Nettitude Limited

Bug Bounty

A unique platform run by LRQA (formerly-LRQA-Nettitude) cybersecurity experts, who abide by the highest ethical code of conduct and world-class industry professionalism. Continuous assurance of internet-facing production systems, e.g. perimeter infrastructure and external web-applications. Bug Bounty is output-oriented – the higher the severity of vulnerability identified, the higher its price.

Features

• A longer testing timeframe ensures continuous coverage
• Incorporates a zero-prior-knowledge approach
• Mimics the initial access an attacker is likely to have
• Heavily focused on deep technical vulnerabilities
• Cost of service is primarily based on vulnerabilities identified
• Free assistance with Vendor Vulnerability disclosure
• Real-time access to team/vulnerability findings via our online platform
• Executive reporting via reports and periodic debriefs

Benefits

• Alerts you to serious vulnerabilities in real-time
• Gives our professionals the freedom to prioritise depth of testing
• A larger group of testers with wide ranging expertise
• View vulnerability statistics over time
• The ability to cover systems traditional bug bounty programs can’t
• Well-curated and high-quality findings avoids being overwhelmed with false positives
• Complements a strong penetration testing regime

£20,000 a unit

Service documents

• Pricing document

  PDF

• Skills Framework for the Information Age rate card

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at bidteam@nettitude.com. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 14

Service ID

629653681192760

Contact

Grace Harrison
0345 5200085
bidteam@nettitude.com

Planning

• Planning service: No

Training

• Training service provided: No

Setup and migration

• Setup or migration service available: No

Quality assurance and performance testing

• Quality assurance and performance testing service: No

Security testing

• Security services: Yes
• Security services type:
  • Security strategy
  • Security risk management
  • Security design
  • Cyber security consultancy
  • Security testing
  • Security incident management
  • Security audit services
  • Other
• Other security services: PCI-DSS Compliance
• Certified security testers: Yes
• Security testing certifications:
  • GBEST
  • CHECK
  • CREST
  • Cyber Scheme
  • Other
• Other security testing certifications:
  • CREST Certified Simulated Attack Specialist - CCSAS
  • CREST Certified Simulated Attack Manager - CCSAM
  • CREST Registered Threat Intelligence Analyst - CRTIA
  • CREST Certified Threat Intelligence Manager - CCTIM
  • Cyber Scheme Team Leader (CSTL)
  • CREST Registered Intrusion Analyst - CRIA
  • CREST Certified Network Intrusion Analyst - CCNIA
  • CREST Certified Host Intrusion Analyst - CCHIA
  • CREST Certified Malware Reverse Engineer - CCMRE
  • Approved Scanning Vendor (ASV)

Ongoing support

• Ongoing support service: No

Service scope

• Service constraints: N/A

User support

• Email or online ticketing support: No
• Phone support: Yes
• Phone support availability: 9 to 5 (UK time), Monday to Friday
• Web chat support: No
• Support levels: Continual support throughout the engagement.

Resellers

• Supplier type: Not a reseller

Staff security

• Staff security clearance: Conforms to BS7858:2019
• Government security clearance: Up to Developed Vetting (DV)

Standards and certifications

• ISO/IEC 27001 certification: Yes
• Who accredited the ISO/IEC 27001: Alcumus
• ISO/IEC 27001 accreditation date: 05/09/2023
• What the ISO/IEC 27001 doesn’t cover: N/A
• ISO 28000:2007 certification: No
• CSA STAR certification: No
• PCI certification: No
• Cyber essentials: Yes
• Cyber essentials plus: Yes
• Other security certifications: No

Social Value

• Social Value:

  Social Value

  • Fighting climate change
  • Covid-19 recovery
  • Tackling economic inequality
  • Equal opportunity
  • Wellbeing

  Fighting climate change

  Net-zero is no longer a compromise. Our commitment is to be a net-zero business by 2030, against all scope 1, 2, and 3 emissions as quickly as possible. As a service provider, we will also help our clients to fight climate change. Whether reporting energy and water usage, measuring waste reduction, or managing product lifecycle, our commitment is to support our customers to work towards any and every environmental goal. Our goal is to help clients to bring credibility to their assertions, helping them to demonstrate compliance with international standards, regulations and commitments. We will combine deep environmental expertise and rigorous methodology to verify all data and information an organisation tracks or publishes. We will certify our customers systems and processes against global standards, giving them the confidence that best practices are being implemented that maximise every opportunity to improve performance. This includes but is not limited to: • Supporting our customers with their ISO 14064 greenhouse gas (GHG) validation • Supporting our customers to verify their systems and processes against global standards • Supporting our customers to transition to sustainable, low carbon power generation. • Supporting our customers to transition from waste to energy, wind, tidal, nuclear to renewable capacity, hydrogen production, storage and distribution • Supporting our customers verify their water usage, • Supporting our customers verify their waste reduction • Supporting our customers verify their or product lifecycle • Supporting our customers to look beyond compliance, examining the resulting data and suggesting actions that put them in control of the areas that matter most to their business.

