TESTFYRA LIMITED

Infrastructure Monitoring & Management Services

Enterprise infrastructure monitoring and management solutions including real-time network monitoring, log intelligence, and IP address management. SolarWinds-powered network visibility across LAN/WAN/WiFi, switch, router, access points, wireless controllers, applications, custom log aggregation and analysis frameworks, and cloud-native DHCP management. Supports on-premises, cloud, and hybrid deployments with 24/7 managed services

Features

• Real‑time monitoring across LAN, WAN, Wi‑Fi, and network devices.
• SolarWinds visibility with custom dashboards and automated alerts.
• Log collection, analysis, visualisation, retention, and archiving.
• Custom log frameworks for infrastructure and compliance needs.
• Cloud‑native DHCP with IP allocation and lease tracking.
• DHCP failover ensuring high availability and continuity.
• Performance optimisation with bottleneck detection and capacity planning.
• Multi‑vendor support for Cisco, Juniper, HP, and Aruba.
• - Predictive analytics enabling proactive fault detection.
• ITSM integration with ServiceNow, JIRA, and custom systems.

Benefits

• Reduce downtime with proactive monitoring detecting issues early.
• Optimise network performance by removing bottlenecks quickly.
• Lower operational costs through automated monitoring processes.
• Ensure compliance with audit trails and log retention.
• Improve security by detecting anomalies and suspicious activity.
• Scale visibility easily as networks grow without reconfiguration.
• Simplify troubleshooting with centralised, real‑time dashboards.
• Prevent IP conflicts using automated DHCP management.
• Accelerate incident resolution with detailed logs and telemetry.
• Support hybrid cloud with seamless on‑prem and cloud monitoring.

• Education pricing available
• Free trial available

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at contact@testfyra.com. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 15

Service ID

600980922984696

Contact

Kam Sangha
07814
contact@testfyra.com

About your service

• Service categories:

  Systems Infrastructure Software

  Network

  Network management

  • Network performance management (NPM)
  • Network operations management (NOM)
• Multi cloud support: Yes

Service scope

• Software add-on or extension: No
• Cloud deployment model:
  • Public cloud
  • Private cloud
  • Community cloud
  • Hybrid cloud
• Service constraints: Infrastructure monitoring requires network access via SNMP, SSH, or API. Firewalls must allow traffic from TestFyra systems or on-prem agents. Enable SNMP v2/v3 on devices with valid credentials. Custom log framework development takes 3–5 months. Legacy devices may need firmware updates for monitoring. High-volume log ingestion (>1TB/day) demands extra storage at added cost. Real-time monitoring depends on latency; WAN links >200ms may delay alerts. Minimum SNMP access is read-only; read-write enables automated remediation.
• System requirements:
  • Network device SNMP v2 or v3 enabled with credentials provided
  • Firewall rules permitting monitoring traffic from TestFyra IP addresses specified
  • SSH or Telnet access to network devices for advanced diagnostics
  • Syslog forwarding configured directing logs to TestFyra collection infrastructure securely
  • NTP synchronization across all monitored devices ensuring accurate log timestamps
  • Minimum network bandwidth: 10Mbps for monitoring traffic and data collection
  • API access credentials for cloud platforms (AWS, Azure, GCP) monitoring
  • Admin-level credentials for initial setup, configuration, and integration activities
  • DNS resolution functioning correctly for hostname-based monitoring and device discovery
  • VLAN access or network segments visibility for comprehensive infrastructure monitoring

User support

• Email or online ticketing support: Yes, at extra cost
• Support response times: TestFyra offers flexible support tailored to testing project needs. Standard Support provides business‑hours remote assistance, monitoring, defect triage, and troubleshooting, with 4‑hour critical and 24‑hour non‑critical responses. Enhanced Support extends hours with a dedicated Test Manager, priority defect handling, analytics, automation support, and strategy reviews, with 2‑hour and 8‑hour response targets. Premium Support delivers 24/7 coverage with an embedded Test Lead, real‑time dashboards, immediate incident response, proactive monitoring, and continuous improvement, with 1‑hour and 4‑hour response times. All tiers include documentation, knowledge transfer, and access to TestFyra’s testing platforms.
• User can manage status and priority of support tickets: Yes
• Online ticketing support accessibility: WCAG 2.2 AA
• Phone support: No
• Web chat support: No
• Onsite support: Yes, at extra cost
• Support levels: TestFyra provides tiered infrastructure monitoring support matching operational requirements.; Standard Support - 24/7 automated monitoring with email alerts for critical infrastructure events. Business hours (9am-5pm, Monday-Friday) phone and email support for alert investigation and troubleshooting. Monthly health reports showing infrastructure performance trends, capacity utilisation, and optimisation recommendations. Response time: 4 hours for critical alerts, 24 hours for non-critical issues. Cost: £1,000/day for setup + £500/month monitoring; Enhanced Support - 24/7 monitoring with SMS and phone call escalations for critical alerts. Extended support hours (7am-10pm, 7 days) with dedicated Infrastructure Engineer providing proactive monitoring, performance tuning, and capacity planning. Weekly performance reviews and bi-weekly optimization sessions. Quarterly infrastructure audits with detailed improvement roadmaps. Response time: 2 hours critical, 8 hours non-critical. Cost: £1,500/day setup + £1,200/month monitoring; Premium Support - Fully managed 24/7/365 infrastructure monitoring with dedicated NOC (Network Operations Center) team. Infrastructure Manager providing on-site presence 2-3 days weekly. Proactive issue remediation, automated healing workflows, and predictive analytics preventing outages. Real-time dashboard access, instant Teams notifications, and executive monthly reporting. Response time: 30 minutes critical, 2 hours non-critical. Cost: £2,200/day setup + £2,500/month monitoring; All tiers include monitoring platform licensing, dashboard customisation, integration support, and quarterly business reviews.
• Support available to third parties: No

