MTI Technology Ltd

Palo Alto Networks

(Palo Alto Networks Cortex XSOAR), (Palo Alto Networks Cortex XDR), (Palo Alto Networks Prisma Cloud), (Palo Alto Networks Prisma SaaS), (Palo Alto Networks VM-Series Next-Generation Firewalls).

Palo Alto Networks offers an enterprise cybersecurity platform which provides network security, cloud security, endpoint protection, and various cloud-delivered security services.

Features

• Threat Intelligence Management
• Detection and Response Platform
• Security Orchestration, Automation, and Response
• Dashboards and Reports: Fully customizable dashboards and reports
• Indicator Repository
• Machine Learning
• SaaS platform and application security Risk
• Advanced Threat Prevention
• Security orchestration and automation platform
• VM-Series Virtual Next-Generation Firewalls

Benefits

• Quicker resolution times and better SOC efficiency
• Improved analyst productivity
• Enhanced team learning
• Automated workflows and remediation
• Flexible and scalable deployment
• Cloud-Delivered Security: 99.99% uptime
• Block known-malware and unknown malware
• Enable access and security for unmanaged non-corporate devices
• Detect advanced attacks with analytics
• Speed up resolution times and boost SOC efficiency

£6.14 a unit

• Free trial available

Service documents

• Pricing document

  ODS

• Skills Framework for the Information Age rate card

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at bid@mti.com. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 13

Service ID

847554794947678

Contact

Darren Moyes
01483520200
bid@mti.com

Service scope

• Software add-on or extension: Yes, but can also be used as a standalone service
• What software services is the service an extension to: Prisma Access, Strata NGFW.
• Cloud deployment model: Private cloud
• Service constraints: 25 external SaaS services are currently supported, full details are at https://docs.paloaltonetworks.com/saas-security/saas-security-admin/saas-security-api/get-started-with-saas-security-api/support-on-saas-security-api/supported-saas-applications.
• System requirements: Supported browser

User support

• Email or online ticketing support: Email or online ticketing
• Support response times: All products come with a standard support offering included which entitles the customer to 24x7x365 email, telephone and web support.; A dedicated "Resident Engineer" is available as an additional purchase at $443,000 USD (List Price)
• User can manage status and priority of support tickets: Yes
• Online ticketing support accessibility: WCAG 2.1 AA or EN 301 549
• Phone support: Yes
• Phone support availability: 24 hours, 7 days a week
• Web chat support: Web chat
• Web chat support availability: 24 hours, 7 days a week
• Web chat support accessibility standard: WCAG 2.1 AA or EN 301 549
• Web chat accessibility testing: 24/7 User Portal Access
• Onsite support: Onsite support
• Support levels: All products come with a standard support offering included which entitles the customer to 24x7x365 email, telephone and web support.; A dedicated "Resident Engineer" is available as an additional purchase at $443,000 USD (List Price).
• Support available to third parties: Yes

Onboarding and offboarding

• Getting started: Palo Alto Networks offers on-site training (EDU-210, EDU-214, EDU-220, EDU-330, and more) and online training (EDU-110, EDU-114, EDU-120, etc.).; In addition, publicly accessible user-documentation which details everything from initial setup through to ongoing maintenance & usage and how to use the API.; Professional Services are also available in the form of "Quickstart" packages to rapidly onboard organisations.
• Service documentation: Yes
• Documentation formats:
  • HTML
  • PDF
• End-of-contract data extraction: Cloud data that Palo Alto Networks hold on an organisation/tenant can be exported and deleted by contacting Palo Alto Networks support. If no contact is made data will automatically be purged after 90 days post cessation of the contract(s).
• End-of-contract process: At the end of the contract, if the organisation chooses not to renew and continue with the service all data pertaining to the organisation is deleted. If the organisation chooses to renew then the service continues as normal. 90-days prior to the contract expiration date an initial reminder email is sent, followed up by gradually increasing reminders until the date of expiration.

