PROACT IT UK LIMITED

Managed Extended Detection and Response (XDR) as a service

Proact’s security services offer a comprehensive defence platform that offers a combination of human, automated and machine intelligence, alongside real-time monitoring of customer software infrastructure. Services are provided directly through our UK security operations centre (SOC).

Features

• Centralised Log repository and retention for multiple log sources
• Log correlation e.g vulnerabilties vs. intrusions and Threat Hunting
• Threat and risk modelling, contextual awareness
• Full 24x7x365 Virtual SOC Capability via skilled Cyber Security Analysts
• Web accessible interface with customisable dashboards and reportin
• Highly scalable, agile and secure platform
• Security data and time stamp across all logs ensuring data
• Proactive Threat Detection and Response
• 24/7 SOC Services
• Threat Intelligence

Benefits

• Streamline compliance reporting
• Consolidated and centralised event view across platforms
• Improve incident handling. Facilitate focus on riskiest threats
• Fully management deployment reduces resource overhead on local IT personnel
• Lower TCO Than On-Premise deployments, Quick ROI
• Service reviews, detailed monthly reporting and security guidance
• Maximising Your Investment in Microsoft
• Proact's MDR services are scalable
• The service provides comprehensive reporting

• Education pricing available

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at bids@proact.co.uk. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 15

Service ID

946394944474965

Contact

Proact IT UK Sales
01246266300
bids@proact.co.uk

About your service

• Service categories:

  Systems Infrastructure Software

  Security

  • Endpoint security
  • Security analytics

  Data security

  • Information protection
• Multi cloud support: Yes

Service scope

• Software add-on or extension: No
• Cloud deployment model: Public cloud
• Service constraints: Customers are required to nominate available security contacts for incident handling and timely response. Please refer to the Service Definition documentation for a detailed overview of constraints, dependencies and requirements.
• System requirements:
  • Microsoft Exchange Server
  • Microsoft Office365
  • Google Gsuite
  • Maintain valid subscriptions and provide credentials/access for managed systems
  • Ensure sufficient compute/network/storage resources for log collection/analysis
  • Open required firewall ports and deploy agent software as requested
  • Facilitate access with appropriate privileges for data collection/response actions

User support

• Email or online ticketing support: Yes
• Support response times: Email, telephone and online ticketing support are offered. Standard support response times are: P1 (critical) – 30 minutes, 24x7x365. P2 (major) – 1 working hour, 8am-6pm Mon-Fri excluding Bank Holidays. P3 (minor) – 4 working hours, 8am-6pm Mon-Fri excluding Bank Holidays. P4 (general) – 8 working hours, 8am-6pm Mon-Fri excluding Bank Holidays. In reality, the average response time for all cases (P1, 2, 3 & 4) raised to the service desk over the past 12 months is 20 minutes.
• User can manage status and priority of support tickets: Yes
• Online ticketing support accessibility: EN 301 549
• Phone support: Yes
• Phone support availability: 24 hours, 7 days a week
• Web chat support: No
• Onsite support: No
• Support levels: Proact MDR offers 24/7 monitoring and incident response by a dedicated UK Security Operations Center (SOC).; The service includes:; Continuous threat detection and analysis across your IT environment.; Incident triage, escalation, and response.; Regular security reviews and advanced reporting.; Proactive threat hunting and alert tuning to minimize false positives.; Access to Proact’s Incident Response Team (IRT) for serious incidents.; Service requests (such as password resets or information requests) are typically initiated within 8 working hours.; Emergency changes are implemented 24/7 at no additional charge, while standard and normal changes are scheduled during local business hours unless otherwise agreed (additional charges may apply for out-of-hours changes).; Proact MDR includes access to security specialists and consultants, with quarterly security insight meetings and regular summary reporting.
• Support available to third parties: Yes

Onboarding and offboarding

• Getting started: All of Proact's managed cloud service contracts are started with an initiation meeting, it is as this point that the design and delivery are agreed. Formalisation training is provided as part of the project. This will take the form of either remote or onsite dependent on the customer's preference. Documentation is also provided.
• Service documentation: Yes
• Documentation formats: PDF
• End-of-contract data extraction: Prior to contract end, the Service Delivery Manager at Proact will approach the customer to agree a contract exit strategy, this includes data extraction. In addition the customer can add change or remove their data at any time with or without Proact's technical input.
• End-of-contract process: Once the contract has reached its term, the customer can either terminate or renew their contract. In this situation, there are no additional costs to the customer to exit the agreement or to renew. However, If the contract is terminated early, or the customer wishes to make significant changes to the contract before renewing, charges may be applicable. Please refer to our T&Cs for further information.
• Documentation accessibility standard: None or don’t know
• How the documentation is accessible: We provide all onboarding and offboarding documentation through a secure online portal in accessible formats (PDF, HTML, and text). Alternative formats such as large print, audio, or braille are available on request. Documentation is written in plain English and available 24/7, with additional support via phone, email, or video call if needed.

