SOCURA LIMITED

Socura - Managed Vulnerability Scanning (MVS) Service

Socura provides a Managed Vulnerability Scanning Service which has been designed to help our clients to identify potential vulnerabilities, configuration, and asset management flaws in on-premises & off-premises systems, databases, and web applications.

Features

• Continuous vulnerability scanning and management
• Discover new assets in your estate
• Monthly vulnerability reports
• Identification and evaluation of vulnerabilities
• Actionable insights from Socura’s expert Cyber Analysis team

Benefits

• Helps protects the business from operational impacts of cyber attacks
• Continuous identification and mitigation of vulnerabilities
• On demand or scheduled scanning
• Actionable vulnerability insights

£80 a unit

• Education pricing available
• Free trial available

Service documents

• Pricing document

  PDF

• Skills Framework for the Information Age rate card

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at hello@socura.co.uk. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 14

Service ID

601054405022367

Contact

Jamie Brummell
0000000000
hello@socura.co.uk

Service scope

• Service constraints: To perform the service Socura will require access to the customer's endpoints and workloads. An internet connection will be required to pass this information to the Socura service over an encrypted network link.
• System requirements: Firewalls configured to allow access for Scanning

User support

• Email or online ticketing support: Email or online ticketing
• Support response times: Response times are determined based on the agreed SLA with the client.
• User can manage status and priority of support tickets: Yes
• Online ticketing support accessibility: WCAG 2.1 AAA
• Phone support: Yes
• Phone support availability: 9 to 5 (UK time), 7 days a week
• Web chat support: No
• Onsite support: Yes, at extra cost
• Support levels: Two levels of support; Basic provides Scanning and report production; Advanced provides expert interpretation of the scan results.
• Support available to third parties: Yes

Onboarding and offboarding

• Getting started: Each deployment will be managed by a Socura Transition Manager who will manage the setup with the customer. A Cyber Engineer will be dedicated to the deployment and will work with the customer to enable the appropriate setup. Full Training is also provided as part of the deployment. Training will be provided remotely via online tools.
• Service documentation: Yes
• Documentation formats: PDF
• End-of-contract data extraction: On completion of the contract, customer data is available for up to 30 days and can be made available on request.
• End-of-contract process: On completion of the contract, all information that Socura has collected as part of the engagement can be made available to the customer.

Using the service

• Web browser interface: Yes
• Using the web interface: The portal will provide access to the scan results along with interpretation by the Socura team.
• Web interface accessibility standard: WCAG 2.1 AAA
• Web interface accessibility testing: None
• API: Yes
• What users can and can't do using the API: Scan results can be integrated with other services, such as Socura's MDR / SOC Service to enhance visibility and understanding of threats.
• API automation tools: Other
• Other API automation tools: None
• API documentation: Yes
• API documentation formats: PDF
• Command line interface: No

Scaling

• Scaling available: No
• Independence of resources: Each customer instance is seperate - there are no shared resources
• Usage notifications: Yes
• Usage reporting:
  • Email
  • Other
• Other usage reporting: Call; The service will be regularly reviewed and the customer will be informed as agreed when onboarded.; This will also be highlighted in their monthly service review

Analytics

• Infrastructure or application metrics: Yes
• Metrics types: Other
• Other metrics:
  • Vulnerability Scores
  • Number of Assets
• Reporting types:
  • API access
  • Real-time dashboards
  • Regular reports
  • Reports on request

Resellers

• Supplier type: Not a reseller

Staff security

• Staff security clearance: Conforms to BS7858:2019
• Government security clearance: Up to Security Clearance (SC)

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations: United Kingdom
• User control over data storage and processing locations: Yes
• Datacentre security standards: Managed by a third party
• Penetration testing frequency: At least once a year
• Penetration testing approach: Another external penetration testing organisation
• Protecting data at rest:
  • Physical access control, complying with CSA CCM v3.0
  • Physical access control, complying with SSAE-16 / ISAE 3402
  • Encryption of all physical media
• Data sanitisation process: Yes
• Data sanitisation type: Explicit overwriting of storage before reallocation
• Equipment disposal approach: A third-party destruction service

Backup and recovery

• Backup and recovery: No

Data-in-transit protection

• Data protection between buyer and supplier networks: TLS (version 1.2 or above)
• Data protection within supplier network: TLS (version 1.2 or above)

Availability and resilience

• Guaranteed availability: The service has an up-time and availability SLA of 99.9%.
• Approach to resilience: A full description of our architecture is available on request
• Outage reporting: Service outages are available via a dashboard and email alerts. If required, a direct phone call to the customer can also be made.

