Tenable.CS

Service scope

Software add-on or extension: Yes, but can also be used as a standalone service
What software services is the service an extension to: Can be used as a stand-alone SaaS or integrated into SecurityCenter Continuous View product. Vulnerability Management, Lumin, Tenable.ad, Tenable.cs and Web Application Scanning are add-on's to the main Tenable.io platform.

Tenable.io can be configured as an extension to SecurityCenter Continuous View, however not mandatory. Widespread integration with 3rd-party solutions
Cloud deployment model: Public cloud
Service constraints: Tenable IO must be accessed via a web browser
System requirements: Please contact

User support

Email or online ticketing support: Email or online ticketing
Support response times: RTO varies due to the critical nature, but all within a 24 hour window.
User can manage status and priority of support tickets: Yes
Online ticketing support accessibility: None or don’t know
Phone support: Yes
Phone support availability: 24 hours, 7 days a week
Web chat support: Web chat
Web chat support availability: 24 hours, 7 days a week
Web chat support accessibility standard: None or don’t know
How the web chat support is accessible: The chat feature is available once a named contact has logged into the support portal.
Web chat accessibility testing: Salesforce provide the chat facility for the community website (including the support function). Please refer to Salesforce documentation for further information.
Onsite support: Yes, at extra cost
Support levels: Standard, Advanced, Premier and Elite. Each support level includes 24x7x365 Email, Portal and Chat support, the Standard and Premium Packages include Phone Support. Additional details can be found in http://static.tenable.com/prod_docs/Tenable_Technical_Support_Plans.pdf
Support available to third parties: Yes

Onboarding and offboarding

Getting started: There are a range of support and training facilities provided to help new users. These range from FOC on-demand training through to professional services onsite; an online support portal and customers community forums.
Service documentation: Yes
Documentation formats: HTML

PDF

Other
Other documentation formats: Online via support portal: https://support.tenable.com/ or https://docs.tenable.com/cloud/

Report output formats include HTML, PDF, CSV, and XML.
End-of-contract data extraction: Should a customer's account expire or terminate, Tenable will retain the data, as it was at the time of expiration, for no more than 180 days for customers to download their records accordingly. After that time, this data may be deleted and cannot be recovered.
End-of-contract process: Should a customer's account expire or terminate, Tenable will retain the data, as it was at the time of expiration, for no more than 180 days for customers to download their records accordingly. After that time, this data may be deleted and cannot be recovered.

Using the service

Web browser interface: Yes
Supported browsers: Microsoft Edge

Firefox

Chrome

Safari
Application to install: No
Designed for use on mobile devices: Yes
Differences between the mobile and desktop service: Nessus Manager and Tenable.io integrate with leading Mobile Device Management (MDM) products (Microsoft Exchange, Apple Profile Manager, MobileIron, AirWatch, Good for Enterprise) to capture device info for iOS, Android and Windows phones to perform vulnerability and compliance assessments. Unmanaged devices can continue to be assessed for vulnerabilities and security issues via Passive Vulnerability Scanning - inspection of network traffic generated by the mobile devices.
Service interface: Yes
User support accessibility: None or don’t know
Description of service interface: Detailed response available https://www.tenable.com/section-508-voluntary-product-accessibility
Accessibility standards: None or don’t know
Description of accessibility: Access to Tenable.io is through a web browser utilising TLS/SSL secure communication. Support is either via phone, email or our support portal.
Accessibility testing: Detailed response available https://www.tenable.com/section-508-voluntary-product-accessibility
API: Yes
What users can and can't do using the API: Users can easily integrate and automate the sharing of capabilities and vulnerability data, or build on the Tenable.io platform, leveraging a fully documented API set and SDK. There is no extra cost to use these tools to maximize the value of your vulnerability data.
API documentation: Yes
API documentation formats: Open API (also known as Swagger)

HTML

ODF

PDF

Other
API sandbox or test environment: Yes
Customisation available: Yes
Description of customisation: Tenable.io has a large number of filtering options available for the purpose of filtering down the resultant vulnerability and configuration data. These filters can be combined in various ways and allows for the organization to quickly filter down to the subset of the data that is pertinent to the task at that time.

