Wiz Advanced

Service scope

Software add-on or extension: No
Cloud deployment model: Public cloud
Service constraints: No. Wiz is a true CNAPP platform
System requirements: Internet access to the Wiz portal and its subsidiary services

In some scenarios outbound network connectivity to the Wiz backend

Wiz IP addresses must access customer cloud APIs.

User support

Email or online ticketing support: Email or online ticketing
Support response times: Support requests for Priority Levels 2-4 is provided during Wiz’s Business Hours (9:00 AM until 5:00 PM, US Eastern Time, during Business Days Monday through Friday). Support for Priority Level 1 requests
will be on a 24x7x365 basis.
User can manage status and priority of support tickets: Yes
Online ticketing support accessibility: None or don’t know
Phone support: No
Web chat support: Web chat
Web chat support availability: 24 hours, 7 days a week
Web chat support accessibility standard: None or don’t know
How the web chat support is accessible: Wiz uses Intercom to provide users with chatbox support within the platform.
Web chat accessibility testing: N/a
Onsite support: No
Support levels: Wiz provides a mixture of self paced training & enablement and remote delivery services to help organisations operationalise the platform across the security, operations and engineering teams. Today these services, including support, are included as part of the license cost. Wiz will provide premium service options in the future such as technical account managers.
Support available to third parties: Yes

Onboarding and offboarding

Getting started: Wiz provides user documentation, online training plus customer success teams to support operationalisation of the service.
Service documentation: Yes
Documentation formats: HTML
End-of-contract data extraction: If a paid subscription ends or is terminated, Wiz retains customer data stored in the Wiz database in a limited-function account for 90 days to enable the subscriber to extract the data e.g. via management reports. After the 90-day retention period ends, Wiz disables the account and deletes the customer data. However, such data may reside in Wiz's backups for up to 180 days.
End-of-contract process: At the end of the contract, the tenant would be suspended and all "connectors" would stop polling for data. No further interaction with Wiz would be provided. Being a SaaS service and agentless, there is no further action required on the customer with the exception of revoking permissions that have been given to Wizand extracting any data necessary via management reports.

Using the service

Web browser interface: Yes
Supported browsers: Internet Explorer 11

Microsoft Edge

Firefox

Chrome

Safari
Application to install: No
Designed for use on mobile devices: No
Service interface: Yes
User support accessibility: None or don’t know
Description of service interface: Wiz offer various ways to interact with its platform, such as through cloud connectors for different cloud providers, integrations with CI/CD pipelines, and the use of its CLI tool and API. Wiz also provides an inventory of workloads deployed in the cloud(s) which provides predictability on service usage. The primary function of Wiz is to provide deep security analysis and monitoring for cloud environments, rather than offering tools for monitoring the performance of the Wiz platform. Users can view system health and deployment status within Wiz, which may indirectly provide some insights into the performance of the Wiz application.
Accessibility standards: WCAG 2.1 A
Accessibility testing: N/a
API: Yes
What users can and can't do using the API: With the Wiz API, users have the power to programmatically perform every task and action available within Wiz. This includes performing actions such as bulk add connectors, mimic UI behavior in textual format, or perform complex data manipulation operations.
API documentation: Yes
API documentation formats: HTML

Other
API sandbox or test environment: No
Customisation available: Yes
Description of customisation: Features within the product such as those relating to securing, visualising and reporting on customer environments are highly customisable. Wiz comes with nearly 1,000 controls out-of-the-box but but these can be customised if needed.

Scaling

Independence of resources: Wiz is a multi-tenant service with a shared tenancy model. Our approach to isolation relies on several layers of protection both at rest and in runtime. Wiz has proven performance at scale for some of the largest cloud customers in the world.

Analytics

Service usage metrics: Yes
Metrics types: Inventory of cloud workloads which provides predictability on service usage.
Reporting types: API access

Real-time dashboards

Regular reports

Reports on request

Resellers

Supplier type: Reseller providing extra support
Organisation whose services are being resold: Wiz

Staff security

Staff security clearance: Other security clearance
Government security clearance: Up to Developed Vetting (DV)

Asset protection

Knowledge of data storage and processing locations: Yes
Data storage and processing locations: United Kingdom
User control over data storage and processing locations: Yes
Datacentre security standards: Managed by a third party
Penetration testing frequency: At least once a year
Penetration testing approach: Another external penetration testing organisation
Protecting data at rest: Encryption of all physical media

