SPECIALIST NETWORK OPERATIONS LIMITED

Managed Secure Access Service Edge (SASE)

SNO’s Managed SASE, powered by Fortinet, delivers a cloud-based secure access platform built on Zero Trust principles. The service combines secure networking and advanced threat protection, including SWG, CASB, ZTNA, DEM and DLP, to protect users, applications and data across distributed enterprise environments

Features

• Cloud-delivered secure access using SASE architecture
• Zero Trust Network Access for users and devices
• Secure Web Gateway with real-time traffic inspection
• Cloud Access Security Broker for SaaS visibility and control
• Integrated Data Loss Prevention across web and cloud
• Policy-driven access enforcement across users and locations
• Centralised management and configuration via cloud console
• Continuous threat intelligence and automatic security updates
• Digital Experience Monitoring for user performance visibility
• Multi-cloud and hybrid environment support

Benefits

• Securely connect users to applications from any location
• Reduce operational complexity by consolidating security services
• Improve security posture using Zero Trust access principles
• Simplify policy management through centralised controls
• Protect sensitive data across web, cloud and users
• Improve user experience with optimised application performance
• Enable secure hybrid and remote working at scale
• Reduce risk from unmanaged devices and implicit trust
• Gain clear visibility into access, usage and threats
• Allow teams to focus on core work, not infrastructure

• Education pricing available

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at sales@sno.cloud. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 15

Service ID

851851486038877

Contact

Russell Bristow
07970319563
sales@sno.cloud

About your service

• Service categories:

  Systems Infrastructure Software

  Security

  Network security

  • Trusted network access and protection
• Multi cloud support: Yes

Service scope

• Software add-on or extension: Yes, but can also be used as a standalone service
• What software services is the service an extension to: SNO’s Managed SASE service can extend and integrate with existing enterprise security and networking solutions, including identity and access management platforms, endpoint protection systems, cloud and SaaS applications, secure web gateways and threat intelligence services, enabling organisations to consolidate security controls and enforce consistent policies across hybrid and multi-cloud environments.
• Cloud deployment model: Public cloud
• Service constraints: SNO’s Managed SASE service requires compatible network connectivity and supported endpoint devices for optimal performance. Planned maintenance may occasionally affect service availability, though notifications are provided in advance. Certain integrations with on-premises systems, legacy applications or non-standard configurations may require additional scoping. While the service is cloud-delivered, performance depends on customers’ existing internet or private network infrastructure and support is aligned with agreed service levels and core operating hours.
• System requirements:
  • Modern web browser (Chrome, Edge, Firefox, Safari) for console access
  • Internet or private network connectivity for cloud-delivered services
  • Supported endpoint OS for security agents (Windows, macOS, Linux)
  • Compatible identity provider for Zero Trust authentication and SSO
  • VPN or secure link for legacy application access
  • Active Directory or cloud directory for centralised policy enforcement
  • Minimum endpoint specifications for agents and telemetry collection
  • Valid TLS certificates for encrypted traffic and secure tunnels
  • Endpoint anti-virus for layered protection alongside security services
  • Access to SaaS applications for web and cloud security enforcement

User support

• Email or online ticketing support: Yes
• Support response times: We respond to support questions within 1 business hour during standard business hours, Monday to Friday. Outside of business hours and at weekends, responses are typically provided within 4 hours for standard requests. Critical or high-severity issues are monitored 24/7 and receive an initial response within 30 minutes, including weekends and public holidays.
• User can manage status and priority of support tickets: Yes
• Online ticketing support accessibility: WCAG 2.2 AA
• Phone support: Yes
• Phone support availability: 24 hours, 7 days a week
• Web chat support: No
• Onsite support: Yes, at extra cost
• Support levels: We provide tiered support levels designed to meet different operational and business requirements. Standard Support is included in the service price and provides 24x7x365 monitoring, incident detection, alerting and response via email and ticketing. It includes access to our Security Operations Centre (SOC) and defined SLAs for incident acknowledgement and resolution. Enhanced Support is available at an additional cost and includes faster response SLAs, 24x7 phone support, priority incident handling and expanded reporting. Customers are assigned a named Technical Account Manager (TAM) who acts as the primary point of contact for service reviews, operational guidance and escalation management. Premium Support is offered at an additional cost and provides dedicated engineering engagement, proactive threat hunting, custom playbooks, regular security posture reviews and optional onsite support. Premium customers receive direct access to a named Cloud Support Engineer and senior security specialists. Pricing for enhanced and premium support tiers is based on service scope, environment size and SLA requirements and is agreed contractually.
• Support available to third parties: Yes

