Phoenix Software Ltd

VMware Workspace ONE

Workspace ONE is a cloud-based simple and secure enterprise platform that delivers and manages any app on any smartphone, tablet, or laptop. With consumer grade self-service, single sign on access to cloud, mobile, and Windows apps and includes powerfully integrated email, calendar, file and social collaboration tools that engage users


  • Enterprise app catalog delivers the right apps to any device
  • Catalog can be easily customized to transform employee onboarding
  • Conditional Access policy enforcement to mobile, web, and Windows apps
  • Record application, device and console events to capture detailed information
  • Allow desktop administrators to automate application distribution and update
  • Remotely monitor and manage all devices connected to your enterprise
  • Enforce authentication strength and restrict access by device restrictions
  • Automate device compliance for advanced data leakage protection
  • Federates even the most complex on-premises Active Directory topologies
  • Leverage both new and existing forms of 3rd party authentication


  • Email app supports your mail accounts and integrates with repositories
  • View integrated calendar without having to navigate between apps
  • Secure email and attachments through the AirWatch Secure Email Gateway
  • Use content app to push/manage secure content on the device
  • Support your end users with remote assistance and troubleshooting
  • Remote configuration management allows employees to provision new devices anywhere
  • Employees determine desired level of access and corresponding management
  • User interface is simple, intuitive and responsive
  • Self-Service App Store meets consumer-style expectations
  • Accelerate the adoption of Windows 10


£11.87 per device per year

  • Education pricing available
  • Free trial available

Service documents

G-Cloud 9


Phoenix Software Ltd

Jonny Scott

01904 562200

Service scope

Service scope
Software add-on or extension No
Cloud deployment model Hybrid cloud
Service constraints The AirWatch Cloud Connector and/or IDM Connector are required for directory integration with Workspace ONE
System requirements
  • Please refer to the VMware Workspace ONE reference Architecture

User support

User support
Email or online ticketing support Email or online ticketing
Support response times Response times are based upon severity of incidents and support package
User can manage status and priority of support tickets No
Phone support Yes
Phone support availability 24 hours, 7 days a week
Web chat support No
Onsite support Yes, at extra cost
Support levels Pleaser refer to our website for support details:
Technical Support Managers are available at an additional cost
Support available to third parties Yes

Onboarding and offboarding

Onboarding and offboarding
Getting started We provide a comprehensive pre-installation checklist that includes all network and technical requirements that must be satisfied to help ensure a successful implementation. Our Account Executives and Professional Services team members will support you throughout the entire process, from pre-implementation meetings through the final hand-off to our Global Support Team.
- Upon the successful completion of all implementation deliverables, you can continue to leverage our breadth of professional services resources in the form of our global Support Services, extensive technical documentation and robust knowledgebase
Access a comprehensive and easily accessible catalog of training resources that provides varying levels of product knowledge and technical expertise, depending on the administrator role
Options include on-demand access to product documentation, instructional videos, online forums and instructor led training courses
Service documentation Yes
Documentation formats
  • HTML
  • PDF
  • Other
Other documentation formats CSV/PPT
End-of-contract data extraction Per Section 2.9 Deletion of Service Data from the Workspace ONE Privacy Addendum: Following expiration of the Agreement, we will endeavour to delete your Service Data within a reasonable period of time, except to the extent we are required to retain any Service Data for compliance with applicable law. If we are unable to delete your Service Data for technical or other reasons, we will apply measures to ensure that your Service Data is blocked from any further Processing.
- At the end of the contract, AirWatch can assist the customer in using solution controls to export data within the VMware AirWatch solution. Customers in a Dedicated Cloud deployment can leverage a robust data mart. Data is secured in transmission.
-- AirWatch has defined data retention and data disposal policies to safeguard data throughout its lifecycle.
-- Customers can export Workspace ONE data at any time from the administrator consoles.
End-of-contract process Per Section 2.9 Deletion of Service Data from the Workspace ONE Privacy Addendum: Following expiration of the Agreement, we will endeavor to delete your Service Data within a reasonable period of time, except to the extent we are required to retain any Service Data for compliance with applicable law. If we are unable to delete your Service Data for technical or other reasons, we will apply measures to ensure that your Service Data is blocked from any further Processing.
- At the end of the contract, AirWatch can assist the customer in using solution controls to export data within the VMware AirWatch solution. Customers in a Dedicated Cloud deployment can leverage a robust data mart. Data is secured in transmission.
- Customer data in the solution is overwritten every 30 days.
- Please refer to the VMware Data Privacy Addendum for additional details:

