SYNECHRON LIMITED

ServiceNow: Governance, Risk and Compliance (GRC, IRM, BCM, TPRM)

A ServiceNow SaaS offering covering Governance, Risk and Compliance, third party risk management, and business continuity management. Provides consultancy-led design, implementation, and ongoing support to help public sector organisations strengthen resilience, manage third parties, ensure continuity and embed effective, scalable governance frameworks through configurable tools and best-practice methodologies.

Features

• Integrated GRC, third-party risk and business continuity SaaS platform
• Consultancy-led service design tailored to public sector requirements
• Third-party risk assessment, monitoring and assurance workflows
• Business continuity planning, testing and resilience management tools
• Data-fed configurable governance frameworks aligned to recognised standards
• End-to-end implementation from discovery to live operation
• Secure cloud hosting meeting UK public sector compliance requirements
• Configurable management dashboards and reporting for oversight and assurance
• Ongoing service support and continuous improvement consultancy
• Best-practice templates, patterns and pre-configured industry designs

Benefits

• Improved governance visibility and executive decision-making
• Reduced organisational risk and cost through proactive management
• Stronger regulatory compliance and audit readiness
• Enhanced resilience through effective business continuity planning
• Better control and oversight of third-party risks
• Faster implementation using proven templates and patterns
• Scalable solution adapting to organisational change
• Consistent risk and compliance processes across departments
• Ongoing expert support ensuring continuous improvement
• Certified industry experts with decades of experience in regulated industries

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at richard.hamstead@synechron.com. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 15

Service ID

941794832134656

Contact

Richard Hamstead
07966466607
richard.hamstead@synechron.com

About the service

• Service categories:
  • Systems Infrastructure Software
    • Security
      • Governance, risk and compliance
        • Governance, risk and compliance
• Multi cloud support: Yes

Service scope

• Software add-on or extension: Yes, but can also be used as a standalone service
• What software services is the service an extension to: ServiceNow
• Cloud deployment model:
  • Public cloud
  • Private cloud
  • Hybrid cloud
• Service constraints: Requires internet connectivity
• System requirements:
  • ServiceNow licences
  • Desktop or mobile browser
  • Appropriate bandwidth and Connectivity to the Internet

User support

• Email or online ticketing support: Yes, at extra cost
• Support response times: Bespoke depending on contractual terms
• User can manage status and priority of support tickets: No
• Phone support: No
• Web chat support: No
• Onsite support: Yes, at extra cost
• Support levels: Synechron provide support for the customer requirement. Typically this will be remote support for systems hosted in the Cloud. Priority 1 Support - for production system outages, 9 to 5 (UK time), Monday to Friday coverage and 1 hour response. Priority 2 Support - for non urgent production system incidents, 9 to 5 (UK time), Monday to Friday coverage and 3 hour response. Priority 3 Support - for non-production support incidents, 9 to 5 (UK time), Monday to Friday coverage and 8 hour response. All customers are allocated an account manager. All support levels are as defined in individual Service Level Agreements.
• Support available to third parties: Yes

Onboarding and offboarding

• Getting started: Our training and support offering provides end-to-end learning and adoption services for ServiceNow users. It includes onsite and online training, comprehensive user and administrator documentation, and access to the Synechron Training Academy for structured, full-service learning. We deliver Certified Implementation Specialist (CIS) compliant training, supporting organisational change management to ensure smooth adoption, improved user competency, and maximised value from the platform.
• Service documentation: Yes
• Documentation formats:
  • HTML
  • PDF
• Documentation accessibility standard: WCAG 2.2 AA
• End-of-contract data extraction: Data may be extracted either manually or programatically at any time during and up to end of contract.
• End-of-contract process: We provide a secure, compliant ServiceNow end-of-contract data extraction service. This includes identifying required records, extracting instance data via UI, XML export, or APIs, validating completeness, and delivering files in agreed formats. All data is handled in line with regulatory and contractual obligations, with full documentation and audit trails.

Using the service

• Web browser interface: Yes
• Supported browsers:
  • Microsoft Edge
  • Chrome
  • Safari
• Application to install: No
• Designed for use on mobile devices: Yes
• Differences between the mobile and desktop service: Display automatically scales for mobile devices, possible to simplify presentation of services displayed on mobiles.
• Service interface: No
• User support accessibility: WCAG 2.2 AA
• API: Yes
• What users can and can't do using the API: ServiceNow provides inbound web services, including REST APIs, enabling interaction with instance data through standard web service requests. Outbound REST capabilities allow data to be created, retrieved, updated, or deleted on external systems supporting REST architectures. ServiceNow integrates with numerous third-party applications and data sources using industry-standard technologies such as REST, SOAP, WSDL, JDBC, LDAP, Excel, CSV, and email. With appropriate permissions, authorised users can exchange data between ServiceNow and external systems. These integrations are typically configured by power users or system administrators.
• API documentation: Yes
• API documentation formats:
  • HTML
  • PDF
• API sandbox or test environment: Yes
• Customisation available: No

Scaling

• Independence of resources: Services are scoped and delivered based on the underlying resource availability. Dynamic resourcing is employed to balance customer demand for services by ServiceNow.

