INTEGRITY360 LIMITED

Orca Security CNAPP

Orca Security is the leading agentless CNAPP that allows security teams to work smarter, not harder. Designed for organizations operating in the cloud who need complete, centralized visibility of their entire cloud estate and focus on remediating the actual risks that matter most.

Features

Cloud Native Application Protection
Cloud Workload Protection
Container and Kubernetes Security
Cloud Detection & Response
Cloud Security Posture Management
Cloud Infrastructure Entitlement Management
Shift Left Security
Multi-Cloud Compliance
API Security
Data Security and Posture Management

Benefits

CNAPP-Secure cloud-native applications with a purpose-built platform,
CWPP-Protect VMs, containers, server-less-functions
Container Security-Scalable security for containers/Kubernetes for every cloud layer,
CDR-24x7 monitoring/response across entire cloud attack-surface
CSPM-Identify/remediate misconfigurations across clouds
CIEM-Secure cloud identities and entitlements
Shift Left Security-Secure cloud-native apps across SDLC
Multi-Cloud Compliance-Achieve regulatory compliance with frameworks, benchmarks, custom checks
API Security-Complete API discovery, security-posture management, drift detection,
DSPM-Reduce the risk of data breaches and protect sensitive PII

£20 a unit

Education pricing available
Free trial available

Service documents

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at bidreviewboard@integrity360.com. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 14

Service ID

Contact

INTEGRITY360 LIMITED Paul Momirovski
Telephone: +44 20 3397 3414
Email: bidreviewboard@integrity360.com

Service scope

Software add-on or extension: No
Cloud deployment model: Public cloud
Service constraints: Primary Cloud Service Provider support - AWS, Azure, GCP, Alibaba Cloud, Oracle Cloud
System requirements: None, does not install Agent software

User support

Email or online ticketing support: Email or online ticketing
Support response times: Standard - Basic support coverage, 5 business days per week for 9 hours a day. This includes customer support portal access, documentation access, and chat support.
Elite - Enhanced support coverage, seven days a week for 24 hours a day. This includes phone support, a dedicated Slack channel, faster response times, assigned CSM and CSE, monthly check-in calls, feature release and roadmap sessions, and feature request tracking.
Diamond -Enhanced support coverage, 7 days a week for 24 hours a day. Includes a dedicated support engineer, threat analysis, fastest response times, and an executive sponsorship.
User can manage status and priority of support tickets: Yes
Online ticketing support accessibility: WCAG 2.1 AA or EN 301 549
Phone support: Yes
Phone support availability: 9 to 5 (UK time), 7 days a week
Web chat support: Web chat
Web chat support availability: 24 hours, 7 days a week
Web chat support accessibility standard: WCAG 2.1 AA or EN 301 549
Web chat accessibility testing: No testing
Onsite support: Yes, at extra cost
Support levels: Standard - Basic support coverage, 5 business days per week for 9 hours a day. This includes customer support portal access, documentation access, and chat support.
Elite - Enhanced support coverage, seven days a week for 24 hours a day. This includes phone support, a dedicated Slack channel, faster response times, assigned CSM and CSE, monthly check-in calls, feature release and roadmap sessions, and feature request tracking.
Diamond -Enhanced support coverage, 7 days a week for 24 hours a day. Includes a dedicated support engineer, threat analysis, fastest response times, and an executive sponsorship.
Support available to third parties: Yes

Onboarding and offboarding

Getting started: Training, Documentation
Service documentation: Yes
Documentation formats: HTML

PDF

Other
Other documentation formats: Web Access directly
End-of-contract data extraction: Should the customer like to retrieve any data from their Orca tenant, they should do so before the expiration of the contract as access is terminated immediately.
End-of-contract process: Following the expiration of the contract, we will maintain the customer tenant and associated data for a period of 60 days after which the data will be purged

Using the service

Web browser interface: Yes
Supported browsers: Microsoft Edge

Firefox

Chrome

Safari

Opera
Application to install: No
Designed for use on mobile devices: No
Service interface: Yes
User support accessibility: WCAG 2.1 AA or EN 301 549
Description of service interface: API as addition
Accessibility standards: WCAG 2.1 AA or EN 301 549
Accessibility testing: N/A
API: Yes
What users can and can't do using the API: Many platform functions available via API. Full documentation available. Throttle limits include:-

For the following query type values:
assets, alerts, inventory, logs, cves, stats, top_alerts, scheme, asset_map

o api_query_organization - All users can make 30000 API /query/{query_type} per 1 day.
o api_query_user - Each user can make 30000 API /query/{query_type} per 1 day.
o api_query_default - Each IP can make 30000 API calls per each API /query/{query_type} per 1 day.