Using the service

Using the service
Web browser interface Yes
Supported browsers
  • Internet Explorer 10+
  • Microsoft Edge
  • Firefox
  • Chrome
  • Opera
Application to install Yes
Compatible operating systems
  • Android
  • IOS
  • Linux or Unix
  • MacOS
  • Windows
  • Windows Phone
  • Other
Designed for use on mobile devices Yes
Differences between the mobile and desktop service Workspace ONE is accessible via web browser and native mobile app and is easy to user regardless of device.
The Workspace ONE portal functions as a mobile app and a browser-based console. The mobile app version of the solution is available for download to corporate-owned or BYOD devices. The solution integrates with a desktop app launcher to deploy an HTML5-enabled desktop version.
Eliminate the need for employees to register each device through flexible deployment options for the browser and native mobile app:
- Employees can log-in and gain access to applications based on unique policies set for each app.
Accessibility standards None or don’t know
Description of accessibility Refer to the VMware Workspace ONE FAQ for details of the service accessibility
Accessibility testing VMware AirWatch is not officially VPAT certified and in general our software is not compliant with Section 508 and WCAG (Web Content Accessibility Guidelines) standards.
- We have completed an evaluation of our solution against these standards and we are partially compliant with some applicable topic areas.
- Furthermore, our solution runs on Microsoft products such as Microsoft SQL Server and Internet Explorer, both of which are very accessible products.
-- Public VPAT documents for these products are available on the Microsoft website.
- We offer a broad range of functionality in our product and for this reason it is a challenge to attain full compliance with accessibility standards.
- Our development and UI teams follow best practices when designing our software solutions and we will continue to work with our customer and partner communities to meet relevant accessibility needs where possible.
What users can and can't do using the API API configuration is done through the AirWatch console. Available APIs can be found on The solution provides full support for all major OEM Mobile Device Management APIs as they become available. Due to inherent manufacturer OS and API limitations, some features are not supported across all devices or OS versions.
API documentation Yes
API documentation formats
  • HTML
  • PDF
API sandbox or test environment Yes
Customisation available Yes
Description of customisation Administrators can build a branded login experience across desktop and mobile devices using customisable templates
Use company logo for featured components of the solution:
• Login prompts
• Application Launcher
• Favicon
• Add background picture
• Company and product name


Independence of resources The solution scales easily to support up to 100,000 concurrent users in a single instance
The software scales to support additional users, and we recommend that customers with large deployments work with professional services to ensure the optimal configuration for scalability


Service usage metrics Yes
Metrics types - Administrators can gather metrics from Workspace ONE via VMware AirWatch and VMware Identity Manager reporting and logging:
-- View events within Workspace ONE to capture detailed information
-- The VMware AirWatch solution records all console activity and provides data in a detailed log of users accessing the system and the events or actions taking place.
--- Customers can use the built-in event log, customizable dashboards, integrated reporting engine and AirWatch Hub to audit the web console and end-user actions.
-- The VMware Identity Manager admin console provides audit event reports for resource entitlements for groups and users.
Reporting types
  • API access
  • Real-time dashboards
  • Regular reports
  • Reports on request


Supplier type Reseller providing extra features and support
Organisation whose services are being resold VMware, Microsoft, Citrix etc.

