Cirro

Operational Technology (OT) Cyber Security

As the worlds of IT and OT merge, OT assets are at greater risk than ever of cyber security attacks. Identify OT assets, even non-networked ones, and build a risk picture.

Protect Critical Infrastructure and Industrial Operations with Risk-Based Vulnerability Management for OT

Features

• Protection for operational assets (OT), Operational Process Optimisation
• Complete, centralised inventory of all your operational assets
• Detailed risk score and visualisations for each device
• Detailed list of common vulnerabilities and exposures for your devices
• Information on patches available for these vulnerabilities
• Eliminate the manual task of data collection and report generation
• Comprehensive suite of built-in standard risk and operational reports
• Holistically manage OT cyber risks in operational technology environments.
• Safely collect, monitor and manage OT asset data at scale
• Visibility into all cyber-physical systems (CPS)

Benefits

• Gain full visibility of OT environment and assets
• Gain insight on OT cyber security real world risk
• Bring OT cyber security inline with IT cyber security
• Complete OT cyber security solution
• Unique OT Security Expertise, Award-Winning Products
• Achieve cyber and operational resilience, Actionable Insights and Risk Reduction
• Identify & mitigate vulnerabilities, risk management, and threat detection
• Extend IT security controls and governance to OT
• Ensures compliance with NERC CIP, TSA Directive,NIS 2.0, RCE, SOCI/SLACIP
• Unique OT Security Expertise,

£2,500 to £3,500 a device

• Education pricing available

Service documents

• Pricing document

  PDF

• Skills Framework for the Information Age rate card

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at michaelo@cirro-solutions.co.uk. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 14

Service ID

696320480803415

Contact

Michael Owen
020 3418 0412
michaelo@cirro-solutions.co.uk

Service scope

• Service constraints: This service typically requires on-site hardware, installation, configuration and set-up
• System requirements: Requirements will be detailed in a bespoke SoW

User support

• Email or online ticketing support: Email or online ticketing
• Support response times: 30 mins during working hours; 2 hours 24x7x365
• User can manage status and priority of support tickets: Yes
• Online ticketing support accessibility: None or don’t know
• Phone support: Yes
• Phone support availability: 24 hours, 7 days a week
• Web chat support: No
• Onsite support: Yes, at extra cost
• Support levels: The Industrial Defender services team provides the highest quality customer support for your users via email, phone or our Support Portal.; ; Industrial Defender’s broad range of service offerings includes commissioning, support, training, engineering, analysis, advising and technical consulting to ensure you get the most value possible from your deployment.; ; Work hand in hand with customers to understand their unique needs and apply the right solutions; ; Focus on system hardening and threat prevention using the Industrial Defender platform; ; Optimising platform deployment for each customer’s environment to achieve the lowest TCO.; ; A dedicate support contact is offered which includes support, training, remote management, onsite visits.
• Support available to third parties: Yes

Onboarding and offboarding

• Getting started: Documents
• Service documentation: Yes
• Documentation formats:
  • HTML
  • PDF
• End-of-contract data extraction: OPen format
• End-of-contract process: Nothing

Using the service

• Web browser interface: Yes
• Using the web interface: The web interface is the main access to manage, configure and administer the Industrial Defender solution. This includes managing users, assets, security, logs, firmware updates, security profiles and groups, cyber risk reports, access control and log files.
• Web interface accessibility standard: None or don’t know
• How the web interface is accessible: Via a standard web browser
• Web interface accessibility testing: None
• API: Yes
• What users can and can't do using the API: Everything
• API automation tools: Terraform
• API documentation: Yes
• API documentation formats: HTML
• Command line interface: Yes
• Command line interface compatibility:
  • Linux or Unix
  • Windows
• Using the command line interface: Acess management

Scaling

• Scaling available: Yes
• Scaling type: Automatic
• Independence of resources: Resources are dedicated and to each customer deployment. This typically includes onsite hardware,
• Usage notifications: Yes
• Usage reporting:
  • API
  • Email
  • Other
• Other usage reporting: SMTP