Using the service

• Web browser interface: Yes
• Supported browsers:
  • Microsoft Edge
  • Firefox
  • Chrome
  • Safari
  • Opera
  • Other
• Application to install: No
• Designed for use on mobile devices: No
• Service interface: Yes
• User support accessibility: None or don’t know
• Description of service interface: The service is accessible via a web based console to provide reporting and dashboard functionality.
• Accessibility standards: None or don’t know
• Description of accessibility: Users can access reporting metrics, search data sets and configure dashboards.
• Accessibility testing: None
• API: No
• Customisation available: No

Scaling

• Independence of resources: The service is operated from the Microsoft Azure platform and is scaled automatically on demand for any increase in usage.

Analytics

• Service usage metrics: Yes
• Metrics types: Metrics relating to the number of phishing incidents blocked automatically, the types of incident, number of reported phishing emails by users and the incidents resolved by the Proact security team can be provided. In addition the results of simulation training exercises where this feature is consumed.
• Reporting types:
  • Real-time dashboards
  • Regular reports
  • Reports on request
• Resource tagging: No
• FOCUS resource tagging: No

Resellers

• Supplier type: Not a reseller

Staff security

• Staff security clearance: Other security clearance
• Government security clearance: Security Clearance (SC)

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations: United Kingdom
• User control over data storage and processing locations: Yes
• Datacentre security standards: Complies with a recognised standard (for example CSA CCM version 4.0)
• Penetration testing frequency: At least once a year
• Penetration testing approach: ‘IT Health Check’ performed by a CREST-approved service provider
• Protecting data at rest:
  • Physical access control, complying with SSAE-18 / ISAE 3402
  • Physical access control, complying with another standard
  • Encryption of all physical media
• Data sanitisation process: Yes
• Equipment disposal approach: Complying with a recognised standard, for example CSA CCM v4.0, CAS (Sanitisation) or ISO/IEC 27001
• Data sanitisation type: Deleted data can’t be directly accessed / Cryptographic Erasure

Data importing and exporting

• Data export approach: User data in the form or email addresses and usernames can be exported from the platform by Proact on behalf of the customer.; ; Any user data is purged from the platform after contract expiry. Email body content is not stored on the platform at all unless the email is confirmed as a legitimate phishing attempt.
• Data export formats: CSV
• Data import formats: CSV

Data-in-transit protection

• Data protection between buyer and supplier networks:
  • TLS (version 1.2 or above)
  • IPsec or TLS VPN gateway
• Data protection within supplier network:
  • TLS (version 1.2 or above)
  • IPsec or TLS VPN gateway

Availability and resilience

• Guaranteed availability: The Proact service is designed to be 99.5% available as a minimum. Through the deployment of a scaled out platform built across multiple servers and hosted within data centres which feature redundant network and power.
• Approach to resilience: The platform uses a highly available architecture containing no single points of failure through compute, storage and networking components. The service is hosted within Microsoft Azure data centre facilities.
• Outage reporting: Outages are reported to the customer via email notifications and the service dashboard. Regular reviews are scheduled between the customer and the Service Delivery Manager, where additional information can be provided surrounding any outages that may have occurred. Where relevant, email would be used and or the emergency contact would be directly informed.

Identity and authentication

• User authentication needed: Yes
• User authentication:
  • Multi-Factor Authentication (MFA)
  • Public key authentication (including by TLS client certificate)
  • Username or password
• Access restrictions in management interfaces and support channels: Role Based Access Control is in effect. Traffic is segregated onto dedicated VLANs – no routing between VLANs is allowed other than via a firewall
• Access restriction testing frequency: At least every 6 months
• Management access authentication:
  • Multi-Factor Authentication (MFA)
  • Limited access network (for example PSN)
  • Dedicated link (for example VPN)
  • Username or password

Audit information for users

• Access to user activity audit information: Users contact the support team to get audit information
• How long user audit data is stored for: User-defined
• Access to supplier activity audit information: No audit information available
• How long system logs are stored for: User-defined