Onboarding and offboarding

• Getting started: Users are supported through a structured onboarding process to ensure rapid, secure adoption. This includes access to comprehensive user documentation, step-by-step configuration guides and online training modules for administrators and IT teams. A named Service Delivery Manager (SDM) guides the customer through initial setup, policy design, user and device onboarding and configuration of security and access rules.; ; Where required, SNO can provide remote or onsite workshops to demonstrate management console operations, policy enforcement and reporting features. Users are also supported via a dedicated Service Desk for questions, configuration assistance and troubleshooting during the onboarding period.; ; Interactive resources, including FAQs, knowledge base articles and video tutorials, help administrators and end users understand day-to-day operations and self-service capabilities. Additionally, APIs are documented with Open API specifications and sandbox environments, allowing technical teams to safely test integrations and automate tasks before deployment.; ; This approach ensures that organisations can quickly enforce consistent Zero Trust access policies, secure connectivity and threat protection across all users and locations, while maintaining operational visibility, compliance and audit readiness from day one.
• Service documentation: Yes
• Documentation formats:
  • HTML
  • PDF
• End-of-contract data extraction: At the end of the contract, users can securely extract all service data, including user configurations, access policies, audit logs and reporting history. Data is provided in open, standard formats such as CSV or ODF to ensure interoperability with other systems and ease of import into alternative solutions.; ; Extraction can be performed via the service’s management console, where administrators can select the desired data sets and export them directly, or through the API, allowing automated retrieval of configuration and reporting data. All exports are logged for audit purposes, ensuring traceability and compliance.; ; Where required, SNO provides guidance and support for end-of-contract extraction, including structured procedures for data verification and integrity checks. Data retained within the service is securely sanitised following extraction to ensure complete removal from the platform, preserving confidentiality and compliance with data protection obligations.; ; This approach ensures that organisations maintain control over their information, enabling seamless transition to other services while maintaining operational continuity and audit readiness.
• End-of-contract process: At the end of the contract, SNO provides a structured offboarding process to ensure a smooth transition. This includes secure extraction of all customer data, transfer of configuration files, access policies, audit logs and service reports. Data is delivered in open standard formats to enable seamless migration to another service or internal systems.; ; Included in the contract price are standard offboarding activities: guidance on data export, secure deletion of data from the managed platform, review of service usage and final reporting on policies, access, and audit logs. Additionally, continued access to the management console for data export and policy review during the offboarding period is included.; ; Additional costs may apply for extended support beyond the standard offboarding window, custom data extraction or transformation, integration assistance with third-party platforms or onsite support to facilitate migration. Any such services are scoped and agreed with the customer in advance.; ; This ensures organisations retain full control over their data, maintain compliance and can transition efficiently without disruption to secure access, networking or operational workflows. All offboarding actions are logged for audit and accountability.
• Documentation accessibility standard: WCAG 2.2 AA

