tmc3 Limited

Vulnerability Management

tmc3 Vulnerability Assessment leverages Tenable's powerful suite of security tools to provide comprehensive vulnerability scanning and vulnerability management for your IT infrastructure. Designed to detect, prioritise, and remediate vulnerabilities, this vulnerability management service helps safeguard your networks, applications, and data from potential threats, ensuring compliance with industry standards and regulations.

Features

• Continuous Vulnerability Scanning: Real-time monitoring with Tenable's scanning capabilities.
• Comprehensive Asset Coverage: Monitors all environments—cloud, on-premise, mobile.
• Risk-Based Prioritisation: Focus on critical vulnerabilities using advanced analytics
• Integration with Existing Systems: Seamless integration with current IT infrastructure.
• Automated Compliance Reports: Generates detailed reports for PCI-DSS, HIPAA, GDPR.
• Customisable Dashboards: Tailored dashboards for clear security posture view.
• Incident Response Support: Guidance for incident planning and execution.
• Patch Management Assistance: Aid in effective patch deployment.
• Security Awareness Training: Enhance team's vulnerability management understanding.
• Security Reviews: Adaptation to evolving threat landscapes with periodic reviews.

Benefits

• Enhanced Cybersecurity Posture: Proactively addresses vulnerabilities for strengthened security.
• Reduced Risk of Breaches: Timely threat remediation minimizes breach risks.
• Cost-Effective Security Solution: Economical alternative to in-house management.
• Regulatory Compliance Assurance: Ensures compliance, avoiding fines and penalties.
• Improved Efficiency: Frees IT for core tasks
• Scalable Service: Fits organisations of all sizes, scalable to needs.
• Expertise and Support: Access to Tenable experts for ongoing support.
• Proactive Threat Intelligence: Leverages threat intelligence for proactive defense.
• Visibility and Control: Complete security landscape visibility for better control.
• Strategic Security Planning: Informs strategic planning with comprehensive security data.

£44.53 a unit a year

• Education pricing available

Service documents

• Pricing document

  PDF

• Skills Framework for the Information Age rate card

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at Frameworks@tmc3.co.uk. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 14

Service ID

931936568910798

Contact

Nathan Tittensor
0113 8730449
Frameworks@tmc3.co.uk

Service scope

• Software add-on or extension: Yes, but can also be used as a standalone service
• What software services is the service an extension to: Multiple - reach out for guidance
• Cloud deployment model:
  • Public cloud
  • Private cloud
  • Hybrid cloud
• Service constraints: Must be accessed via a web browser. System maintenance is automatic and included as part of the subscription.
• System requirements:
  • Web browser
  • There is a deployment guide available -link available upon request

User support

• Email or online ticketing support: Email or online ticketing
• Support response times: Initial response times vary due to the critical nature, but all within a 24-hour window.
• User can manage status and priority of support tickets: Yes
• Online ticketing support accessibility: WCAG 2.1 AA or EN 301 549
• Phone support: Yes
• Phone support availability: 24 hours, 7 days a week
• Web chat support: Yes, at an extra cost
• Web chat support availability: 24 hours, 7 days a week
• Web chat support accessibility standard: WCAG 2.1 AA or EN 301 549
• Web chat accessibility testing: UAT
• Onsite support: Yes, at extra cost
• Support levels: Tenable offers three tiers of support: Advanced, Premier, and Elite. Advanced support is included with your subscription cost, and users can upgrade to additional plans if they choose to.
• Support available to third parties: Yes

Onboarding and offboarding

• Getting started: There are a range of support and training options provided to help new users. These range from FOC on-demand training and ILT through to professional services onsite; online support portal and customers community forums are also available for knowledge sharing.
• Service documentation: Yes
• Documentation formats:
  • HTML
  • PDF
• End-of-contract data extraction: It is normally Module dependent but generally data can be exported via the console or API calls in formats like PDF and/or CSV.
• End-of-contract process: Should a customer's account expire or terminate, Tenable will retain the data, as it was at the time of expiration, for no more than 180 days for customers to download their records accordingly. After that time, this data may be deleted and cannot be recovered.

