Azure DevSecOps and IaC Security Enablement (CI/CD hardening)
New Scaler hardens Azure DevOps/GitHub CI/CD pipelines using DevSecOps controls: secure IaC, policy-as-code, secrets management, code and dependency scanning, SBOM, gated releases and audit-ready evidence. We implement secure build/release templates, branch protections, and automated compliance checks aligned to your security baseline.
Features
- CI/CD security baseline and threat modelling for pipelines
- IaC scanning (Terraform/Bicep/ARM) and secure patterns
- Policy-as-code and guardrails (Azure Policy)
- Secrets management (Key Vault), rotation and least privilege
- Code, dependency, container and image scanning
- SBOM generation and vulnerability management workflow
- Gated releases/approvals with evidence and audit trail
- Secure repo standards (branch protections, PR checks)
- Secure build agents/runners and permissions hardening
- Documentation, runbooks and knowledge transfer
Benefits
- Reduced supply-chain and pipeline attack risk
- Faster, safer releases through automated controls
- Improved auditability and compliance evidence
- Consistent secure deployments across teams
- Early detection of vulnerabilities and misconfigurations
- Lower rework and incident remediation cost
- Better segregation of duties and access control
- Stronger operational resilience of delivery process
Pricing
- Education pricing available
Service documents
Request an accessible format
Framework
G-Cloud 15
Service ID
8 3 9 2 1 8 6 8 4 3 3 1 2 2 0
Contact
NEW SCALER LIMITED
Wini Gokhru
Telephone: +44 1628 274306
Email: winig@newscaler.com
About your service
- Service categories
-
Cloud Support Services
Security Services
- Security strategy
- Security risk management
- Security design
- Security incident management
Service scope
- Service constraints
-
Remote delivery by default; onsite by agreement. Buyer provides access to repos, pipelines, tenants and stakeholders. Third-party tools/licences (if required) are buyer-funded unless agreed. Timelines depend on current pipeline maturity and environments.
Remediation may require application/team change windows
Scope changes managed through agreed change control
User support
- Email or online ticketing support
- Yes
- Support response times
- We acknowledge support requests within 1 business day (Mon–Fri, UK business hours). For P1/critical identity incidents, we acknowledge within 4 hours during UK business hours. Weekend/out-of-hours support can be agreed in the call-off contract where required. Requests are logged and tracked internally and status updates are provided by email. Target resolution times depend on severity and scope and are agreed per engagement.
- User can manage status and priority of support tickets
- No
- Phone support
- No
- Web chat support
- No
- Support levels
- Standard (included): Email/online ticketing support during UK business hours (Mon–Fri). Suitable for planned identity change activities and BAU queries. Response and resolution targets are agreed in the Call-Off Contract. Enhanced (optional): Extended hours and priority response for time-critical identity changes (for example evenings/weekends), charged at the agreed out-of-hours rate(s) and confirmed in the call-off. Critical incident (optional): On-call escalation for P1 incidents during agreed migration/cutover periods, charged at the agreed out-of-hours rate(s) and confirmed in the call-off. A named Technical Account Manager/Service Delivery Lead coordinates support, governance and reporting. A Cloud Security/Identity Engineer (and specialist resources where required) provides technical resolution and advice.