Scaling

Independence of resources: Tenable commits to provide 99.95% average uptime with respect to the Cloud Services during each calendar month of the subscription term. http://static.tenable.com/prod_docs/Service_Level_Commitment.pdf. Currently (April 2022) Tenable.io utilises AWS autoscaling to provide expansion of the service as required

Analytics

Service usage metrics: Yes
Metrics types: License usage. Further information: https://docs.tenable.com/tenableio/vulnerabilitymanagement/Content/Settings/ViewLicenseInformation.htm

Resellers

Supplier type: Reseller providing extra support
Organisation whose services are being resold: Tenable

Staff security

Staff security clearance: Other security clearance
Government security clearance: Up to Developed Vetting (DV)

Asset protection

Knowledge of data storage and processing locations: Yes
Data storage and processing locations: United Kingdom
User control over data storage and processing locations: Yes
Datacentre security standards: Supplier-defined controls
Penetration testing frequency: At least once a year
Penetration testing approach: In-house
Protecting data at rest: Other
Other data at rest protection approach: At rest all customer data collected are encrypted using AES-256 encryption.

Tenable.io uses state-of-the-art container technology to create and segregate customer environments. All customer accounts, vulnerability data and user settings are contained within a container uniquely allocated to each specific customer. Data contained within one container cannot leak or otherwise be intermingled with another container, thus ensuring the privacy, security and independence of each customer environment.
Data sanitisation process: Yes
Data sanitisation type: Explicit overwriting of storage before reallocation

Deleted data can’t be directly accessed
Equipment disposal approach: In-house destruction process

Data importing and exporting

Data export approach: Tenable IO has the facility to allow users to export their data either via the console or via the API
Data export formats: CSV

Other
Other data export formats: HTML

PDF
Data import formats: Other
Other data import formats: Data can only be uploaded in a Nessus Scanner format.

Data-in-transit protection

Data protection between buyer and supplier networks: TLS (version 1.2 or above)

Other
Other protection between networks: All customer data is marked with a "container ID", which corresponds to a single customer subscription. This container ID assures that access to a customer’s data is limited to only that customer.

All customer data in motion is encrypted using TLS v1.2 with a 4096-bit key. This includes browser, API and intra-application communication.
Data protection within supplier network: Other
Other protection within supplier network: Tenable.io uses state-of-the-art container technology to create and segregate customer environments. All customer accounts, vulnerability data and user settings are contained within a container uniquely allocated to each specific customer. Data contained within one container cannot leak or otherwise be intermingled with another container, thus ensuring the privacy, security and independence of each customer environment.

Availability and resilience

Guaranteed availability: Tenable commits to provide 99.95% average uptime with respect to the Cloud Services during each calendar month of the subscription term. If in any calendar month this uptime commitment is not met by Tenable and Customer was negatively impacted, Tenable shall provide, as the sole and exclusive remedy for unavailability or performance degradation of the specific Tenable Cloud Services, a service credit.
Approach to resilience: Tenable uses health and status data to detect and address potential issues in a timely manner, thereby maintaining SLA commitments. Tenable Cloud services are replicated both within and across AWS regions. Should both instances in a region fail (or the region suffers an outage in general), the regional-failover layer (usually using dynamic DNS) will instead direct traffic to the other three regions. Failover is closest-path to the traffic origin.
Outage reporting: Tenable.io disaster recovery procedures have several levels and are designed to react to situations that may occur from anywhere between once in five years to once in 50 years. Depending on the scope of the disaster, the recovery procedures vary in time from 60 minutes to 24 hours.

Identity and authentication

User authentication needed: Yes
User authentication: 2-factor authentication

Username or password

Other
Other user authentication: The system administrator sets up the user accounts, not Tenable.io.
Access restrictions in management interfaces and support channels: User accounts are assigned roles that dictate the level of access a user has in Tenable.io. You can change the role of a user account at any time, as well as disable the account.
Access restriction testing frequency: At least once a year
Management access authentication: Other
Description of management access authentication: Granular Role Based Access Controls are used within Tenable.io to control access to different features and functions. User management is restricted to a specific Administrator role.

Audit information for users

Access to user activity audit information: Users contact the support team to get audit information
How long user audit data is stored for: At least 12 months
Access to supplier activity audit information: Users contact the support team to get audit information
How long supplier audit data is stored for: At least 12 months
How long system logs are stored for: At least 12 months

Standards and certifications

ISO/IEC 27001 certification: Yes
Who accredited the ISO/IEC 27001: Via Amazon
ISO/IEC 27001 accreditation date: Via Amazon
What the ISO/IEC 27001 doesn’t cover: Via Amazon
ISO 28000:2007 certification: No
CSA STAR certification: Yes
CSA STAR accreditation date: 2019_11_22
CSA STAR certification level: Level 1: CSA STAR Self-Assessment
What the CSA STAR doesn’t cover: https://cloudsecurityalliance.org/star/registry/tenable-inc/
PCI certification: No
Cyber essentials: No
Cyber essentials plus: No
Other security certifications: Yes
Any other security certifications: SOC2.

