Phoenix Software Ltd

Zscaler for users

Fast, secure, and reliable access to applications and the internet from anywhere. Policy-based, secure access to private applications and assets without the cost, or security risks of a VPN. Users get all of the benefits of marketing-leading Internet Security platform+granular, policy-based access to internal resources from a single point.

Features

• ecure private application access, without exposing applications to the Internet
• Decouples private internal applications from the physical network
• No VPN client to launch, or exit
• Global visibility for users and applications
• Single console for policy definition and management
• Secure Web Gateway - on any device, in any location
• URL and Content Filtering - with granular policy rules
• Cloud Sandboxing - Protection against Advanced Persistent Threats (APTs)
• Easily scale Data Loss Prevention (DLP) to all users
• Quickly and easily scale protection to all offices or users

Benefits

• Secure internet access, including roaming users and mobile devices
• No hardware or software to purchase and administer, reduces expenses
• Eliminate backhauling data for fast experience with Office 365
• Over 120,000 security updates/day - unrivalled intelligence
• Integrated Sandboxing, Cloud Firewall, URL Content Filtering, DLP, CASBs
• SSL inspection stops threats, data leaks in encrypted traffic
• No need to buy excess capacity— Zscaler cloud scales elastically
• Users get application access without network access
• Users only see apps/resources they are authorised to access
• No need to buy, maintain, or upgrade VPN hardware

£225 a user

• Education pricing available
• Free trial available

Service documents

• Pricing document

  PDF

• Skills Framework for the Information Age rate card

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at ccs@phoenixs.co.uk. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 14

Service ID

866144791536380

Contact

Jonny Scott
01904 562200
ccs@phoenixs.co.uk

Service scope

• Software add-on or extension: No
• Cloud deployment model: Private cloud
• Service constraints: There are no operational constraints to the service
• System requirements:
  • For offices, set-up a GRE/IPsec router-tunnel to the closest Zscaler-DC
  • For mobile employees, forward traffic via the ZscalerApp or PACfile

User support

• Email or online ticketing support: Email or online ticketing
• Support response times: Response time will be dependent on severity, 30 minutes for P1, 1hr for P2, 3hrs for P3 and 4hrs for P4.
• User can manage status and priority of support tickets: Yes
• Online ticketing support accessibility: None or don’t know
• Phone support: Yes
• Phone support availability: 24 hours, 7 days a week
• Web chat support: No
• Onsite support: Yes, at extra cost
• Support levels: Our support options can be found here - https://www.zscaler.com/legal/sla-support
• Support available to third parties: Yes

Onboarding and offboarding

• Getting started: "Documentation on deployment guides, help portals can be found on Zscaler Help: https://help.zscaler.com/; All online training can be accessed by Zscaler Academy: https://www.zscaler.com/zscaler-academy"
• Service documentation: Yes
• Documentation formats: PDF
• End-of-contract data extraction: The reports here give different options to extract data from the tenants: https://help.zscaler.com/zia/dashboard-analytics/reports
• End-of-contract process: Data generated by the use of the service can be streamed directly in real time to the customer. If, at the end of contract, the customer requests all data, 6 months will be made available.

Using the service

• Web browser interface: Yes
• Supported browsers:
  • Microsoft Edge
  • Firefox
  • Chrome
• Application to install: Yes
• Compatible operating systems:
  • MacOS
  • Windows
• Designed for use on mobile devices: Yes
• Differences between the mobile and desktop service: None
• Service interface: No
• User support accessibility: None or don’t know
• API: Yes
• What users can and can't do using the API: API is available on request, documentation can be found at https://help.zscaler.com/zia/api
• API documentation: Yes
• API documentation formats: HTML
• API sandbox or test environment: Yes
• Customisation available: Yes
• Description of customisation: Administrators can customise all policies to manage and control users. Acceptable use policy prompts and user messaging frameworks can be highly customised.

Scaling

• Independence of resources: "Zscaler has architected its platform from scratch in order to create a solution that is unparalleled in its scalability.; ; All ZIA Public Service Edges use multi-core architecture to intelligently load-balance tasks within the Public Service Edge. As a result, there is no need for any external load balancing. This inherent scalability differentiates our solution in its ability to provide the service at a unique price point and also have points of presence in numerous locations across the world.

