation engineer, advanced support, project documentation, optional Mimecast project manager).
• Service documentation: Yes
• Documentation formats:
  • HTML
  • PDF
• End-of-contract data extraction: Mimecast provides the ability to export Activity Logs for the lifetime the product was active. These logs come in CSV format. The Mimecast Account Assessment report also contains web-related reporting, and is available for up to 2 years on a rolling basis.
• End-of-contract process: All features and benefits of the service cease to be available, and all customer data is deleted from the Mimecast Cloud service.

Using the service

• Web browser interface: Yes
• Supported browsers:
  • Internet Explorer 11
  • Microsoft Edge
  • Firefox
  • Chrome
  • Safari
  • Opera
• Application to install: Yes
• Compatible operating systems:
  • Android
  • IOS
  • Linux or Unix
  • MacOS
  • Windows
  • Windows Phone
  • Other
• Designed for use on mobile devices: Yes
• Differences between the mobile and desktop service: None
• Service interface: Yes
• User support accessibility: WCAG 2.1 AA or EN 301 549
• Description of service interface: Single Web Based Administration console allowing access to all required controls and settings.
• Accessibility standards: WCAG 2.1 AA or EN 301 549
• Accessibility testing: None
• API: Yes
• What users can and can't do using the API: User Management, Create Policy, Get Policies, Delete Policy, Update Policy.
• API documentation: Yes
• API documentation formats: HTML
• API sandbox or test environment: Yes
• Customisation available: Yes
• Description of customisation: Branding, various policies, settings, notifications and disclaimers, authentication requirements options.

Scaling

• Independence of resources: Mimecast’s cloud platform is capable of scaling horizontally as far as necessary. Today it handles more than one billion connections for service each day and delivers millions of "clean" messages. The system is scaled, with approximately 20% of capacity allowing for surge scenarios and simultaneous server outages. Mimecast can easily scale overall capacity by adding additional storage and processing resources to the relevant resource pools as required.

Analytics

• Service usage metrics: Yes
• Metrics types: Built-in reporting includes visualisations of the top 10 accessed domains, accessed site categories, and blocked domains by site category, as well as DNS requests that were associated with malware or malicious sites. Additionally, transparent login enhances reporting to ensure all activity is tied back to an individual or device.
• Reporting types: Real-time dashboards

Resellers

• Supplier type: Reseller providing extra support
• Organisation whose services are being resold: Mimecast

Staff security

• Staff security clearance: Conforms to BS7858:2019
• Government security clearance: Up to Security Clearance (SC)

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations: United Kingdom
• User control over data storage and processing locations: Yes
• Datacentre security standards: Complies with a recognised standard (for example CSA CCM version 3.0)
• Penetration testing frequency: At least every 6 months
• Penetration testing approach: Another external penetration testing organisation
• Protecting data at rest: Physical access control, complying with CSA CCM v3.0
• Data sanitisation process: Yes
• Data sanitisation type: Explicit overwriting of storage before reallocation
• Equipment disposal approach: In-house destruction process

Data importing and exporting

• Data export approach: Mimecast provides the ability to export Activity Logs for the lifetime the product was active. These logs come in CSV format. The Mimecast Account Assessment report also contains web-related reporting, and is available for up to 2 years on a rolling basis.
• Data export formats: CSV
• Data import formats: Other
• Other data import formats: No other formats.

Data-in-transit protection

• Data protection between buyer and supplier networks: Other
• Other protection between networks: Mimecast uses a combination of TLS, SSL (HTTPS), LDAPS, SMTPS is used as well to secure all types of data in transit.
• Data protection within supplier network:
  • TLS (version 1.2 or above)
  • Other
• Other protection within supplier network: All customer data is independently encrypted and Mimecast operates with least privilege model.