Staff security

Staff security
Staff security clearance Staff screening not performed
Government security clearance Up to Developed Vetting (DV)

Asset protection

Asset protection
Knowledge of data storage and processing locations Yes
Data storage and processing locations
  • United Kingdom
  • European Economic Area (EEA)
  • EU-US Privacy Shield agreement locations
  • Other locations
User control over data storage and processing locations No
Datacentre security standards Managed by a third party
Penetration testing frequency At least once a year
Penetration testing approach In-house
Protecting data at rest Other
Other data at rest protection approach Global data center operations have undergone SSAE16 SOC2 Type II audits.
- Basic passwords, certificate private keys, client cookie data and tokens are encrypted in the SaaS environment with a derived AES 256-bit symmetric encryption algorithm
-- Customers can enable encryption at rest for user first name, last name, email and phone number
-- We do not store AD/LDAP passwords in our database
- VMware Content Locker, VMware Boxer and VMware AirWatch App Wrapping solutions use AES 256-bit encryption to secure data on mobile devices
Data sanitisation process Yes
Data sanitisation type Explicit overwriting of storage before reallocation
Equipment disposal approach In-house destruction process

Data importing and exporting

Data importing and exporting
Data export approach System administrators can record and export application, device and console events and reports via the Workspace ONE console
- Use the built-in VMware AirWatch reporting engine to regularly export solution data
-- Export console data using interactive dashboards (CSV), reports (CSV), the AirWatch Hub (PDF), and event log (CSV)
- Export VMware Identity Manager audit event logs and reports (CSV)
-- The following additional reports are available: recent activity, resource usage, resource entitlements, group membership, users and concurrent users
- Integrate with security information and event management (SIEM) solutions for enhanced logging of events occurring in the console
Data export formats CSV
Data import formats CSV

Data-in-transit protection

Data-in-transit protection
Data protection between buyer and supplier networks TLS (version 1.2 or above)
Data protection within supplier network Other
Other protection within supplier network The solution is SSL/TLS agnostic, and can support TLS version(s) 1.2+ as well as legacy SSL/TLS according to customer security requirements.

Availability and resilience

Availability and resilience
Guaranteed availability '- We have a guaranteed standard SLA of 99.9% for all Workspace ONE components
-- VMware Identity Manager as part of Workspace ONE SLAs are defined here:
-- VMware AirWatch SLAs are defined within the AirWatch Hosted Services Policy (
Approach to resilience '- Our solution meets strict requirements for high availability and redundancy through load balancing across multiple, geographically disparate data centers. We eliminate any single point of failure through the use of redundant equipment, network, power and clustering of key components.
-- We have a guaranteed standard SLA of 99.9%
- Additional information can be provided upon request.
Outage reporting "- In the unlikely event of a security incident, we will notify the appropriate customer IT stakeholders. Email announcements will maintain open lines of communication between support staff and customers regarding change management events, incident events and problem events.
- We will provide at least five days’ or as much advance notice as possible via email of maintenance windows."

Identity and authentication

Identity and authentication
User authentication needed Yes
User authentication
  • 2-factor authentication
  • Public key authentication (including by TLS client certificate)
  • Identity federation with existing provider (for example Google Apps)
  • Dedicated link (for example VPN)
  • Username or password
Access restrictions in management interfaces and support channels We have a formal Access Control policy that includes roles and responsibilities for Asset Owners, Asset Custodians and Users to help ensure proper access to information assets.
-- Strong passwords are required for access to production environments and corporate resources. Password policies are developed according to industry best practices and are technically enforced through Active Directory.
-- All access privileges are technically enforced using role-based access control, separation of duties and the principle of least privileges.
--- Production environment access requires two-factor authentication, is secured by VPN using AD credentials and is restricted to authorized members of applicable teams.
Access restriction testing frequency At least once a year
Management access authentication
  • 2-factor authentication
  • Public key authentication (including by TLS client certificate)
  • Identity federation with existing provider (for example Google Apps)
  • Dedicated link (for example VPN)
  • Username or password

Audit information for users

Audit information for users
Access to user activity audit information Users have access to real-time audit information
How long user audit data is stored for Less than 1 month
Access to supplier activity audit information Users contact the support team to get audit information
How long supplier audit data is stored for Between 1 month and 6 months
How long system logs are stored for Between 1 month and 6 months