Using the service

• Web browser interface: Yes
• Supported browsers:
  • Internet Explorer 11
  • Microsoft Edge
  • Firefox
  • Chrome
  • Safari
• Application to install: Yes
• Compatible operating systems:
  • Android
  • IOS
  • Linux or Unix
  • MacOS
  • Windows
  • Windows Phone
  • Other
• Designed for use on mobile devices: No
• Service interface: Yes
• User support accessibility: WCAG 2.1 AA or EN 301 549
• Description of service interface: Accessed via a web-based console there is a user-friendly graphical interface with drill-down capabilities.
• Accessibility standards: WCAG 2.1 AA or EN 301 549
• Accessibility testing: Testing conducted internally
• API: Yes
• What users can and can't do using the API: RESTful API, Users can easily integrate and automate the sharing of capabilities and vulnerability data, or build on the platform, leveraging a fully documented API set and SDK. There is no extra cost to use these tools to maximize the value of your vulnerability data.
• API documentation: Yes
• API documentation formats: Open API (also known as Swagger)
• API sandbox or test environment: Yes
• Customisation available: Yes
• Description of customisation: Each module within the platform is individually customisable according to each modules own attributes. Additionally for Tenable One specific modules multiple options for customisation exist including customised queries for risk scoring, SLA settings and cyber exposure score threshold for benchmarking, targeted asset reporting and monitoring.

Scaling

• Independence of resources: Tenable commits to provide 99.95% average uptime with respect to the Cloud Services during each calendar month of the subscription term. Tenable Vulnerability Management utilises AWS autoscaling to provide expansion of the service as required

Analytics

• Service usage metrics: Yes
• Metrics types: Licence Usage
• Reporting types:
  • API access
  • Real-time dashboards
  • Regular reports
  • Reports on request

Resellers

• Supplier type: Reseller providing extra support
• Organisation whose services are being resold: Tenable

Staff security

• Staff security clearance: Conforms to BS7858:2019
• Government security clearance: Up to Developed Vetting (DV)

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations: United Kingdom
• User control over data storage and processing locations: Yes
• Datacentre security standards: Managed by a third party
• Penetration testing frequency: At least once a year
• Penetration testing approach: ‘IT Health Check’ performed by a CHECK service provider
• Protecting data at rest:
  • Physical access control, complying with CSA CCM v3.0
  • Encryption of all physical media
• Data sanitisation process: Yes
• Data sanitisation type: Explicit overwriting of storage before reallocation
• Equipment disposal approach: Complying with a recognised standard, for example CSA CCM v.30, CAS (Sanitisation) or ISO/IEC 27001

Data importing and exporting

• Data export approach: It is normally Module dependent but generally they can export their data via the console of API calls in the CSV and/or PDF formats. ; ; There are no formats that can be used to import data.
• Data export formats: CSV
• Data import formats: CSV

Data-in-transit protection

• Data protection between buyer and supplier networks: TLS (version 1.2 or above)
• Data protection within supplier network: Other
• Other protection within supplier network: At rest all customer data collected are encrypted using AES-256 encryption. ; ; Tenable uses state-of-the-art container technology to create and segregate customer environments. All customer accounts, vulnerability data and user settings are contained within a container uniquely allocated to each specific customer. Data contained within one container cannot leak or otherwise be intermingled with another container, thus ensuring the privacy, security and independence of each customer environment.

