WORLDLINE IT SERVICES UK LIMITED

ID Center

ID Center is a digital identity provider and strong authentication service including MFA, offering authentication methods including biometric (fingerprint, palm vein, iris) and other methods (FIDO2, Passkeys, OTP, PIV-Card) for unambigously assessing a person's identity. ID Center offers Single-Sign-On (SSO) for desktop as well as web applications (SAML, OIDC1.0)

Features

• Authentication Service (biometric, OTP+Pwd, Smartcard, FIDO2, Passkeys, OOB App, eiDAS)
• Standardized Identity Provider API: SAML2.0, OIDC1.0(+PKCE)
• Web based Administration Portal, Self-Service Portal
• Flexible authentication policies (2FA, MFA): Level-of-Assurance driven (LoA)
• Shared workplace support - fast user switching
• Fast biometric identification (1:n),present biometric- nothing to type in
• Extensive audit options
• Single sign On (SSO) for (legacy) desktop applications
• Windows Credential Provider, Desktop and Application Virtualization by Terminal Services
• Multiple Deployment Options (OnPremise, PrivateCloud, PublicCloud) upon request

Benefits

• Improved security combined with better usability
• Zero Password - no more forgotten passwords
• Reduced help desk calls
• The proper auth method for each requirement
• Fast and easy to use - excellent user experience
• Utmost reliability and high availability configuration
• Combined desktop SSO and IDP driven WebSSO
• Supports federation with other IDPs like ADFS
• Identity provider for (public) cloud applications
• Scales up to millions of users

• Free trial available

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at WLopportunities@worldline.com. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 15

Service ID

765253430551794

Contact

Christine Best
+447812325539
WLopportunities@worldline.com

About your service

• Service categories:

  Application Development and Deployment

  Application development

  • Software construction components
  • Business rules management

  Modelling and architecture

  • Enterprise Architecture Tools
• Multi cloud support: Yes

Service scope

• Software add-on or extension: No
• Cloud deployment model:
  • Public cloud
  • Private cloud
  • Hybrid cloud
• Service constraints: Using biometrics, smartcards and desktop SSO requires ID Center client software and drivers, which are only available for Windows machines. Authentication methods OTP+Pwd, FIDO2, Passkeys, OOB Apps are platform agnostic and work on any platform including mobile devices. 1:n biometrics (identification) is limited to 4000 users per tenant.
• System requirements:
  • Biometrics,smartcards,desktop SSO only available for Windows machines
  • Supported biometric devices are laid out in Service Definition document
  • Client Software platform is Win10,Win11, Win2019, Win2022 Server
  • Identity database is MS SQL Server (Express) 2019/2022/2025
  • Application Server is Windows Server 2019/2022/2025

User support

• Email or online ticketing support: Yes
• Support response times: For L3 support typically within 4 hours during business hours (8:00 - 16:00). Weekends and holidays: next business day.
• User can manage status and priority of support tickets: No
• Phone support: No
• Web chat support: No
• Onsite support: Yes, at extra cost
• Support levels: The product team provides L3-support during business hours, which includes free product patches and product updates as long as there is an active support contract in place. L3 support will analyse problems escalated by L2 support to the nominated members of L2 support team.; ; Depending on the deployment and operating model ; * on customer premise and IT-environment; * private cloud, 3rd-party data center; * public cloud; L2-support function has to be aligned withe the customer. L1 (end user support) has to arranged by the customer.; More details are described in "Worldline-IDCenter- DirectSupportInformation.pdf"
• Support available to third parties: Yes

Onboarding and offboarding

• Getting started: The ID Center product team provides:; * Installation and bring up support; * administrator training (targeted for L2) ; * support for creating SSO configurations; Trainings and support are provided online and are charged on half-day support chunks.; On-site training (English or German) can be offered on extra cost.
• Service documentation: Yes
• Documentation formats: PDF
• End-of-contract data extraction: The ID Center IAM API allows authorized parties to retrieve user information.; Customers may request an export from the ID Center identity database of specific data entities (e.g master data, audit trails, etc.) in MS SQL database applicable export format.
• End-of-contract process: By default, a standard export of buyer's data is scheduled, in MS SQL database export format. Export will be restricted to business data (no Worldline product specific data will be exported); We will agree for each call-off contract on additional exports, depending on buyer requirements.
• Documentation accessibility standard: None or don’t know
• How the documentation is accessible: Onboarding and offboarding documentation will be customised for each call-off contract. Accessibility standard to meet will be aligned with the buyer