Standards and certifications

Standards and certifications
ISO/IEC 27001 certification No
ISO 28000:2007 certification No
CSA STAR certification Yes
CSA STAR accreditation date 01/05/2016
CSA STAR certification level Level 1: CSA STAR Self-Assessment
What the CSA STAR doesn’t cover N/a
PCI certification No
Other security accreditations Yes
Any other security accreditations
  • Global DC operations undergone a SSAE16 SOC2 Type II audit
  • We comply with the European Data Protection Directive (95/46/EC)

Security governance

Security governance
Named board-level person responsible for service security Yes
Security governance accreditation Yes
Security governance standards Other
Other security governance standards '- We model our security framework using the NIST SP 800-53 rev. 4 standard
- We have an Information Security Governance Committee (ISGC) that is chaired by members of senior management and representatives from our Information Security, IT Operations, HR, Marketing, Facilities and Legal teams.
Information security policies and processes - Our Information Security Program is modeled using industry best practices and regulatory standards, including NIST SP 800-53 which typically align with customer policies and programs. We maintain our own Information Security Program and Policies to protect customer data hosted in our systems and perform annual reviews and audits of our program to ensure the integrity of our hosted offering.
-- The VMware Information Security team manages the enforcement, development, and maintenance of information security policies and standards to ensure VMware Information Assets are preserved in a security environment, in accordance with generally accepted best practices, focusing on VMware business and risk objectives. The VMware Information Security Team is responsible for updating policies as threats and technologies change, initiating and managing periodic reviews of the information security policies and standards, as well as evaluating exceptions to information security policy and standards.
-- Our Information Security team oversees organizational compliance while team leads in conjunction with IT and HR teams help enforce department-level compliance.

Operational security

Operational security
Configuration and change management standard Supplier-defined controls
Configuration and change management approach We maintain a documented Configuration Management policy based on industry best practices to harden SaaS environment and Change Control Policy to manage changes to SaaS environment
-- Changes to Configuration Management policy are processed through Change Management policy
-- Change Management includes approval, testing, implementation and rollback
--- Support staff members initiate change through change control form, which Change Advisory Board team reviews for completeness, impact and scheduling. Severity level of change is categorized.
--- Once form is approved, change is scheduled and alert is released to necessary groups; once change is made, it is tested, validated and closed
Vulnerability management type Supplier-defined controls
Vulnerability management approach We receive threat information and explore threat resolutions from the VMware Security Response Center (
- Regular internal and external vulnerability assessments tests performed against the SaaS environment
- Risk methodology based on NIST standards, including:
-- Identifying and characterizing threats
-- Assessing the vulnerability of critical assets to specific threats
-- Determining risk (i.e., expected likelihood and consequences of attacks)
-- Identifying ways to reduce risks
-- Prioritizing risk reduction measures based on strategy
Protective monitoring type Conforms to a recognised standard, for example CSA CCM v3.0 or SSAE-16 / ISAE 3402
Protective monitoring approach Our cloud support staff have configured the system to notify IT personnel if the central processing unit (CPU) utilization is too high, disk space limited, memory issues, key service failures, bandwidth utilization, power consumption, or other performance items.
- IT Operations has subscriptions to pertinent vendor security and bug-tracking mailing lists.
- After analyzing the severity and impact, network, utility and security equipment is patched or upgraded.
Incident management type Supplier-defined controls
Incident management approach We maintain an Incident Management Plan as part of our Information Security Program.
- Incidents are reported to and resolved by the appropriate Cloud Operations team and by senior management where needed.
-- Alerts, responses and resolutions are tracked through completion.
-- In the unlikely event of an incident, we will notify customers within two business days of any customer data that is affected.
- Incident logs are reviewed by applicable support personnel for analysis and remediation to avoid further incidents of similar type. All remediation actions are reviewed and approved by our Information Security Governance Committee.

Secure development

Secure development
Approach to secure software development best practice Conforms to a recognised standard, but self-assessed

Public sector networks

Public sector networks
Connection to public sector networks No


Price £11.87 per device per year
Discount for educational organisations Yes
Free trial available Yes
Description of free trial Test-drive the full technical capabilities of Workspace ONE with VMware Hands-on Labs


Pricing document View uploaded document
Skills Framework for the Information Age rate card View uploaded document
Service definition document View uploaded document
Terms and conditions document View uploaded document
Return to top ↑