https://www.tenable.com/products/tenable-io/faq#data-security

Security governance

Named board-level person responsible for service security: Yes
Security governance certified: Yes
Security governance standards: ISO/IEC 27001

Other
Other security governance standards: Yes. Tenable's policies were written based on the NIST cybersecurity framework, CEB library best practices , SANS institute documents and Tenable's own professional experience. Policies are shared with business units and reviewed collectively during internal workshop meetings. Once approved, policies are disseminated to all employees via our internal network protal.
Information security policies and processes: Tenable's Information Security and associated policies incorporate industry accepted standards and frameworks including ISO 27001, COBIT, NIST 800-53, and CSA.

Operational security

Configuration and change management standard: Supplier-defined controls
Configuration and change management approach: Not all systems require the same amount of development, testing, and approval. Changes to some systems are routine and represent little or no risk. Therefore, to ensure reasonable processing time for routine maintenance and other low risk change requests, and to ensure that more significant, higher impact changes receive the appropriate scrutiny and planning, the following types of changes have been established. These types have corresponding development, testing, and implementation requirements as well as specific approvals necessary to process. Classification of Change Types:
Provisioning
Configuration
Maintenance/ Upkeep
Development (existing)
Development (new)
Vulnerability management type: Supplier-defined controls
Vulnerability management approach: Internal vulnerability assessments are conducted weekly. Vulnerability management assessments include, but are not limited to, workstations, servers, cloud instances, networks, labs, internet-facing services, Tenable products, and third-party products.

Internal penetration tests are conducted quarterly. Tenable's internal penetration testing team performs assessments to identify risks that require mitigation. Our internal penetration testing methodologies follow the standards from NIST 800-115 and the PTES Technical Guidelines.

External 3rd party Penetration tests are also done annually for our cloud-based offerings and can be provided to customers, upon request, under an NDA agreement.
Protective monitoring type: Supplier-defined controls
Protective monitoring approach: All application logs, audit logs, syslog, and any other textual logs are captured and transmitted immediately to a 3rd party logging system. Additionally, all changes and actions taken in the AWS consoles are logged using CloudWatch. Alerts are generated when certain actions or conditions are met. Alerts are sent using our alerting and notification system.
Incident management type: Supplier-defined controls
Incident management approach: Notification will be made within 48 hours and not before the initial incident report, containing the basic facts, is completed. Notification will be sent to the data breach contact notification on file. Notification will be by email.

Secure development

Approach to secure software development best practice: Supplier-defined process

Public sector networks

Connection to public sector networks: No

Fighting climate change: Fighting climate change

Contract specific Social Value can be given on request
Covid-19 recovery: Covid-19 recovery

Contract specific Social Value can be given on request
Tackling economic inequality: Tackling economic inequality

Contract specific Social Value can be given on request
Equal opportunity: Equal opportunity

Contract specific Social Value can be given on request
Wellbeing: Wellbeing

Contract specific Social Value can be given on request

Pricing

Price: £14.55 a unit
Discount for educational organisations: No
Free trial available: Yes
Description of free trial: 60 day trials can be subscribed to via the website. Alternatively sales teams at Tenable can also be engaged for managed evaluations.

Nessus Home (free) is limited to 6 IP addresses and the inability to perform compliance checks.
Link to free trial: https://www.tenable.com/products/tenable-io/evaluate

Features

Benefits

Service documents

Framework

Service ID

Contact

Service scope

User support

Onboarding and offboarding

Using the service

Scaling

Analytics

Resellers

Staff security

Asset protection

Data importing and exporting

Data-in-transit protection

Availability and resilience

Identity and authentication

Audit information for users

Standards and certifications

Security governance

Operational security

Secure development

Public sector networks

Pricing

Service documents

Cookies on Digital Marketplace

Tenable.CS

Features

Benefits

Pricing

Service documents

Framework

Service ID

Contact

Service scope

User support

Onboarding and offboarding

Using the service

Scaling

Analytics

Resellers

Staff security

Asset protection

Data importing and exporting

Data-in-transit protection

Availability and resilience

Identity and authentication

Audit information for users

Standards and certifications

Security governance

Operational security

Secure development

Public sector networks

Social Value

Pricing

Service documents