tmc3 Limited

Managed Operational Technology (OT) Security Operations Centre (SOC)

tmc3's OT SOC provides a fully outsourced 24/7x365 MDR capability optimised for OT environments. We utilise our technology platforms, security analysts knowledge and experience to enable holistic ICS protection. This includes SIEM, Threat Intelligence, Automation, Incident Management and Vulnerability Management ensuring robust defence across critical IT and OT systems.

Features

• Turn-key Security Operations Centre (SOC)
• Quickly establish a 24/7x365 MDR capability
• Protect OT, ICS, SCADA and IT - ensuring availability
• Run workshops to capture requirements and identify MoSCoW
• Security analysts with extensive experience
• Can provide Incident Management, SIEM, SOAR and Threat Intelligence tools
• Threat Intelligence and Threat Hunting, to identify incidents, faster
• Endpoint, Network and Cloud Monitoring
• SOC can receive Log-data directly from various systems, for analysis
• Monitor hybrid cloud operations and/or data centres

Benefits

• 24/7x365 Security Operations Centre protects against Cyber Threats
• Enhanced resilience against cyber-attacks on critical infrastructure
• 24/7 Monitoring: Continuous vigilance ensures swift threat detection and response
• Confidence SOC provides expert protection for your digital assets
• Flexible and scalable SOC service
• Reduce attacker dwell time to minutes
• Reduced risk of data breach and business impact of attack
• IT/OT convergence support helps optimise technology estate
• Reduces CAPEX and OPEX spend through Business focused delivery
• Scalability: Easily adjust security support as your organisation evolves

£100 a unit a month

• Education pricing available

Service documents

• Pricing document

  PDF

• Skills Framework for the Information Age rate card

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at Frameworks@tmc3.co.uk. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 14

Service ID

747290155998249

Contact

Nathan Tittensor
0113 8730449
Frameworks@tmc3.co.uk

Service scope

• Service constraints: To monitor the customer's environment, access is required to the customer's endpoints, workloads, security logs and network traffic. An internet connection will be required to pass this information to the service over an encrypted network link.
• System requirements:
  • Virtual Environment for telemetry forwarding technology
  • 8 Cores
  • 16 GB RAM
  • 1 TB Storage
  • Site to site VPN

User support

• Email or online ticketing support: Email or online ticketing
• Support response times: Response times are based on the agreed SLA with the client.; ; The Standard SLA is 1 hour for all critical requests.
• User can manage status and priority of support tickets: No
• Phone support: Yes
• Phone support availability: 24 hours, 7 days a week
• Web chat support: No
• Onsite support: Yes, at extra cost
• Support levels: The service price includes all support levels. Support tickets are logged and will be assigned a priority (1 - 3) and responded according to our SLA.; ; We adapt our support to the needs of the users and can offer most support levels requested by clients. We have provided all combinations of first, second, and third line support to our clients; we have provided all combinations of UK business hours, UK extended business hours, and 24/7 support facilities to our clients. We have provided both real-time telephone support, email support, and on-call support. The costs of each of these models is tailored to the specific needs of our clients to ensure the right level of support is provided to the service in question. In all of our client engagements there will be a dedicated account manager – and typically a cloud support engineer or technical account manager depending on the needs of the client.; ; Each customer is allocated a Client Success Manager and a named Cyber Operations Analyst. Regular reports and meetings are held to discuss the service.
• Support available to third parties: Yes

Onboarding and offboarding

• Getting started: Each engagement is treated as a bespoke requirement to ensure planning for onboarding, through life management and offboarding works for our customers unique requirements. Please see our service description for more information and/or get in touch at the contact details provided.; ; Training is bespoke to each service and each buyer. Our team work dynamically with your team to ensure their expertise is shared through workshops, one-to-one sessions, meetings and presentations. Where required they will create learning collateral to be shared amongst those within your delivery team.; ; Training will be provided by the specialists we deploy to your programme and will be overseen by a dedicated Service Specialist. Our aim is to provide you with the specialist support you need to integrate cloud solutions into your business while facilitating a sustainable service to manage your cloud in the long term.
• Service documentation: Yes
• Documentation formats: PDF
• End-of-contract data extraction: On completion of the engagement, customer data is available for up to 30 days and can be made available on request.
• End-of-contract process: On completion of the engagement, all information collected as part of the engagement can be made available to the customer. No further costs are attributed to standard offboarding.

