Palo Alto Prisma Cloud

Service scope

Software add-on or extension: No
Cloud deployment model: Public cloud

Private cloud

Hybrid cloud
Service constraints: At present, Amazon Web Services (AWS), Microsoft Azure, Google Compute Platform, IBM Cloud, Oracle Cloud and Alibaba Cloud are the only supported platforms for all functionality. Docker Enterprise Edition, IBM Cloud, Kubernetes, OpenShift, Rancher and Pivotal are supported from a containerisation technology only at time of writing.
System requirements: Prisma Cloud is supported on both x86_64 and ARM64

User support

Email or online ticketing support: Email or online ticketing
Support response times: 24x7x365 Support
Priority 1 (Critical) - < 1 Hour
Priority 2 (High) - 2 Hours
Priority 3 (Medium) - 4 Hours
Priority 4 (Low) - 8 Business Hours
Support Service Level Agreements (SLA) are identical for Monday to Friday and Weekends/Public Holidays.
User can manage status and priority of support tickets: Yes
Online ticketing support accessibility: None or don’t know
Phone support: Yes
Phone support availability: 24 hours, 7 days a week
Web chat support: No
Onsite support: Yes, at extra cost
Support levels: Standard Customer Success and Support - Prisma Cloud Enterprise Edition and Compute Edition are bundled with Standard Customer Success and Support. Standard Customer Success and Support includes basic customer support online and access to all online content.

Premium Customer Success (CS) - is available for both Prisma Cloud Enterprise Edition and Prisma Cloud Compute Edition. Premium CS is 20% of List on the price book. A dedicated ""Resident Engineer"" is available as an additional purchase
Support available to third parties: Yes

Onboarding and offboarding

Getting started: Customer can use our professional services team to accelerate the journey on the platform. We also provide an online training platform called Beacons. A full range of user documenation can be found on our website.
Service documentation: Yes
Documentation formats: HTML
End-of-contract data extraction: Cloud data that Palo Alto Networks hold on an organisation/tenant can be exported and deleted by contacting Palo Alto Networks support. If no contact is made data will automatically be purged after 90 days post cessation of the contract(s).
End-of-contract process: At the end of the contract, if the organisation chooses not to renew and continue with the service all data pertaining to the organisation is deleted. If the organisation chooses to renew then the service continues as normal. 90-days prior to the contract expiration date an initial reminder email is sent, followed up by gradually increasing reminders until the date of expiration.

Using the service

Web browser interface: Yes
Supported browsers: Internet Explorer 11

Microsoft Edge

Firefox

Chrome

Safari

Opera
Application to install: No
Designed for use on mobile devices: No
Service interface: Yes
User support accessibility: None or don’t know
Description of service interface: All features and functionality are primarily delivered through the secure web admin console.
This includes the initial setup, system-configuration, on-boarding and operational functions such as monitoring and reporting.
A role-based access control (RBAC) system is in place to enforce the relevant access and configuration permissions requirements for certain types of individual users or groups.
Accessibility standards: None or don’t know
Description of accessibility: The secure web console is accessible via apps.paloaltonetworks.com or the stack can be accessed directly based on location of the tenant such as app.uk.prismacloud.io

IP Whitelisting can be utilised to restrict access to the management web interface.
Accessibility testing: The full VPAT / WCAG report can be provided on request.
API: Yes
What users can and can't do using the API: The Prisma Cloud API allows you to programmatically access and manage your Prisma Cloud resources, making it easy to automate tasks, integrate with other tools, and build custom integrations. With a variety of endpoints available, Prisma Cloud API aims to automate tasks and facilitate integrations with a wide range of application types while covering the majority of workflows and use cases currently supported by the Prisma Cloud web interface.
API documentation: Yes
API documentation formats: HTML
API sandbox or test environment: Yes
Customisation available: Yes
Description of customisation: Users can customise the Prisma Cloud service in several different ways. This includes custom policies, custom attack paths, customisable UI which includes dashboards and colour scheme. The customisation differs based on the users role, where a system admin has the ability to customise all of areas mentioned

Scaling

Independence of resources: Palo Alto Networks through an automated process is constantly evaluating and monitoring the load placed upon the application. Each customers instance is unique so there is no risk of shared resources being fully utilised by another organisation. As load increases the service will automatically bring online additional compute resources to accommodate the additional load.