  Covid-19 recovery

  LRQA Nettitude actively contributes to the global recovery from the COVID-19 pandemic by endorsing and supporting vaccination initiatives. As an organisation grounded in science and evidence, we acknowledge the crucial role of vaccination and regular testing in safeguarding individuals and reinstating societal normalcy. While we respect individual choices regarding vaccination, it is anticipated that various authorities, clients, and travel providers may necessitate COVID-19 vaccination for entry or proof of a formal exception. Our commitment extends to supporting colleagues who choose to get vaccinated. LRQA Nettitude pledges to assist those receiving government-approved or World Health Organization-recognised COVID-19 vaccinations. In instances where an approved vaccine is not accessible through public or private healthcare providers, we will reimburse colleagues for the cost of an approved vaccination. Additionally, reasonable paid time off will be provided to facilitate vaccination for colleagues and their families. Respecting privacy, LRQA Nettitude will only inquire about a colleague's vaccine status when there is a legitimate business need, such as travel or working in high-risk environments. Colleagues' vaccine information will be stored securely for a defined period, in compliance with local data privacy legislation, and disclosed only with explicit consent. Recognising the ongoing importance of safety measures post-vaccination, LRQA Nettitude acknowledges that vaccination programs do not eliminate COVID-19 risk entirely. We commit to adhering to good practices and local legal requirements, acknowledging that certain safety measures will likely persist beyond the vaccination program. This comprehensive approach underscores LRQA Nettitude's dedication to supporting recovery and ensuring the well-being of our colleagues and the broader community.

  Tackling economic inequality

  We believe that every person deserves the right to work with dignity. Through our corporate social responsibility compliance, we help our clients discover and understand risks within their workplace and supply chain in order to enhance economic equality. Transparency is the fundamental building block to understanding risk. Without transparency, it is difficult for an audit to report on risk exposure associated with wage underpayment, excessive working hours, child labour, unauthorized subcontractors, compliance to social insurance, harassment, and prison labour, to name a few. Supplier transparency is part of our DNA. We will continually develop innovative solutions that uncover and manage risk from a social perspective. EiQ is our supply chain data analytics platform, to create predictive models to assess the likelihood of unauthorized subcontracting, human trafficking, and labour unrest, to name a few. We are innovators and thought partners. This includes but is not limited to creating better working conditions and tackling inequality for the following areas: • Wage underpayment • Excessive working hours • Child labour • Unauthorized subcontractors • Compliance to social insurance • Harassment • Prison labour

  Equal opportunity

  We believe that our responsibility as an employer, supplier, and customer is to treat people with respect, empathy, and kindness – to ensure people have the support they need to thrive and be at their best. Our promise is to support our people and every stakeholder that we work and interact with. We provide progressive advice and solutions for the following areas: • Fair and equal pay across gender, race, age, and disability • Fair and safe working hours • The restructuring of labour to protect children In addition to this, LRQA is committed to support young people from disadvantaged backgrounds to achieve their greatest potential. In 2022 we will launch “The Brightest Future”. The Brightest Future is LRQA’s philanthropic foundation that supports young people from disadvantaged backgrounds to build the brightest future for themselves, their community, and the planet With a focus on young people from disadvantaged backgrounds, we will support thousands of young people to receive high-quality education over the next seven years. Delivered by our employees in partnership with leading grassroot educational charities, our vision is to inspire young people to find their mighty purpose, curiosity, and courage to be part of building a better future for themselves, their community, and the planet.

  Wellbeing

  At LRQA Nettitude many of us are used to working from home, it is a new experience for lots of us and it may take some time to adjust. We always help to protect and look after our employee’s wellbeing and mental health; they can also reach out to one of our Mental Health First Aiders. Our Mental Health First Aiders (MHFAs) are the go-to people for anyone who wants to talk to someone. Additionally, all members of the Nettitude Leadership and Management Team have an Open Door Policy and are available if employees need someone to talk to, not necessarily their own manager. Nettitude Wellbeing – Objectives • To provide a safe place for all Nettitude employees to raise Mental Health challenges they may be experiencing. • To increase awareness of Mental Health within the Nettitude Group • To signpost all employees on what support is available to them. • To increase the ratio of MH First Aiders within the business. • To develop a well-being strategy. • Build a series of information/training to support employees with their wellbeing and those in their team.

Pricing

• Price: £20,000 a unit
• Discount for educational organisations: No

Service documents

• Pricing document

  PDF

• Skills Framework for the Information Age rate card

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at bidteam@nettitude.com. Tell them what format you need. It will help if you say what assistive technology you use.