Using the service

• Web browser interface: Yes
• Supported browsers:
  • Microsoft Edge
  • Firefox
  • Chrome
  • Safari
• Application to install: Yes
• Compatible operating systems:
  • Android
  • IOS
  • Linux or Unix
  • MacOS
  • Windows
• Designed for use on mobile devices: Yes
• Differences between the mobile and desktop service: The mobile service provides the same core secure access, policy enforcement and threat protection as the desktop service, but with a lightweight agent optimised for mobile devices. Some advanced network management features, detailed reporting or configuration options are available only via the desktop console. Mobile users benefit from seamless VPN-free connectivity, Zero Trust access and real-time traffic inspection, while maintaining consistent security policies. The mobile experience prioritises performance, battery efficiency and usability, ensuring secure access to applications and cloud services without compromising user experience or compliance
• Service interface: Yes
• User support accessibility: WCAG 2.2 AAA
• Description of service interface: The service is accessed via a web-based management console, providing centralised visibility and control of secure access policies, traffic inspection, user activity and security events. The interface allows administrators to configure policies, monitor service performance, view audit logs and generate reports. It is designed for intuitive navigation with dashboards, role-based access and contextual menus to simplify operations for both technical and non-technical users. Mobile-optimised views are available for monitoring on smartphones and tablets
• Accessibility standards: WCAG 2.2 AAA
• Accessibility testing: The interface has been tested with screen readers, keyboard-only navigation and high-contrast display settings to ensure accessibility for users with visual impairments. Feedback from assistive technology users was incorporated to improve focus order, label clarity and error messaging. Navigation elements were validated for keyboard accessibility and dynamic content updates were confirmed to be announced properly by assistive tools. Testing ensures that users relying on accessibility aids can configure, monitor and report on service policies effectively, maintaining full operational control without barriers.
• API: Yes
• What users can and can't do using the API: Users can use the API to automate configuration, policy management and monitoring of the secure access service. Through the API, administrators can onboard users, assign devices, define access rules and retrieve reporting or audit data programmatically. Changes made via the API are applied in real time, ensuring consistent policy enforcement across all users and sites. Limitations include restricted access to certain administrative functions for security reasons and dependence on the existing identity and network integration. Some configuration tasks still require console access for verification or complex policy workflows.
• API documentation: Yes
• API documentation formats: Open API (also known as Swagger)
• API sandbox or test environment: Yes
• Customisation available: Yes
• Description of customisation: Buyers can customise access policies, user groups, device profiles, security rules and reporting parameters to match organisational requirements. Customisation is performed through the cloud-based management console or via the API, allowing administrators to configure rules, define exception workflows and adjust enforcement settings. Policy templates and pre-defined use cases are provided to simplify customisation while ensuring consistency and compliance.; ; Only authorised administrators or users with role-based access control (RBAC) privileges can make customisations. Changes are logged for auditability and review. While the underlying platform and core service architecture are centrally managed to maintain performance and security, the service allows flexible policy, access and monitoring adjustments to meet each organisation’s risk profile, operational needs and compliance obligations.; ; Customisation enables organisations to enforce consistent Zero Trust access, optimise performance for remote or hybrid users and integrate seamlessly with existing identity and device management systems, without requiring operational changes to the managed infrastructure itself.

Scaling

• Independence of resources: SNO guarantees that each customer’s environment operates independently through logical isolation of all configurations, policies and traffic flows. Each SD-WAN and secure access instance is managed separately, with dedicated bandwidth allocation, routing and policy enforcement. Multi-tenant infrastructure is segmented to prevent interference between customers, ensuring one organisation’s usage does not impact another’s performance. Automated monitoring, dynamic path selection and prioritisation of critical applications maintain consistent performance, low latency and resilience. This approach ensures that service levels, security enforcement and user experience remain predictable and reliable, regardless of demand placed on the platform by other users.

Analytics

• Service usage metrics: Yes
• Metrics types: The service provides detailed metrics including link availability, latency, jitter, packet loss, bandwidth utilisation, application traffic performance, device status, failover events and policy enforcement. Metrics are accessible via the browser portal, API, real-time dashboards and regular reports, enabling monitoring, SLA tracking, trend analysis and optimisation
• Reporting types:
  • API access
  • Real-time dashboards
  • Regular reports
  • Reports on request
• Resource tagging: Yes
• FOCUS resource tagging: Yes

Resellers

• Supplier type: Reseller providing extra support
• Organisation whose services are being resold: Fortinet SASE

Staff security

• Staff security clearance: Conforms to BS7858:2019
• Government security clearance: Security Clearance (SC)

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations:
  • United Kingdom
  • European Economic Area (EEA)
• User control over data storage and processing locations: Yes
• Datacentre security standards: Complies with a recognised standard (for example CSA CCM version 4.0)
• Penetration testing frequency: At least every 6 months
• Penetration testing approach: ‘IT Health Check’ performed by a CREST-approved service provider
• Protecting data at rest:
  • Physical access control, complying with CSA CCM v4.0
  • Encryption of all physical media
  • Scale, obfuscating techniques, or data storage sharding
• Data sanitisation process: Yes
• Equipment disposal approach: Complying with a recognised standard, for example CSA CCM v4.0, CAS (Sanitisation) or ISO/IEC 27001
• Data sanitisation type:
  • Deleted data can’t be directly accessed / Cryptographic Erasure
  • Data Erasure
  • Explicit overwriting of storage before reallocation / Secure Erase