Analytics

Service usage metrics: Yes
Metrics types: Prometheus is a monitoring platform that scrapes the published endpoints of targets to collect their metrics. You can configure Prisma Cloud to be a Prometheus target.
Reporting types: API access

Real-time dashboards

Regular reports

Reports on request

Resellers

Supplier type: Reseller providing extra support
Organisation whose services are being resold: Palo Alto

Staff security

Staff security clearance: Other security clearance
Government security clearance: Up to Developed Vetting (DV)

Asset protection

Knowledge of data storage and processing locations: Yes
Data storage and processing locations: United Kingdom

European Economic Area (EEA)
User control over data storage and processing locations: Yes
Datacentre security standards: Complies with a recognised standard (for example CSA CCM version 3.0)
Penetration testing frequency: At least every 6 months
Penetration testing approach: In-house
Protecting data at rest: Physical access control, complying with CSA CCM v3.0

Physical access control, complying with SSAE-16 / ISAE 3402

Physical access control, complying with another standard

Encryption of all physical media

Scale, obfuscating techniques, or data storage sharding

Other
Other data at rest protection approach: Service are supplied from Google and Amazon Data centers (further information to follow)
Google Security statement
https://cloud.google.com/security/overview/
https://cloud.google.com/security/

AWS Security Statement
https://aws.amazon.com/compliance/data-center/controls/
https://d1.awsstatic.com/whitepapers/aws-security-whitepaper
https://aws.amazon.com/compliance/data-center/data-centers/

All logs are stored in the Cortex data lake, user activity is monitored and stored in the Cortex data lake for the agreed retention period.
Data sanitisation process: Yes
Data sanitisation type: Explicit overwriting of storage before reallocation

Deleted data can’t be directly accessed
Equipment disposal approach: Complying with a recognised standard, for example CSA CCM v.30, CAS (Sanitisation) or ISO/IEC 27001

Data importing and exporting

Data export approach: Cloud data that Palo Alto Networks hold on an organisation/tenant can be exported and deleted by contacting Palo Alto Networks support. If no contact is made data will automatically be purged after 90 days post cessation of the contract(s).
Data export formats: CSV
Data import formats: Other
Other data import formats: YAML

Data-in-transit protection

Data protection between buyer and supplier networks: Private network or public sector network

TLS (version 1.2 or above)

IPsec or TLS VPN gateway

Other
Other protection between networks: Palo Alto Networks uses a proprietary encryption layer for API calls, telemetry and update services.
Data protection within supplier network: TLS (version 1.2 or above)

IPsec or TLS VPN gateway

Other
Other protection within supplier network: Palo Alto Networks uses a proprietary encryption layer for API calls, telemetry and update services.

Availability and resilience

Guaranteed availability: Prisma™ Cloud services shall be available 99.9% of the time, measured monthly excluding scheduled maintenance.

If Customer requests maintenance during these hours, any uptime or downtime calculation will exclude periods affected by such maintenance.
Further, any downtime resulting from outages of third-party connections or utilities or other reasons beyond the control of Palo Alto Networks will also be excluded from any such calculation.

Customer’s sole and exclusive remedy and the entire liability of
Palo Alto Networks, in connection with Prisma Cloud service availability, shall be to credit Customer 2% of monthly service fees (downtime credit) for each period of 60 consecutive minutes of downtime, provided that no more than one such credit will accrue
per day. Downtime shall begin to accrue as soon as Customer notifies Palo Alto Networks that downtime is taking place and will continue to accrue until service is restored.