Security governance

• Named board-level person responsible for service security: Yes
• Security governance certified: Yes
• Security governance standards:
  • ISO/IEC 27001
  • Other
• Other security governance standards: Proact is accredited to ISO 27001, Cyber Essentials, and the NHS Data Security and Protection Toolkit (DSPT). Each of these standards embeds governance components that support strong organisational security practices.
• Information security policies and processes: The high level “Information Security Policy” describes the considerations to achieve the company information security objectives and is separated in to the key Tier 2 detailed security policies:; ; • Technical Security Policy; • Physical Security Policy; • Business Continuity Policy; • Data Handling; • 3rd Party Supplier Management Policy; • Network and Infrastructure Management Policy; ; All of these policies are condensed to form the Acceptable Use Policy, which is trained to all new starters during their induction and included in annual security awareness training. These policies are reviewed at least annually prior to security retraining and after changes to compliance requirements. Staff are invited to comment on this policy and suggest ways in which it might be improved by contacting the Chief Information Security Officer.
• Software Security Code of Practice: Yes

Operational security

• Configuration and change management standard: Supplier-defined controls
• Configuration and change management approach: Change management is an ITIL process managed through a ticketing system, which tracks changes to configuration items. Extensive changes are approved by the Change Approval Board.
• Vulnerability management type: Supplier-defined controls
• Vulnerability management approach: Under Proact's managed services all public IP addresses are vulnerability scanned on a weekly basis. The Proact Cloud infrastructure is also vulnerability scanned weekly. Penetration test are carried out at 6 monthly intervals. There is continual monitor of vendor security notifications and bulletins. Vulnerability remediation is typically between seven days to one month and is dependent on critical nature and OS/application type.
• Protective monitoring type: Supplier-defined controls
• Protective monitoring approach: Proact’s Protective monitoring of logs watching for IoC, to alert in accordance with predetermined processes. The Investigation Team perform in-depth analysis, looking for further evidence, or most often to eliminate false positives. Customers are included in Investigations, as an IoC could be a benign activity known by the customer; authorised change or penetration test in progress. If a compromise is suspected or confirmed then the response team will work with the customer to follow established response procedures to cover Containment, Eradication, Recovery and advice on strengthening security controls to prevent similar occurrences.
• Incident management type: Supplier-defined controls
• Incident management approach: Incidents can be reported over the phone to the support team or via the web interface. The Service Delivery Manager can also be contacted, but will be included in communications in any case. Incident reports are made available in the dashboard and as part of the regular review meeting with the Service Delivery Manager.
• Post-quantum cryptography secure: Yes

Secure development

• Approach to secure software development best practice: Conforms to a recognised standard, but self-assessed

Public sector networks

• Connection to public sector networks: No

Pricing

• Discount for educational organisations: Yes
• Free trial available: No

Discount percentage by annual call-off contract value (excluding VAT)

• Less than £250,000: 2%
• Between £250,000 and £500,000: 5%
• Between £500,001 and £1,000,000: 8%
• Between £1,000,001 and £2,500,000: 12%
• Between £2,500,001 and £5,000,000: 15%
• Over £5,000,001: 18%

Non-mandatory Standards and certifications

• ISO/IEC 27001 certification: Yes
• Who accredited the ISO/IEC 27001: BSI, certificate number IS551975
• ISO/IEC 27001 accreditation date: Saturday 6 November 2010
• What the ISO/IEC 27001 doesn’t cover: All business processes are covered by the certificate
• ISO 28000:2022 certification: No
• ISO 9001 certification: Yes
• Who accredited the ISO 9001 certification: WCS, certificate number 7073
• ISO 9001 accreditation date: Sunday 7 March 2010
• What the ISO 9001 doesn’t cover: All business processes are covered by the certificate
• Quality management systems (QMS): Yes
• CSA STAR certification: No
• PCI certification: No
• Cyber essentials: Yes
• Please provide your Cyber Essentials Certificate Number: 69dea7e6-f5d2-4a51-90e3-40cc964d48f7
• Cyber essentials plus: No
• Cyber Essentials Alternative: In relation to the services you do not have a current and valid Cyber Essentials Plus certificate which has been awarded by one of the government approved Cyber Essentials accreditation bodies but you are working towards gaining it, and will be in a position to confirm that you have been awarded a current and valid Cyber Essentials Plus certificate by one of the government approved accreditation bodies within 12 months of the date of award.
• Other security certifications: No

Social value

• Section B - Commitment for Future: Delivery:

  • Mission: Kick start economic growth. To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

    Policy Outcome 1: Fair work: That offers fair wages and good working conditions. Help people get a job, stay in work, and progress in their careers, with good employment opportunities across the country. Notes: Where there is a large proportion of labour costs in the contract, commercial teams should consider MAC in Outcome 1 as a priority

    • New apprenticeships on the contract workforce in the relevant area that meet the criteria set out in MAC 1b

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at bids@proact.co.uk. Tell them what format you need. It will help if you say what assistive technology you use.