Data importing and exporting

• Data export approach: Users can export their data directly via the management console or through the API. Exportable data includes user configurations, access policies, audit logs and reporting metrics. Data is provided in open, standard formats such as CSV or ODF to ensure compatibility with other systems. Exports are logged for audit and compliance purposes. Administrators can select specific data sets or perform full exports and SNO provides guidance to verify data integrity. The export process ensures that customers retain control over their information and can migrate seamlessly to alternative solutions or internal platforms
• Data export formats:
  • CSV
  • ODF
  • Other
• Other data export formats:
  • JSON
  • XML
  • PDF
• Data import formats:
  • CSV
  • ODF
  • Other
• Other data import formats:
  • JSON
  • XML

Data-in-transit protection

• Data protection between buyer and supplier networks:
  • Private network or public sector network
  • TLS (version 1.2 or above)
  • IPsec or TLS VPN gateway
• Data protection within supplier network:
  • TLS (version 1.2 or above)
  • IPsec or TLS VPN gateway

Availability and resilience

• Guaranteed availability: SNO’s Managed SASE service guarantees high availability with a 99.9% uptime SLA for policy enforcement and secure access services. This includes all critical components of the cloud-delivered infrastructure, ensuring continuous connectivity, security enforcement and user productivity. The SLA covers network availability, application access and essential management services, measured monthly.; ; If the guaranteed availability is not met, customers are eligible for service credits, calculated as a percentage of the monthly service fee, based on the duration and severity of the outage. Service credits are applied automatically following verification of SLA breaches, providing transparent and fair compensation without impacting the renewal or continuation of services.; ; Availability is supported by redundant, geographically distributed infrastructure, automated failover, load balancing and proactive monitoring to quickly detect and remediate issues before they impact users. Maintenance windows are scheduled in advance with minimal service impact and customers are notified according to agreed SLAs.; ; This approach ensures that organisations can rely on continuous, secure access to their applications, data and cloud resources, maintaining business continuity and resilience even during unexpected network or platform events.
• Approach to resilience: SNO’s Managed SASE service is designed for always-on, mission-critical access with multiple layers of resilience. The service leverages geographically distributed, redundant datacentres, ensuring that failures in one location do not affect service continuity. Core components, including policy enforcement, routing, traffic inspection and threat protection, are deployed in active-active configurations with automatic failover and load balancing.; ; Traffic is dynamically routed across available paths, optimising performance while maintaining connectivity during link or node failures. Redundant network connections and infrastructure components prevent single points of failure, while continuous health monitoring and automated alerting enable rapid detection and resolution of issues.; ; Data integrity and availability are protected through replicated storage, secure backups and automated failover, ensuring that user configurations, policies and audit logs remain accessible even during disruptive events. Disaster recovery procedures are tested regularly and BCDR plans are in place to restore services quickly in extreme scenarios.; ; Operational resilience is further reinforced through robust change management and incident response processes, ensuring that updates, patches and configuration changes do not negatively impact availability. Detailed resilience architecture information can be provided on request to meet customer and compliance requirements.
• Outage reporting: SNO provides comprehensive outage reporting to ensure customers are informed of service disruptions in real time. Service status and incidents are communicated through multiple channels, including a public-facing dashboard that displays current availability, ongoing incidents and maintenance schedules.; ; Customers can also access outage information via the API, allowing integration with internal monitoring systems and automated alerting workflows. For critical events, email alerts are sent directly to designated administrators, Service Delivery Managers and account contacts, providing detailed information on the nature of the outage, affected services and expected resolution times.; ; All incidents are logged in the service management platform, including timestamps, impacted components, root cause analyses and actions taken to restore service. Customers receive post-incident reports for high-impact events, supporting audit, compliance and internal reporting requirements.; ; The reporting framework ensures transparency, rapid communication and accountability, allowing organisations to manage operational impact, maintain stakeholder confidence and verify SLA adherence. Scheduled maintenance windows and planned updates are also published in advance on the dashboard and communicated via email to minimise unexpected disruption.

Identity and authentication

• User authentication needed: Yes
• User authentication:
  • Multi-Factor Authentication (MFA)
  • Identity federation with existing provider (for example Google Apps)
  • Username or password
• Access restrictions in management interfaces and support channels: Access to management interfaces and support channels is controlled through role-based access control (RBAC), ensuring users only see and manage functionality relevant to their role. All accounts require secure credentials and Multi-Factor Authentication (MFA). Support staff access is restricted to authorised personnel, with activity logged and monitored. Sensitive operations, such as configuration changes or policy updates, require approval workflows and audit logging. Access is reviewed regularly to remove inactive or unauthorised accounts, ensuring that both management interfaces and support channels maintain strict security, accountability and compliance with operational policies.
• Access restriction testing frequency: At least every 6 months
• Management access authentication:
  • Multi-Factor Authentication (MFA)
  • Identity federation with existing provider (for example Google Apps)
  • Dedicated link (for example VPN)
  • Username or password