Using the service

• Web browser interface: Yes
• Using the web interface: The portal will be provisioned once the customer starts the service and login credentials will be provided to the customer. Security Incidents will be presented through the web interface (and notified through other methods). Changes to the service can be requested through the web interface.
• Web interface accessibility standard: WCAG 2.1 AAA
• Web interface accessibility testing: UAT.
• API: No
• Command line interface: No

Scaling

• Scaling available: Yes
• Scaling type: Automatic
• Independence of resources: The service is delivered as SaaS with each customer environment running independently, so there is no sharing of resources between clients. The service is delivered with an SLA of 99.9% for availability.
• Usage notifications: Yes
• Usage reporting: Email

Analytics

• Infrastructure or application metrics: Yes
• Metrics types: Other
• Other metrics: Threat and security based metrics
• Reporting types:
  • API access
  • Real-time dashboards
  • Regular reports
  • Reports on request

Resellers

• Supplier type: Reseller providing extra features and support
• Organisation whose services are being resold: Google, Microsoft, Splunk, Crowdstrike

Staff security

• Staff security clearance: Conforms to BS7858:2019
• Government security clearance: Up to Developed Vetting (DV)

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations: United Kingdom
• User control over data storage and processing locations: Yes
• Datacentre security standards: Managed by a third party
• Penetration testing frequency: At least once a year
• Penetration testing approach: ‘IT Health Check’ performed by a Tigerscheme qualified provider or a CREST-approved service provider
• Protecting data at rest: Physical access control, complying with CSA CCM v3.0
• Data sanitisation process: Yes
• Data sanitisation type: Hardware containing data is completely destroyed
• Equipment disposal approach: Complying with a recognised standard, for example CSA CCM v.30, CAS (Sanitisation) or ISO/IEC 27001

Backup and recovery

• Backup and recovery: Yes
• What’s backed up: All information.
• Backup controls: As our solution is delivered via a SaaS Model, all backup of data is handled by tmc3 with no requirement for the client to be involved in the process. Data is backed up continually.
• Datacentre setup: Multiple datacentres with disaster recovery
• Scheduling backups: Supplier controls the whole backup schedule
• Backup recovery: Users contact the support team

Data-in-transit protection

• Data protection between buyer and supplier networks: TLS (version 1.2 or above)
• Data protection within supplier network: TLS (version 1.2 or above)

Availability and resilience

• Guaranteed availability: 99.9% as a minimum - please see further SOWs for all SLAs and service credits
• Approach to resilience: A full description of architecture is available on request
• Outage reporting: Outages to the service are reported to the client immediately by telephone communication, due to the nature of the service and reviewed at the service meetings as part of standard reporting.

Identity and authentication

• User authentication:
  • 2-factor authentication
  • Identity federation with existing provider (for example Google apps)
  • Username or password
• Access restrictions in management interfaces and support channels: Management interfaces and support channels are protected by multiple layers of security. tmc3 does not expose any services to the internet that can be connected to directly inbound. All services are proxied in the cloud with strong authentication required before even being able to establish a connection. All services are protected by DDOS mitigation and web application firewalls.
• Access restriction testing frequency: At least every 6 months
• Management access authentication:
  • 2-factor authentication
  • Identity federation with existing provider (for example Google Apps)
  • Username or password
• Devices users manage the service through: Directly from any device which may also be used for normal business (for example web browsing or viewing external email)

Audit information for users

• Access to user activity audit information: Users have access to real-time audit information
• How long user audit data is stored for: At least 12 months
• Access to supplier activity audit information: Users have access to real-time audit information
• How long supplier audit data is stored for: At least 12 months
• How long system logs are stored for: At least 12 months

Standards and certifications

• ISO/IEC 27001 certification: Yes
• Who accredited the ISO/IEC 27001: NQA Certification Limited
• ISO/IEC 27001 accreditation date: 16 January 2023
• What the ISO/IEC 27001 doesn’t cover: N/A – This certification covers the entire business and in particular the delivery Cyber Security & Data Protection Professional Services.
• ISO 28000:2007 certification: No
• CSA STAR certification: No
• PCI certification: No
• Cyber essentials: Yes
• Cyber essentials plus: Yes
• Other security certifications: No

Security governance

• Named board-level person responsible for service security: Yes
• Security governance certified: Yes
• Security governance standards: ISO/IEC 27001
• Information security policies and processes: Tmc3 has a dedicated team of professionals responsible for ensuring the security and protection of all information under our control. Our team undergoes regular training and assessments to keep up-to-date with the latest developments in information security. ; ; We have the ability to send and received material securely, via our email system, and hold all information within M365, hosted within the UK, securely encrypted in transit and rest, and hardened to industry best practice, such as CIS Benchmarks. Our comprehensive information security management system is ISO27001 certified and we hold Cyber Essentials+ providing you with the confidence that tmc3 systems comply with industry standards and best practices.