Availability and resilience

• Guaranteed availability: Mimecast offer the following service levels:; ; Email Delivery Credit Fee:; ; <100% but >=99% 10%; <99% but >=98% 20%; <98% but >=97% 30%; <97% but >=96% 40%; <96% 50% and Customer may terminate the Agreement and receive a pro-rata refund of any unused pre-paid fees.
• Approach to resilience: This information is available on request.; ; In brief, the platform is completely resilient with data replicated across diverse physical locations ensuring no single points of failure.
• Outage reporting: Public Dashboard / Website announcements.; ; Emails.; ; Other communications including phone and text notification available as required.

Identity and authentication

• User authentication needed: Yes
• User authentication:
  • 2-factor authentication
  • Public key authentication (including by TLS client certificate)
  • Identity federation with existing provider (for example Google Apps)
  • Username or password
  • Other
• Other user authentication: Users may interact with an authentication form requiring username and password input and optionally a second factor. Integrated Windows Authentication requires no interaction by the end user. Public key authentication usually requires no interaction by end users. SAML can vary based on a customer's own deployment as this is a third party product brokering the authentication but usually SAML products primarily authenticate using username and password prompt.
• Access restrictions in management interfaces and support channels: The management interface is granular in allowing access on a per user basis for predefined rights. Authorised users are allowed to log support queries.
• Access restriction testing frequency: At least every 6 months
• Management access authentication:
  • 2-factor authentication
  • Other
• Description of management access authentication: Username and password. SMS, EMAIL or Authenticator application supplying the 2nd factor.

Audit information for users

• Access to user activity audit information: Users have access to real-time audit information
• How long user audit data is stored for: At least 12 months
• Access to supplier activity audit information: Users have access to real-time audit information
• How long supplier audit data is stored for: At least 12 months
• How long system logs are stored for: At least 12 months

Standards and certifications

• ISO/IEC 27001 certification: Yes
• Who accredited the ISO/IEC 27001: LRQA
• ISO/IEC 27001 accreditation date: 03/10/2022
• What the ISO/IEC 27001 doesn’t cover: This relates to Six Degrees' own security accreditations, for our platforms and service. Mimecast have their own set of accreditations.
• ISO 28000:2007 certification: No
• CSA STAR certification: Yes
• CSA STAR accreditation date: 15/09/2023
• CSA STAR certification level: Level 2: CSA STAR Attestation
• What the CSA STAR doesn’t cover: This relates to Mimecast's accreditation for their service. The full certification details can be found here: https://cloudsecurityalliance.org/star/registry/mimecast/
• PCI certification: Yes
• Who accredited the PCI DSS certification: IT Governance
• PCI DSS accreditation date: 08/11/2023
• What the PCI DSS doesn’t cover: Only the physical and environmental security at the data centres we use in our operations were included in this assessment. The relates to the provision of the secure physical environment for the Colocation Services that Six Degrees provides to its clients. All other services provided by Six Degrees, internal systems supporting business operations or for other clients are specifically excluded from this assessment.; ; This relates to Six Degrees' own security accreditations, for our platforms and service. Mimecast have their own set of accreditations.
• Cyber essentials: Yes
• Cyber essentials plus: Yes
• Other security certifications: Yes
• Any other security certifications:
  • ISO 9001
  • ISO 22301
  • PSN Compliance Certified
  • SOC 1 Type 2
  • SOC 2 Type 2

Security governance

• Named board-level person responsible for service security: Yes
• Security governance certified: Yes
• Security governance standards: ISO/IEC 27001
• Information security policies and processes: Mimecast is accredited with ISO 22301:2012 and ISO 27018:2014 and follows strict policies and procedures to maintain the highest levels of information security.