Using the service

• Web browser interface: Yes
• Supported browsers:
  • Microsoft Edge
  • Firefox
  • Chrome
  • Safari
• Application to install: Yes
• Compatible operating systems: Windows
• Designed for use on mobile devices: Yes
• Differences between the mobile and desktop service: Only mobile platforms running on Windows OS can utilize desktop SSO and biometrics like fingerprint, palm vein and iris) and smartcards. Mobile platforms(iOS/ Android) can utilize the ID Center IDP (inc. WebSSO) with FIDO2, passkeys, OTP, OOB app )
• Service interface: Yes
• User support accessibility: None or don’t know
• Description of service interface: ID Center provides a user-friendly self-service portal to end users to manage their accounts and authentication means (lost, forgotten, etc.) Separately ID Center provides a comprehensive administration portal to operation and support personnel to manage users, analyze problems, draw various reports and perform 2-set of eyes management actions controlled by role-based access.; In addition ID Center provides fat client administration programs to set up the integration with Active Directory and or maintain low level server settings like encryption keys etc.
• Accessibility standards: WCAG 2.2 AA
• Accessibility testing: No specific interface testing has been conducted with users of assistive technology at this stage.
• API: Yes
• What users can and can't do using the API: The main ID Center function of user authentication is provided by the standardized identity provider API following either the Open ID Connect 1.0 and alternatively the SAML2.0 standard. The identity provider offers a frontend (authentication user dialog, collecting credentials) and in addition also a frontendless API.; Application flows may require user interaction (e.g. biometric enrolement or authentication) and thus rely on user interaction and device interaction.; Secondly the ID Center API (SOAP webservices) allows authorized callers to perform classical user, account and identity-management operations (CRUDE).
• API documentation: Yes
• API documentation formats: HTML
• API sandbox or test environment: Yes
• Customisation available: No

Scaling

• Independence of resources: ID Center service is built upon application server technology, which governs the computing resources spent on individual user sessions. The overall demand can be managed by scale-out procedures on computing resources for frontend- application and database service as required by the processes and number of users supported.

Analytics

• Service usage metrics: Yes
• Metrics types: User non-activity for a given time period - list of users
• Reporting types: Reports on request
• Resource tagging: No
• FOCUS resource tagging: No

Resellers

• Supplier type: Not a reseller

Staff security

• Staff security clearance: Other security clearance
• Government security clearance: Security Clearance (SC)

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations: United Kingdom
• User control over data storage and processing locations: Yes
• Datacentre security standards: Complies with a recognised standard (for example CSA CCM version 4.0)
• Penetration testing frequency: At least once a year
• Penetration testing approach: Another external penetration testing organisation
• Protecting data at rest:
  • Physical access control, complying with CSA CCM v4.0
  • Encryption of all physical media
• Data sanitisation process: Yes
• Equipment disposal approach: A third-party destruction service
• Data sanitisation type: Deleted data can’t be directly accessed / Cryptographic Erasure

Data importing and exporting

• Data export approach: Users may request a GDPR report of their data
• Data export formats: Other
• Other data export formats:
  • User's master data as webpage (HTML)
  • Report is in XML
• Data import formats: Other
• Other data import formats: Manual input using web UI

Data-in-transit protection

• Data protection between buyer and supplier networks: TLS (version 1.2 or above)
• Data protection within supplier network: TLS (version 1.2 or above)