Onboarding and offboarding

• Getting started: TestFyra ensures seamless infrastructure‑monitoring deployment through a structured onboarding process.; Phase 1: Infrastructure Discovery (Week 1); A detailed discovery session identifies all devices, systems, and monitoring needs. TestFyra reviews topology diagrams, inventories, monitoring gaps, and alert priorities. Critical services, business hours, escalation paths, and SLA expectations are documented. A tailored implementation plan defines device coverage, alert thresholds, and dashboards.; Phase 2: Monitoring Platform Deployment (Weeks 1–2); SolarWinds components or cloud‑based agents are deployed across the environment. SNMP access, SSH credentials, and log‑forwarding configurations are established. Secure connectivity is created between monitoring systems and infrastructure. Initial dashboards display network health, performance, and capacity utilisation.; Phase 3: Alert Configuration (Week 2); Alert thresholds are set using baseline performance data and business‑impact analysis Escalation policies align with organisational structures and on‑call schedules. Maintenance‑window suppression prevents false positives. Alert mechanisms are tested to ensure notifications reach the correct teams.; Phase 4: Knowledge Transfer (Weeks 2–3); Administrators receive training on dashboards, alert handling, and reporting. Documentation, troubleshooting guides, and runbooks are provided. TestFyra reviews existing support processes to understand workflows.; Phase 5: Optimisation (Weeks 3–4); Alert thresholds are refined to reduce noise. Dashboards are customised for stakeholders, and automated remediation workflows are introduced where appropriate.
• Service documentation: Yes
• Documentation formats:
  • HTML
  • PDF
• End-of-contract data extraction: TestFyra ensures complete monitoring‑data extraction to support a seamless transition at contract end. Historical monitoring data, including performance metrics, availability statistics, and capacity trends, is exported in CSV, JSON, or Excel formats compatible with standard analytics tools. Time‑series datasets cover device metrics, interface utilisation, response times, and error rates, with configurable daily, weekly, or monthly aggregations. Retention typically spans 12–24 months depending on the service tier.; Complete log archives are exported in syslog or compressed text formats, preserving original timestamps and metadata. Logs are organised by device, severity, and date range, with searchable exports enabling historical analysis and compliance audits.; All monitoring configurations—such as device templates, alert rules, dashboard layouts, and automation workflows—are provided in XML or JSON. Network‑device configurations captured during the monitoring period are included for reference. Custom scripts and automation code are delivered with full source and documentation.; Historical performance reports, capacity‑planning analyses, and infrastructure‑health assessments are supplied as PDF archives. Network topology maps, inventory lists, and monitoring‑architecture diagrams are delivered in editable formats.; Clients receive 90 days of read‑only platform access for historical reference and report generation. All exported data is deleted within 30 days, with GDPR‑compliant sanitisation and written confirmation
• End-of-contract process: TestFyra manages infrastructure monitoring contract closure systematically:; 60 Days Before Contract End: Initiate transition planning discussing handover requirements, data extraction needs, and potential service continuation or migration. Prepare comprehensive asset inventory including monitored devices, alert configurations, custom dashboards, and integration points. Schedule knowledge transfer sessions and documentation handover.; Final 30 Days: Export all historical monitoring data, logs, configurations, and reports in agreed formats. Conduct detailed handover sessions covering monitoring architecture, alert management procedures, troubleshooting methodologies, and platform administration. Provide recorded training materials and complete documentation packages for operational continuity.; Contract End Activities: Deliver complete data export including performance metrics, log archives, configuration backups, and historical reports. Remove TestFyra monitoring agents from client infrastructure and revoke SNMP/SSH access credentials. Provide data deletion certificate confirming removal of all client information from TestFyra systems per GDPR compliance. Disable alerting to prevent continued notifications after service termination.; Post-Contract Options: Offer 30-60 day transition support period at reduced rates for migration queries and troubleshooting. Provide ad-hoc consulting for monitoring platform selection and implementation if required.; Final Deliverables: Project closure report summarising monitoring insights, infrastructure health trends, capacity recommendations, and suggestions for continued operational excellence. Compliance documentation and audit reports for record retention.
• Documentation accessibility standard: WCAG 2.2 AA