Operational security

• Configuration and change management standard: Conforms to a recognised standard, for example CSA CCM v3.0 or SSAE-16 / ISAE 3402
• Configuration and change management approach: Stringent change control procures are in place to maintain operational and service level agreements. All changes are fully documented including roll back procedures.; ; Updates to the service follow a regular schedule and the impact is communicated to relevant parts of the business and customers. Changes to systems that could impact or compromise existing security and control procedures are subject to review by the Mimecast Information Security Team prior to acceptance.
• Vulnerability management type: Conforms to a recognised standard, for example CSA CCM v3.0 or SSAE-16 / ISAE 3402
• Vulnerability management approach: Mimecast reviews vendor security bulletins and utilise the corporate SIEM system to log and identify any possible issues.; ; The severity of vulnerabilities are assessed on impact vs likelihood and risks are adjusted accordingly for manual analysis and system events. Critical vulnerabilities can be deployed globally throughout the Mimecast infrastructure within minutes.
• Protective monitoring type: Supplier-defined controls
• Protective monitoring approach: The entire platform is monitored 24 x 7 and system and network logs are entered into a centralised system. The monitoring platform provides mealtime information as well as automated alerting.
• Incident management type: Conforms to a recognised standard, for example, CSA CCM v3.0 or ISO/IEC 27035:2011 or SSAE-16 / ISAE 3402
• Incident management approach: Mimecast has a formal Incident reporting process activated by monitoring and staff awareness.; ; User are able to log calls to activate an incident process.; ; Mimecast use a fully collaborative ticketing system allowing for the production of accurate incidents reports.

Secure development

• Approach to secure software development best practice: Independent review of processes (for example CESG CPA Build Standard, ISO/IEC 27034, ISO/IEC 27001 or CSA CCM v3.0)

Public sector networks

• Connection to public sector networks: No

Social Value

• Social Value:

  Social Value

  • Fighting climate change
  • Tackling economic inequality
  • Equal opportunity
  • Wellbeing

  Fighting climate change

  We have an established environmental committee that is specifically focussed on ensuring that we apply an approach of continuous improvement in relation to environmental compliance and good practice. As part of our environmental commitments, we are aligned to ISO 14001(Environmental Management) and have a published Carbon Reduction Plan on our website, which was measured and recorded in accordance with GHG Protocols and Procurement Policy Note 06/21. ; ; We will be reviewing our footprint on an annual basis and carrying out actions identified to reduce our footprint. We are committed to achieving Net Zero by 2050 at the latest. During this time, targets will be set for the remaining period to ensure Net Zero will be achieved by our target date. We are aiming to reduce our absolute carbon emissions by at least 90% from our baseline year or achieve (and maintain) a carbon intensity metric of <1 tonne CO2e per employee, whichever comes soonest. This is in line with science-based Net Zero targets. ; ; Our largest environmental burden is the use of power in our datacentres. We use technology designed specifically to manage power consumption. We are very proud to have switched our data centres fully to use green and renewable energy. ; ; Our focus on environmental performance as a supplier under this framework will benefit you as you strive to achieve your own Net Zero targets. ; ; As a leading Microsoft partner, we can work with Microsoft to help you understand the carbon footprint for your existing estates, and how a transition to hybrid/public cloud could help reduce it. As part of any agreement under this framework we can also engage with your local communities to promote environmental awareness or engage in projects that benefit the environment.

  Tackling economic inequality

  Six Degrees supports this theme in several ways. Firstly, by working with local communities to provide mentoring and job opportunities. We take pride in employing local people and offering new opportunities as they arise. We do this through our internal Talent Acquisition (TA) team, who are actively building richer and deeper contacts within the local community to raise aspirations of people from all backgrounds. ; ; We seek to encourage local people to work within the technology sector by removing barriers to entry, for example through behavioural interviewing with objective behaviours that actively seek to remove bias (unconscious or otherwise) in recruitment and individual development discussions. Our TA team partner with local universities, schools and colleges to support careers fairs and our subject matter experts provide talks on IT or cyber security to local students. ; ; We are also very passionate about our ‘Women in Tech’ group, which seeks to encourage women into IT through all sorts of activity, such as webinars, school visits and other events. We are continuously planning new events and initiatives under this scheme, which we could then offer to buyers and their community as part of engagements on this framework. ; ; Secondly, we will tackle economic inequality and the digital skills gap through creation of new skills & jobs in the high-growth cyber security sector. Our cyber apprenticeship programme, sponsored by our People Business Partner & Cyber Consultancy Director, provide skills and accreditations that enable our people to progress in cyber security or transition into that space. ; ; We also run in-person events, known as ‘Cyber University’, as an education scheme for our Buyers based on our extensive knowledge and experience in Cyber Security. Cyber University provides an open forum for customers to create new skills in Cyber Strategy, best practice approaches and the latest in Cyber Security.