Operational security

• Configuration and change management standard: Conforms to a recognised standard, for example CSA CCM v3.0 or SSAE-16 / ISAE 3402
• Configuration and change management approach: Tmc3 has a full change management process, which can be provided as requested.; ; Change Management is run by a change control board. Only those changes that conform to the Change Management process described in our policy document are authorised for implementation. Within these standards are the rules of conduct relating to: 1) Change Entry 2) Change Review 3) Testing 4) Change Approval 5) Change Announcement 6) Change Management Meeting 7) Implementation 8) Report and Control
• Vulnerability management type: Conforms to a recognised standard, for example CSA CCM v3.0 or SSAE-16 / ISAE 3402
• Vulnerability management approach: The vulnerability management team is responsible for tracking and following up on vulnerabilities. Once a vulnerability requiring remediation has been identified, it is logged, prioritised according to severity, and assigned an owner. ; ; Emergency patches will be deployed by relevant SOC Staff. They should be deployed within 8 hours of availability. As Emergency patches pose an imminent threat to the network, the release may proceed testing. Critical security patches should be deployed within 3 business days of the time the vendor makes them available. Non-critical security and other patches may be applied monthly.
• Protective monitoring type: Conforms to a recognised standard, for example CSA CCM v3.0 or SSAE-16 / ISAE 3402
• Protective monitoring approach: We utilise Managed Detection and Response service to proactively monitor its infrastructure which allows us to detect and respond to threats as they occur. This is monitored continuously 24/7 . We respond to potential compromises using our Security Incident response process within one hour of detection.
• Incident management type: Conforms to a recognised standard, for example, CSA CCM v3.0 or ISO/IEC 27035:2011 or SSAE-16 / ISAE 3402
• Incident management approach: As an ISO27001 accredited company, tmc3 maintains a detailed Incident Handling Policy and suite of procedures to ensure that we have a comprehensive and repeatable risk assessment process. Incidents are reported to the Information Security Officer as per policy and our Information Security Management System.

Secure development

• Approach to secure software development best practice: Independent review of processes (for example CESG CPA Build Standard, ISO/IEC 27034, ISO/IEC 27001 or CSA CCM v3.0)

Separation between users

• Virtualisation technology used to keep applications and users sharing the same infrastructure apart: No

Energy efficiency

• Energy-efficient datacentres: Yes
• Description of energy efficient datacentres: We're focused on reducing our energy use while serving the growth of the internet. Most data centers use almost as much non-computing or "overhead" energy (like cooling and power conversion) as they do to power their servers. We've reduced this overhead to only 10%. That way, most of the energy we use powers the machines directly serving searches and products. We take detailed measurements to continually push toward doing more with less — serving more users while wasting less energy.

Social Value

• Social Value:

  Social Value

  • Fighting climate change
  • Tackling economic inequality
  • Equal opportunity
  • Wellbeing

  Fighting climate change

  In 2024, tmc3 has achieved Net Zero emissions.; ; tmc3 has implemented a documented Environmental Management System to reduce our environmental impacts. We will continue to focus on further reductions and our sights remain firmly set on exceeding all elements of our Science-Based Target on a long-term basis.; ; Actions we take include, but are not limited to: establishing environmentally sensitive purchasing policies (buying recycled or long-life products; favouring products derived from natural/sustainable sources) and monitoring the environmental performance of our suppliers; ensuring that all decisions regarding working practices and purchasing take environmental considerations into account. We measure, monitor and minimise our usage of resources and consumables, and our greenhouse gas emissions. We actively look for ways to reduce waste and recycling, and encourage the use of sustainable modes of transport. We encourage home working and the use of virtual collaboration tools.; ; tmc3's Carbon Reduction Plan has been completed in accordance with PPN 06/21 and associated guidance and reporting standard for Carbon Reduction Plans. This is available on the tmc3 website.; ; For the provision of these services, we commit to offsetting the carbon footprint for the development of the tmc3 deliverables and, if requested, will provide certification verifying this action has been completed within a month of project completion. We will measure the ‘As-is’ state of the contract to give us an accurate benchmark to work from, and how we need to progress throughout the contract lifecycle. This will include measuring against Scope 1,2&3 emissions, for example: Water use, electricity use, conducting a materiality checklist, measuring business travel, working from Home, business travel accommodation, employee commuting etc. We will gather data across all scope of emissions and utilise carbon calculator tooling to give an accurate and transparent measurement. We will then present these findings back to you and key stakeholders.