Using the service

• Web browser interface: Yes
• Supported browsers:
  • Microsoft Edge
  • Firefox
  • Chrome
  • Safari
  • Opera
  • Other
• Application to install: No
• Designed for use on mobile devices: Yes
• Differences between the mobile and desktop service: Some services will work better on desktop version.
• Service interface: Yes
• User support accessibility: WCAG 2.2 AA
• Description of service interface: TestFyra offers role-based access through four intuitive interfaces. The Web-Based Dashboard provides a responsive browser platform (Chrome, Firefox, Safari, Edge) for managing test projects, monitoring real-time execution, and generating reports. RESTful APIs allow programmatic test execution, result retrieval, and CI/CD integration. Finally, the Admin Console centralizes user permissions, project setup, and reporting, secured via SSO authentication. Each interface ensures seamless, efficient testing tailored to user needs.
• Accessibility standards: WCAG 2.2 AA
• Accessibility testing: TestFyra has not conducted formal user testing with assistive technology users to date. However, our web-based interfaces are developed following WCAG 2.1 Level AA guidelines including semantic HTML markup, keyboard navigation support, ARIA attributes for dynamic content, sufficient color contrast ratios (4.5:1 minimum), and alternative text for non-text content. Automated accessibility scanning performed using Axe and WAVE tools during development identifying and addressing common accessibility barriers. We are committed to conducting formal accessibility testing with assistive technology users for future releases and welcome feedback from users requiring accessibility accommodations to improve service inclusivity.
• API: Yes
• What users can and can't do using the API: TestFyra provides custom API implementations tailored to client requirements rather than standardized product APIs. Typical capabilities include programmatic test execution, real-time status monitoring, automated result retrieval, performance data extraction, and CI/CD integration. Users can automate testing workflows, integrate with DevOps pipelines, and generate custom reports.; API limitations defined collaboratively based on security and operational requirements, typically including rate limiting, authentication token expiration, restricted production environment access, and read-only access for sensitive configurations. Specific API capabilities, endpoints, authentication methods, and constraints documented in project-specific specifications ensuring APIs match exact client needs and security policies.
• API documentation: Yes
• API documentation formats:
  • Open API (also known as Swagger)
  • HTML
  • PDF
• API sandbox or test environment: Yes
• Customisation available: Yes
• Description of customisation: TestFyra services are highly customisable to match specific organisational requirements, workflows, and technical environments.; What Can Be Customised: Dashboards and reporting formats tailored to stakeholder preferences, alert thresholds and notification rules matching operational priorities, integration points with existing systems (ITSM, monitoring, CI/CD tools), user roles and permissions reflecting organisational structure, automated workflows and business logic specific to client processes, data retention policies meeting compliance requirements, branding elements including logos and colour schemes, and API endpoints for custom integrations.; How Users Customise: Configuration performed through web-based administrative interfaces for standard customisations including dashboard layouts, alert rules, user management, and reporting preferences. Complex customisations requiring code changes (custom integrations, workflow logic, API extensions) delivered through change request process with TestFyra development team implementing modifications. Infrastructure-as-code configurations enable version-controlled customisation management.; Who Can Customise: Administrative users with appropriate permissions can perform standard customisations through web interface including dashboard modifications, alert configurations, user management, and report generation. Technical customisations requiring code changes restricted to designated administrators submitting formal change requests. TestFyra provides training enabling client teams to perform routine customisations independently while supporting complex modifications through professional services engagements.

Scaling

• Independence of resources: TestFyra ensures strong infrastructure isolation to maintain consistent monitoring performance. Each client receives dedicated monitoring collectors, databases, and processing resources, eliminating cross‑tenant contention. Capacity is allocated according to device counts and log volumes, with a 40% overhead to support growth and peak activity. Performance commitments include maximum alert‑delivery latency of 60 seconds, dashboard load times under three seconds, and query responses within five seconds. Critical alerts are always processed with highest priority, regardless of platform load. The scalable architecture automatically adds resources when utilisation exceeds 70%, preventing performance degradation and ensuring stable, predictable monitoring operations.