Analytics

• Service usage metrics: Yes
• Metrics types: Service usage, threats detected and stopped, types of threats blocked, Bandwidth, SSL inspedction, license usage, latency, top cloud applications,traffic volume trends, Office365 usage, potential sensitive files being uploaded and more. Please note these will be reviewed during QBR sessions but are accessible as a powerpoint presentation for your own assesment and playback within the organisation.
• Reporting types:
  • API access
  • Real-time dashboards

Resellers

• Supplier type: Reseller (no extras)
• Organisation whose services are being resold: Zscaler

Staff security

• Staff security clearance: Other security clearance
• Government security clearance: None

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations:
  • United Kingdom
  • European Economic Area (EEA)
• User control over data storage and processing locations: Yes
• Datacentre security standards: Supplier-defined controls
• Penetration testing frequency: At least every 6 months
• Penetration testing approach: In-house
• Protecting data at rest: Other
• Other data at rest protection approach: "Zscaler leverages a full proxy architecture and is built to ensure data is not written to disk to maintain the highest level of data security. Data is scanned in random access memory (RAM) and then erased. Log data generated for every transaction is compressed, tokenized, and exported over secure TLS connections to Log Routers that direct the logs to Zscaler's logging module, hosted in the appropriate geographical region for each buyer. ; "
• Data sanitisation process: Yes
• Data sanitisation type:
  • Explicit overwriting of storage before reallocation
  • Deleted data can’t be directly accessed
• Equipment disposal approach: A third-party destruction service

Data importing and exporting

• Data export approach: With Zscaler Internet Access (ZIA), you can download data in CSV format, for any specified date/time range, within theavailable 6-month window. Audit Logs can also be retrieved via API, enabling easy integration to SIEM and third-party auditing tools. To learn more, see: https://help.zscaler.com/zia/audit-log-use-cases
• Data export formats: CSV
• Data import formats: CSV

Data-in-transit protection

• Data protection between buyer and supplier networks:
  • TLS (version 1.2 or above)
  • Other
• Other protection between networks: As Zscaler is an overlay network, traffic is likely already encrypted between the user and Zscaler. By default, traffic between the users network and the buyer's network is encrypted using TLS tunnels when utilizing the Zscaler service. Management access is always encrypted with TLS 1.2
• Data protection within supplier network: TLS (version 1.2 or above)

Availability and resilience

• Guaranteed availability: 99.999%, assured by contractual commitment
• Approach to resilience: Each Zscaler cloud has three key components - the Central Authority, Zscaler Enforcement Nodes and Nanolog clusters. The CA consists of one active server and two in passive standby mode. The active CA replicates data in real time to the two standby CAs, so any of them can become active at any time and each is hosted in separate locations. Zscaler Enforcement Nodes are inline Internet security gateways inspecting Internet traffic bi-directionally for malware and enforce security and compliance policies. When a user moves to a different location, the nearest Node downloads and enforces the appropriate policy for that user.
• Outage reporting: Zscaler monitors its cloud through proprietary monitoring systems and 3rd parties. Live stats and alerts are available here 24/7: https://trust.zscloud.net/

Identity and authentication

• User authentication needed: Yes
• User authentication:
  • 2-factor authentication
  • Public key authentication (including by TLS client certificate)
  • Identity federation with existing provider (for example Google Apps)
  • Username or password
• Access restrictions in management interfaces and support channels: "Management access is restricted per login and further with orchestrated access via individual accounts.; ; Support access is federated via vendor support and live chat."
• Access restriction testing frequency: At least every 6 months
• Management access authentication:
  • Dedicated link (for example VPN)
  • Username or password

Audit information for users

• Access to user activity audit information: Users have access to real-time audit information
• How long user audit data is stored for: User-defined
• Access to supplier activity audit information: No audit information available
• How long system logs are stored for: User-defined

