Skip to main content

Beta Help us improve the Digital Marketplace - send your feedback

Entrust Datacard (Europe) Limited

Managed Root CA

Entrust will commission, host and manage your high assurance off-line Root CA using an audited tScheme process. With the Hosted Root CA service you have a solution built to your own policy requirements with full control of your own cryptographic keys, managed from an accredited facility in the UK.

Features

  • High assurance Root CA PKI service
  • Full design and commissioning service
  • Can be built to a customer specific Certificate Policy
  • Fully audited Key Signing Ceremony
  • Root CA cryptographic keys held in FIPs140-2 Level 3 HSM
  • Full backup and recovery facility
  • Standalone offline Root CA managed and assured under tScheme
  • Customer only access to HSM held CA Private Key
  • Will support sub- CA infrastructure on multiple technologie
  • Hosted in a purpose-built UK ISO27001 facility

Benefits

  • A robust root CA that can meet industry standard compliance
  • Reduces business risk by compliance with recognized assured tScheme processes
  • Annual audited assurance process, with customer to validate keys/policy
  • Bespoke design fits your business requirements
  • Built to comply with industry and UK Government standards
  • tScheme and ETSI Certified environment
  • Easy front-end integration with EIDAS for digital signing

Pricing

£19,500 an instance a year

Service documents

Request an accessible format
If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at robert.hann@entrust.com. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 14

Service ID

8 6 8 5 2 1 8 5 8 3 5 6 3 4 5

Contact

Entrust Datacard (Europe) Limited Robert Hann
Telephone: 07818 552411
Email: robert.hann@entrust.com

Service scope

Service constraints
Nil
System requirements
None - the Root CA is offline

User support

Email or online ticketing support
Email or online ticketing
Support response times
Aim to respond to the most severe issues within 1 hour
User can manage status and priority of support tickets
No
Phone support
Yes
Phone support availability
24 hours, 7 days a week
Web chat support
No
Onsite support
Yes, at extra cost
Support levels
All services operate 24x7. The standard support package is 9am - 5pm Monday-Friday (excluding holidays). Other support options are available. A customer service engineer is allocated for each service request.
Support available to third parties
Yes

Onboarding and offboarding

Getting started
Following the Root CA build, there is a Key Signing Ceremony (KSC). This is the event where the protected key material for the CA is created. The Key Signing Ceremony for CAs is conducted at our secure facilities. We provide proven and highly refined documentation for the conduct of the signing ceremony and will orchestrate this carefully planned process.
Service documentation
Yes
Documentation formats
PDF
End-of-contract data extraction
The Root CA can be handed over with proper security procedures.
End-of-contract process
Off Boarding is triggered when if customer wants to migrate the key pair(s), before the keys are naturally due to expire. In this case Entrust can sell the hardware, if usable life remains in it, to the customer at current market rate. In any scenario, we would provide a migration plan supported by our professional services to ensure the process is carried out securely, swiftly and with the least disruption.

Using the service

Web browser interface
No
API
No
Command line interface
No

Scaling

Scaling available
No
Independence of resources
Root CA activities are planned and scheduled well in advance of any critical events
Usage notifications
Yes
Usage reporting
Email

Analytics

Infrastructure or application metrics
No

Resellers

Supplier type
Not a reseller

Staff security

Staff security clearance
Conforms to BS7858:2019
Government security clearance
Up to Developed Vetting (DV)

Asset protection

Knowledge of data storage and processing locations
Yes
Data storage and processing locations
United Kingdom
User control over data storage and processing locations
Yes
Datacentre security standards
Supplier-defined controls
Penetration testing frequency
Never
Protecting data at rest
  • Physical access control, complying with another standard
  • Encryption of all physical media
Data sanitisation process
Yes
Data sanitisation type
  • Explicit overwriting of storage before reallocation
  • Deleted data can’t be directly accessed
  • Hardware containing data is completely destroyed
Equipment disposal approach
A third-party destruction service

Backup and recovery

Backup and recovery
Yes
What’s backed up
  • Backups stored to two geographical locations
  • Root CA backed up to Removable media
Backup controls
Backups are performed at a Key Signing ceremony under two person control, audit conditions, video recorded and records maintained for 7 years after the life of the Root CA
Datacentre setup
Single datacentre with multiple copies
Scheduling backups
Supplier controls the whole backup schedule
Backup recovery
Users contact the support team

Data-in-transit protection

Data protection between buyer and supplier networks
Other
Other protection between networks
No network connectivity. Data in Transit is protected by file level encryption or secure channels such as SFTP
Data protection within supplier network
Other
Other protection within supplier network
Standalone system - no associated network connectivity

Availability and resilience

Guaranteed availability
Not applicable to Root CAs that are offline
Approach to resilience
Multiple Offline Backups are maintained
Outage reporting
Not Applicable

