Exponential-e Ltd

Next Generation Unified Threat Management (NGUTM)

Exponential-e Next Generation Unified Threat Management Service (NGUTM) delivers industry-leading security effectiveness with unmatched performance capabilities managed within a single pane of glass and fully visible to our customers.


  • Antivirus
  • Intrusion Prevention System
  • Application control
  • Web Filtering


  • Increased visibility within virtualised infrastructure monitoring
  • Rapid deployment capability
  • Ability to manage virtual and physical appliances
  • simple licensing with no per-user fees
  • Support for multiple virtualization and cloud platforms
  • Wide array of liscensing choices to fit any infrastructure requirement
  • VDOM-enabled models for multi-tenant environments

Service scope

Service scope
Software add-on or extension No
Cloud deployment model
  • Public cloud
  • Private cloud
  • Hybrid cloud
Service constraints Refer to Service Description.
System requirements Sized based on number of VCPU's and memory

User support

User support
Email or online ticketing support Email or online ticketing
Support response times 1 Hour
User can manage status and priority of support tickets Yes
Online ticketing support accessibility None or don’t know
Phone support Yes
Phone support availability 24 hours, 7 days a week
Web chat support No
Onsite support Yes, at extra cost
Support levels Exponential-e will use reasonable endeavours to ensure that the availability of the service purchased by the customer in a given calendar month equals the applicable Availability Commitment. Target Availability - 99.9%
Support available to third parties Yes

Onboarding and offboarding

Onboarding and offboarding
Getting started Implementation and configuration of the service can be quite complex and Exponential-e recognise that the crux of the service is for it to work how our customers want.
Exponential-e have a matrix of managed firewall implementation models under which this service falls; to assist our customers. These vary according to the complexity of the environment. Other variants are possible using our standard consultant day rate charges.
This Service is for the implementation and provision of standard Next Generation services and does not supersede or negate any need for additional professional services for more complex solutions.
Service documentation Yes
Documentation formats
  • HTML
  • PDF
End-of-contract data extraction All available user data will be extracted.
End-of-contract process Prior to end of contract, business will approach customer to renew/ upgrade service required by customer.

Using the service

Using the service
Web browser interface Yes
Supported browsers
  • Internet Explorer 7
  • Internet Explorer 8
  • Internet Explorer 9
  • Internet Explorer 10
  • Internet Explorer 11
  • Microsoft Edge
  • Firefox
  • Chrome
  • Safari 9+
Application to install Yes
Compatible operating systems
  • Android
  • IOS
  • Linux or Unix
  • MacOS
  • Windows
Designed for use on mobile devices No
Accessibility standards None or don’t know
Description of accessibility Please refer to Service Description.
Accessibility testing N/A
Customisation available Yes
Description of customisation Changes can be made swiftly to the service via the operations centre and enacted on a day change basis of 8 hours or an emergency basis of 4 hours.


Independence of resources N/A


Service usage metrics No


Supplier type Reseller providing extra support
Organisation whose services are being resold Fortinet

Staff security

Staff security
Staff security clearance Conforms to BS7858:2012
Government security clearance Up to Baseline Personnel Security Standard (BPSS)

Asset protection

Asset protection
Knowledge of data storage and processing locations Yes
Data storage and processing locations
  • United Kingdom
  • European Economic Area (EEA)
User control over data storage and processing locations Yes
Datacentre security standards Complies with a recognised standard (for example CSA CCM version 3.0)
Penetration testing frequency At least every 6 months
Penetration testing approach Another external penetration testing organisation
Protecting data at rest Encryption of all physical media
Data sanitisation process No
Equipment disposal approach A third-party destruction service

Data importing and exporting

Data importing and exporting
Data export approach N/A
Data export formats Other
Other data export formats N/A
Data import formats Other
Other data import formats N/A

Data-in-transit protection

Data-in-transit protection
Data protection between buyer and supplier networks TLS (version 1.2 or above)
Data protection within supplier network Other
Other protection within supplier network Please refer to terms of service.

Availability and resilience

Availability and resilience
Guaranteed availability SLAs, if any, are as communicated to you by the Provider in writing.
Approach to resilience Available on request
Outage reporting Service reports outages via email alerts.

Identity and authentication

Identity and authentication
User authentication needed No
Access restrictions in management interfaces and support channels Available on request
Access restriction testing frequency At least every 6 months
Management access authentication Identity federation with existing provider (for example Google Apps)

Audit information for users

Audit information for users
Access to user activity audit information Users contact the support team to get audit information
How long user audit data is stored for User-defined
Access to supplier activity audit information Users contact the support team to get audit information
How long supplier audit data is stored for User-defined
How long system logs are stored for User-defined

Standards and certifications

Standards and certifications
ISO/IEC 27001 certification Yes
Who accredited the ISO/IEC 27001 BSI
ISO/IEC 27001 accreditation date 13/4/2018
What the ISO/IEC 27001 doesn’t cover N/A
ISO 28000:2007 certification No
CSA STAR certification Yes
CSA STAR accreditation date 13/4/2018
CSA STAR certification level Level 3: CSA STAR Certification
What the CSA STAR doesn’t cover N/A
PCI certification Yes
Who accredited the PCI DSS certification Blackmores UK
PCI DSS accreditation date 19/3/2019
What the PCI DSS doesn’t cover Hosting Provider – Applications, Storage, Security Services, shared hosting, Online Hosting, Managed Services – System Security, IT Support, Backup, Cloud Services Payment Processes – All payment services
Other security certifications Yes
Any other security certifications CAS(T) NCSC-264868406-1689

Security governance

Security governance
Named board-level person responsible for service security Yes
Security governance certified Yes
Security governance standards ISO/IEC 27001
Information security policies and processes Available on request.

Operational security

Operational security
Configuration and change management standard Supplier-defined controls
Configuration and change management approach Details available on request.
Vulnerability management type Undisclosed
Vulnerability management approach Details available on request.
Protective monitoring type Supplier-defined controls
Protective monitoring approach We have a SOC service which provides security in depth to protect our customers environments and our own.
Incident management type Supplier-defined controls
Incident management approach Details available on request.

Secure development

Secure development
Approach to secure software development best practice Supplier-defined process

Public sector networks

Public sector networks
Connection to public sector networks No


Price £2163 per instance per year
Discount for educational organisations No
Free trial available No

Service documents

pdf document: Pricing document pdf document: Skills Framework for the Information Age rate card pdf document: Service definition document pdf document: Terms and conditions pdf document: Modern Slavery statement
Service documents
Return to top ↑