datb limited

datb - Risk Register

A cloud-hosted, fully configurable risk register for use by local authorities and other organisations, allowing tracking of risks, risk scores and mitigations at all points in an organisation's hierarchy. Risk versioning is used to ensure that reviews are undertaken appropriately and can be tracked.

Features

• Administrator-defined risk hierarchy ensures alignment with corporate strategy
• Assignment of risks at any level in organisational hierarchy
• Configurable risk dimensions (financial, safety, HR etc.)
• User-defined reporting functionality
• Suited to publication of risk summaries to public audience
• Versioning of risks / scores / mitigations
• Full audit history ensures traceability
• Configurable user home page
• Risk management workflow controls risk review & publication lifecycle
• Role-based access rights control visibility & editability of risks

Benefits

• Clear risk ownership and responsibility through organisational hierarchy
• View time-based movement in risk scores & mitigations
• Workflows ensure that risks are reviewed when needed
• Escalation of late / missing information to ultimate owners
• Easy data take-on from documents / spreadsheets
• Clear public / stakeholder visibility of selected real-time risk data
• Configurable scoring mechanism to match existing methodologies
• Configurable online help texts to guide infrequent / inexperienced users
• Complete, robust and secure risk management out of the box
• Mobile or desktop access to all functionality

• Free trial available

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at mark.bushman@datb.com. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 15

Service ID

634813280298447

Contact

Mark Bushman
020 7923 9239
mark.bushman@datb.com

About the service

• Service categories:
  • Application Development and Deployment
    • Application platforms
      • Model driven application platforms
        • Model driven application platforms
• Multi cloud support: Yes

Service scope

• Software add-on or extension: No
• Cloud deployment model:
  • Public cloud
  • Private cloud
  • Community cloud
  • Hybrid cloud
• Service constraints: None
• System requirements: Browser for developer, administrator & end-user access

User support

• Email or online ticketing support: Yes
• Support response times: One hour during business hours; additional out-of-hours cover by arrangement.
• User can manage status and priority of support tickets: Yes
• Online ticketing support accessibility: WCAG 2.2 AA
• Phone support: Yes
• Phone support availability: 9 to 5 (UK time), Monday to Friday
• Web chat support: Yes
• Web chat support availability: 9 to 5 (UK time), Monday to Friday
• AI chatbot: No
• Web chat support accessibility standard: WCAG 2.2 AA
• Web chat accessibility testing: We provide real-time chat support to customers via Slack, rather than a dedicated “web chat” component embedded within a web page. We have not carried out formal usability testing of Slack chat support with assistive technology users specifically for our service. However, Slack is a widely used communication platform which provides its own accessibility features and is designed to be usable with assistive technologies such as screen readers and keyboard navigation. Where customers require an alternative support channel, we can provide support via email and/or scheduled video or phone calls, and we can make reasonable adjustments to meet individual accessibility needs.
• Onsite support: Yes, at extra cost
• Support levels: Our standard support agreement covers faults in the application by telephone, email or online, plus assistance to administrative users in the configuration and operation of the application. Additional levels of cover (out-of-hours, business support etc.) can be arranged by agreement. Reported issues are assigned a priority that determines the target time to resolution: Priority 1 - One business day, Priority 2 - Three business days, Priority 3 - 10 business days, Priority 4 - Next scheduled release. Support costs are included in the platform licence cost.
• Support available to third parties: Yes

Onboarding and offboarding

• Getting started: We can provide onsite or online training to clients' developers, and can assist them in initial development activities to promote learning. Online reference and tutorial documentation is available to registered users.; Many clients implement a call-off budget to cater for ad hoc development support, which aids productivity by providing quick access to datb's highly skilled developers for the swift resolution of any issues.
• Service documentation: Yes
• Documentation formats: HTML
• Documentation accessibility standard: WCAG 2.2 AA
• End-of-contract data extraction: Exports can be performed using tools provided by the database vendor or a third party. The platform's web service support provides another route to data extraction.
• End-of-contract process: There are no additional costs at the end of the contract.