Availability and resilience

• Guaranteed availability: SLAs are completely dependent on the chosen deployment and operation option (on premise, customer chosen data center, private cloud, public cloud, operation by customer, third party or Worldline).; Typical Availability of a Worldline run service (monthly uptime): 99.5%.; Incident management; Mean Time to Notify (MTTN) Service Level for all Services: 30 minutes for Severity 1 incidents from Worldline awareness .; Mean Time to Restore (MTTR) Service Level for all Services:; - 4 hours for Severity 1 incidents;; - 1 Business Day for Severity 2 incidents, if no Change Management Process is needed;; - 3 Business Days for Severity 3 incidents, if no Change Management Process is needed.; Service support availability:; - not provided by Worldline; - Level 2: Business Hours (on duty for Severity 1 incidents).; - Level 3: Business Hours (on duty for Severity 1 incidents).; Incident Severity Definition; -Severity 1: An error that disables or materially impairs major service function or the Customer’s operations. If a workaround exists, reclassified as Severity 2.; - Severity 2: An error reducing performance in any non-critical process.; - Severity 3: An error visible only on a single end-user system or non-essential components.
• Approach to resilience: The service architecture is built on an application server architecture, which allows for load balancing and scale out. The application servers allow for HA - structure to guarantee utmost availability. Resilience values are dependent upon deployment option.; Standard Worldine data centers provide resilient operation architecture.
• Outage reporting: Reporting is dependent upon deployment options and may typically include subscribable SIEM alerts. Our service delivery teams inform customers according to agreed contractual terms.

Identity and authentication

• User authentication needed: Yes
• User authentication:
  • Multi-Factor Authentication (MFA)
  • Public key authentication (including by TLS client certificate)
  • Identity federation with existing provider (for example Google Apps)
  • Other
• Other user authentication: ID Center Identity Provider:; Users are redirected to ID Center IDP frontend ( login page). Depending on configured authentication methods+ required LoA, different authentication options are provided. User discovery may be necessary (e.g. login name), subsequently ID Center performs authenticator defined procedure, during which the user will present appropriate credentials (single or multifactor), as result the IDP creates a signed security token and returns.; ID Center desktop SSO: (legacy) applications, which require username/password login, an ID Center desktop agent will capture the dialog an will substitute the app credentials upon ID Center successful authentication (e.g. with biometrics)
• Access restrictions in management interfaces and support channels: Access to management and support functions is controlled by role - based access and requires appropriate security tokens, issued by the ID Center IDP.
• Access restriction testing frequency: At least once a year
• Management access authentication:
  • Multi-Factor Authentication (MFA)
  • Public key authentication (including by TLS client certificate)
  • Identity federation with existing provider (for example Google Apps)
  • Other
• Description of management access authentication: Access to management and support functions is controlled by role - based access and requires appropriate security tokens, issued by the ID Center IDP.

Audit information for users

• Access to user activity audit information: Users have access to real-time audit information
• How long user audit data is stored for: At least 12 months
• Access to supplier activity audit information: Users have access to real-time audit information
• How long supplier audit data is stored for: User-defined
• How long system logs are stored for: User-defined

Security governance

• Named board-level person responsible for service security: Yes
• Security governance certified: Yes
• Security governance standards: ISO/IEC 27001
• Information security policies and processes: SLAs are completely dependent on the chosen deployment and operation option (on premise, customer chosen data center, private cloud, public cloud, operation by customer, third party or Worldline).; Worldline has established and certified an Information Security Management System (ISMS) in accordance with the ISO/IEC 27001:2013 standard, covering its operations and the projects entrusted to it by its clients. All services and deliverables provided under this engagement are included in the ISMS and benefit from all associated security measures—both technical and organizational—based on current best practices as well as the legal and regulatory requirements applicable to Worldline and its clients.; All employees receive mandatory training in security policy.; Security incidents can be reported either via the line manager or the project's CISO, or via a dedicated mailbox.
• Software Security Code of Practice: Yes