Scale, obfuscating techniques, or data storage sharding

Other
Other data at rest protection approach: The physical and environmental security controls are provided by our underlying IaaS provider (AWS), this includes security cameras, lighting, fire detection/suppression, and power redundancy. Wiz employees do not have physical access to any of the data centers. AWS is responsible for implementing an appropriate set of controls in order to address physical security issues. Wiz reviews the Service Organisation Control (SOC) reports of AWS (subservice organisations) on an annual basis. Documentation of the review is retained.
Data sanitisation process: Yes
Data sanitisation type: Deleted data can’t be directly accessed
Equipment disposal approach: Complying with a recognised standard, for example CSA CCM v.30, CAS (Sanitisation) or ISO/IEC 27001

Data importing and exporting

Data export approach: Logs and specific findings be exported either through the API or generating custom reports (either in CSV for solely data, or Executive reports which are formatted in PDF).
Data export formats: CSV

Other
Other data export formats: PDF

JSON
Data import formats: Other
Other data import formats: Rego

JSON

Data-in-transit protection

Data protection between buyer and supplier networks: TLS (version 1.2 or above)
Data protection within supplier network: TLS (version 1.2 or above)

IPsec or TLS VPN gateway

Availability and resilience

Guaranteed availability: Guaranteed Up Times
The service availability to customers is 99.5% of all Scheduled Available Time calculated on a monthly basis and excluding Scheduled Downtime as defined below, or circumstances beyond reasonable control.
Downtime
Downtime refers to any periods within the Scheduled Available Time (excluding Scheduled Downtime) during which the Customer’s security team or users authorized by Customer are unable to log on with proper credentials. Scheduled Downtime for planned upgrades and maintenance will be detailed to the Customer, giving at least 48 hours prior notice. Wherever possible this will be targeted for Sundays and limited to a maximum of four hours. Scheduled Downtime will not exceed 10 hours per calendar year. Any overrun beyond the planned completion time or the yearly limit will be considered Downtime.

Monthly Uptime Percentage: The Monthly Uptime Percentage is calculated using the following formula:

"User Minutes - Downtime" /"User Minutes" x 100

where Downtime is measured in user-minutes; that is, for each month, Downtime is the sum of the length (in minutes) of each Incident that occurs during that month multiplied by the number of users impacted by that Incident.
Service Credits:
Monthly Uptime Percentage Service Credit
< 99.5% = 10%
< 99% = 25%
Approach to resilience: Wiz runs isolated in multiple datacenters. Additionally, from a data perspective, we perform continuous backups and Business Continuity and Disaster Recovery (BCDR) readiness supporting immediate transition to another availability zone or another region as required. Each Wiz data center has a central region and a backup region which can become active within hours.
Outage reporting: Current and historical information is available on https://status.wiz.io. Plus it's possible to subscribe to status alerts.

Identity and authentication

User authentication needed: Yes
User authentication: 2-factor authentication

Identity federation with existing provider (for example Google Apps)

Username or password
Access restrictions in management interfaces and support channels: Users are authenticated using 3 mechanisms to access the Wiz service. These include the user providing their username and password, as well as identity federation with an existing provider, for example Google apps, and finally 2-factor authentication.
Access restriction testing frequency: At least once a year
Management access authentication: 2-factor authentication

Identity federation with existing provider (for example Google Apps)

Username or password

Audit information for users

Access to user activity audit information: Users have access to real-time audit information
How long user audit data is stored for: Between 6 months and 12 months
Access to supplier activity audit information: Users have access to real-time audit information
How long supplier audit data is stored for: Between 6 months and 12 months
How long system logs are stored for: At least 12 months

Standards and certifications

ISO/IEC 27001 certification: Yes
Who accredited the ISO/IEC 27001: IQNet Partner
ISO/IEC 27001 accreditation date: 09/12/2021
What the ISO/IEC 27001 doesn’t cover: N/a
ISO 28000:2007 certification: No
CSA STAR certification: Yes
CSA STAR accreditation date: 16/02/2024
CSA STAR certification level: Level 1: CSA STAR Self-Assessment
What the CSA STAR doesn’t cover: N/a
PCI certification: No
Cyber essentials: No
Cyber essentials plus: No
Other security certifications: Yes
Any other security certifications: SOC2 Type 2

HIPAA

SOC3

SIG

ISO27701

CyberGRX

CAIQ

Security governance

Named board-level person responsible for service security: Yes
Security governance certified: Yes
Security governance standards: ISO/IEC 27001

Other
Other security governance standards: SOC2 Type 2
SOC3
ISO27701
HIPAA
CyberGRX
CAIQ
SIG
Information security policies and processes: Wiz leverages multiple layers of defense to protect key information and handles all critical facets of network and application security, including authentication, authorization, and assurance. As a security provider focusing on security architecture, Wiz designed its internal architecture from the ground up for minimal manual intervention in the deployment and maintenance process. The production update process is fully-automated, greatly reducing the risks to the service and to customers' data. The security program systematically evaluates our information security risks, taking into account the impact of company threats and vulnerabilities.
For reporting and transparency, Wiz provides a public Trust Center, which is the single source of truth for the most accurate and up-to-date copies of security policies, certifications, and reports. Stakeholders can request access to the Compliance Command Center through the Trust Center to review these documents. More information can be provided with our security pack, including our attestations.