Standards and certifications

• ISO/IEC 27001 certification: Yes
• Who accredited the ISO/IEC 27001: Schellman Compliance, LLC
• ISO/IEC 27001 accreditation date: 10/05/2023
• What the ISO/IEC 27001 doesn’t cover: No ISO/IEC 27001 control activities have been excluded from the scope of Zscaler’s ISMS and PIMS.
• ISO 28000:2007 certification: No
• CSA STAR certification: Yes
• CSA STAR accreditation date: 31/07/2023
• CSA STAR certification level: Level 2: CSA STAR Attestation
• What the CSA STAR doesn’t cover: No CSA STAR control activities have been excluded from the scope of Zscaler’s ISMS and PIMS.
• PCI certification: No
• Cyber essentials: Yes
• Cyber essentials plus: Yes
• Other security certifications: Yes
• Any other security certifications: SOC2 Type 2 / SOC3 Type 2

Security governance

• Named board-level person responsible for service security: Yes
• Security governance certified: Yes
• Security governance standards: ISO/IEC 27001
• Information security policies and processes: "Many certifications including ISO27001/2, CSA Star, SOC 2 Type II, Cyber Essentials; More certification information can be found here - https://www.zscaler.com/compliance/overview"

Operational security

• Configuration and change management standard: Supplier-defined controls
• Configuration and change management approach: "Zscaler has a documented Change Management Policy that ensures any changes are made in accordance with best practices and in alignment with our organization's commitments regarding security and compliance frameworks. We also have a documented Change Management procedure that serves to provide instruction and requirements for the changes to Zscaler production services in order to ensure its continued availability and integrity. Any changes to Zscaler systems must follow this procedure, which falls under our ISO 27001 certification.
• Vulnerability management type: Supplier-defined controls
• Vulnerability management approach: Zscaler has a documented Security Audit and Vulnerability Management procedure, created in accordance with our ISO 27001 certification, that provides instructions for conducting security audits/vulnerability testing, evaluating information system technical vulnerability results, and remediating technical vulnerabilities or implementing appropriate measures to address associated risk. Zscaler has a full suite of policies audited by external auditors annually for compliance with SOC 2 Type II, ISO 27001, ISO 27701, ISO 27017, ISO 27018, CSA Star, and other major global frameworks, which can be reviewed on our public-facing compliance we page at: https://www.zscaler.com/compliance/overview
• Protective monitoring type: Supplier-defined controls
• Protective monitoring approach: Zscaler monitors the daily business and operational activities, including the internal control environment, as a routine part of business. Zscaler has implemented a set of logging and monitoring tools that are configured to collect data from system infrastructure components to monitor system performance, potential security threats and vulnerabilities, resource utilization and alert IT operations upon detection of unusual system activity or service requests. The in-scope systems are monitored using enterprise monitoring applications that track system performance, responsiveness, availability and vulnerabilities.
• Incident management type: Supplier-defined controls
• Incident management approach: Zscaler has an Incident Response Plan (IRP) in place to ensure that we are prepared to manage cyber incidents in an effective and efficient manner and respond accordingly. The IRP identifies the structure, roles and responsibilities, types of common incidents, and the approach to preparing, identifying, containing, eradicating, recovering, and conducting lessons learned to minimize the impact of security incidents. Our Management team has defined the following types of incidents:; • Support Incidents: Customer-related incidents; • Security Incidents: These may include security weaknesses, Acceptable Use Policy (“AUP”) violations, suspected and actual data security breaches, or incidents resulting from vulnerability scans

Secure development

• Approach to secure software development best practice: Supplier-defined process

Public sector networks

• Connection to public sector networks: Yes
• Connected networks: Other
• Other public sector networks: Any network being a Cloud based SaaS platform

Social Value

• Social Value:

  Social Value

  • Fighting climate change
  • Covid-19 recovery
  • Tackling economic inequality
  • Equal opportunity
  • Wellbeing