Analytics

• Infrastructure or application metrics: Yes
• Metrics types:
  • CPU
  • Disk
  • HTTP request and response status
  • Memory
  • Network
  • Number of active instances
  • Other
• Other metrics:
  • Device asset ID
  • Firmware version
  • State
• Reporting types:
  • API access
  • Real-time dashboards
  • Regular reports
  • Reports on request

Resellers

• Supplier type: Reseller providing extra support
• Organisation whose services are being resold: Industrial Defender

Staff security

• Staff security clearance: Other security clearance
• Government security clearance: Up to Security Clearance (SC)

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations: United Kingdom
• User control over data storage and processing locations: Yes
• Datacentre security standards: Complies with a recognised standard (for example CSA CCM version 3.0)
• Penetration testing frequency: At least once a year
• Penetration testing approach: Another external penetration testing organisation
• Protecting data at rest:
  • Physical access control, complying with CSA CCM v3.0
  • Encryption of all physical media
• Data sanitisation process: Yes
• Data sanitisation type:
  • Explicit overwriting of storage before reallocation
  • Deleted data can’t be directly accessed
  • Hardware containing data is completely destroyed
• Equipment disposal approach: Complying with a recognised standard, for example CSA CCM v.30, CAS (Sanitisation) or ISO/IEC 27001

Backup and recovery

• Backup and recovery: Yes
• What’s backed up: Setings
• Backup controls: Via web UI
• Datacentre setup: Single datacentre with multiple copies
• Scheduling backups: Users schedule backups through a web interface
• Backup recovery: Users can recover backups themselves, for example through a web interface

Data-in-transit protection

• Data protection between buyer and supplier networks:
  • Private network or public sector network
  • TLS (version 1.2 or above)
  • IPsec or TLS VPN gateway
• Data protection within supplier network: TLS (version 1.2 or above)

Availability and resilience

• Guaranteed availability: 99.99%
• Approach to resilience: Its designed that way
• Outage reporting: SMTP notiofication is sent

Identity and authentication

• User authentication:
  • 2-factor authentication
  • Username or password
• Access restrictions in management interfaces and support channels: X
• Access restriction testing frequency: At least once a year
• Management access authentication:
  • 2-factor authentication
  • Public key authentication (including by TLS client certificate)
  • Identity federation with existing provider (for example Google Apps)
  • Dedicated link (for example VPN)
  • Username or password
• Devices users manage the service through: Dedicated device on a segregated network (providers own provision)

Audit information for users

• Access to user activity audit information: Users have access to real-time audit information
• How long user audit data is stored for: User-defined
• Access to supplier activity audit information: Users have access to real-time audit information
• How long supplier audit data is stored for: User-defined
• How long system logs are stored for: User-defined

Standards and certifications

• ISO/IEC 27001 certification: Yes
• Who accredited the ISO/IEC 27001: IQS
• ISO/IEC 27001 accreditation date: 17/7/2023
• What the ISO/IEC 27001 doesn’t cover: 3rd parties
• ISO 28000:2007 certification: No
• CSA STAR certification: No
• PCI certification: No
• Cyber essentials: Yes
• Cyber essentials plus: No
• Other security certifications: Yes
• Any other security certifications:
  • ISO 22301 - Business Continuity
  • ISO 9001 - Quality

Security governance

• Named board-level person responsible for service security: Yes
• Security governance certified: Yes
• Security governance standards: ISO/IEC 27001
• Information security policies and processes: From top down

Operational security

• Configuration and change management standard: Conforms to a recognised standard, for example CSA CCM v3.0 or SSAE-16 / ISAE 3402
• Configuration and change management approach: Chnages is good
• Vulnerability management type: Conforms to a recognised standard, for example CSA CCM v3.0 or SSAE-16 / ISAE 3402
• Vulnerability management approach: They find vulnerabilities
• Protective monitoring type: Supplier-defined controls
• Protective monitoring approach: X
• Incident management type: Conforms to a recognised standard, for example, CSA CCM v3.0 or ISO/IEC 27035:2011 or SSAE-16 / ISAE 3402
• Incident management approach: X