Audit information for users

• Access to user activity audit information: Users have access to real-time audit information
• How long user audit data is stored for: At least 12 months
• Access to supplier activity audit information: Users receive audit information on a regular basis
• How long supplier audit data is stored for: At least 12 months
• How long system logs are stored for: At least 12 months

Security governance

• Named board-level person responsible for service security: Yes
• Security governance certified: Yes
• Security governance standards:
  • CSA CSM version 4.0
  • ISO/IEC 27001
• Information security policies and processes: SNO follows a comprehensive set of information security policies and processes aligned with ISO/IEC 27001 and CSA CCM v4.0 standards. Policies cover access management, device posture enforcement, network and application security, incident response, change management, configuration management, data protection and user onboarding/offboarding. The organisation maintains a structured reporting hierarchy: the Security Officer oversees adherence to policies, while Service Delivery Managers, Technical Account Managers and NOC Team Leads ensure operational compliance. All staff are trained on security policies and responsibilities are clearly defined, with escalation paths for incidents or policy breaches. Compliance is enforced through automated monitoring, periodic audits and regular reviews. Policy adherence is tracked via the Service Management platform, which logs changes, incidents and access events. Deviations or security events trigger investigation, remediation and lessons-learned reviews, ensuring continuous improvement. Formal change management and configuration management processes ensure all modifications to access policies, enforcement rules or system configurations are documented, assessed for risk and approved before implementation. This structured approach ensures policies are consistently applied, security risks are mitigated and access remains secure and auditable, supporting both operational resilience and compliance with government and industry standards.
• Software Security Code of Practice: Yes

Operational security

• Configuration and change management standard: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Configuration and change management approach: All service components are tracked through their full lifecycle using a centralised configuration management system, maintaining secure baselines, version control and audit logs. Changes are submitted through a formal change management process, where each modification is assessed for potential security, operational and compliance impact. Emergency changes follow an expedited but controlled workflow with post-implementation review. Regular audits and validation checks detect misconfigurations or drift, ensuring integrity. Role-based approvals and segregation of duties are enforced, providing traceability and accountability for every configuration change while minimising risk to service availability and security
• Vulnerability management type: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Vulnerability management approach: SNO operates a formal vulnerability management process across all service components. Potential threats are assessed through continuous monitoring, automated scans and intelligence from industry sources, vendor alerts and security advisories. Vulnerabilities are prioritised based on severity, risk and business impact. Patches and mitigations are tested and deployed promptly according to risk, with emergency patches expedited through controlled workflows. All vulnerability assessments, remediation actions and patch deployments are logged in the Change Management system for auditability. This proactive approach ensures that threats are rapidly identified, mitigated, and tracked, maintaining the security, availability and compliance of the service.
• Protective monitoring type: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Protective monitoring approach: SNO continuously monitors all service components, including network traffic, user activity, policy enforcement and system health, using automated tools and analytics to identify anomalies and potential compromises. Alerts are prioritised based on severity and incidents are investigated immediately by the Security Operations team. Confirmed compromises trigger predefined response procedures, including containment, mitigation and escalation to relevant stakeholders. High-severity incidents are responded to within minutes, while all actions are logged and tracked for audit purposes. This proactive, structured approach ensures rapid detection and resolution, minimising impact on service availability, security and user experience.
• Incident management type: Complies with a recognised standard, for example, CSA CCM v4.0 or ISO/IEC 27035:2011 or SSAE-18 / ISAE 3402
• Incident management approach: SNO operates pre-defined incident response processes for common events, including security breaches, service disruptions and performance issues. Users report incidents via the Service Desk, portal or API, which logs and prioritises each event. Incidents are triaged and resolved according to severity, with escalation procedures for critical events. Customers receive real-time updates, email notifications and post-incident reports detailing the root cause, resolution steps and mitigation actions. All incident data is recorded for audit, compliance and continuous improvement, ensuring transparent, timely and structured handling of operational and security events across the service
• Post-quantum cryptography secure: No

Secure development

• Approach to secure software development best practice: Independent review of processes (for example CESG CPA Build Standard, ISO/IEC 27034, ISO/IEC 27001 or CSA CCM v4.0)