Identity and authentication

• User authentication:
  • 2-factor authentication
  • Identity federation with existing provider (for example Google apps)
  • Username or password
• Access restrictions in management interfaces and support channels: Management interfaces and support channels are protected by multiple layers of security. We do not expose any services to the internet that can be connected to directly inbound. All services are proxied in the cloud with strong authentication required before even being able to establish a connection. All services are protected by DDOS mitigation and web application firewalls.
• Access restriction testing frequency: At least every 6 months
• Management access authentication: Identity federation with existing provider (for example Google Apps)
• Devices users manage the service through: Directly from any device which may also be used for normal business (for example web browsing or viewing external email)

Audit information for users

• Access to user activity audit information: Users have access to real-time audit information
• How long user audit data is stored for: At least 12 months
• Access to supplier activity audit information: Users receive audit information on a regular basis
• How long supplier audit data is stored for: User-defined
• How long system logs are stored for: At least 12 months

Standards and certifications

• ISO/IEC 27001 certification: Yes
• Who accredited the ISO/IEC 27001: British Assessment Bureau
• ISO/IEC 27001 accreditation date: 15/07/2021
• What the ISO/IEC 27001 doesn’t cover: There are no exclusions
• ISO 28000:2007 certification: No
• CSA STAR certification: No
• PCI certification: No
• Cyber essentials: Yes
• Cyber essentials plus: Yes
• Other security certifications: No

Security governance

• Named board-level person responsible for service security: Yes
• Security governance certified: Yes
• Security governance standards: ISO/IEC 27001
• Information security policies and processes: Socura's security management system is based on ISO 27001, with regular internal and external audits. Security is the responsibility of our CTO.

Operational security

• Configuration and change management standard: Conforms to a recognised standard, for example CSA CCM v3.0 or SSAE-16 / ISAE 3402
• Configuration and change management approach: Socura has a full change management process, which can be provided as requested and is accredited to ISO9001. Changes are requested via the Socura Portal, with full visibility of the change lifecycle and security risk assessment.
• Vulnerability management type: Conforms to a recognised standard, for example CSA CCM v3.0 or SSAE-16 / ISAE 3402
• Vulnerability management approach: Socura incorporates the latest threat intelligence into its service and also utilises this to protect its own infrastructure. Patches are deployed continuously and immediately upon availability. We conduct regular Vulnerability Scans and Penetration tests on the service.
• Protective monitoring type: Conforms to a recognised standard, for example CSA CCM v3.0 or SSAE-16 / ISAE 3402
• Protective monitoring approach: Socura utilises its own Managed Detection and Response service to proactively monitor its infrastructure which allows us to detect and respond to threats as they occur. This is monitored continuously 24/7 by our team. We respond to potential compromises using our Security Incident response process within one hour of detection.
• Incident management type: Conforms to a recognised standard, for example, CSA CCM v3.0 or ISO/IEC 27035:2011 or SSAE-16 / ISAE 3402
• Incident management approach: Socura has defined and automated processes for common events through the use of playbooks. Users can directly report incidents via our portal, and incident reports are also provided through our portal. Socura follows the CREST Cyber Security Incident Response (CSIR) scheme and our process is accredited under ISO27001.