  Equal opportunity

  We recognise that people are more likely to be engaged and productive if they are rewarded fairly and offered flexibility to help achieve a positive work life balance. We therefore pay at the Real Living Wage in all of our roles, and remain committed to our ongoing pay review process to ensure all our employees are fairly rewarded. Six Degrees also has a continuous focus on closing the gender pay gap in our company, with our latest report available on our website. ; ; We recognise that females are underrepresented in education, training and employment related to STEM. To combat this, we have introduced several strategies to bring new females into the organisation. These include our engagement with schools, colleges, and universities to raise the aspirations of females toward tech. Our goal of ensuring every recruitment shortlist contains as least one female, and our offer of a guaranteed interview for every shortlisted female. ; ; We have collaborated with the Employers Network for Equality & Inclusion (ENEI), achieving a bronze TIDE Award in our first two years of collaboration. Through our continued devotion to improving, we were awarded a silver status in 2023. Through this partnership we have focused our work around seven critical areas of inclusion – our workforce, our strategy and plan, leadership and accountability, recruitment and attraction, training and development, employment practices, and communication.; ; We have zero tolerance to slavery in any form, but by no means limited to, bonded labour, debt bondage, serfdom, forced labour, child slavery, marital slavery, sexual slavery and/or human trafficking. We expect all those in our supply chains to comply with our values and the Modern Slavery Act 2015, which is governed by our Supplier Management and Sustainable Procurement Policy.

  Wellbeing

  Supporting our workforce’s health and wellbeing is crucial to Six Degrees. We have established an employee network, known as the 360 Degrees Group, which is made up of people who are passionate about making a difference from across all different business units, with an Executive-level sponsor and SLT-level sponsors for each sub-group or initiative. The initiatives include: ; ; - Including Everyone, Everywhere: Our forum which focuses on diversity and inclusion: it’s about creating a Six Degrees where everyone feels able to bring their truest self to work.; ; - Healthy Minds, Healthy Lives: Our forum for mental health and general wellbeing. A healthy mind and body is at the core of being happy and productive at work and at home.; ; - For The Benefit of Others: There’s something that touches, motivates or inspires all of us; this is a forum which focuses on charity fundraising, on making a positive mark on the communities which Six Degrees touches, and on making this a greener place to work.; ; We operate a well-being calendar led by Healthy Minds, Healthy Lives and also have certified Mental Health First Aiders across the business, demonstrating our commitment to providing our workforce with wellbeing support. ; ; We have a significant focus on building awareness and promoting dialogue around health and wellbeing: our Women in Tech committee talks about female health, and for June (Men’s Health Awareness Month) they will be promoting awareness of men’s health, for example testicular and prostate cancers.; ; Under the 3rd initiative we actively encourage community engagement through numerous social value activities. These include collaborative and individual fundraising projects for our partnership with Macmillan as well as promoting events within communities. In 2019 we sponsored the Women in IT awards and have also sponsored a Tough Mudder charity event.

Pricing

• Price: £10.60 to £26.50 a user a year
• Discount for educational organisations: Yes
• Free trial available: Yes
• Description of free trial: Mimecast provides a Proof Of Concept Account where a wide range of features can be tested.
• Link to free trial: Details are available on request at: https://www.mimecast.com/company/contact/

Service documents

• Pricing document

  PDF

• Skills Framework for the Information Age rate card

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at Publicsector.sales@6dg.co.uk. Tell them what format you need. It will help if you say what assistive technology you use.