Brookcourt Solutions

Vulnerability Management - Tenable

Identify and prioritize vulnerabilities based on risk to your business. Managed in the cloud.

Features

Customer-friendly elastic asset licencing
Comprehensive assessment options
Real-time continuous assessment
Accurate asset-based vulnerability tracking
Vulnerability prioritization based on actual risk
Simplified vulnerability management
Automated cloud visibility
Pre-built integrations and documented API and integrated SDK
SLA with Uptime guarantee

Benefits

Continuously track known and unknown assets and their vulnerabilities
Identify threats and unexpected network changes
Boost Productivity: your initial assessments in less than 5 minutes
Prioritize Vulnerabilities: easy to understand risk scores
Automate Processes: fully documented API and pre-built integrations
Maximize ROI: Eliminate double- or triple-counting of assets

£44 an instance a year

Free trial available

Service documents

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at contact@brookcourtsolutions.com. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 14

Service ID

Contact

Brookcourt Solutions Phil Higgins
Telephone: 01737 886111
Email: contact@brookcourtsolutions.com

Service scope

Software add-on or extension: No
Cloud deployment model: Public cloud
Service constraints: Must be accessed via a web browser.
System requirements: Scanners: https://docs.tenable.com/general-requirements/Content/PDF/TenableGeneralRequirements.pdf

https://docs.tenable.com/vulnerability-management/Content/vulnerability-management/GetStarted.htm

User support

Email or online ticketing support: Email or online ticketing
Support response times: RTO for initial response times varies due to the critical nature, but all within a 24 hour window.
User can manage status and priority of support tickets: Yes
Online ticketing support accessibility: None or don’t know
Phone support: Yes
Phone support availability: 24 hours, 7 days a week
Web chat support: Web chat
Web chat support availability: 24 hours, 7 days a week
Web chat support accessibility standard: None or don’t know
How the web chat support is accessible: The chat feature is available once a named contact has logged into the support portal.
Web chat accessibility testing: Salesforce provide the chat facility for the community website (including the support function).
Onsite support: Yes, at extra cost
Support levels: Advanced, Premier and Elite. Advanced support is included with your subscription cost and users can upgrade to additional plans if they chose to. Details on each plan type: https://www.tenable.com/support/plans
Support available to third parties: Yes

Onboarding and offboarding

Getting started: There are a range of support and training options provided to help new users. These range from FOC on-demand training and ILT through to professional services onsite; online support portal and customers community forums are also available for knowledge sharing.
Service documentation: Yes
Documentation formats: HTML

PDF

Other
Other documentation formats: CSV

XML
End-of-contract data extraction: Should a customer's account expire or terminate, Tenable will retain the data, as it was at the time of expiration, for no more than 180 days for customers to download their records accordingly. After that time, this data may be deleted and cannot be recovered.
End-of-contract process: Should a customer's account expire or terminate, Tenable will retain the data, as it was at the time of expiration, for no more than 180 days for customers to download their records accordingly. After that time, this data may be deleted and cannot be recovered.

Using the service

Web browser interface: Yes
Supported browsers: Microsoft Edge

Firefox

Chrome

Safari
Application to install: Yes
Compatible operating systems: Linux or Unix

MacOS

Windows

Other
Designed for use on mobile devices: No
Service interface: Yes
User support accessibility: WCAG 2.1 AA or EN 301 549
Description of service interface: User-friendly graphical interface with drill-down capabilities.
Accessibility standards: WCAG 2.1 AA or EN 301 549
Accessibility testing: Detailed response available https://docs.tenable.com/PDFs/legal/508/VPAT_2_4/Tenable_Vulnerability_Management_VPAT_2023-06.pdf
API: Yes
What users can and can't do using the API: Users can easily integrate and automate the sharing of capabilities and vulnerability data, or build on the platform, leveraging a fully documented API set and SDK. There is no extra cost to use these tools to maximize the value of your vulnerability data.
API documentation: Yes
API documentation formats: Open API (also known as Swagger)

HTML

PDF
API sandbox or test environment: Yes
Customisation available: Yes
Description of customisation: Tenable Vulnerability Management has a large number of filtering options available for the purpose of filtering down the resultant vulnerability and configuration data. These filters can be combined in various ways and allows for the organization to quickly filter down to the subset of the data that is pertinent to the task at that time.