For the Sonar query:
o api_query_organization - All users can make 100 API /sonar/query per 1 minute.
API documentation: Yes
API documentation formats: Open API (also known as Swagger)

HTML

PDF
API sandbox or test environment: Yes
Customisation available: Yes
Description of customisation: Accounts to be connected, auto-remediation availablity and type, integrations with external platforms, reports type and frequency, API integration for automation

Scaling

Independence of resources: Auto-scaling on AWS backend, robust config and sizing constraints. Global regions for service continuation.

Analytics

Service usage metrics: Yes
Metrics types: Number of active instances, serverless functions, images, containers etc.
Reporting types: API access

Real-time dashboards

Regular reports

Reports on request

Resellers

Supplier type: Reseller providing extra support
Organisation whose services are being resold: Orca Security

Staff security

Staff security clearance: Conforms to BS7858:2019
Government security clearance: Up to Security Clearance (SC)

Asset protection

Knowledge of data storage and processing locations: Yes
Data storage and processing locations: European Economic Area (EEA)

Other locations
User control over data storage and processing locations: Yes
Datacentre security standards: Complies with a recognised standard (for example CSA CCM version 3.0)
Penetration testing frequency: At least once a year
Penetration testing approach: Another external penetration testing organisation
Protecting data at rest: Physical access control, complying with CSA CCM v3.0
Data sanitisation process: Yes
Data sanitisation type: Explicit overwriting of storage before reallocation

Deleted data can’t be directly accessed
Equipment disposal approach: Complying with a recognised standard, for example CSA CCM v.30, CAS (Sanitisation) or ISO/IEC 27001

Data importing and exporting

Data export approach: Reports, API
Data export formats: CSV

Other
Other data export formats: API
Data import formats: CSV

Other
Other data import formats: API

Data-in-transit protection

Data protection between buyer and supplier networks: TLS (version 1.2 or above)

Other
Other protection between networks: All of Orca's communications at transit external or internal are done via secure and encrypted channels using TLS 1.2 and above.
Data protection within supplier network: TLS (version 1.2 or above)

Other
Other protection within supplier network: All of Orca's communications at transit external or internal are done via secure and encrypted channels using TLS 1.2 and above.

Availability and resilience

Guaranteed availability: 99.9 - available in realtime here:- https://status.orcasecurity.io/
Approach to resilience: AWS Datacenters:- https://aws.amazon.com/compliance/data-center/controls/
Outage reporting: Public Dashboard

Identity and authentication

User authentication needed: Yes
User authentication: 2-factor authentication

Identity federation with existing provider (for example Google Apps)

Other
Other user authentication: All access for Web UI is 2-factor or federated. Web UI then used for management, onboarding etc. For API access, users be authorized to make API calls using authentication from your Orca session.
Access restrictions in management interfaces and support channels: By default, Orca Security's support team and engineers have access to your Orca tenant. This allows quick and effective support when needed. You can deny this access at any time.
Access restriction testing frequency: At least once a year
Management access authentication: 2-factor authentication

Identity federation with existing provider (for example Google Apps)

Other
Description of management access authentication: All access for Web UI is 2-factor or federated. Web UI then used for management, onboarding etc. For API access, users be authorized to make API calls using authentication from your Orca session.