Availability and resilience

• Guaranteed availability: Tenable commits to provide 99.95% average uptime with respect to the Cloud Services during each calendar month of the subscription term. If in any calendar month this uptime commitment is not met by Tenable and Customer was negatively impacted, Tenable shall provide, as the sole and exclusive remedy for unavailability or performance degradation of the specific Tenable Cloud Services, a service credit.
• Approach to resilience: Tenable uses health and status data to detect and address potential issues in a timely manner, thereby maintaining SLA commitments. Tenable Cloud services are replicated both within and across AWS regions. Should both instances in a region fail (or the region suffers an outage in general), the regional-failover layer (usually using dynamic DNS) will instead direct traffic to the other three regions. Failover is closest-path to the traffic origin.
• Outage reporting: Tenable One disaster recovery procedures have several levels and are designed to react to situations that may occur from anywhere between once in five years to once in 50 years. Depending on the scope of the disaster, the recovery procedures vary in time from 60 minutes to 24 hours.

Identity and authentication

• User authentication needed: Yes
• User authentication:
  • 2-factor authentication
  • Identity federation with existing provider (for example Google Apps)
  • Username or password
• Access restrictions in management interfaces and support channels: User accounts are assigned roles that dictate the level of access a user has in Tenable Vulnerability Management. You can change the role of a user account at any time, as well as disable the account.
• Access restriction testing frequency: At least once a year
• Management access authentication:
  • 2-factor authentication
  • Identity federation with existing provider (for example Google Apps)
  • Username or password

Audit information for users

• Access to user activity audit information: Users contact the support team to get audit information
• How long user audit data is stored for: Between 1 month and 6 months
• Access to supplier activity audit information: Users contact the support team to get audit information
• How long supplier audit data is stored for: Between 1 month and 6 months
• How long system logs are stored for: At least 12 months

Standards and certifications

• ISO/IEC 27001 certification: Yes
• Who accredited the ISO/IEC 27001: Schellman & Company LLC
• ISO/IEC 27001 accreditation date: 15/02/2022
• What the ISO/IEC 27001 doesn’t cover: N/A
• ISO 28000:2007 certification: No
• CSA STAR certification: No
• PCI certification: No
• Cyber essentials: Yes
• Cyber essentials plus: Yes
• Other security certifications: Yes
• Any other security certifications: SOC 2 Type II Report

Security governance

• Named board-level person responsible for service security: Yes
• Security governance certified: Yes
• Security governance standards:
  • CSA CCM version 3.0
  • ISO/IEC 27001
  • Other
• Other security governance standards: Tenable's Information Security and associated policies incorporate industry accepted standards and frameworks including ISO 27001, COBIT, NIST 800-53, and CSA.
• Information security policies and processes: Tenable's Information Security and associated policies incorporate industry accepted standards and frameworks including ISO 27001, COBIT, NIST 800-53, and CSA.

Operational security

• Configuration and change management standard: Conforms to a recognised standard, for example CSA CCM v3.0 or SSAE-16 / ISAE 3402
• Configuration and change management approach: Not all systems require the same amount of development, testing, and approval. Changes to some systems are routine and represent little or no risk. Therefore, to ensure reasonable processing time for routine maintenance and other low risk change requests, and to ensure that more significant, higher impact changes receive the appropriate scrutiny and planning, the following types of changes have been established. These types have corresponding development, testing, and implementation requirements as well as specific approvals necessary to process. Classification of Change Types: ; ; Provisioning ; ; Configuration ; ; Maintenance/ Upkeep ; ; Development (existing) ; ; Development (new)
• Vulnerability management type: Conforms to a recognised standard, for example CSA CCM v3.0 or SSAE-16 / ISAE 3402
• Vulnerability management approach: Internal vulnerability assessments are conducted weekly. Vulnerability management assessments include, but are not limited to, workstations, servers, cloud instances, networks, labs, internet-facing services, Tenable products, and third-party products. ; ; Internal penetration tests are conducted quarterly. Tenable's internal penetration testing team performs assessments to identify risks that require mitigation. Our internal penetration testing methodologies follow the standards from NIST 800-115 and the PTES Technical Guidelines. ; ; External 3rd party Penetration tests are also done annually for our cloud-based offerings and can be provided to customers, upon request, under an NDA agreement.
• Protective monitoring type: Conforms to a recognised standard, for example CSA CCM v3.0 or SSAE-16 / ISAE 3402
• Protective monitoring approach: All application logs, audit logs, syslog, and any other textual logs are captured and transmitted immediately to a 3rd party logging system. Additionally, all changes and actions taken in the AWS consoles are logged using CloudWatch. Alerts are generated when certain actions or conditions are met. Alerts are sent using our alerting and notification system.
• Incident management type: Conforms to a recognised standard, for example, CSA CCM v3.0 or ISO/IEC 27035:2011 or SSAE-16 / ISAE 3402
• Incident management approach: Notification will be made within 48 hours and not before the initial incident report, containing the basic facts, is completed. Notification will be sent to the data breach contact notification on file. Notification will be by email.