Resellers
- Supplier type
- Not a reseller
Staff security
- Staff security clearance
- Other security clearance
- Government security clearance
- Baseline Personnel Security Standard (BPSS)
Pricing
- Discount for educational organisations
- Yes
Architecture roles
| Role level | UK Rate | Offshore Rate |
|---|---|---|
| Enterprise architect | £950.00 | £650.00 |
| Lead enterprise architect | £1,000.00 | £700.00 |
| Principal enterprise architect | £1,000.00 | £700.00 |
| Role level | UK Rate | Offshore Rate |
|---|---|---|
| Security architect | £900.00 | £600.00 |
| Lead security architect | £1,000.00 | £700.00 |
| Principal security architect | £1,100.00 | £800.00 |
| Role level | UK Rate | Offshore Rate |
|---|---|---|
| Technical architect | £700.00 | £500.00 |
| Lead technical architect | £800.00 | £600.00 |
| Principal technical architect | £950.00 | £750.00 |
Non-mandatory Standards and certifications
- ISO/IEC 27001 certification
- No
- ISO 28000:2022 certification
- No
- ISO 9001 certification
- No
- Quality management systems (QMS)
- Yes
- CSA STAR certification
- No
- PCI certification
- No
- Cyber essentials
- Yes
- Please provide your Cyber Essentials Certificate Number
- 4c06cfff-671a-481c-9566-bdc92fc79130
- Cyber essentials plus
- Yes
- Please provide your Cyber Essentials Plus Certificate Number
- 154a0971-4743-4095-a97b-87ba65198d4c
- Other security certifications
- No
Social value
- Section B - Commitment for Future: Delivery
-
-
Mission: Kick start economic growth. To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.
Policy Outcome 1: Fair work: That offers fair wages and good working conditions. Help people get a job, stay in work, and progress in their careers, with good employment opportunities across the country. Notes: Where there is a large proportion of labour costs in the contract, commercial teams should consider MAC in Outcome 1 as a priority
- Measures to support in-work progression to help people in the contract workforce, to move into higher paid work by developing new skills relevant to the contract
- Support for the contract workforce by providing career advice, and providing opportunities for staff working on the contract with in-work progression career development into known skills shortages or high growth areas
- Support for educational attainment relevant to the contract, including training schemes that address skills gaps and result in recognised qualifications
- Volunteering opportunities for staff
-
Mission: Kick start economic growth. To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.
Policy Outcome 2: Skills for growth: Supporting growth sectors and addressing skills gaps.
- Understanding of employment and relevant skills issues, and of the education and training issues relating to the contract. Illustrative examples: demographics, skills shortages, new opportunities in high growth sectors, geographic/local community and skills/employment challenges
- Support for educational attainment relevant to the contract, including training schemes that address skills gaps and result in recognised qualifications
- Activities to support relevant sector related skills growth and sustainability in the contract workforce. Illustrative examples: careers talks, curriculum support, literacy support, safety talks and volunteering
-
Mission: Kick start economic growth. To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.
Policy Outcome 3: Resilient, innovative and flexible supply chains: Support economic growth through enabling resilient businesses, opportunities for small businesses and voluntary, community and social enterprises
- Understanding of the types of businesses in the market and the level of participation by new businesses, entrepreneurs, start-ups, SMEs, VCSEs and mutuals
- Plans for engaging a diverse range of businesses in engagement activities prior to appointing subcontractors (including activities prior to award of the main contract and during the contract term)
- Structuring of the supply chain selection process to ensure fairness (e.g. anti-corruption) and encourages participation by a diverse range of businesses, including with regard to new businesses, entrepreneurs, start-ups, SMEs, VCSEs and mutual
-
Mission: Make Britain a clean energy superpower: To cut bills, create jobs and deliver security with cheaper, zero-carbon electricity by 2030, accelerating to net zero
Policy Outcome 4: Sustainable procurement practices: Reducing carbon footprints, minimising waste, and promoting the use of clean energy and green technologies.
- Understanding of opportunities for additional environmental benefits delivery in the performance of the contract, including working towards net zero carbon emissions and use of clean energy and green technologies
- Delivery of additional environmental benefits through the performance of the contract, including working towards net zero carbon emissions and use of clean energy and green technologies
-
Mission: Build an NHS fit for the future: That is there when people need it; with fewer lives lost to the biggest killers; in a fairer Britain, where everyone lives well for longer.
Policy Outcome 8: Increasing productivity through physical and mental wellbeing: In the supply chain and communities in the relevant area.
- Actions to invest in the physical and mental health and wellbeing of the contract workforce
-