In order to receive downtime credit, the customer must notify Palo Alto Networks in writing within 24 hours from the time of downtime. Failure to provide such notice will forfeit the right to receive downtime credit.
Approach to resilience: Palo Alto Networks delivers the Prisma Cloud service utilising public cloud providers Amazon Web Services and Google Compute Platform. Within each of these providers the use of “availability zones” (AZ) to ensure geo and service redundancy and resiliency within a region (e.g. United Kingdom) and at a regional level with traffic being able to be steered to another region/availability zone/location should an incident occur.
Outage reporting: A public dashboard available at status.paloaltonetworks.com and via email alerting

Identity and authentication

User authentication needed: Yes
User authentication: 2-factor authentication

Username or password
Access restrictions in management interfaces and support channels: Users authenticate to the service at organisation.traps.paloaltonetworks.com or apps.paloaltonetworks.com using a username and password combination and multifactor authentication (if configured). API access is controlled via key/token system.
Access restriction testing frequency: At least every 6 months
Management access authentication: 2-factor authentication

Username or password

Other
Description of management access authentication: Users authenticate to the service at organisation.prismacloud.io or apps.paloaltonetworks.com using a username and password combination and multifactor authentication (if configured). API access is controlled via key/token system.

Audit information for users

Access to user activity audit information: Users have access to real-time audit information
How long user audit data is stored for: User-defined
Access to supplier activity audit information: Users contact the support team to get audit information
How long supplier audit data is stored for: User-defined
How long system logs are stored for: User-defined

Standards and certifications

ISO/IEC 27001 certification: Yes
Who accredited the ISO/IEC 27001: Certified by PECB MS, Canada
ISO/IEC 27001 accreditation date: Valid from 22/08/2023 until 31/10/2025.
What the ISO/IEC 27001 doesn’t cover: Certification downloadable from https://www.paloaltonetworks.com/content/dam/pan/en_US/assets/pdf/legal/technical-certifications/iso-27001.pdf
ISO 28000:2007 certification: No
CSA STAR certification: Yes
CSA STAR accreditation date: 16/07/2020
CSA STAR certification level: Level 1: CSA STAR Self-Assessment
What the CSA STAR doesn’t cover: N/A
PCI certification: Yes
Who accredited the PCI DSS certification: N/A
PCI DSS accreditation date: N/A
What the PCI DSS doesn’t cover: Information available on request. https://panservicedesk.service-now.com/esp?id=contract_request&sys_id=f53d00d61b01ac506b7d0e1dcd4bcb45
Cyber essentials: No
Cyber essentials plus: Yes
Other security certifications: Yes
Any other security certifications: SOC2

Fedramp

Common Criteria

FIPS 140-2

NCSC Foundation Grade Certification.

Telecom Security Act Code of Practice

Security governance

Named board-level person responsible for service security: Yes
Security governance certified: Yes
Security governance standards: ISO/IEC 27001

Other
Other security governance standards: SOC2
ISO 27001
ISO 27017
ISO 27018
ISO 27032
ISO 27701
Information security policies and processes: Palo Alto Networks has a formal Enterprise Risk Management program, which includes the performance of an annual risk assessment, with periodic updates, as applicable, to identify and assess key risks and their mitigation approaches. The scope of the program encompasses information security risks and product risks. Our security program consists of a risk-based approach that includes administrative, technical and physical safeguards reasonably designed to protect the confidentiality, integrity and availability of customer data. Palo Alto Network's information security program is aligned to ISO 27001/2, and includes key controls from HIPAA, PCI and SOC2.