  Fighting climate change

  Fighting climate change ; Effective stewardship of the environment with activities that deliver additional environmental benefits in the performance of the contract including working towards net zero greenhouse gas emissions. ; We can support customers environmental goals by providing annual carbon emissions on contract and reduction plans.; ; We will run free of charge sustainability infrastructure reviews for customers to understand how they can reduce carbon emissions of their IT services. ; ; We are working towards 2040 Net-Zero GreenHouseGas emissions. ; Since 2021 we have been Carbon Neutral with Gold Standard Certified carbon credits - partner Ecologi.; By 2026 we aimed to reduce Scope 1 and 2 emissions by 50% from a 20/21 baseline year and which we have now achieved.; By 2030 we aim to reduce all of our emissions (including Scope 3) by 50% this is from a 22/23 baseline year.; ; Achievement of 2030 50% reduction targets (based on last FY) would mean a minimum carbon reduction of 142tCO2e per year for the public sector. ; ; We record and monitor our usage/ conversion to carbon emissions monthly and progress is published annually on the website in accordance with PPN06/21 and SECR guidelines. We are ISO14001 certified, and our targets are currently being verified by SBTi.; ; Overall, the business:; -Generates solar energy (85%) with REGO renewable purchased energy.; -Zero waste to landfill waste management; -Minimises travel emissions by 60%; -Uses water wisely – reduced by 15%; ; Influence staff, suppliers, customers and communities through the delivery of the contract to support environmental protection and improvement. ; ; We work hard to influence others and change behaviours to help fight climate change. ; ; Workforce:; -Sustainability inductions; -Sustainability training ; -Staff campaigns ; -Volunteering opportunities ; -Family woodland tree planting; ; Suppliers:; -Supply-chain reviews ; -Sustainability training; -Blogs/ media content ; -Sustainability training ; ; Customers: ; -Sustainability Infrastructure Review; -Hardware Carbon-Assessments; -Circular-Economy support; -Sustainability training

  Covid-19 recovery

  COVID-19 ; Help local communities to manage and recover from the impact of COVID-19 with activities in the delivery of the contract which: ; Create employment, re-training and other return to work opportunities for those left unemployed by COVID-19, particularly new opportunities in high growth sectors. ; - Phoenix Employability Outreach Programme - Unique access to Microsoft Career Essentials programme; Support organisations and businesses to manage and recover from the impacts of COVID-19, including where new ways of working are needed to deliver services. ; -Phoenix Small Business Digital Skills Outreach programme – webinars supporting cyber security, accessibility and licensing.; -Phoenix VCSE Digital Skills Outreach Programme – webinars supporting cyber security, accessibility and licensing.; Support the physical and mental health of people affected by COVID-19, including reducing the demand on health and care services.; -Phoenix Digital Skills Outreach Programme – Supporting people to access services services online e.g NHS app and Banking apps. ; Examples of our working with London and Quadrant Housing Association to deliver befriending calls for tenants who were lonely and isolated as a result of Covid19.; We have also worked with Liverpool City Council to promote employability courses to those left unemployed by Covid-19 and who are now in employment.; We provided free of charge IT service desk to 15 charities during the pandemic and have worked closely with them to support them with returning to full operation again.

  Tackling economic inequality

  Tackling economic inequality ; Create new businesses, new jobs and new skills with activities that, in the delivery of the contract: ; Create opportunities for entrepreneurship and help new, small organisations to grow, supporting economic growth and business creation.; -60% of our supply chain are SME’s; -We are signatories and adhere to the Prompt Payment Code; -Host Dragons Den SME supply chain sessions for new suppliers to showcase their services for our customers.; Create employment opportunities particularly for those who face barriers to employment and/or who are located in deprived areas. ; - The Phoenix Employability Outreach Programme provide unique access to Microsoft Career Essentials digital literacy programme, career talks and employability advice.; Create employment and training opportunities, particularly for people in industries with known skills shortages or in high growth sectors. ; -Graduate work placements; -Phoenix Employability Outreach Programme - Unique access to Microsoft Career Essentials programme for certifications to skill up for roles in the IT sector.; -We work with our supply-chain to create job roles with shared apprenticeship heads and promotion to permanent employment.; Support educational attainment relevant to the contract, including training schemes that address skills gaps and result in recognised qualifications. ; -Apprenticeships whereby we aim for c.10 graduating apprentices and all are moved into permanent employment with Phoenix.; -Skills City Bootcamp where we deliver career talks and provide projects to 19+ year olds seeking to upskill for employment in the technology sector.; Influence staff, suppliers, customers and communities through the delivery of the contract to support employment and skills opportunities in high growth sectors.; -Our programmes are delivered in partnership with our customers, supply chain and workforce, including Career talks, mentoring and IT challenge activities.