Audit information for users

Access to user activity audit information: Users have access to real-time audit information
How long user audit data is stored for: Between 1 month and 6 months
Access to supplier activity audit information: Users have access to real-time audit information
How long supplier audit data is stored for: Between 1 month and 6 months
How long system logs are stored for: Between 1 month and 6 months

Standards and certifications

ISO/IEC 27001 certification: Yes
Who accredited the ISO/IEC 27001: THE STANDARDS INSTITUTION OF ISRAEL
ISO/IEC 27001 accreditation date: 29/01/2023
What the ISO/IEC 27001 doesn’t cover: N/A
ISO 28000:2007 certification: No
CSA STAR certification: Yes
CSA STAR accreditation date: 29/5/2023
CSA STAR certification level: Level 1: CSA STAR Self-Assessment
What the CSA STAR doesn’t cover: N/A
PCI certification: No
Cyber essentials: No
Cyber essentials plus: No
Other security certifications: Yes
Any other security certifications: SOC2. Full details on all security accreditations available on the

Orca Security Trust Center:- https://trustcenter.orca.security/

Security governance

Named board-level person responsible for service security: Yes
Security governance certified: Yes
Security governance standards: ISO/IEC 27001
Information security policies and processes: All available in Orca Security Trust Center:- https://trustcenter.orca.security/

Operational security

Configuration and change management standard: Conforms to a recognised standard, for example CSA CCM v3.0 or SSAE-16 / ISAE 3402
Configuration and change management approach: All changes, such as architectural/physical changes, shall go through a set process outlined as follows:- • Change request-a request is submitted to the asset owner with the change, objectives, potential impacts on information security • Risk assessment-The asset-owner performs risk assessments to identify potential security risks associated with the change. • Approval-Once both the change and its impacts are understood, the change receives approval from the asset owner • Implementation-Approved changes are implemented and tested for effectiveness • Monitoring - The changed asset shall be monitored continuously to ensure that it meets its objectives and does not introduce new risks.
Vulnerability management type: Conforms to a recognised standard, for example CSA CCM v3.0 or SSAE-16 / ISAE 3402
Vulnerability management approach: Orca scans on daily basis in order to detect any applicable patches and we perform the patch in accordance with the applicable SLA by our Devops team
Protective monitoring type: Conforms to a recognised standard, for example CSA CCM v3.0 or SSAE-16 / ISAE 3402
Protective monitoring approach: Orca uses a suite of monitoring tools to monitor its service. The production environment, including the servers/application, is monitored by the Operation Team. Key Orca personnel are notified of events related to the security, availability, confidentiality of service to clients. To improve service availability to clients and support the operations of Orca Security environments, Orca Security maintains a dedicated DevOps team. The production environment, including the servers and application, is monitored by the DevOps team. Actions performed on the production environment, including OS, DB and application are monitored, logged and reviewed. Alerts are triggered upon the identification of an anomaly.
Incident management type: Conforms to a recognised standard, for example, CSA CCM v3.0 or ISO/IEC 27035:2011 or SSAE-16 / ISAE 3402
Incident management approach: Orca has a security incident response management policy. Identified incidents are managed and tracked in Jira tickets up to resolution. Incidents are classified according to the level of urgency and importance. Resources are allocated in order to investigate the incident and resolve the issue. The CISO is responsible for escalating critical incidents and performing Lesson Learned reviews. By procedure and according to a strict SLA, Incident notifications are sent to customers in the case that their data has been impacted.

Secure development

Approach to secure software development best practice: Independent review of processes (for example CESG CPA Build Standard, ISO/IEC 27034, ISO/IEC 27001 or CSA CCM v3.0)

Public sector networks

Connection to public sector networks: No

Pricing

Price: £20 a unit
Discount for educational organisations: Yes
Free trial available: Yes
Description of free trial: Limited assets and number of days.

Service documents

Request an accessible format

Cookies on Digital Marketplace

Orca Security CNAPP

Features

Benefits

Pricing

Service documents

Framework

Service ID

Contact

Service scope

User support

Onboarding and offboarding

Using the service

Scaling

Analytics

Resellers

Staff security

Asset protection

Data importing and exporting

Data-in-transit protection

Availability and resilience

Identity and authentication

Audit information for users

Standards and certifications

Security governance

Operational security

Secure development

Public sector networks

Social Value

Pricing

Service documents