Using the service

• Web browser interface: Yes
• Supported browsers:
  • Microsoft Edge
  • Firefox
  • Chrome
  • Safari
  • Opera
• Application to install: No
• Designed for use on mobile devices: Yes
• Differences between the mobile and desktop service: The platform provides adaptive and responsive behaviours enabling use on devices of all sizes without application changes. Application content can be made specific to mobile devices if specific use-cases require it. A separate capability enables the delivery of forms and associated data to mobile devices when connected, to allow completion of forms and collection of data (video / images / voice notes etc.) when the device is offline. Entered data is synchronised with the main application when network connectivity is regained. This offline functionality is device independent, relying only on modern browser capabilities.
• Service interface: No
• User support accessibility: WCAG 2.2 AA
• API: Yes
• What users can and can't do using the API: The platform enables developers to implement web services supporting any XML- or JSON-based data interchange required by their application. Web services may operate as client (requesting data from an external interface) or as server (responding to requests from external systems). Access to web services requires a token generated by the application; separate tokens may be assigned to individual users, organisations or systems to control access and to audit data access / updates as required.
• API documentation: Yes
• API documentation formats: PDF
• API sandbox or test environment: Yes
• Customisation available: Yes
• Description of customisation: The Risk Register employs a configurable hierarchy for the categorisation and segregation of recorded risks.; Risk types are administrator configurable, as is the risk scoring mechanism. ; The 'dimensions' against which risks are evaluated are fully configurable, allowing specification of various data types (selections, multiple choices, checkboxes, free text and so on) to meet any organisation's needs.; Notifications and escalations are also configurable to meet varying requirements.

Scaling

• Independence of resources: Each instance of the platform is implemented within separate Cloud tenancies so that there can be no impact on either performance or data security through colocation of data or services.

Analytics

• Service usage metrics: Yes
• Metrics types: User sessions are recorded within the platform. Resource usage (memory, sessions etc.) is logged periodically. Service availability and status are subject to automated monitoring. Support issues and associated SLA compliance are recorded, monitored and submitted to the client monthly or quarterly as required.
• Reporting types:
  • API access
  • Real-time dashboards
  • Regular reports
  • Reports on request
• Resource tagging: Yes
• FOCUS resource tagging: No

Supplier type

• Supplier type: Not a reseller

Staff security

• Staff security clearance: Other security clearance
• Government security clearance: Developed Vetting (DV)

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations: United Kingdom
• User control over data storage and processing locations: Yes
• Datacentre security standards: Complies with a recognised standard (for example CSA CCM version 4.0)
• Penetration testing frequency: At least once a year
• Penetration testing approach: Another external penetration testing organisation
• Protecting data at rest:
  • Physical access control, complying with CSA CCM v4.0
  • Physical access control, complying with SSAE-18 / ISAE 3402
  • Encryption of all physical media
• Data sanitisation process: Yes
• Data sanitisation type: Explicit overwriting of storage before reallocation / Secure Erase
• Equipment disposal approach: Complying with a recognised standard, for example CSA CCM v4.0, CAS (Sanitisation) or ISO/IEC 27001

Data importing and exporting

• Data export approach: Exports can be performed using tools provided by the database vendor or a third party.; Applications can define data export functionality allowing export to Excel, PDF, CSV formats.; Web services can be defined to allow querying of data as XML or JSON data structures.
• Data export formats:
  • CSV
  • Other
• Other data export formats:
  • XML
  • JSON
  • PDF
  • Excel
• Data import formats:
  • CSV
  • Other
• Other data import formats:
  • XML
  • JSON
  • Excel

Data-in-transit protection

• Data protection between buyer and supplier networks:
  • TLS (version 1.2 or above)
  • IPsec or TLS VPN gateway
• Data protection within supplier network:
  • TLS (version 1.2 or above)
  • IPsec or TLS VPN gateway

Availability and resilience

• Guaranteed availability: Different cloud infrastructure providers offer various levels of availability. Oracle Cloud Infrastructure (OCI), which is our standard choice if no alternative is preferred, offers 99.9% or greater availability for the components that we deploy (server, database, load balancer etc.).
• Approach to resilience: Depends on the selected cloud infrastructure provider. For Oracle Cloud Infrastructure (OCI), please refer to https://www.oracle.com/a/ocom/docs/caiq-oracle-cloud-applications.pdf
• Outage reporting: Datb performs automated monitoring of managed kinodb platform instances on behalf of our clients. Clients will be informed via email / telephone in the event of a service outage or other notifiable event.

Identity and authentication

• User authentication needed: Yes
• User authentication:
  • Multi-Factor Authentication (MFA)
  • Identity federation with existing provider (for example Google Apps)
  • Limited access network (for example PSN)
  • Dedicated link (for example VPN)
  • Username or password
• Access restrictions in management interfaces and support channels: Access to specific functionality such as configuration changes can be restricted to whitelisted networks if required. Access to the management interface is typically via SSO or user name and password, requiring additionally a second authentication factor (for instance a one-time code generated by Google Authenticator or similar, or emailed to the user). Access to the support portal is via user name and password. By default, users with administrative rights within the system are required to separately authenticate using a 2FA mechanism before undertaking administrative tasks.
• Access restriction testing frequency: At least every 6 months
• Management access authentication:
  • Multi-Factor Authentication (MFA)
  • Identity federation with existing provider (for example Google Apps)
  • Limited access network (for example PSN)
  • Dedicated link (for example VPN)
  • Username or password