Secure development

• Approach to secure software development best practice: Independent review of processes (for example CESG CPA Build Standard, ISO/IEC 27034, ISO/IEC 27001 or CSA CCM v3.0)

Public sector networks

• Connection to public sector networks: No

Social Value

• Social Value:

  Social Value

  • Fighting climate change
  • Tackling economic inequality
  • Equal opportunity
  • Wellbeing

  Fighting climate change

  In 2024, tmc3 has achieved Net Zero emissions.; ; tmc3 has implemented a documented Environmental Management System to reduce our environmental impacts. We will continue to focus on further reductions and our sights remain firmly set on exceeding all elements of our Science-Based Target on a long-term basis.; ; Actions we take include, but are not limited to: establishing environmentally sensitive purchasing policies (buying recycled or long-life products; favouring products derived from natural/sustainable sources) and monitoring the environmental performance of our suppliers; ensuring that all decisions regarding working practices and purchasing take environmental considerations into account. We measure, monitor and minimise our usage of resources and consumables, and our greenhouse gas emissions. We actively look for ways to reduce waste and recycling, and encourage the use of sustainable modes of transport. We encourage home working and the use of virtual collaboration tools.; ; tmc3's Carbon Reduction Plan has been completed in accordance with PPN 06/21 and associated guidance and reporting standard for Carbon Reduction Plans. This is available on the tmc3 website.; ; For the provision of these services, we commit to offsetting the carbon footprint for the development of the tmc3 deliverables and, if requested, will provide certification verifying this action has been completed within a month of project completion. We will measure the ‘As-is’ state of the contract to give us an accurate benchmark to work from, and how we need to progress throughout the contract lifecycle. This will include measuring against Scope 1,2&3 emissions, for example: Water use, electricity use, conducting a materiality checklist, measuring business travel, working from Home, business travel accommodation, employee commuting etc. We will gather data across all scope of emissions and utilise carbon calculator tooling to give an accurate and transparent measurement. We will then present these findings back to you and key stakeholders.

  Tackling economic inequality

  Social responsibility and supporting our communities are hugely important aspects of who we are. We love to spend time and energy helping local charities and developing the security professionals of tomorrow, through organising meetups and mentorship initiatives. Cyber Choices, Hullo and Hull4Heroes are just a few charities and initiatives we support. For us, this is much more than a set of words, this is about the positive impact we have on society, the environment and the economy.; ; tmc3 are pleased to confirm that all of our staff and associates are paid above the real living wage, in addition to receiving a pay review following every performance review. Furthermore, we hold formal accreditation from the Living Wage Foundation as a living wage employer. In our supply chain of associates, we prefer to work with known and trusted associates with well-established subcontracts and working practices. We do not use zero hour contracts. ; ; We are committed to creating job opportunities, particularly for those who face barriers to employment or are located in deprived areas. Our hiring practices are inclusive, and we provide comprehensive training to our employees to equip them with the necessary skills for their roles. Additionally, we offer apprenticeships and internships to individuals from diverse backgrounds, providing them with practical experience and a pathway to employment in the technology industry.; Each year tmc3 supports a number of young people to obtain an apprenticeship in Cyber Security through the tmc3 Academy.; ; To monitor and measure our efforts in tackling economic inequality, we will use Key Performance Indicators such as:; ; 1. Number of new businesses supported: This will measure our impact on entrepreneurship.; 2. Number of job opportunities created: This will assess our contribution to employment.; 3. Number of individuals trained and qualifications achieved: This will evaluate our efforts in supporting educational attainment.

