Armadillo Managed Services

CyberArk CorePAS Privileged Access Management (PAM)

CyberArk provide Privileged Access Management (PAM) software, this is an end-to-end solution that protects, manages and audits both user and application credentials, provides least privilege access and session isolation while recording, monitoring and responding to all real time privileged activity using intelligent threat analytics.


  • (EPV) Secure and tamper proof digital vault
  • (PSM) Single-sign-on control point that isolates
  • (PTA) Intelligent real time audit to respond to threats.


  • Manage Privilege at an Enterprise level through policy driven rules
  • Protection all privileged Accounts and SSH Keys
  • Control Access to Privileged Accounts
  • Initiate and Monitor Privileged Sessions
  • Manage application and service credentials
  • Comply with audit and regulatory requirements
  • Streamlined management of Privileged Accounts
  • Seamlessly integrate with enterprise systems
  • Detect and respond to known threats such as over-pass-the-hash
  • Risk Scoring of privileged use and session behaviours


£665.2 per user

  • Free trial available

Service documents


G-Cloud 11

Service ID

7 5 9 6 6 1 8 7 1 4 0 8 7 3 6


Armadillo Managed Services

John Webster


Service scope

Software add-on or extension
Yes, but can also be used as a standalone service
What software services is the service an extension to
"Application Access Manager (AAM)
Secrets management for DevOps and automation processes
On-Demand Privileges Manager (OPM)
Control and monitor commands and replacement of SUDO
Endpoint Privilege Manager (EPM)
Server and Workstation least privilege, credential theft protection
Privileged Session Manager for Cloud (PSM4C)
Control point that isolates, records and audits privileged access"
Cloud deployment model
  • Private cloud
  • Hybrid cloud
Service constraints
Supplied upon request, contact your CyberArk Partner to arrange an initial needs assessment session to capture your service specific requirements
System requirements
See release notes for CorePAS in the CyberArk Implementation Guide

User support

Email or online ticketing support
Yes, at extra cost
Support response times
1 hour
User can manage status and priority of support tickets
Online ticketing support accessibility
None or don’t know
Phone support
Phone support availability
24 hours, 7 days a week
Web chat support
Onsite support
Yes, at extra cost
Support levels
Bespoke options available upon requirements
Support available to third parties

Onboarding and offboarding

Getting started
CyberArk Training and Certification is available and required before customers can access the main Support service.
Service documentation
Documentation formats
  • HTML
  • ODF
  • PDF
End-of-contract data extraction
End-of-contract process
Customers who do not have an active license agreement cannot access the CyberArk Support service

Using the service

Web browser interface
Supported browsers
  • Internet Explorer 10
  • Internet Explorer 11
  • Microsoft Edge
  • Firefox
  • Chrome
  • Safari 9+
  • Opera
Application to install
Compatible operating systems
  • Android
  • IOS
  • Linux or Unix
  • MacOS
Designed for use on mobile devices
Service interface
Description of service interface
Services such as knowledgebase, logging and reviewing support tickets as well as communicating with the support team. Downloading new versions, patches and software updates
Accessibility standards
None or don’t know
Description of accessibility
Accessibility testing
What users can and can't do using the API
API documentation
API documentation formats
API sandbox or test environment
Customisation available
Description of customisation
End users cannot customise the Solution. However, when setting up the CyberArk solution, it should be customised with several user defined parameters in line with the clients requirements. E.g. time logs files are kept for, rules for raising flags and reporting content & scheduling etc.


Independence of resources
CyberArk Core PAS is not a shared service. It is implemented as an individual instance per enterprise so there is complete independence from the demands of other businesses.


Service usage metrics
Metrics types
"Metrics include: transactions per second, number of users,
average queue time, number of successful
changes/verifications/reconciliations , number of failed
Reporting types
  • Regular reports
  • Reports on request


Supplier type
Reseller providing extra support
Organisation whose services are being resold

Staff security

Staff security clearance
Other security clearance
Government security clearance
Up to Baseline Personnel Security Standard (BPSS)

Asset protection

Knowledge of data storage and processing locations
Data storage and processing locations
  • United Kingdom
  • European Economic Area (EEA)
  • EU-US Privacy Shield agreement locations
User control over data storage and processing locations
Datacentre security standards
Supplier-defined controls
Penetration testing frequency
At least every 6 months
Penetration testing approach
Protecting data at rest
Other data at rest protection approach
We do not hold data at rest
Data sanitisation process
Equipment disposal approach
Complying with a recognised standard, for example CSA CCM v.30, CAS (Sanitisation) or ISO/IEC 27001