Scaling

Independence of resources: Tenable commits to provide 99.95% average uptime with respect to the Cloud Services during each calendar month of the subscription term. http://static.tenable.com/prod_docs/Service_Level_Commitment.pdf Currently (April 2022) Tenable Vulnerability Management utilises AWS autoscaling to provide expansion of the service as required

Analytics

Service usage metrics: Yes
Metrics types: License usage. Further information: https://docs.tenable.com/tenableio/vulnerabilitymanagement/Content/Settings/ViewLicenseInformation.htm
Reporting types: Real-time dashboards

Resellers

Supplier type: Reseller providing extra support
Organisation whose services are being resold: Tenable

Staff security

Staff security clearance: Other security clearance
Government security clearance: Up to Security Clearance (SC)

Asset protection

Knowledge of data storage and processing locations: Yes
Data storage and processing locations: United Kingdom

European Economic Area (EEA)

Other locations
User control over data storage and processing locations: Yes
Datacentre security standards: Managed by a third party
Penetration testing frequency: At least once a year
Penetration testing approach: Another external penetration testing organisation
Protecting data at rest: Other
Other data at rest protection approach: At rest all customer data collected is encrypted using AES-256 encryption.
Data sanitisation process: Yes
Data sanitisation type: Deleted data can’t be directly accessed
Equipment disposal approach: A third-party destruction service

Data importing and exporting

Data export approach: Via the console or via API calls.
Data export formats: CSV

Other
Other data export formats: PDF

HTML

Nessus
Data import formats: Other
Other data import formats: Nessus Scanner

Data-in-transit protection

Data protection between buyer and supplier networks: Other
Other protection between networks: All customer data in motion is encrypted using TLS v1.2 with a 4096-bit key. This includes browser, API and intra-application communication.
Data protection within supplier network: Other
Other protection within supplier network: Tenable Vulnerability Management uses state-of-the-art container technology to create and segregate customer environments. All customer accounts, vulnerability data and user settings are contained within a container uniquely allocated to each specific customer. Data contained within one container cannot leak or otherwise be intermingled with another container, thus ensuring the privacy, security and independence of each customer environment.

Availability and resilience

Guaranteed availability: Tenable commits to provide 99.95% average uptime with respect to the Cloud Services during each calendar month of the subscription term. If in any calendar month this uptime commitment is not met by Tenable and Customer was negatively impacted, Tenable shall provide, as the sole and exclusive remedy for unavailability or performance degradation of the specific Tenable Cloud Services, a service credit.
Approach to resilience: Tenable uses health and status data to detect and address potential issues in a timely manner, thereby maintaining SLA commitments. Tenable Cloud services are replicated both within and across AWS regions. Should both instances in a region fail (or the region suffers an outage in general), the regional-failover layer (usually using dynamic DNS) will instead direct traffic to the other three regions. Failover is closest-path to the traffic origin.
Outage reporting: Tenable Vulnerability Management disaster recovery procedures have several levels and are designed to react to situations that may occur from anywhere between once in five years to once in 50 years. Depending on the scope of the disaster, the recovery procedures vary in time from 60 minutes to 24 hours.

Identity and authentication

User authentication needed: Yes
User authentication: 2-factor authentication

Username or password

Other
Other user authentication: Username and password with optional 2-factor authentication. Multi-factor authentication is either supported by the SAML broker (such as Ping, Duo, etc.), or SMS one-time codes through the built-in integration with Twillo.
Access restrictions in management interfaces and support channels: User accounts are assigned roles that dictate the level of access a user has in Tenable Vulnerability Management. You can change the role of a user account at any time, as well as disable the account.
Access restriction testing frequency: At least once a year
Management access authentication: Other
Description of management access authentication: Granular Role Based Access Controls are used within Tenable Vulnerability Management to control access to different features and functions. User management is restricted to a specific Administrator role.