Audit information for users

• Access to user activity audit information: Users have access to real-time audit information
• How long user audit data is stored for: User-defined
• Access to supplier activity audit information: Users have access to real-time audit information
• How long supplier audit data is stored for: User-defined
• How long system logs are stored for: User-defined

Security governance

• Named board-level person responsible for service security: Yes
• Software Security Code of Practice: Yes
• Security governance certified: Yes
• Security governance standards: ISO/IEC 27001
• Information security policies and processes: We hold ISO27001 certification and Cyber Essentials Plus. Our technical director holds overall responsibility for security policy. All staff are required to undertake a security self-assessment semi-annually; we conduct a semi-annual security questionnaire to ensure that staff are aware of correct processes. All security exceptions are logged within our internal management system and reviewed weekly at board level. We monitor threat reporting services to ensure that we are aware of emerging threats. End-user devices (desktops, laptops) are encrypted and centrally managed. Mobile devices with corporate access must be of defined types with biometric security, and are required to be kept up-to-date with security patches. Our activities are also controlled by our ISO 9001 certification.

Operational security

• Configuration and change management standard: Supplier-defined controls
• Configuration and change management approach: All components of the service are subject to change management processes in compliance with ISO27001 and our ISO9001 audited processes. All changes are subject to a quality review; this includes an assessment of all code and configuration changes with specific reference to any security impacts that they may have.
• Vulnerability management type: Supplier-defined controls
• Vulnerability management approach: We monitor a variety of threat notification resources weekly and assess these in terms of any threat that they may present. We deploy patches regularly, or in response to a newly-identified security issue. We commission comprehensive penetration testing at least annually - this involves a skilled third party with full knowledge of, and access to, a configured application server in order to attempt to exploit any vulnerability present in our standard build.
• Protective monitoring type: Supplier-defined controls
• Protective monitoring approach: We perform automated monitoring of cloud infrastructure logs, network activity logs and application event logs. The application server monitors and records all external access attempts. Security exceptions (failed login attempts, CSP violations etc.) are recorded and reported to the management server, which is configured to alert administrative users of significant events / exceptions. If a potential compromise is suspected, our security exception process ensures that specific actions are taken to minimise impact, preserve evidence, ensure that appropriate people are informed and to prevent further compromise.
• Incident management type: Supplier-defined controls
• Post-quantum cryptography secure: Yes
• Incident management approach: Our internal management application requires staff to record an 'exception' in response to any out-of-the-ordinary incident. Depending on the exception type, a variety of processes may be appropriate, but will generally result in the recording of an 'intervention', this being used to record the steps required to mitigate the incident. Exceptions and interventions are reviewed weekly in order to determine changes to processes, training needs etc. to prevent recurrence. We maintain a client contact to whom exceptions are reported; this individual or a delegate are notified of specific event types such as security exceptions.

Secure development

• Approach to secure software development best practice: Independent review of processes (for example CESG CPA Build Standard, ISO/IEC 27034, ISO/IEC 27001 or CSA CCM v4.0)

Public sector networks

• Connection to public sector networks: No

Pricing

• Discount for educational organisations: No
• Free trial available: Yes
• Description of free trial: We can provide a test instance of the Risk Register application suitable for a trial exercise, allowing potential clients to investigate capabilities with no commitment. This provides all functionality available within the full product. Timescales are subject to discussion with the potential client.

Discount percentage by annual call-off contract value (excluding VAT)

• Less than £250,000: 0%
• Between £250,000 and £500,000: 5%
• Between £500,001 and £1,000,000: 5%
• Between £1,000,001 and £2,500,000: 10%
• Between £2,500,001 and £5,000,000: 10%
• Over £5,000,001: 10%