  Equal opportunity

  tmc3 is committed to ensuring fair treatment of all stakeholders in our business from customers to employees. We believe in equality of opportunity and inclusion, where tmc3’s Equality, Diversity and Inclusion policy goes beyond what we are required to do to ensure all contributions are valued and respected. We ensure that in all our activities we promote equality and provide respect to all, irrespective of marital or civil partnership status; having or not having dependants; religion or beliefs; race (including colour, nationality, ethnic or national origin); disability; sex or sexual orientation; age; or pregnancy and maternity. This policy extends beyond our own employees to client personnel, subcontractors, suppliers and potential recruits, and underpins our approach to recruitment of staff and engagement with our supplier base.; Our tailored onboarding programs acclimate new employees with disabilities to the workplace culture and educate them on relevant policies and procedures but also include disability-specific information such as physical alterations, flexible hours, staff training and more ergonomic equipment and software.; The tmc3 Academy is a development programme designed to cultivate emerging talent in the field of security. The Academy is tailored to guide individuals into becoming security specialists. It provides a dynamic mix of practical experiences and formal coaching, all underpinned by three pillars: competence, knowledge, and transferable skills.; ; The tmc3 Academy aims to empower individuals within a span of 16 months, providing them with hands-on experience, dedicated study sessions, and individualised coaching. This approach facilitates their transition into confident members of both the client-facing and internal teams at tmc3. The Academy prides itself on its inclusivity, welcoming individuals from diverse academic backgrounds and placing an emphasis on transferable skills and motivation rather than prior exposure to cyber security.

  Wellbeing

  tmc3 is a company that is committed to supporting the health and wellbeing of our staff, both physically and mentally. We make every effort to ensure that our people are physically comfortable working at home by providing office equipment, and whatever else is needed (subject to individual accessibility requirements). ; We provide an Employee Assistance Programme for all staff including access to an online platform and 24hr confidential helpline. This provides counselling support and a virtual library of wellbeing information, ensuring all staff have practical support for all aspects of physical and mental wellbeing. Our team physically get together every 6-8 weeks, to participate in social and team building activities. We have employed a Mental Health First Aider, who provides advice and support, to our personnel and associates. ; We have created a safe space for all employees to ask for help. This can be done confidentially, or anonymously, through our ‘Better Ways of Working’ form, which is reviewed by the Executive Committee. We capture decisions made, within the ExCo Minutes. Recent examples of action taken: ; o Introduced the Electric Vehicle Scheme ; o Introduced an Employee Rewards and Recognition Scheme ; o Private Medical Healthcare Plans ; We conduct regular mental health and well-being workshops for staff and stakeholders, drawing on our experience of coaching and mentoring experience with Hullo Charity. We have encouraged all tmc3 personnel to provide a minimum of one day (paid) per annum, to charity volunteering. We also factor in team charity days, such as planting trees for the UK National Forestry Commission. ; We routinely monitor employee MHW by undertaking: Engagement surveys to analyse UK employee MHW issues and monitor progress, and, Account “Pulse check” surveys to understand how people are feeling and whether immediate intervention is required.

Pricing

• Price: £44.53 a unit a year
• Discount for educational organisations: Yes
• Free trial available: No

Service documents

• Pricing document

  PDF

• Skills Framework for the Information Age rate card

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at Frameworks@tmc3.co.uk. Tell them what format you need. It will help if you say what assistive technology you use.