Analytics

• Service usage metrics: Yes
• Metrics types: TestFyra provides comprehensive service metrics enabling performance monitoring and continuous improvement. Metrics include availability percentages, incident response times,resolution times, ticket volumes by severity, service request fulfillment rates, and SLA compliance percentages. Real-time dashboards display current service health, performance trends, and capacity utilisation. Monthly reports deliver detailed analytics covering incident patterns, root cause analysis, service quality trends,improvement recommendations. Custom metrics tailored to client requirements including business-specific KPIs, user satisfaction scores, and operational efficiency indicators. Historical data retention enables trend analysis and forecasting. All metrics accessible via web dashboards, automated email reports, and API exports for integration with client analytics platforms
• Reporting types:
  • API access
  • Real-time dashboards
  • Regular reports
  • Reports on request
• Resource tagging: Yes
• FOCUS resource tagging: No

Resellers

• Supplier type: Reseller providing extra features and support
• Organisation whose services are being resold: Solarwinds

Staff security

• Staff security clearance: Other security clearance
• Government security clearance: Security Clearance (SC)

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations: United Kingdom
• User control over data storage and processing locations: Yes
• Datacentre security standards: Supplier-defined controls
• Penetration testing frequency: At least once a year
• Penetration testing approach: In-house
• Protecting data at rest: Encryption of all physical media
• Data sanitisation process: Yes
• Equipment disposal approach: A third-party destruction service
• Data sanitisation type:
  • Deleted data can’t be directly accessed / Cryptographic Erasure
  • Data Erasure

Data importing and exporting

• Data export approach: Users can export infrastructure monitoring data via multiple methods:; Dashboard Exports – SolarWinds and custom dashboards allow one-click downloads of reports, charts, and metrics in PDF, Excel, or CSV formats.; API Access – RESTful APIs enable bulk data extraction for integration with analytics platforms and automated workflows; full documentation provided.; Scheduled Reporting – Automated daily, weekly, or monthly reports delivered via email or SFTP with performance summaries and capacity trends.; Database Queries – Read-only database access supports advanced custom analysis.; All exports include metadata for context, traceability, and accurate interpretation.
• Data export formats: CSV
• Data import formats: CSV

Data-in-transit protection

• Data protection between buyer and supplier networks:
  • Private network or public sector network
  • TLS (version 1.2 or above)
  • IPsec or TLS VPN gateway
  • Legacy SSL and TLS (under version 1.2)
• Data protection within supplier network:
  • TLS (version 1.2 or above)
  • IPsec or TLS VPN gateway
  • Legacy SSL and TLS (under version 1.2)

Availability and resilience

• Guaranteed availability: TestFyra guarantees industry-leading availability backed by comprehensive SLAs:; Availability Targets:; Standard Tier - 99.5% uptime during business hours (9am-5pm, Monday-Friday), equivalent to maximum 2 hours monthly downtime. Planned maintenance windows excluded, scheduled outside business hours with 5 days advance notice.; Enhanced Tier - 99.7% uptime across extended hours (8am-8pm, Monday-Saturday), maximum 1.3 hours monthly downtime. Emergency maintenance permitted with 24-hour notice; routine maintenance outside operating hours.; Premium Tier - 99.9% uptime 24/7/365, maximum 1-2 hour monthly downtime. Fully redundant infrastructure with automatic failover. Maintenance performed with zero-downtime rolling updates. Emergency support available within 15 minutes.; Measurement & Reporting: Availability measured monthly excluding scheduled maintenance windows. Real-time status dashboard accessible to clients showing current system health and historical uptime metrics. Monthly availability reports delivered showing actual performance against SLA targets.; Exclusions: Force majeure events, client-caused issues (network problems, incorrect configurations), third-party service failures beyond TestFyra control, and pre-scheduled maintenance windows not counted against availability guarantees.
• Approach to resilience: TestFyra's monitoring infrastructure implements comprehensive resilience ensuring continuous visibility:; Redundant Monitoring Architecture: Dual monitoring collectors deployed for each client with active-passive or active-active configurations. Primary collector failure triggers automatic failover to secondary within 2 minutes. Geographic distribution across separate UK data centers prevents single-site failures impacting monitoring capabilities.; Data Collection Resilience: Monitoring agents buffer metrics locally during connectivity interruptions preventing data loss. Upon restoration, buffered data automatically synchronizes to central platform. SNMP polling retries automatically with exponential backoff handling transient network issues gracefully.; Database Resilience: Time-series databases replicated in real-time across multiple nodes with automatic failover. Continuous incremental backups with 5-minute RPO (Recovery Point Objective). Complete monitoring platform restoration achievable within 2-hour RTO (Recovery Time Objective).; Alert Delivery Redundancy: Multiple notification channels (email, SMS, phone calls, webhooks) ensure alert delivery even if primary channel fails. Alert queuing prevents loss during temporary notification service outages. Retry mechanisms with escalation ensure critical alerts always reach appropriate personnel.; Network Resilience: Multiple ISP connections with automatic failover. Monitoring collectors distributed across network segments reducing dependency on single network paths.; Platform Monitoring: Self-monitoring systems detect monitoring platform issues with automated recovery procedures. 24/7 NOC team monitors monitoring infrastructure health ensuring meta-monitoring visibility.
• Outage reporting: TestFyra maintains transparent communication during service disruptions through multi-channel notification:; Real-Time Status Page: Public status dashboard (status.testfyra.com) displays current system health with color-coded indicators (operational, degraded, outage). Historical uptime statistics and scheduled maintenance calendar visible. RSS feeds and webhook integrations available for automated monitoring.; Proactive Notifications: Immediate Alert - Within 5 minutes of detecting service disruption, automated emails sent to registered technical contacts describing issue scope, affected services, and estimated resolution time.; Progress Updates - Every 30 minutes during active incidents, update notifications provide investigation progress, root cause findings, and revised resolution estimates.; Resolution Notification - Upon service restoration, comprehensive incident report delivered detailing: timeline of events, root cause analysis, resolution steps, preventive measures.; Communication Channels:; • Email alerts to designated contacts; • SMS notifications for critical outages (premium tier); • Teams integration posting updates to dedicated channels; • Phone calls to service managers for major incidents; Scheduled Maintenance: Planned maintenance windows announced 5 days advance via email with detailed scope, duration, and expected impact. Calendar invitations sent for tracking. Post-maintenance confirmation sent upon successful completion.; Post-Incident Reviews: Major outages trigger formal post meetings with stakeholders, delivering detailed reports including lessons learned and improvement commitments.