  Tackling economic inequality

  Social responsibility and supporting our communities are hugely important aspects of who we are. We love to spend time and energy helping local charities and developing the security professionals of tomorrow, through organising meetups and mentorship initiatives. Cyber Choices, Hullo and Hull4Heroes are just a few charities and initiatives we support. For us, this is much more than a set of words, this is about the positive impact we have on society, the environment and the economy.; ; tmc3 are pleased to confirm that all of our staff and associates are paid above the real living wage, in addition to receiving a pay review following every performance review. Furthermore, we hold formal accreditation from the Living Wage Foundation as a living wage employer. In our supply chain of associates, we prefer to work with known and trusted associates with well-established subcontracts and working practices. We do not use zero hour contracts. ; ; We are committed to creating job opportunities, particularly for those who face barriers to employment or are located in deprived areas. Our hiring practices are inclusive, and we provide comprehensive training to our employees to equip them with the necessary skills for their roles. Additionally, we offer apprenticeships and internships to individuals from diverse backgrounds, providing them with practical experience and a pathway to employment in the technology industry.; Each year tmc3 supports a number of young people to obtain an apprenticeship in Cyber Security through the tmc3 Academy.; ; To monitor and measure our efforts in tackling economic inequality, we will use Key Performance Indicators such as:; ; 1. Number of new businesses supported: This will measure our impact on entrepreneurship.; 2. Number of job opportunities created: This will assess our contribution to employment.; 3. Number of individuals trained and qualifications achieved: This will evaluate our efforts in supporting educational attainment.

  Equal opportunity

  tmc3 is committed to ensuring fair treatment of all stakeholders in our business from customers to employees. We believe in equality of opportunity and inclusion, where tmc3’s Equality, Diversity and Inclusion policy goes beyond what we are required to do to ensure all contributions are valued and respected. We ensure that in all our activities we promote equality and provide respect to all, irrespective of marital or civil partnership status; having or not having dependants; religion or beliefs; race (including colour, nationality, ethnic or national origin); disability; sex or sexual orientation; age; or pregnancy and maternity. This policy extends beyond our own employees to client personnel, subcontractors, suppliers and potential recruits, and underpins our approach to recruitment of staff and engagement with our supplier base.; Our tailored onboarding programs acclimate new employees with disabilities to the workplace culture and educate them on relevant policies and procedures but also include disability-specific information such as physical alterations, flexible hours, staff training and more ergonomic equipment and software.; The tmc3 Academy is a development programme designed to cultivate emerging talent in the field of security. The Academy is tailored to guide individuals into becoming security specialists. It provides a dynamic mix of practical experiences and formal coaching, all underpinned by three pillars: competence, knowledge, and transferable skills.; ; The tmc3 Academy aims to empower individuals within a span of 16 months, providing them with hands-on experience, dedicated study sessions, and individualised coaching. This approach facilitates their transition into confident members of both the client-facing and internal teams at tmc3. The Academy prides itself on its inclusivity, welcoming individuals from diverse academic backgrounds and placing an emphasis on transferable skills and motivation rather than prior exposure to cyber security.

  Wellbeing

  tmc3 is a company that is committed to supporting the health and wellbeing of our staff, both physically and mentally. We make every effort to ensure that our people are physically comfortable working at home by providing office equipment, and whatever else is needed (subject to individual accessibility requirements). ; We provide an Employee Assistance Programme for all staff including access to an online platform and 24hr confidential helpline. This provides counselling support and a virtual library of wellbeing information, ensuring all staff have practical support for all aspects of physical and mental wellbeing. Our team physically get together every 6-8 weeks, to participate in social and team building activities. We have employed a Mental Health First Aider, who provides advice and support, to our personnel and associates. ; We have created a safe space for all employees to ask for help. This can be done confidentially, or anonymously, through our ‘Better Ways of Working’ form, which is reviewed by the Executive Committee. We capture decisions made, within the ExCo Minutes. Recent examples of action taken: ; o Introduced the Electric Vehicle Scheme ; o Introduced an Employee Rewards and Recognition Scheme ; o Private Medical Healthcare Plans ; We conduct regular mental health and well-being workshops for staff and stakeholders, drawing on our experience of coaching and mentoring experience with Hullo Charity. We have encouraged all tmc3 personnel to provide a minimum of one day (paid) per annum, to charity volunteering. We also factor in team charity days, such as planting trees for the UK National Forestry Commission. ; We routinely monitor employee MHW by undertaking: Engagement surveys to analyse UK employee MHW issues and monitor progress, and, Account “Pulse check” surveys to understand how people are feeling and whether immediate intervention is required.

Pricing

• Price: £100 a unit a month
• Discount for educational organisations: Yes
• Free trial available: No

Service documents

• Pricing document

  PDF

• Skills Framework for the Information Age rate card

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at Frameworks@tmc3.co.uk. Tell them what format you need. It will help if you say what assistive technology you use.