  Equal opportunity

  Equal opportunity ; Reduce the disability employment gap with activities that: ; Demonstrate action to increase the representation of disabled people in the contract workforce. ; -We are certified Disability Confident Employers (level 2).; -We provide Digital Accessibility training for all staff so we can communicate with each other and our customers in an inclusive manner.; -We are exploring the use of the Voluntary Reporting Framework for understanding the disability makeup of the workforce.; Tackling workforce inequalities with activities that demonstrate action to identify and tackle inequality in employment, skills and pay in the contract workforce. ; - We focus on ensuring an inclusive and unbiased recruitment strategy, with unconscious-bias training, blind recruitment processes, and reviewing language and placement of advertisements. ; ; -All staff trained receive mandatory EDI training annually.; ; Various initiatives include ; -Signatories of the Race at Work Charter, ; -Disability Confident Committed Employer ; -Signatories of the Armed Forces Covenant; -Gender-Neutral toilets; -Prayer room; -Milk-pumping room; -Sponsor York Pride; -We have specific policies for Menopause, and LGBTQ+. ; -We have established an Accessibility-Centre-of-Excellence to display the latest technology ; -We monitor our workforce statistics and report on them:; Gender 65% male /35% female (industry-average 20%); Ethnicity 5.6% (local-area 3.9%); Staff turnover 12.3% (industry-average 13.2%); Using the Voluntary Reporting Framework, we are working on what and how we can report metrics around disabled people in the workforce, including those with hidden disabilities. ; ; We have been recertified as a Great Place to Work™ and UK's Best Workplaces™ for Women.

  Wellbeing

  Wellbeing ; The mental health and well-being (MHWB) of our staff is of the utmost importance to us and our MHWB Policy aims to provide a working environment that promotes and supports the MHWB of all employees. ; Activities that demonstrate action to support the health and wellbeing, including physical and mental health, in the contract workforce at Phoenix include: ; -We utilise different resources not least those from Mental Health at Work Commitment, NHS Every Mind Matters, and the MIND employer toolkit to improve our employee MHWB programme. ; -All our staff heavily discounted private health insurance includes mental wellness. Plan members access a range of health treatments including face to face counselling and cognitive behaviour therapy. ; -Phoenix invests in the St Johns Ambulance Mental Health First Aid training course to ensure we have MH first aiders in the business and the skills to address MH in the workplace. ; -The new challenges the pandemic has raised, on our employee’s MHWB, has led to the creation of a staff network group who meet monthly, to ensure that all we do and say truly covers all aspects of MHWB. ; -All employees are given a monthly wellbeing hour to take for their own personal time and are also supported with monthly tea and toast sessions discussing and normalising MHWB topics.; ; We influence staff, suppliers, customers and communities through the delivery of the contract to support health and wellbeing, including physical and mental health.; -We provide Digital Accessibility training for all staff so we can communicate with each other and our customers in an inclusive manner.; -We have established an Accessibility-Centre-of-Excellence to display the latest technology to the workforce, supply chain and our customers; -We deliver digital accessibility training to customers; -We are sponsors of the Neurodiversity Awards

Pricing

• Price: £225 a user
• Discount for educational organisations: Yes
• Free trial available: Yes
• Description of free trial: Full product on qualified 30-day proof-of-concept trial. When organisations satisfy themselves that the product functions as specified, they usually proceed to purchase and the PoC trial is simply switched to production and the full production user-load added.
• Link to free trial: https://help.zscaler.com/zcspm/free-trial

Service documents

• Pricing document

  PDF

• Skills Framework for the Information Age rate card

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at ccs@phoenixs.co.uk. Tell them what format you need. It will help if you say what assistive technology you use.