Identity and authentication

• User authentication needed: Yes
• User authentication:
  • Multi-Factor Authentication (MFA)
  • Public key authentication (including by TLS client certificate)
  • Dedicated link (for example VPN)
  • Username or password
• Access restrictions in management interfaces and support channels: TestFyra enforces strict access controls to protect all management systems. Multi‑Factor Authentication is mandatory for administrative access, using time‑based one‑time passwords or hardware security keys. Role‑Based Access Control applies the least‑privilege principle, ensuring staff receive only the permissions required, with support teams limited to their assigned client accounts. IP whitelisting restricts management interfaces to corporate networks and approved VPN access, with geographic blocks on high‑risk regions. Sessions automatically log out after 15 minutes of inactivity, and concurrent sessions are limited. All administrative actions are immutably logged with full user identification, timestamps, and activity details.
• Access restriction testing frequency: At least once a year
• Management access authentication:
  • Multi-Factor Authentication (MFA)
  • Public key authentication (including by TLS client certificate)
  • Dedicated link (for example VPN)
  • Username or password

Audit information for users

• Access to user activity audit information: Users contact the support team to get audit information
• How long user audit data is stored for: At least 12 months
• Access to supplier activity audit information: Users contact the support team to get audit information
• How long supplier audit data is stored for: At least 12 months
• How long system logs are stored for: At least 12 months

Security governance

• Named board-level person responsible for service security: Yes
• Security governance certified: No
• Security governance approach: TestFyra has established a comprehensive security governance framework in preparation for ISO 27001 certification. A designated Information Security Manager oversees governance with senior management involvement and quarterly security reviews. A full policy suite is in place covering information security, secure development, access control, data protection, incident response, and business continuity aligned to ISO 27001. Risks are identified and mitigated through structured assessments, vulnerability management, penetration testing. Cyber Essentials certification provides validated baseline controls. Secure development follows OWASP guidance with code reviews and automated testing. GDPR procedures are documented. Staff receive quarterly training. Internal audits are complete, certification expected in 2026.
• Information security policies and processes: TestFyra maintains comprehensive information security governance aligned with international standards:; ISO 27001 Certified (Certification in-progress): Information Security Management System (ISMS) certified to ISO/IEC 27001:2022 covering all testing services and infrastructure. Annual surveillance audits ensure continued compliance. Policy framework reviewed quarterly and updated for emerging threats.; Security Policies:; • Access Control Policy - Role-based access with least privilege principle, mandatory MFA for all accounts, regular access reviews quarterly; • Data Classification Policy - Client data classified as confidential, handled per GDPR requirements with encryption at rest and transit; • Incident Response Policy - Defined procedures for detection, containment, eradication, recovery, and lessons learned; • Secure Development Policy - Security-by-design principles, code reviews, vulnerability scanning, penetration testing; • Business Continuity Policy - Disaster recovery plans tested quarterly, maximum 4-hour RTO, 15-minute RPO; Compliance Framework: Cyber Essentials certified providing baseline security controls. GDPR compliant with designated Data Protection Officer. Regular compliance audits by independent assessors.; Employee Security: All staff undergo security awareness training quarterly. Background checks mandatory for employees handling client data. Confidentiality agreements and acceptable use policies signed by all personnel.; Third-Party Risk: Vendor security assessments conducted before engagement. Sub-processors maintaining equivalent security standards. Annual third-party security audits required.
• Software Security Code of Practice: Yes