Identity and authentication

User authentication
Other
Other user authentication
Offline Root CA requires Username and password for server management purposes only. Root CA requires quorum of security credentials under multi-person control to access the Root CA Private Keys
Access restrictions in management interfaces and support channels
Not applicable to Root CAs
Access restriction testing frequency
At least every 6 months
Management access authentication
Other
Description of management access authentication
Not applicable to Root CAs
Devices users manage the service through
Dedicated device on a segregated network (providers own provision)

Audit information for users

Access to user activity audit information
Users contact the support team to get audit information
How long user audit data is stored for
At least 12 months
Access to supplier activity audit information
Users contact the support team to get audit information
How long supplier audit data is stored for
At least 12 months
How long system logs are stored for
At least 12 months

Standards and certifications

ISO/IEC 27001 certification
Yes
Who accredited the ISO/IEC 27001
LRQA
ISO/IEC 27001 accreditation date
21/02/2020
What the ISO/IEC 27001 doesn’t cover
All business operations and locations are covered by the scope of the ISO27001:2013 certification
ISO 28000:2007 certification
No
CSA STAR certification
No
PCI certification
No
Cyber essentials
No
Cyber essentials plus
No
Other security certifications
Yes
Any other security certifications
  • TScheme TSd0106_3-01 Approval Profile Certificate Status Management
  • TScheme TSd0104_3-01 Approval Profile Certificate Generation
  • TScheme TSd0105_3-01 Approval Profile Certificate Dissemination
  • TScheme TSd0106_3-01 Approval Profile Certificate Status Management

Security governance

Named board-level person responsible for service security
Yes
Security governance certified
Yes
Security governance standards
  • ISO/IEC 27001
  • Other
Other security governance standards
TScheme
Information security policies and processes
Entrust, with the full commitment of the senior leadership, strongly believes that the fundamental principle to its success in innovation is its information security strategy. This strategy is based on adherence to enterprise-wide world-class governance, a set of controls and strict compliance with National UK Government, financial, international, and industry standards such as:
• ISO 27001
• tScheme
• Cyber Essentials (Managed Root CA out of scope)

Operational security

Configuration and change management standard
Supplier-defined controls
Configuration and change management approach
Configuration is agreed at the initiation of the Root CA and will not typically change through out the life of the CA. Any required changes are with explicit agreement with the Policy Authority
Vulnerability management type
Undisclosed
Vulnerability management approach
Not Applicable - Offline Managed Root CA
Protective monitoring type
Supplier-defined controls
Protective monitoring approach
A Root CA is offline so security controls are based on physical access and multi-person controls. A customer's Root CA can only be brought up with their attendance. Audit logs are maintained in accordance with the Certificate Policy and tScheme compliance. All records are retained for 7 years after the life of the CA
Incident management type
Supplier-defined controls
Incident management approach
Our Incident Management policy and procedures follows best practice as required by ISO27001:2013. Examples of incidents and events are defined and subsequent actions are designed into security incident responses.
Users report incidents either by telephone, email or directly to managers or the Security Manager. All incidents are recorded in the Service Desk system and coordinated through to closure by the investigating body.
Incident reports are generated upon completed investigation and these are shared with interested parties under NDA, as required contractually, legally, regulatory. All incidents are reported to the Security Management Forum and subsequently to the Board

Secure development

Approach to secure software development best practice
Conforms to a recognised standard, but self-assessed

Separation between users

Virtualisation technology used to keep applications and users sharing the same infrastructure apart
No

Energy efficiency

Energy-efficient datacentres
No

Social Value

Social Value

Social Value

  • Fighting climate change
  • Tackling economic inequality
  • Equal opportunity
  • Wellbeing

Fighting climate change

Environment – Our goal is to manage our manufacturing, warehousing, distribution, and office facilities to minimize ecological impact. Entrust maintains an ISO 14001 certification at its headquarters and principal manufacturing facility and is working to set organizational carbon reduction goals to achieve net zero carbon emissions by 2050. We also comply with important environmental measures such as REACH, RoHS, and Proposition 65 where applicable to our business.

Tackling economic inequality

Diversity, Equity and Inclusion – Entrust has established concrete goals to build a more diverse workplace and supplier base. We actively promote an inclusive and welcoming culture across our business through our Entrust Includes initiative and we look for suppliers that embrace similar values through our formalized supplier diversity program.

Equal opportunity

Diversity, Equity and Inclusion – Entrust has established concrete goals to build a more diverse workplace and supplier base. We actively promote an inclusive and welcoming culture across our business through our Entrust Includes initiative and we look for suppliers that embrace similar values through our formalized supplier diversity program.

Wellbeing

Diversity, Equity and Inclusion – Entrust has established concrete goals to build a more diverse workplace and supplier base. We actively promote an inclusive and welcoming culture across our business through our Entrust Includes initiative and we look for suppliers that embrace similar values through our formalized supplier diversity program.

Pricing

Price
£19,500 an instance a year
Discount for educational organisations
No
Free trial available
No

Service documents

Request an accessible format
If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at robert.hann@entrust.com. Tell them what format you need. It will help if you say what assistive technology you use.