Secure development

• Approach to secure software development best practice: Conforms to a recognised standard, but self-assessed

Separation between users

• Virtualisation technology used to keep applications and users sharing the same infrastructure apart: No

Energy efficiency

• Energy-efficient datacentres: No

Social Value

• Social Value:

  Social Value

  • Fighting climate change
  • Equal opportunity
  • Wellbeing

  Fighting climate change

  Commitment to Reduce Carbon Footprint and Climate-Related Initiatives In alignment with our commitment to reducing our ecological impact, we are dedicated to collaborating with our customers and suppliers to contribute to environmentally sustainable initiatives that improve ecosystems and reduce ecological impact. Our primary objective is to minimise the environmental impact of our operations. Focus on Environmental Impact Reduction Our main focus is to engage in discussions with our customers to explore collaborative approaches for reducing the environmental impact, particularly by minimising non-essential travel, to reduce energy usage and wastage of time and materials, all of which have an impact on operational consumption. As we transition back to regular operations, we are focused on reducing our physical impact, including initiatives such as flexible working, minimising printing, and enhancing recycling efforts. We are committed to optimising our physical office requirements to ensure efficient resource utilisation. Future-Focused Solutions and Efficiency We are dedicated to designing future-oriented solutions that embed efficiency into our design and delivery processes. Leveraging the momentum generated by the pandemic, we aim to build on successful new working methods. At Cirro, we are continually looking to identify potential improvements in the way we work to improve our operational efficiencies which directly impact energy usage, travel or ecological impact. By championing these initiatives, we are steadfast in our commitment to not only reduce our own ecological impact but also to actively engage with our stakeholders to foster environmental sustainability and support initiatives that have a positive impact on our world.

  Equal opportunity

  Delivering Social Value Theme 4 and PPN 06/20 Model Award Criteria In the following section, we elaborate on our approach to fulfilling Social Value Theme 4 and the relevant PPN 06/20 Model Award Criteria Our strategy, aligned with WSP’s 2022-24 Inclusion & Diversity Strategy, encompasses the following initiatives: Skill Development for Underrepresented Groups We are committed to supporting the development of new skills that lead to recognised qualifications for underrepresented groups. Addressing Inequality in Employment, Skills, and Pay We will demonstrate a clear commitment to identifying and addressing inequality in employment, skills, and pay within the contract workforce. This includes implementing time-bound action plans to monitor the inclusion and progression of full-time equivalent (FTE) employees from underrepresented groups. Supporting In-Work Progression Our approach includes support for in-work progression, aiming to assist individuals from disadvantaged or minority groups in transitioning into higher-paid roles by developing new skills relevant to the contract. Real-World Equal Opportunity When recruiting, Cirro has a policy to ensure that all names, ages, race or gender details are removed from CVs, so we focus on interviewing and employing the most suitable person for the role.

  Wellbeing

  Wellbeing Initiatives In our commitment to prioritising the well-being of our teams, we are dedicated to supporting the health and well-being of our employees, contractors, suppliers and customers. Flexible Working Support We offer flexible working conditions to our staff. They have a clearly defined job description, they know what needs to be done and they have the flexibility they need to be able to do that whilst balancing home life, physical and mental health. Internal Support Cirro’s works typically in virtual teams, it’s important that we have ‘virtual’ tea breaks and have regular discussions. Cirro also keeps an eye on the level of output expectations and workloads of employees to ensure the right resourcing levels and workloads. During periods of high-intensity working, such as working on tenders, delivering projects or whatever it might be, Cirro ensure employees take time out once this is more practically possible to ensure employees can refresh and relax.

Pricing

• Price: £2,500 to £3,500 a device
• Discount for educational organisations: Yes
• Free trial available: No

Service documents

• Pricing document

  PDF

• Skills Framework for the Information Age rate card

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at michaelo@cirro-solutions.co.uk. Tell them what format you need. It will help if you say what assistive technology you use.