Using the service

• Web browser interface: Yes
• Supported browsers:
  • Internet Explorer 11
  • Microsoft Edge
  • Firefox
  • Chrome
  • Safari
  • Opera
• Application to install: Yes
• Compatible operating systems:
  • Android
  • IOS
  • Linux or Unix
  • MacOS
  • Windows
  • Windows Phone
  • Other
• Designed for use on mobile devices: No
• Service interface: Yes
• User support accessibility: None or don’t know
• Description of service interface: All features and functionality are primarily delivered through the web interface.; This includes the initial setup, system-configuration, on-boarding and operational functions such as monitoring and reporting.; A role-based access control (RBAC) system is in place to enforce the relevant access and configuration permissions requirements for certain types of individual users or groups.
• Accessibility standards: None or don’t know
• Description of accessibility: The web interface is unique per organisation and is sent to the organisation once the service is setup. ; Once the URL is designated, the interface can be accessed through any modern web browser.
• Accessibility testing: N/A
• API: Yes
• What users can and can't do using the API: The API can be used to interact with and configure, monitor and report on anything that is possible within the web interface.
• API documentation: Yes
• API documentation formats:
  • HTML
  • PDF
• API sandbox or test environment: Yes
• Customisation available: Yes
• Description of customisation: Users can choose what third party SaaS applications are to be monitored, what alerts they are shown, and which of the available third party integrations are to be used.

Scaling

• Independence of resources: Palo Alto Networks through an automated process is constantly evaluating and monitoring the load placed upon the application. Each customers instance is unique so there is no risk of shared resources being fully utilised by another organisation. As load increases the service will automatically bring online additional compute resources to accommodate the additional load.

Analytics

• Service usage metrics: Yes
• Metrics types: Asset details, compliance, policy violations
• Reporting types:
  • API access
  • Real-time dashboards
  • Regular reports
  • Reports on request

Resellers

• Supplier type: Reseller providing extra features and support
• Organisation whose services are being resold: Cyber Security and Data Centre Services.

Staff security

• Staff security clearance: Conforms to BS7858:2019
• Government security clearance: Up to Security Clearance (SC)

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations: United Kingdom
• User control over data storage and processing locations: No
• Datacentre security standards: Complies with a recognised standard (for example CSA CCM version 3.0)
• Penetration testing frequency: At least every 6 months
• Penetration testing approach: ‘IT Health Check’ performed by a CHECK service provider
• Protecting data at rest: Physical access control, complying with SSAE-16 / ISAE 3402
• Data sanitisation process: Yes
• Data sanitisation type: Explicit overwriting of storage before reallocation
• Equipment disposal approach: Complying with a recognised standard, for example CSA CCM v.30, CAS (Sanitisation) or ISO/IEC 27001

Data importing and exporting

• Data export approach: Data from the solution can be exported in CSV format.
• Data export formats: CSV
• Data import formats: CSV

Data-in-transit protection

• Data protection between buyer and supplier networks: Private network or public sector network
• Data protection within supplier network: TLS (version 1.2 or above)

Availability and resilience

• Guaranteed availability: 99.999% Up time.
• Approach to resilience: Multiple Instances, hardware and data centers.
• Outage reporting: Email alerts.

Identity and authentication

• User authentication needed: Yes
• User authentication:
  • 2-factor authentication
  • Public key authentication (including by TLS client certificate)
  • Identity federation with existing provider (for example Google Apps)
  • Limited access network (for example PSN)
  • Dedicated link (for example VPN)
  • Username or password
• Access restrictions in management interfaces and support channels: Restrictions can be implemented by restricting IP addresses able to access the management interface(s). In addition a role-based access control (RBAC) system is in place to further restrict users to user definable configuration views and modes.
• Access restriction testing frequency: At least every 6 months
• Management access authentication:
  • 2-factor authentication
  • Username or password

Audit information for users

• Access to user activity audit information: Users have access to real-time audit information
• How long user audit data is stored for: User-defined
• Access to supplier activity audit information: Users contact the support team to get audit information
• How long supplier audit data is stored for: User-defined
• How long system logs are stored for: User-defined

Standards and certifications

• ISO/IEC 27001 certification: Yes
• Who accredited the ISO/IEC 27001: SGS
• ISO/IEC 27001 accreditation date: 26/12/2012
• What the ISO/IEC 27001 doesn’t cover: N/A
• ISO 28000:2007 certification: No
• CSA STAR certification: No
• PCI certification: No
• Cyber essentials: Yes
• Cyber essentials plus: Yes
• Other security certifications: No