Operational security

• Configuration and change management standard: Supplier-defined controls
• Configuration and change management approach: TestFyra applies a structured change‑management process to prevent unauthorised modifications. All infrastructure and application changes require a formal request outlining the rationale, impact assessment, rollback steps, and approval from the Change Advisory Board. Changes are deployed first to development and then to staging, where full functional and security testing is completed before production release. Production updates occur during agreed maintenance windows with customer notification, while emergency changes are limited to critical security patches and reviewed afterwards. All configurations are stored in Git with full audit trails, and every change includes a documented and tested rollback procedure.
• Vulnerability management type: Supplier-defined controls
• Vulnerability management approach: TestFyra proactively identifies and remediates security vulnerabilities:; Continuous Scanning - Automated vulnerability scanning performed weekly across infrastructure, applications, and dependencies. Critical vulnerabilities flagged immediately.; Patch Management - Critical security patches applied within 48 hours; high-severity within 7 days; medium within 30 days. Emergency patching process for zero-day exploits.; Penetration Testing - Independent third-party penetration testing conducted annually with remediation of identified issues before re-testing.; Threat Intelligence - Subscription to threat intelligence feeds providing early warning of emerging vulnerabilities affecting our technology stack.; Remediation Tracking - Vulnerability management system tracks findings through complete remediation lifecycle with management reporting on security posture.
• Protective monitoring type: Supplier-defined controls
• Protective monitoring approach: TestFyra provides continuous 24/7 security monitoring to detect and respond to threats. Its SIEM platform aggregates logs from all systems, using machine‑learning analytics to identify anomalous behaviour and potential compromises. Real‑time alerts notify the security team of suspicious activity. Indicators such as failed logins, unusual access patterns, data‑exfiltration signals, malware signatures, and network anomalies trigger automated investigations. The Security Operations Centre responds to critical alerts within 15 minutes, with automated containment preventing lateral movement. Forensic analysis determines the attack vector and scope. Response targets include 15‑minute response and one‑hour containment for critical incidents, and one‑hour response for high‑severity cases.
• Incident management type: Supplier-defined controls
• Incident management approach: TestFyra follows an ITIL‑based incident‑management framework to ensure rapid, consistent resolution. Pre‑defined runbooks outline response steps for common incidents, including outages, performance issues, and security breaches. Incidents can be reported via a 24/7 hotline, email, web portal, or Teams, while automated monitoring raises tickets proactively. All incidents are classified by business impact as Critical, High, Medium, or Low. Engineers investigate promptly and provide regular updates, with post‑incident reports issued within 48 hours detailing the timeline, root cause, resolution, and preventive actions. Unresolved incidents escalate automatically: Level 1 at 30 minutes, Level 2 at two hours, and Management at four hours.
• Post-quantum cryptography secure: No

Secure development

• Approach to secure software development best practice: Supplier-defined process

Public sector networks

• Connection to public sector networks: No

Pricing

• Discount for educational organisations: Yes
• Free trial available: Yes
• Description of free trial: TestFyra offers a complimentary 2-hour discovery workshop to assess current testing, infrastructure, or development practices. It includes gap analysis, challenge identification, and initial recommendations. Excludes full discovery assessment, implementation, or detailed documentation. Limited to one session per organization, providing insight into TestFyra’s approach and service fit before commitment.

Discount percentage by annual call-off contract value (excluding VAT)

• Less than £250,000: 4%
• Between £250,000 and £500,000: 7%
• Between £500,001 and £1,000,000: 10%
• Between £1,000,001 and £2,500,000: 11%
• Between £2,500,001 and £5,000,000: 12%
• Over £5,000,001: 14%

Non-mandatory Standards and certifications

• ISO/IEC 27001 certification: No
• ISO 28000:2022 certification: No
• ISO 9001 certification: No
• Quality management systems (QMS): Yes
• CSA STAR certification: No
• PCI certification: No
• Cyber essentials: Yes
• Please provide your Cyber Essentials Certificate Number: F591209e-cfca-49d7-9cbd-1b984b5acee9
• Cyber essentials plus: No
• Cyber Essentials Alternative: None of the criteria
• Other security certifications: No

Social value

• Section B - Commitment for Future: Delivery:

  • Mission: Kick start economic growth. To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

    Policy Outcome 1: Fair work: That offers fair wages and good working conditions. Help people get a job, stay in work, and progress in their careers, with good employment opportunities across the country. Notes: Where there is a large proportion of labour costs in the contract, commercial teams should consider MAC in Outcome 1 as a priority