Data importing and exporting

Data export approach
"CyberArk is a client hosted solution (even in the cloud), as such users will always exclusively own and hold their data which they can export and report on. Users can export metadata, but not passwords from
the solution. Users are able to produce reports on activity using the web portal."
Data export formats
  • CSV
  • Other
Other data export formats
Data import formats

Data-in-transit protection

Data protection between buyer and supplier networks
Private network or public sector network
Data protection within supplier network
TLS (version 1.2 or above)

Availability and resilience

Guaranteed availability
"SLA's will be defined once the target operating model with the
buyer is agreed."
Approach to resilience
There are many methods of designing resiliency into a CyberArk system. It is always a highly business-critical system and the CyberArk solution has evolved over many years to maximise availability and remove single points-of-failure. Further details are available on request.
Outage reporting
Public Dashboard & Email

Identity and authentication

User authentication needed
User authentication
2-factor authentication
Access restrictions in management interfaces and support channels
For a full description of how the CuberArk solution Authenticates users, please see the attached service definition document: file name = CyberArk_Core Privileded Access Security_2019.pdf
Access restriction testing frequency
At least every 6 months
Management access authentication
2-factor authentication

Audit information for users

Access to user activity audit information
Users have access to real-time audit information
How long user audit data is stored for
Access to supplier activity audit information
Users contact the support team to get audit information
How long supplier audit data is stored for
How long system logs are stored for

Standards and certifications

ISO/IEC 27001 certification
Who accredited the ISO/IEC 27001
The Standards Institute Israel Certificate
ISO/IEC 27001 accreditation date
What the ISO/IEC 27001 doesn’t cover
Certificate is Applicable to Business processes: Research, development, sales and support of information security solutions and
ISO 28000:2007 certification
CSA STAR certification
PCI certification
Other security certifications

Security governance

Named board-level person responsible for service security
Security governance certified
Security governance standards
ISO/IEC 27001
Information security policies and processes
"The Information Security Department must provide direction and technical expertise to ensure that CyberArk’s information is properly protected. This includes consideration of confidentiality, integrity, and availability of information and the systems that handle it. The Department act as liaison on InfoSec matters between all departments, and must be the focal point for all InfoSec activities throughout CyberArk.

The Department performs risk-assessments, prepares action-plans, evaluates vendor-products, participates on in-houseIT system development projects, assists control Implementations, investigates information security breaches, trains staff members.

The InfoSec Department has the authority to create and periodically modify both technical standards and standard operating procedures that supports the InfoSec policy. When approved by appropriate CyberArk management, new requirements have the same scope and authority as if they were included in existing policy documents.

An information security steering committee, consisting of the CEO, GM, CIO and CISO
must meet bi-weekly to review the current status of information security at CyberArk,
approve and later review information security projects, and perform other necessary
high-level information security management activities. Other employees may join the
committee according to necessity and relevance.

An information security Audit committee is being updated with information security
work plan and risks management on a bi-quarterly basis."

Operational security

Configuration and change management standard
Supplier-defined controls
Configuration and change management approach
Available on request
Vulnerability management type
Supplier-defined controls
Vulnerability management approach
As opposed to other cloud service providers who only provide a service but use 3rd-party technologies, CyberArk developed all the technologies it uses from scratch and only uses standard servers and routers (no 3rd-party technologies). This allows much more flexibility and rapid reaction to new threats and attack vectors as we do not have to wait for updates and patches – we do them ourselves immediately. In order to fight todays sophisticated and constantly changing attack patterns we have CyberArk’s 24x7 SOC - manned with security experts that can handle any attack in real time.
Protective monitoring type
Protective monitoring approach
Available on request
Incident management type
Incident management approach
We have defined process of incident response and an incident response team whose responsibilities include: Analysis of the security issue risk (based on Severity Matrix and CVSS), remediation and recommendation. SLA of handling the issue according to the risk level. In case the decision is to fix, the fix is like any standard feature\bug development, including validation (QA) and automation. Security bulletin - in case a security issue found risky, and requires patch, we have a mechanism of publishing "security bulleting" to our customers. This bulletin contains explanation of the issue, and mitigation steps (including patch if needed).

Secure development

Approach to secure software development best practice
Supplier-defined process

Public sector networks

Connection to public sector networks


£665.2 per user
Discount for educational organisations
Free trial available
Description of free trial
Full product on qualified 14- day proof-of-concept trial. The CyberArk Discover and Audit (DnA) module is also available to run free-of-charge to baseline and establish PAM requirements

Service documents

Return to top ↑