Public sector networks

• Connection to public sector networks: Yes
• Connected networks:
  • Public Services Network (PSN)
  • Health and Social Care Network (HSCN)

Pricing

• Discount for educational organisations: Yes
• Free trial available: No

Discount percentage by annual call-off contract value (excluding VAT)

• Less than £250,000: 0%
• Between £250,000 and £500,000: 5%
• Between £500,001 and £1,000,000: 7.5%
• Between £1,000,001 and £2,500,000: 10%
• Between £2,500,001 and £5,000,000: 15%
• Over £5,000,001: 20%

Non-mandatory Standards and certifications

• ISO/IEC 27001 certification: Yes
• Who accredited the ISO/IEC 27001: 3Core2
• ISO/IEC 27001 accreditation date: Thursday 18 July 2024
• What the ISO/IEC 27001 doesn’t cover: Cover SNO Network Operations Centre in the UK only. Does not cover other parts of the business such as Finance, PMO, US NOC, Sales, Business Operations
• ISO 28000:2022 certification: No
• ISO 9001 certification: Yes
• Who accredited the ISO 9001 certification: 3Core2
• ISO 9001 accreditation date: Wednesday 18 September 2024
• What the ISO 9001 doesn’t cover: Cover SNO Network Operations Centre in the UK only. Does not cover other parts of the business such as Finance, PMO, US NOC, Sales, Business Operations
• Quality management systems (QMS): Yes
• CSA STAR certification: No
• PCI certification: No
• Cyber essentials: Yes
• Please provide your Cyber Essentials Certificate Number: 3acf591d-7c54-4ff6-976e-3754609672c6
• Cyber essentials plus: No
• Cyber Essentials Alternative: In relation to the services you do not have a current and valid Cyber Essentials Plus certificate which has been awarded by one of the government approved Cyber Essentials accreditation bodies but you are working towards gaining it, and will be in a position to confirm that you have been awarded a current and valid Cyber Essentials Plus certificate by one of the government approved accreditation bodies within 12 months of the date of award.
• Other security certifications: Yes
• Any other security certifications:
  • ISO 14001:2015
  • ISO 20000:2015

Social value

• Section B - Commitment for Future: Delivery:

  • Mission: Kick start economic growth. To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

    Policy Outcome 1: Fair work: That offers fair wages and good working conditions. Help people get a job, stay in work, and progress in their careers, with good employment opportunities across the country. Notes: Where there is a large proportion of labour costs in the contract, commercial teams should consider MAC in Outcome 1 as a priority

    • New or retained jobs on the contract workforce in the relevant area that meet the criteria set out in MAC 1b, 1c and 1d
    • New apprenticeships on the contract workforce in the relevant area that meet the criteria set out in MAC 1b
    • Providing opportunities for, and measuring and monitoring of, staff workforce conditions over time, including employee engagement, involvement in decision-making and satisfaction and adapting to any changes in the results, with clear processes for acting on issues identified
    • Plans to engage the contract workforce in deciding the most important workplace issues to address
    • Ensuring new workers are informed of their right to join a trade union
    • Monitoring of employee engagement rates (by protected characteristic) and, where necessary, the development of actions to ensure all voices are heard across the diversity of the workforce
    • Employment contracts that reflect actual hours worked; steps taken to ensure employees understand their contracts and have the ability to review and adjust them if actual hours regularly exceed contracted hours
    • Activities that support an environment where staff are educated about, and feel empowered to, address their physical wellbeing
    • Activities that support an environment where staff are educated about and feel empowered to report and address bullying and harassment
    • Activities to cascade good practice on fair working conditions throughout the supply chain
    • Offer a pay and leave entitlement to all eligible staff who become kinship carers, ideally equivalent to statutory adoption pay and leave
    • Payment of more than the National Minimum Wage or National Living Wage (as appropriate) to the contract workforce
    • Monitoring and reporting of gender and ethnicity pay gaps and plans to address them where necessary
    • Entitlement to sick pay for the contract workforce, with provision in place for any staff who do not meet the earnings threshold for statutory sick pay, payment of sick pay from day one of absence and payment of staff on the contract workforce who are off sick a replacement income of 100% of their usual earnings for as long as possible
    • Plans for an appropriate income replacement policy for staff who are required to spend time away from work to care for a sick dependent or close relative
    • Understanding of in-work progression issues affecting the market, industry or sector relevant to the contract, and in the supplier’s own organisation and those of its key sub-contractors
    • Measures to support in-work progression to help people in the contract workforce, to move into higher paid work by developing new skills relevant to the contract
    • Support for the contract workforce by providing career advice, and providing opportunities for staff working on the contract with in-work progression career development into known skills shortages or high growth areas
    • Support for educational attainment relevant to the contract, including training schemes that address skills gaps and result in recognised qualifications
    • Volunteering opportunities for staff
    • Understanding of the modern slavery risks and issues affecting the market, industry, sector or country (of origin or of source) relevant to the contract, and the workforce in the supplier’s own organisation and those of its key subcontractors
    • Measures to identify, mitigate and manage modern slavery risks relating to the contract and how these will be implemented
    • Outline policies and practices to be applied to or put in place for the contract to mitigate and manage modern slavery risks, including: Pre-employment checks, recruitment practices. Workplace conditions, safeguarding plans and processes in place and regular monitoring with relevant groups considered, which may include sampling
    • How these flow down the supply chain and are monitored Illustrative examples include reporting, site visits, audits, etc.
    • How to ensure business decisions re: price/cost, short lead times, payment timescales do not create modern slavery risks in the supply chain
    • How the supplier will work with NGOs, trade unions or other businesses to address modern slavery risk
    • Means of influencing staff, suppliers, customers, communities and/or any other appropriate stakeholders with respect to modern slavery risks relating to the contract