    • New or retained jobs on the contract workforce in the relevant area that meet the criteria set out in MAC 1b, 1c and 1d
    • Providing opportunities for, and measuring and monitoring of, staff workforce conditions over time, including employee engagement, involvement in decision-making and satisfaction and adapting to any changes in the results, with clear processes for acting on issues identified
    • Employment contracts that reflect actual hours worked; steps taken to ensure employees understand their contracts and have the ability to review and adjust them if actual hours regularly exceed contracted hours
    • Activities that support an environment where staff are educated about and feel empowered to report and address bullying and harassment
    • Activities to cascade good practice on fair working conditions throughout the supply chain
    • Offer a pay and leave entitlement to all eligible staff who become kinship carers, ideally equivalent to statutory adoption pay and leave
    • Payment of more than the National Minimum Wage or National Living Wage (as appropriate) to the contract workforce
    • Monitoring and reporting of gender and ethnicity pay gaps and plans to address them where necessary
    • Entitlement to sick pay for the contract workforce, with provision in place for any staff who do not meet the earnings threshold for statutory sick pay, payment of sick pay from day one of absence and payment of staff on the contract workforce who are off sick a replacement income of 100% of their usual earnings for as long as possible
    • Plans for an appropriate income replacement policy for staff who are required to spend time away from work to care for a sick dependent or close relative
    • Understanding of in-work progression issues affecting the market, industry or sector relevant to the contract, and in the supplier’s own organisation and those of its key sub-contractors
    • Measures to support in-work progression to help people in the contract workforce, to move into higher paid work by developing new skills relevant to the contract
    • Support for the contract workforce by providing career advice, and providing opportunities for staff working on the contract with in-work progression career development into known skills shortages or high growth areas
    • Support for educational attainment relevant to the contract, including training schemes that address skills gaps and result in recognised qualifications
    • Understanding of the modern slavery risks and issues affecting the market, industry, sector or country (of origin or of source) relevant to the contract, and the workforce in the supplier’s own organisation and those of its key subcontractors
    • Measures to identify, mitigate and manage modern slavery risks relating to the contract and how these will be implemented
    • Outline policies and practices to be applied to or put in place for the contract to mitigate and manage modern slavery risks, including: Pre-employment checks, recruitment practices. Workplace conditions, safeguarding plans and processes in place and regular monitoring with relevant groups considered, which may include sampling
    • How these flow down the supply chain and are monitored Illustrative examples include reporting, site visits, audits, etc.
    • How to ensure business decisions re: price/cost, short lead times, payment timescales do not create modern slavery risks in the supply chain
    • How the supplier will work with NGOs, trade unions or other businesses to address modern slavery risk
    • Means of influencing staff, suppliers, customers, communities and/or any other appropriate stakeholders with respect to modern slavery risks relating to the contract

  • Mission: Kick start economic growth. To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

    Policy Outcome 2: Skills for growth: Supporting growth sectors and addressing skills gaps.

    • Understanding of employment and relevant skills issues, and of the education and training issues relating to the contract. Illustrative examples: demographics, skills shortages, new opportunities in high growth sectors, geographic/local community and skills/employment challenges
    • Support for educational attainment relevant to the contract, including training schemes that address skills gaps and result in recognised qualifications
    • Activities to support relevant sector related skills growth and sustainability in the contract workforce. Illustrative examples: careers talks, curriculum support, literacy support, safety talks and volunteering

  • Mission: Kick start economic growth. To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

    Policy Outcome 3: Resilient, innovative and flexible supply chains: Support economic growth through enabling resilient businesses, opportunities for small businesses and voluntary, community and social enterprises

    • Understanding of the types of businesses in the market and the level of participation by new businesses, entrepreneurs, start-ups, SMEs, VCSEs and mutuals
    • Activities to identify opportunities to open up sub-contracts under the prime contract to a diverse range of businesses, including new businesses, entrepreneurs, start-ups, SMEs, VCSEs and mutuals
    • Plans for engaging a diverse range of businesses in engagement activities prior to appointing subcontractors (including activities prior to award of the main contract and during the contract term)
    • Activities that demonstrate a collaborative way to work with a diverse range of businesses as part of the supply chain
    • Advertising of supply chain opportunities openly and to ensure they are accessible to a diverse range of businesses, including advertising all subcontracting opportunities on Contracts Finder
    • Ensuring accessibility to contracting and subcontracting opportunities for disabled business owners and employees
    • Structuring of the supply chain selection process to ensure fairness (e.g. anti-corruption) and encourages participation by a diverse range of businesses, including with regard to new businesses, entrepreneurs, start-ups, SMEs, VCSEs and mutual
    • Understanding of local demographics, needs and opportunities for the co-design of the goods, services and works to be delivered under the contract
    • Methods for engaging with different parts of the community (including the education system and charities representing the community) and how communities come together to inform decisions, strategy and projects to leave a positive legacy for future generations
    • Measures to involve local stakeholders and/or users in design (e.g. in the design of services, systems, products or buildings)
    • Plans for positive actions with community groups.
    • Measures for making facilities used in the delivery of the contract available for community groups, education or training
    • Measures to engage users and communities and build relationships to increase community integration build trust and influence how the contract is delivered
    • Plans to respond flexibly and adapt approaches to community engagement and initiatives
    • Support for community-led initiatives relevant to the contract. Illustrative examples: improving transport links; reducing loneliness; helping with English language proficiency; and facilitating social mixing among people with different backgrounds
    • Collaborating with anchor institutions and community groups to make facilities available for education, training or community events