Operational security

• Configuration and change management standard: Supplier-defined controls
• Configuration and change management approach: Change management is a formal process for handling modifications to the platform, including software updates and configuration changes to adapt to evolving circumstances, regulations, and technologies. It relies on strict documentation and application version control, as well as validation steps with clearly identified responsibilities as defined in the quality assurance plan. These validation steps include risk management, specifically security risks, for updating the risk register and implementing appropriate actions for each case.
• Vulnerability management type: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Vulnerability management approach: Vulnerability management process dependent on chosen deployment and operation option (on premise, customer data center, private cloud, public cloud, operation by customer, ...).; If Worldline is in charge: Weekly security scans on IP addresses exposed to the internet. Results sent to Security Officer responsible.; Technical updates carried out at least twice a year to keep the service up to date and resolve known vulnerabilities .; Known vulnerability tracking in collaboration with the Security Officer, and deployment decisions according to the severity of the threat: from deployment within 24 hours to periodic updates.; Security scans are based on OWASP, Qualys references.
• Protective monitoring type: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Protective monitoring approach: "Vulnerability management process completely dependent on the chosen deployment and operation option (on premise, customer chosen data center, private cloud, public cloud, operation by customer, third party or Worldline).; Worldline’s security incident management policy outlines procedures for response, categorisation, handling, and communication of events. Incident priority determined by scope and impact. ; For attacks involving client data, a preliminary incident report within 48 hours, detailing investigation status, understanding of the attack, scope, impact, and mitigation taken. Relevant logs, traces are provided upon confirmation of attack. ; Additionally, Worldline can deploy a Security Operations Centre (SOC) ."
• Incident management type: Complies with a recognised standard, for example, CSA CCM v4.0 or ISO/IEC 27035:2011 or SSAE-18 / ISAE 3402
• Incident management approach: Incident management process completely dependent on the chosen deployment and operation option (on premise, customer chosen data center, private cloud, public cloud, operation by customer, third party or Worldline). In case of Worldline Application and platform monitoring is carried out 24/7 by operational teams who can be contacted at any time via phone or ticketing. ; The monitoring centre analyses and categorises incidents, taking appropriate action according to the type of event and established procedures. ; Incident tracking is available through the ticketing system, and a post-incident report is produced for major or critical incidents.
• Post-quantum cryptography secure: No

Secure development

• Approach to secure software development best practice: Independent review of processes (for example CESG CPA Build Standard, ISO/IEC 27034, ISO/IEC 27001 or CSA CCM v4.0)

Public sector networks

• Connection to public sector networks: No

Pricing

• Discount for educational organisations: No
• Free trial available: Yes
• Description of free trial: ID Center provides a time-limited, licence for a limited number of users (5) for specific authentication methods. Biometric methods might require purchasing the respective biometric devices. App-based authentication and SMS based OTP can not be evaluated as part of the free evaluation. Free evaluation requires paid one time setup fee.

Discount percentage by annual call-off contract value (excluding VAT)

• Less than £250,000: 0%
• Between £250,000 and £500,000: 1%
• Between £500,001 and £1,000,000: 1.5%
• Between £1,000,001 and £2,500,000: 2%
• Between £2,500,001 and £5,000,000: 2.5%
• Over £5,000,001: 3%

Non-mandatory Standards and certifications

• ISO/IEC 27001 certification: Yes
• Who accredited the ISO/IEC 27001: EY CertifyPoint
• ISO/IEC 27001 accreditation date: Tuesday 1 August 2023
• What the ISO/IEC 27001 doesn’t cover: Nothing
• ISO 28000:2022 certification: No
• ISO 9001 certification: Yes
• Who accredited the ISO 9001 certification: EY CertifyPoint0
• ISO 9001 accreditation date: Tuesday 1 August 2023
• What the ISO 9001 doesn’t cover: Nothing
• Quality management systems (QMS): Yes
• CSA STAR certification: No
• PCI certification: Yes
• Who accredited the PCI DSS certification: USD AG
• PCI DSS accreditation date: Wednesday 16 October 2024
• What the PCI DSS doesn’t cover: All Worldline services which are not part of a card payment solution (PCI DSS only applies to card payment related services). All Worldline teams are nevertheless trained to PCI DSS requirements and the Worldline Information Security Management System is aligned with PCI DSS requirements
• Cyber essentials: Yes
• Please provide your Cyber Essentials Certificate Number: A4af5190-7f45-41c3-ab5a-c40a1557bd92
• Cyber essentials plus: No
• Cyber Essentials Alternative: None of the criteria
• Other security certifications: No

Social value

• Section B - Commitment for Future: Delivery:

  • Mission: Kick start economic growth. To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

    Policy Outcome 1: Fair work: That offers fair wages and good working conditions. Help people get a job, stay in work, and progress in their careers, with good employment opportunities across the country. Notes: Where there is a large proportion of labour costs in the contract, commercial teams should consider MAC in Outcome 1 as a priority

    • Activities that support an environment where staff are educated about, and feel empowered to, address their physical wellbeing

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at WLopportunities@worldline.com. Tell them what format you need. It will help if you say what assistive technology you use.