Standards and certifications

• ISO/IEC 27001 certification: Yes
• ISO/IEC 27001 accredited by: Approachable Certification
• ISO/IEC 27001 accreditation date: Saturday 16 March 2024
• What the ISO/IEC 27001 doesn’t cover: A7.1 Physical security perimeter; A7.2 Physical entry; A7.3 Securing offices rooms and facilities; A7.4 Physical security monitoring; A7.6 Working in secure areas; A7.12 Cabling security; A8.30 Outsourced development; The above clauses are excluded because all information and other associated assets are stored in the cloud, hosted by external suppliers holding ISO27001 accreditation.; There are no physical sites owned by datb that contain information or other associated assets. There are no secure areas as defined in A7.1 of the standard. The physical areas in which staff laptops are used are not under datb’s control.; We do not commission outsourced development.
• ISO 28000:2022 certification: No
• ISO 9001 certification: Yes
• ISO 9001 certification accredited by: Approachable Certification
• ISO 9001 accreditation date: Saturday 16 March 2024
• What the ISO 9001 doesn’t cover: 8.5.1(f) Control of production and service provision. ; - This clause is excluded because all outputs can be verified.; 7.1.5.2 Measurement Traceability; - This clause is excluded because all measurement is completed in software, there is no specific measurement equipment that is used by datb in the delivery of its products/services.
• Quality management systems (QMS): Yes
• CSA STAR certification: No
• PCI certification: No
• Cyber essentials: Yes
• Cyber Essentials Certificate Number: A3bc9efc-546a-4033-ab3b-17846d4ccfa7
• Cyber essentials plus: Yes
• Cyber Essentials Plus Certificate Number: 32ff1308-cdad-41fd-b6f0-ba214893e6fa
• Other security certifications: No

Social value

• Mission: Kick start economic growth:

  To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

  Policy Outcome 1: Fair work: That offers fair wages and good working conditions. Help people get a job, stay in work, and progress in their careers, with good employment opportunities across the country. Notes: Where there is a large proportion of labour costs in the contract, commercial teams should consider MAC in Outcome 1 as a priority

  • Providing opportunities for, and measuring and monitoring of, staff workforce conditions over time, including employee engagement, involvement in decision-making and satisfaction and adapting to any changes in the results, with clear processes for acting on issues identified
  • Plans to engage the contract workforce in deciding the most important workplace issues to address
  • Activities that support an environment where staff are educated about, and feel empowered to, address their physical wellbeing
  • Activities that support an environment where staff are educated about and feel empowered to report and address bullying and harassment
  • Payment of more than the National Minimum Wage or National Living Wage (as appropriate) to the contract workforce
  • Monitoring and reporting of gender and ethnicity pay gaps and plans to address them where necessary
  • Entitlement to sick pay for the contract workforce, with provision in place for any staff who do not meet the earnings threshold for statutory sick pay, payment of sick pay from day one of absence and payment of staff on the contract workforce who are off sick a replacement income of 100% of their usual earnings for as long as possible
  • Understanding of in-work progression issues affecting the market, industry or sector relevant to the contract, and in the supplier’s own organisation and those of its key sub-contractors
  • Measures to support in-work progression to help people in the contract workforce, to move into higher paid work by developing new skills relevant to the contract
  • Support for educational attainment relevant to the contract, including training schemes that address skills gaps and result in recognised qualifications
  • Understanding of the modern slavery risks and issues affecting the market, industry, sector or country (of origin or of source) relevant to the contract, and the workforce in the supplier’s own organisation and those of its key subcontractors

  Policy Outcome 2: Skills for growth: Supporting growth sectors and addressing skills gaps.

  • Understanding of employment and relevant skills issues, and of the education and training issues relating to the contract. Illustrative examples: demographics, skills shortages, new opportunities in high growth sectors, geographic/local community and skills/employment challenges
  • Support for educational attainment relevant to the contract, including training schemes that address skills gaps and result in recognised qualifications
• Mission: Make Britain a clean energy superpower:

  To cut bills, create jobs and deliver security with cheaper, zero-carbon electricity by 2030, accelerating to net zero

  Policy Outcome 4: Sustainable procurement practices: Reducing carbon footprints, minimising waste, and promoting the use of clean energy and green technologies.

  • Understanding of opportunities for additional environmental benefits delivery in the performance of the contract, including working towards net zero carbon emissions and use of clean energy and green technologies
• Mission: Break down barriers to opportunity:

  By reforming our childcare and education systems, to make sure there is no class ceiling on the ambitions of young people in Britain

  Policy Outcome 6: Employment and training: For those who face barriers to employment

  • Working conditions which promote an inclusive working environment and promote retention and progression
  • Understanding of the issues affecting inequality in employment, skills and pay in the market, industry or sector relevant to the contract, and in the supplier’s own organisation and those of its key sub-contractors. Measures to tackle inequality in employment, skills and pay in the contract workforce
• Mission: Build an NHS fit for the future:

  That is there when people need it; with fewer lives lost to the biggest killers; in a fairer Britain, where everyone lives well for longer.

  Policy Outcome 8: Increasing productivity through physical and mental wellbeing: In the supply chain and communities in the relevant area.

  • Understanding of issues relating to health and wellbeing, including physical and mental health, in the contract workforce

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at mark.bushman@datb.com. Tell them what format you need. It will help if you say what assistive technology you use.