  • Mission: Make Britain a clean energy superpower: To cut bills, create jobs and deliver security with cheaper, zero-carbon electricity by 2030, accelerating to net zero

    Policy Outcome 4: Sustainable procurement practices: Reducing carbon footprints, minimising waste, and promoting the use of clean energy and green technologies.

    • Understanding of opportunities for additional environmental benefits delivery in the performance of the contract, including working towards net zero carbon emissions and use of clean energy and green technologies
    • Collaborative ways of working with the supply chain to deliver additional environmental benefits in the performance of the contract, including working towards net zero carbon emissions and use of clean energy and green technologies
    • Delivery of additional environmental benefits through the performance of the contract, including working towards net zero carbon emissions and use of clean energy and green technologies
    • Understanding of how to influence staff, suppliers, customers, communities and/or any other appropriate stakeholders through the delivery of the contract to support climate and nature protection and improvement
    • Activities to reconnect people with the environment and increase awareness of ways to protect and enhance it

  • Mission: Break down barriers to opportunity: By reforming our childcare and education systems, to make sure there is no class ceiling on the ambitions of young people in Britain

    Policy Outcome 6: Employment and training: For those who face barriers to employment

    • Understanding of employment and skills issues, and of the skills and employment shortages of high growth sectors relating to the contract
    • Understanding of the issues affecting the representation of disabled people in the workforce in the market, industry or sector relevant to the contract, and in the supplier’s own organisation and those of its key sub-contractors
    • Collection of the views and expertise of disabled people and their representative organisations on successfully supporting disabled employees or applicants
    • Inclusive and accessible recruitment practices, and retention-focused activities, including those provided in the Guide for line managers on recruiting, managing and developing people with a disability or health condition
    • Introducing transparency to pay and reward processes
    • Offering a range of quality opportunities with routes of progression if appropriate, e.g. T Level industry placements, students supported into higher level apprenticeships.
    • Working conditions which promote an inclusive working environment and promote retention and progression
    • Other measures to provide equality of opportunity for disabled people and those with health conditions into employment, including becoming a Disability Confident employer and inclusion of supported businesses in the contract supply chain
    • Understanding of the issues affecting inequality in employment, skills and pay in the market, industry or sector relevant to the contract, and in the supplier’s own organisation and those of its key sub-contractors. Measures to tackle inequality in employment, skills and pay in the contract workforce

  • Mission: Break down barriers to opportunity: By reforming our childcare and education systems, to make sure there is no class ceiling on the ambitions of young people in Britain

    Policy Outcome 7: Creating a pipeline of opportunities: For the contract workforce, reducing barriers to entry for under-represented groups.

    • Understanding of the issues affecting the development of new skills by target cohort
    • Understanding of the underlying factors affecting improvements to reduce barriers to entry and training schemes for the target cohort(s) related to the contract workforce
    • Other measures to offer development opportunities for the target cohort(s) in the contract workforce
    • Understanding of issues relating to entering the contract workforce
    • Creation of outreach activities to create a pipeline of employees for the future contract delivery
    • Content of the outreach activity is designed to suit the target cohort
    • Advertising, promotional and outreach activities designed to raise awareness of the offer to reach the target cohort

  • Mission: Build an NHS fit for the future: That is there when people need it; with fewer lives lost to the biggest killers; in a fairer Britain, where everyone lives well for longer.

    Policy Outcome 8: Increasing productivity through physical and mental wellbeing: In the supply chain and communities in the relevant area.

    • Understanding of issues relating to health and wellbeing, including physical and mental health, in the contract workforce
    • Understanding barriers to access to health and social care services or employment opportunities e.g. digital inclusion
    • Inclusive and accessible recruitment practices, development practices and retention policies that support-focused activities including those provided in the Guide for line managers on recruiting, managing and developing which support people with a disability or health condition
    • Actions to invest in the physical and mental health and wellbeing of the contract workforce

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at contact@testfyra.com. Tell them what format you need. It will help if you say what assistive technology you use.