Operational security

Configuration and change management standard: Supplier-defined controls
Configuration and change management approach: The CI/CD pipeline is the only gateway into the Wiz production environment. This encompasses both code changes as well as infrastructure changes as we follow the gitops principle of "everything is code". By baking controls into the CI/CD pipeline including automated testing and mandatory code reviews, we can ensure that all code changes follow the same pipeline and are approved, reviewed, and audited before shipped to production. Furthermore, as we follow the immutable infra design pattern, any unauthorized change to production is immediately detected, flagged, and remediated.
Vulnerability management type: Supplier-defined controls
Vulnerability management approach: Security incidents detected by Wiz employees, clients or business partners are reported to the Chief Security Officer (CSO). The CSO acts according to Wiz's "Incident Response Plan" procedure in classifying, handling, documenting and reporting the incident. The incident response plan is available under NDA.
Protective monitoring type: Supplier-defined controls
Protective monitoring approach: We leverage the Wiz natively-built controls engine to continuously validate the state of the infrastructure, review the inventory and ensure compliance with the required configuration baseline. More information is available under NDA.
Incident management type: Supplier-defined controls
Incident management approach: Wiz has an incident response plan which is monitored as part of our SOC2 report audit.

Secure development

Approach to secure software development best practice: Independent review of processes (for example CESG CPA Build Standard, ISO/IEC 27034, ISO/IEC 27001 or CSA CCM v3.0)

Public sector networks

Connection to public sector networks: No

Social Value

Fighting climate change

We take our environmental management and the impact we have on the environment very seriously. We have environmental policies in place and hold the ISO14001 accreditation. Our environmental assessments are conducted annually by an external Lead ESOS Assessor; they are signed-off by the board and compliance reported to the regulator (the Environment Agency). Our environmental policy is published on our website at https://www.bytes.co.uk/company/sustainability/environmental.
Bytes achieved carbon net zero in March 2022 through approved carbon offsetting schemes. We are always seeking to reduce our impact on the environment. We aim to minimise waste, reduce pollutants and use renewable materials. Our offices have recycling facilities for cans, plastic and paper. We aim to reduce our office printing to zero within the next few years.
An Environmental Steering Committee has been established to coordinate environmental activities and drive change.
To drastically reduce our emissions, we have switched to renewable energy. Our Head Office has reached our first milestone of using a specialist 100% renewable electricity provider. We are also exploring options to install solar panels on our Headquarters building.
Other environmental initiatives include installing electric vehicle charging points and encouraging staff to commute to work without the car (setting up a car share network and installing secure cycle parking).
We produce a SECR (Streamlined Energy and Carbon Reporting) report that details the companies energy consumption and carbon emissions. This report is produced annually by an independent assessor.
This report provides details of our emissions in Scope 1, 2 and 3 categories. It details the activities previously taken to reduce emissions and also recommendations for further improvements.
For scope 1,2 and 3 emissions we aim to reduce these by 50% by 2025-2026 from our 2021 baseline.
We aim to be Net Zero by 2040, covering our own operational emissions.

Pricing

Price: £220 an instance a year
Discount for educational organisations: Yes
Free trial available: Yes
Description of free trial: Yes. The full scope of Wiz Advanced is available for the free trial. Typical trial period is between 1-4 weeks

Features

Benefits

Service documents

Framework

Service ID

Contact

Service scope

User support

Onboarding and offboarding

Using the service

Scaling

Analytics

Resellers

Staff security

Asset protection

Data importing and exporting

Data-in-transit protection

Availability and resilience

Identity and authentication

Audit information for users

Standards and certifications

Security governance

Operational security

Secure development

Public sector networks

Pricing

Service documents

Cookies on Digital Marketplace

Wiz Advanced

Features

Benefits

Pricing

Service documents

Framework

Service ID

Contact

Service scope

User support

Onboarding and offboarding

Using the service

Scaling

Analytics

Resellers

Staff security

Asset protection

Data importing and exporting

Data-in-transit protection

Availability and resilience

Identity and authentication

Audit information for users

Standards and certifications

Security governance

Operational security

Secure development

Public sector networks

Social Value

Pricing

Service documents