Secure development

• Approach to secure software development best practice: Supplier-defined process

Separation between users

• Virtualisation technology used to keep applications and users sharing the same infrastructure apart: No

Energy efficiency

• Energy-efficient datacentres: Yes
• Description of energy efficient datacentres: Our data centres used conform to the EU Code of Conduct

Social Value

• Social Value:

  Social Value

  • Fighting climate change
  • Covid-19 recovery
  • Tackling economic inequality
  • Equal opportunity
  • Wellbeing

  Fighting climate change

  Carbon Neutrality by 2026 Through Carbon Reduction Plan, we will actively measure and reduce our total carbon emissions from operations, including energy consumption, transportation, and other relevant sources. We will achieve this through energy-efficient practices, renewable energy adoption, and operational improvements. Any remaining emissions will be offset through activities like reforestation projects or renewable energy investments. Zero E-Waste to Landfill by 2026 Eliminate electronic waste (e-waste) sent to landfills including old computers, devices, and electronic components, contains hazardous materials that can harm the environment and human health if improperly disposed of. We will deliver reductions within Scope 1 and 2 through the efficient utilisation of real estate, increasing energy efficiency, procuring 100% renewable electricity, increasing hybrid working on the project and by engaging with customers and our own employees on our sustainability strategy. Within the proposed service, we will deliver reductions in Scope 3 by working up and downstream within our supply chain throughout the duration to drive emissions reductions in product use, operations, and supply chain. We believe that digitisation is both a fundamental enabler of sustainability and at the heart of this innovative and transformative service. We are committed to ensuring our project delivery model and product selection delivers sustainability and fights climate change.

  Covid-19 recovery

  The pandemic has undoubtedly reshaped the world in many ways, with its impacts felt across various sectors and industries. The pandemic has caused a surge in mental health challenges, encompassing feelings of loneliness, isolation, depression, and anxiety. The need to address these issues has never been more pressing, as they affect not only individuals but also have far-reaching consequences for staff and suppliers. Within the cyber industry, an area known for its high-stress environment, the psychological impact of causing a security breach can be significant. The consequences of a breach can extend beyond the technical aspects and directly affect the wellbeing of staff. Therefore, it is crucial that staff are not only well-trained to manage the technical aspects of their jobs but are also equipped to deal with the emotional implications of their roles.

  Tackling economic inequality

  Working & Experience Practices: To ensure the quality and retention of employment, we commit to paying above the real living wage, offering secure working hours, and investing in the training of lower-paid team members. Transparent pathways for promotion and inclusive working practices contribute to a positive and expansive work environment. Industry-Leading Employment Benefits: We conduct annual salary benchmarking, ensuring competitiveness and fairness. A comprehensive benefits package supports the well-being of all team members, including financial education webinars covering topics like money management and pensions.

  Equal opportunity

  At Socura, fostering equality and inclusivity is ingrained in our culture. We've established a comprehensive program encompassing practices to eliminate barriers based on factors such as race, gender, socioeconomic background, or personal characteristics. This commitment extends to local community initiatives, recruitment practices, and progression and reward strategies. Recruitment & Selection Practices: Our inclusive recruitment process extends job opportunities to diverse communities. Clear and accessible job descriptions, devoid of unnecessary jargon, ensure transparency. We actively promote vacancies through platforms catering to specific groups, offering accommodations like video applications and inclusive interview training. This approach addresses the barriers faced by disabled candidates and other minority groups in traditional employment avenues. Inclusive Organisational Culture: To further our inclusive culture, a Shadow Board comprising individuals from diverse backgrounds has been introduced. This ensures active inclusion and representation in key strategic decision-making. A Workforce Community DE&I dashboard is under development to provide transparent visibility of our progress.

  Wellbeing

  Wellness Activities: Physical health is intricately linked to mental wellbeing. We regularly organise wellness activities such as fitness challenges, offer health assessments through our benefits provision, deliver nutrition workshops to encourage a healthy lifestyle. This holistic approach to wellbeing ensures that our workforce is physically and mentally prepared to meet the demands of their roles. Awareness Campaigns: We believe that awareness and education are crucial in addressing mental health challenges. We conduct awareness campaigns to reduce stigma around mental health issues, encouraging open conversations, and providing information on available resources. In conclusion, our commitment to promoting wellbeing and addressing physical and mental health challenges is at the core of our strategy. We are dedicated to taking concrete actions, tailored to the unique needs of this sector, to support the physical and mental health of our workforce.

Pricing

• Price: £80 a unit
• Discount for educational organisations: Yes
• Free trial available: Yes
• Description of free trial: 1 month proof of concept is available.

Service documents

• Pricing document

  PDF

• Skills Framework for the Information Age rate card

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at hello@socura.co.uk. Tell them what format you need. It will help if you say what assistive technology you use.