Audit information for users

Access to user activity audit information: Users contact the support team to get audit information
How long user audit data is stored for: At least 12 months
Access to supplier activity audit information: Users contact the support team to get audit information
How long supplier audit data is stored for: User-defined
How long system logs are stored for: User-defined

Standards and certifications

ISO/IEC 27001 certification: Yes
Who accredited the ISO/IEC 27001: Schellman Compliance, LLc.
ISO/IEC 27001 accreditation date: 12/07/2023
What the ISO/IEC 27001 doesn’t cover: The accreditation is to cover Tenable's ISMS program, which governs all locations worldwide.
ISO 28000:2007 certification: No
CSA STAR certification: No
PCI certification: No
Cyber essentials: No
Cyber essentials plus: No
Other security certifications: No

Security governance

Named board-level person responsible for service security: Yes
Security governance certified: Yes
Security governance standards: Other
Other security governance standards: Tenable's policies were written based on the National Institute of Standards and Technology (NIST) cybersecurity framework, CEB library best practices , SANS institute documents and Tenable's own professional experience. Policies are shared with business units and reviewed during meetings. Once approved, policies are disseminated Policies are reviewed annually.
Information security policies and processes: Tenable's Information Security and associated policies incorporate industry accepted standards and frameworks including ISO 27001, COBIT, NIST 800-53, and CSA.

Operational security

Configuration and change management standard: Supplier-defined controls
Configuration and change management approach: Not all systems require the same amount of development, testing, and approval. Changes to some systems are routine and represent little or no risk. Therefore, to ensure reasonable processing time for routine maintenance and other low risk change requests, and to ensure that more significant, higher impact changes receive the appropriate scrutiny and planning, the following types of changes have been established. These types have corresponding development, testing, and implementation requirements as well as specific approvals necessary to process. Classification of Change Types:
Provisioning
Configuration
Maintenance/ Upkeep
Development (existing)
Development (new)
Vulnerability management type: Supplier-defined controls
Vulnerability management approach: Internal vulnerability assessments are conducted weekly. Vulnerability management assessments include, but are not limited to, workstations, servers, cloud instances, networks, labs, internet-facing services, Tenable products, and third-party products.
Protective monitoring type: Supplier-defined controls
Protective monitoring approach: All application logs, audit logs, syslog, and any other textual logs are captured and transmitted immediately to a 3rd party logging system. Additionally, all changes and actions taken in the AWS consoles are logged using CloudWatch. Alerts are generated when certain actions or conditions are met. Alerts are sent using our alerting and notification system.
Incident management type: Supplier-defined controls
Incident management approach: Notification will be made within 48 hours and not before the initial incident report, containing the basic facts, is completed. Notification will be sent to the data breach contact notification on file. Notification will be by email.

Secure development

Approach to secure software development best practice: Supplier-defined process

Public sector networks

Connection to public sector networks: No

Pricing

Price: £44 an instance a year
Discount for educational organisations: No
Free trial available: Yes
Description of free trial: To obtain a 30-day trail, please use the link below
https://www.tenable.com/products/tenable-io/evaluate

Service documents

Request an accessible format

Cookies on Digital Marketplace

Vulnerability Management - Tenable

Features

Benefits

Pricing

Service documents

Framework

Service ID

Contact

Service scope

User support

Onboarding and offboarding

Using the service

Scaling

Analytics

Resellers

Staff security

Asset protection

Data importing and exporting

Data-in-transit protection

Availability and resilience

Identity and authentication

Audit information for users

Standards and certifications

Security governance

Operational security

Secure development

Public sector networks

Social Value

Pricing

Service documents