Security governance

• Named board-level person responsible for service security: Yes
• Security governance certified: Yes
• Security governance standards:
  • CSA CCM version 3.0
  • ISO/IEC 27001
• Information security policies and processes: Palo Alto Networks has a formal Enterprise Risk Management program, which includes the performance of an annual risk assessment, with periodic updates, as applicable, to identify and assess key risks and their mitigation approaches. The scope of the program encompasses information security risks and product risks. Our security program consists of a risk-based approach that includes administrative, technical and physical safeguards reasonably designed to protect the confidentiality, integrity and availability of customer data. Palo Alto Network's information security program is aligned to ISO 27001/2, and includes key controls from HIPAA, PCI and SOC2.

Operational security

• Configuration and change management standard: Supplier-defined controls
• Configuration and change management approach: Both Palo Alto Networks and the end-user organisation are in full control of their relevant and respective change control processes.
• Vulnerability management type: Supplier-defined controls
• Vulnerability management approach: Applications and software that collect, transmit or display, or process End User Data, Palo Alto Networks conducts an application security assessment review to identify common security vulnerabilities as identified by industry recognized organizations annually or for all major releases, whichever occurs first. The scope of the security assessment will primarily focus on application security, including, but not limited to, a penetration test of the application, as well as a code review.; ; Palo Alto Networks utilizes a qualified third party to conduct the application security assessments. Palo Alto Networks may conduct the security assessment review directly, following industry standard best practices.
• Protective monitoring type: Supplier-defined controls
• Protective monitoring approach: Applications and software that collect, transmit or display, or process End User Data, Palo Alto Networks conducts an application security assessment review to identify common security vulnerabilities as identified by industry recognized organizations annually or for all major releases, whichever occurs first. The scope of the security assessment will primarily focus on application security, including, but not limited to, a penetration test of the application, as well as a code review.; ; Palo Alto Networks utilizes a qualified third party to conduct the application security assessments. Palo Alto Networks may conduct the security assessment review directly, following industry standard best practices.
• Incident management type: Supplier-defined controls
• Incident management approach: This information is available upon request.

Secure development

• Approach to secure software development best practice: Independent review of processes (for example CESG CPA Build Standard, ISO/IEC 27034, ISO/IEC 27001 or CSA CCM v3.0)

Public sector networks

• Connection to public sector networks: No

Social Value

• Fighting climate change:

  Fighting climate change

  MTI publishes an annual Quality & Environmental (Q&E) Policy statement, which is aligned to its ISO 9001 & ISO 14001 accreditations and the annual EcoVadis CSR review and accreditation. MTI’s Corporate & Social Responsibility policies integrate our business values and operations to meet our strategic objectives and the expectations of our customers, employees, investors, suppliers, the community and the environment. By putting our CSR into practice, we are committed to conducting ourselves responsibly and in an ethical manner, creating a positive and supportive working environment, supporting local communities, improving service levels to customers, acting fairly and collaboratively with suppliers and other third parties, to deliver solutions that support our environmental objectives. Our Environmental Management System, recognised by independent ISO 14001 Environmental Management certification, incorporates our Environmental Policies and Procedures.Demonstrating our commitment to protecting the environment and sustainability. We undergo regular independent audits to demonstrate our commitment to improvement. Our management review programme and CSR and Environmental Reporting, evaluate and demonstrate our environmental achievements, through measurement of impacts as a result of all business activities, monitoring of reduction targets, achievements against objectives & results from our activities, initiatives and environmental commitments. Our FY2022 focus includes; Zero-Carbon Society: we will strive to achieve zero emissions from our own business activities and encourage carbon neutrality within our supply chain. Through comprehensive energy conservation activities and the use of renewable energy, we aim to reducing our carbon footprint and impact on the environment through reduction of contributions to greenhouse gases (GHGs) and annual CO2 emissions, and support supplier commitments; •Partnering with Tier-1 suppliers who are committed to carbon neutrality, evidenced through annual environmental and sustainability assessment •Commitment form partners/product vendors to commit to supplying packaging with a minimum of 50% recycled content (80% Cardboard) or be entirely derived from sustainable sources.
• Covid-19 recovery:

  Covid-19 recovery

  Covid-19 recovery; ; In response to the COVID-19 pandemic, MTI has implemented thorough in-house technology solutions allowing over 90% of our staff to be based at home, including the majority of our service delivery staff. This approach provides greater job opportunities across the region without the potential for geographically disadvantage, and ensures we have skilled staff locally across the UK to deliver our core services. Where MTI are delivering longer-term services to Buyers, MTI is committed to sourcing and utilising local suppliers to provide relevant elements of the service and would support running local supplier days to publicise the delivery and give opportunities for local company involvement. MTI recognises that the COVID-19 pandemic presents challenges for graduate employment and is offering employment opportunities for graduates in order to support local students to progress from higher education into jobs utilising their skills and knowledge.
• Tackling economic inequality:

  Tackling economic inequality

  MTI has invested significantly in developing in house skills and capabilities in order to provide high-class services across a wide range of technologies and disciplines, with emphasis on providing a wide range of professional and managed services. Our Internal Development Programmes and individual development plans ensure that all employees are offered opportunities for learning and development and provides skills training for new employees and existing employees to prepare them for promotions, transfers or new responsibilities. Our development programmes help our employees stretch their capabilities and those of the organisation, upskilling employees through investments in a wide range of skills and product training and development for staff and managers to broaden opportunities. Building a diverse and inclusive workplace has become an imperative part for the all-round growth and development of MTI. Therefore, our HR team takes tangible steps to create a workplace that is committed to diversity and inclusion, including providing career opportunities to support disadvantaged people into the workplace. MTI are registered to the Disability Confident scheme, and have agreed to the Disability Confident commitments to provide interventions to increase employment opportunities and retention for people with a long- term health condition or disability to support these people into employment.
• Equal opportunity:

  Equal opportunity

  We recognise our obligations under the Equality Act 2010, Article 119 of the Treaty of Rome, The Race Relations Act, The Employment Equality (Sexual Orientation) Regulations 2003 and The Employment Equality (Religion or Beliefs) Regulations 2003, and The Codes of Practice published by the Equal Opportunities Commission, the Commission for Racial Equality and the European Commission; We are committed to the principle of equal opportunities in employment. We are opposed to any form of less favourable treatment or financial reward through direct or indirect discrimination, harassment, victimisation to our staff members or job applicants on the grounds of race, religious beliefs, political opinions, creed, colour, ethnic origin, nationality, marital/parental status, sex, sexual orientation, offending past, disability, age, caring responsibilities or social class. We extend protection under this Policy to our suppliers, customers, contractors, and others who are on our premises and in return expect all suppliers, customers, contractors and others to behave in the same way towards our members of staff. This policy is intended to assist the organisation to put this commitment into practice. Compliance with this policy should also ensure that employees do not commit unlawful acts of discrimination. Communicating this policy will be supported by appropriate training, and the effectiveness of this Policy will be monitored on an on-going basis. No form of intimidation, bullying or harassment will be tolerated. Implementation of this policy will be carried out where necessary by invoking the Disciplinary Procedure. Every employee is required to assist the organisation to meet its commitment to provide equal opportunities in employment and avoid unlawful discrimination.
• Wellbeing:

  Wellbeing

  The organisation has developed an employee wellbeing policy to manage its obligations to maintain the mental health and wellbeing of all staff. It covers the organisation's commitment to employee health, the responsibilities of managers and others for maintaining psychological health, health promotion initiatives, communicating and training on health issues, the range of support available for the maintenance of mental health, and organisational commitment to handling individual issues.

Pricing

• Price: £6.14 a unit
• Discount for educational organisations: No
• Free trial available: Yes
• Description of free trial: Palo Alto Networks offers vast amount of trial options that span across the entire product and services range. Depending on the nature of the product or license, 30-60 days is the standard time period for a free trial.
• Link to free trial: https://www.paloaltonetworks.com/vm-series-trial

Service documents

• Pricing document

  ODS

• Skills Framework for the Information Age rate card

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at bid@mti.com. Tell them what format you need. It will help if you say what assistive technology you use.