  • Mission: Kick start economic growth. To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

    Policy Outcome 2: Skills for growth: Supporting growth sectors and addressing skills gaps.

    • Understanding of employment and relevant skills issues, and of the education and training issues relating to the contract. Illustrative examples: demographics, skills shortages, new opportunities in high growth sectors, geographic/local community and skills/employment challenges
    • Support for educational attainment relevant to the contract, including training schemes that address skills gaps and result in recognised qualifications
    • Activities to support relevant sector related skills growth and sustainability in the contract workforce. Illustrative examples: careers talks, curriculum support, literacy support, safety talks and volunteering
    • Delivery of apprenticeships, supported internships and T Level industry placement opportunities (Level 2, 3 and 4+) in relation to the contract

  • Mission: Kick start economic growth. To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

    Policy Outcome 3: Resilient, innovative and flexible supply chains: Support economic growth through enabling resilient businesses, opportunities for small businesses and voluntary, community and social enterprises

    • Understanding of the types of businesses in the market and the level of participation by new businesses, entrepreneurs, start-ups, SMEs, VCSEs and mutuals
    • Activities to identify opportunities to open up sub-contracts under the prime contract to a diverse range of businesses, including new businesses, entrepreneurs, start-ups, SMEs, VCSEs and mutuals
    • Plans for engaging a diverse range of businesses in engagement activities prior to appointing subcontractors (including activities prior to award of the main contract and during the contract term)
    • Activities that demonstrate a collaborative way to work with a diverse range of businesses as part of the supply chain
    • Advertising of supply chain opportunities openly and to ensure they are accessible to a diverse range of businesses, including advertising all subcontracting opportunities on Contracts Finder
    • Ensuring accessibility to contracting and subcontracting opportunities for disabled business owners and employees
    • Structuring of the supply chain selection process to ensure fairness (e.g. anti-corruption) and encourages participation by a diverse range of businesses, including with regard to new businesses, entrepreneurs, start-ups, SMEs, VCSEs and mutual
    • Understanding of local demographics, needs and opportunities for the co-design of the goods, services and works to be delivered under the contract
    • Methods for engaging with different parts of the community (including the education system and charities representing the community) and how communities come together to inform decisions, strategy and projects to leave a positive legacy for future generations
    • Measures to involve local stakeholders and/or users in design (e.g. in the design of services, systems, products or buildings)
    • Plans for positive actions with community groups.
    • Measures for making facilities used in the delivery of the contract available for community groups, education or training
    • Measures to engage users and communities and build relationships to increase community integration build trust and influence how the contract is delivered
    • Plans to respond flexibly and adapt approaches to community engagement and initiatives
    • Support for community-led initiatives relevant to the contract. Illustrative examples: improving transport links; reducing loneliness; helping with English language proficiency; and facilitating social mixing among people with different backgrounds
    • Collaborating with anchor institutions and community groups to make facilities available for education, training or community events

  • Mission: Make Britain a clean energy superpower: To cut bills, create jobs and deliver security with cheaper, zero-carbon electricity by 2030, accelerating to net zero

    Policy Outcome 4: Sustainable procurement practices: Reducing carbon footprints, minimising waste, and promoting the use of clean energy and green technologies.