Operational security

Configuration and change management standard: Supplier-defined controls
Configuration and change management approach: Both Palo Alto Networks and the end-user organisation are in full control of their relevant and respective change control processes.
Additional details are available upon request.
Vulnerability management type: Supplier-defined controls
Vulnerability management approach: Applications and software that collect, transmit or display, or process End User Data, Palo Alto Networks conducts an application security assessment review to identify common security vulnerabilities as identified by industry recognized organizations annually or for all major releases, whichever occurs first. The scope of the security assessment will primarily focus on application security, including, but not limited to, a penetration test of the application, as well as a code review.
Palo Alto Networks utilizes a qualified third party to conduct the application security assessments. Palo Alto Networks may conduct the security assessment review directly, following industry standard best practices.
Protective monitoring type: Conforms to a recognised standard, for example CSA CCM v3.0 or SSAE-16 / ISAE 3402
Protective monitoring approach: Applications and software that collect, transmit or display, or process End User Data, Palo Alto Networks conducts an application security assessment review to identify common security vulnerabilities as identified by industry recognized organizations annually or for all major releases, whichever occurs first. The scope of the security assessment will primarily focus on application security, including, but not limited to, a penetration test of the application, as well as a code review.
Palo Alto Networks utilizes a qualified third party to conduct the application security assessments. Palo Alto Networks may conduct the security assessment review directly, following industry standard best practices.
Incident management type: Conforms to a recognised standard, for example, CSA CCM v3.0 or ISO/IEC 27035:2011 or SSAE-16 / ISAE 3402
Incident management approach: This information is available upon request

Secure development

Approach to secure software development best practice: Supplier-defined process

Public sector networks

Connection to public sector networks: No

Social Value

Fighting climate change

We take our environmental management and the impact we have on the environment very seriously. We have environmental policies in place and hold the ISO14001 accreditation. Our environmental assessments are conducted annually by an external Lead ESOS Assessor; they are signed-off by the board and compliance reported to the regulator (the Environment Agency). Our environmental policy is published on our website at https://www.bytes.co.uk/company/sustainability/environmental.
Bytes achieved carbon net zero in March 2022 through approved carbon offsetting schemes. We are always seeking to reduce our impact on the environment. We aim to minimise waste, reduce pollutants and use renewable materials. Our offices have recycling facilities for cans, plastic and paper. We aim to reduce our office printing to zero within the next few years.
An Environmental Steering Committee has been established to coordinate environmental activities and drive change.
To drastically reduce our emissions, we have switched to renewable energy. Our Head Office has reached our first milestone of using a specialist 100% renewable electricity provider. We are also exploring options to install solar panels on our Headquarters building.
Other environmental initiatives include installing electric vehicle charging points and encouraging staff to commute to work without the car (setting up a car share network and installing secure cycle parking).
We produce a SECR (Streamlined Energy and Carbon Reporting) report that details the companies energy consumption and carbon emissions. This report is produced annually by an independent assessor.
This report provides details of our emissions in Scope 1, 2 and 3 categories. It details the activities previously taken to reduce emissions and also recommendations for further improvements.
For scope 1,2 and 3 emissions we aim to reduce these by 50% by 2025-2026 from our 2021 baseline.
We aim to be Net Zero by 2040, covering our own operational emissions.

Pricing

Price: £180 a unit
Discount for educational organisations: No
Free trial available: No

Features

Benefits

Service documents

Framework

Service ID

Contact

Service scope

User support

Onboarding and offboarding

Using the service

Scaling

Analytics

Resellers

Staff security

Asset protection

Data importing and exporting

Data-in-transit protection

Availability and resilience

Identity and authentication

Audit information for users

Standards and certifications

Security governance

Operational security

Secure development

Public sector networks

Pricing

Service documents

Cookies on Digital Marketplace

Palo Alto Prisma Cloud

Features

Benefits

Pricing

Service documents

Framework

Service ID

Contact

Service scope

User support

Onboarding and offboarding

Using the service

Scaling

Analytics

Resellers

Staff security

Asset protection

Data importing and exporting

Data-in-transit protection

Availability and resilience

Identity and authentication

Audit information for users

Standards and certifications

Security governance

Operational security

Secure development

Public sector networks

Social Value

Pricing

Service documents