    • Understanding of opportunities for additional environmental benefits delivery in the performance of the contract, including working towards net zero carbon emissions and use of clean energy and green technologies
    • Collaborative ways of working with the supply chain to deliver additional environmental benefits in the performance of the contract, including working towards net zero carbon emissions and use of clean energy and green technologies
    • Delivery of additional environmental benefits through the performance of the contract, including working towards net zero carbon emissions and use of clean energy and green technologies
    • Understanding of how to influence staff, suppliers, customers, communities and/or any other appropriate stakeholders through the delivery of the contract to support climate and nature protection and improvement
    • Activities to reconnect people with the environment and increase awareness of ways to protect and enhance it

  • Mission: Break down barriers to opportunity: By reforming our childcare and education systems, to make sure there is no class ceiling on the ambitions of young people in Britain

    Policy Outcome 6: Employment and training: For those who face barriers to employment

    • Understanding of employment and skills issues, and of the skills and employment shortages of high growth sectors relating to the contract
    • Creation of employment opportunities particularly for those who face barriers to employment, such as prison leavers, care leavers and/or who are located in deprived areas, and for people in industries with known skills shortages or in high growth sectors
    • Delivery of training schemes and programmes to address any identified skills gaps and under-representation in the workforce for the contract (e.g. prison leavers, care leavers, kinship carers, disabled people)
    • Advertising, promotional and outreach activities designed to raise awareness of the offer to reach the target cohort
    • Understanding of the issues affecting the representation of disabled people in the workforce in the market, industry or sector relevant to the contract, and in the supplier’s own organisation and those of its key sub-contractors
    • Collection of the views and expertise of disabled people and their representative organisations on successfully supporting disabled employees or applicants
    • Inclusive and accessible recruitment practices, and retention-focused activities, including those provided in the Guide for line managers on recruiting, managing and developing people with a disability or health condition
    • Introducing transparency to pay and reward processes
    • Offering a range of quality opportunities with routes of progression if appropriate, e.g. T Level industry placements, students supported into higher level apprenticeships.
    • Working conditions which promote an inclusive working environment and promote retention and progression
    • Other measures to provide equality of opportunity for disabled people and those with health conditions into employment, including becoming a Disability Confident employer and inclusion of supported businesses in the contract supply chain
    • Understanding of the issues affecting inequality in employment, skills and pay in the market, industry or sector relevant to the contract, and in the supplier’s own organisation and those of its key sub-contractors. Measures to tackle inequality in employment, skills and pay in the contract workforce
    • Inclusive and accessible development practices, including guidance for line managers on recruiting, managing and developing people with a disability or health condition

  • Mission: Break down barriers to opportunity: By reforming our childcare and education systems, to make sure there is no class ceiling on the ambitions of young people in Britain

    Policy Outcome 7: Creating a pipeline of opportunities: For the contract workforce, reducing barriers to entry for under-represented groups.

    • Understanding of the issues affecting the development of new skills by target cohort
    • Understanding of the underlying factors affecting improvements to reduce barriers to entry and training schemes for the target cohort(s) related to the contract workforce
    • Other measures to offer development opportunities for the target cohort(s) in the contract workforce
    • Advertising, promotional and outreach activities designed to raise awareness of the offer to reach the target cohort
    • Understanding of issues relating to entering the contract workforce
    • Creation of outreach activities to create a pipeline of employees for the future contract delivery
    • Content of the outreach activity is designed to suit the target cohort
    • Advertising, promotional and outreach activities designed to raise awareness of the offer to reach the target cohort

  • Mission: Build an NHS fit for the future: That is there when people need it; with fewer lives lost to the biggest killers; in a fairer Britain, where everyone lives well for longer.

    Policy Outcome 8: Increasing productivity through physical and mental wellbeing: In the supply chain and communities in the relevant area.

    • Understanding of issues relating to health and wellbeing, including physical and mental health, in the contract workforce
    • Understanding barriers to access to health and social care services or employment opportunities e.g. digital inclusion
    • Inclusive and accessible recruitment practices, development practices and retention policies that support-focused activities including those provided in the Guide for line managers on recruiting, managing and developing which support people with a disability or health condition
    • Actions to invest in the physical and mental health and wellbeing of the contract workforce

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at sales@sno.cloud. Tell them what format you need. It will help if you say what assistive technology you use.