Analytics

• Service usage metrics: No

Supplier type

• Supplier type: Not a reseller

Staff security

• Staff security clearance: Other security clearance
• Government security clearance: Security Clearance (SC)

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations: United Kingdom
• User control over data storage and processing locations: Yes
• Datacentre security standards: Complies with a recognised standard (for example CSA CCM version 4.0)
• Penetration testing frequency: At least every 6 months
• Penetration testing approach: Another external penetration testing organisation
• Protecting data at rest:
  • Physical access control, complying with SSAE-18 / ISAE 3402
  • Encryption of all physical media
• Data sanitisation process: Yes
• Data sanitisation type: Data Erasure
• Equipment disposal approach: A third-party destruction service

Data importing and exporting

• Data export approach: Users export data options in ServiceNow:; • List/Table Export: Export records directly from lists in CSV, Excel, PDF, or XML.; • Reports Export: Export filtered or aggregated data from reports in multiple formats.; • System Export: Use Export XML for full tables, attachments, or instance snapshots.; • APIs: Retrieve data programmatically via REST or SOAP for automation or integration.; • Attachments: Download individually or include in XML exports.; User permissions Required are: Admin, power user, or authorised roles; only accessible data can be exported.
• Data export formats:
  • CSV
  • Other
• Other data export formats:
  • Microsoft Excel
  • PDF
• Data import formats:
  • CSV
  • Other
• Other data import formats: Microsoft Excel

Data-in-transit protection

• Data protection between buyer and supplier networks: TLS (version 1.2 or above)
• Data protection within supplier network: TLS (version 1.2 or above)

Availability and resilience

• Guaranteed availability: ServiceNow delivers a high-availability, cloud-hosted platform with a target uptime of 99.9%. Scheduled maintenance is communicated in advance and does not count against SLA. In the event of unplanned downtime exceeding SLA commitments, customers may claim service credits as a percentage of subscription fees. Redundant infrastructure and disaster recovery support business continuity.
• Approach to resilience: Synechrons GRC service relies on ServiceNow’s resilience and continuous service delivery. This is implemented using the following approaches:; ; 1. Multi-site data centre architecture with redundancy for uninterrupted service; 2. Automated failover and load balancing to maintain platform availability; 3. Multi-site data replication to protect against data loss; 4. Regular backups and disaster recovery procedures supporting rapid restoration; 5. Scalable infrastructure to handle demand surges without performance impact.; ; The following features are direct benefits of this approach:; ; 1. Minimised downtime ensures uninterrupted access to critical services; 2. Data protection reduces risk of loss or corruption; 3. Rapid recovery from failures or incidents supports business continuity; 4. Reliable performance even during usage spikes or high demand; 5. Enhanced operational confidence for public sector organisations managing sensitive data.
• Outage reporting: In ServiceNow, outages and service incidents are reported and managed through a structured process:; ; 1. ServiceNow Status Page; • Customers can view current system status and any ongoing incidents via the ServiceNow System Status page.; • Provides real-time updates on planned maintenance, service interruptions, and restoration progress.; ; 2. Automated Notifications; • For subscribed customers, ServiceNow can send email alerts or notifications for outages or service degradations.; • Notifications include affected services, expected resolution times, and updates.; ; 3. Customer Support and Incident Management; • Customers can raise incidents through the ServiceNow support portal or via support contacts.; • All incidents are tracked and managed according to ServiceNow’s SLA and response procedures.; ; 4. Post-Incident Reports; • After an outage, ServiceNow provides a root cause analysis (RCA) and incident report, detailing the cause, duration, and resolution.; • Helps organisations understand impact and update continuity plans.; ; 5. Integration with Internal ITSM; • Outage notifications can be integrated with customer IT service management tools for automated incident creation and tracking.

Identity and authentication

• User authentication needed: Yes
• User authentication:
  • Multi-Factor Authentication (MFA)
  • Public key authentication (including by TLS client certificate)
  • Identity federation with existing provider (for example Google Apps)
  • Username or password
• Access restrictions in management interfaces and support channels: ServiceNow employs role and scope based security with a zero trust approach.
• Access restriction testing frequency: At least every 6 months
• Management access authentication:
  • Multi-Factor Authentication (MFA)
  • Public key authentication (including by TLS client certificate)
  • Identity federation with existing provider (for example Google Apps)
  • Username or password

Audit information for users

• Access to user activity audit information: Users have access to real-time audit information
• How long user audit data is stored for: At least 12 months
• Access to supplier activity audit information: Users have access to real-time audit information
• How long supplier audit data is stored for: At least 12 months
• How long system logs are stored for: At least 12 months

Security governance

• Named board-level person responsible for service security: Yes
• Software Security Code of Practice: Yes
• Security governance certified: Yes
• Security governance standards: ISO/IEC 27001
• Information security policies and processes: Approved Synechron policies, processes and annual training for all employees. Controls are in place that ensure compliance through monitoring.

Operational security

• Configuration and change management standard: Supplier-defined controls
• Configuration and change management approach: Changes are requested via email or a Change Management ticket, including a description, the reason, affected items, and any related incident. An impact analysis and implications of not implementing the change are submitted, along with implementation steps, verification, and approval requirements. Requests are categorised and prioritised before review by the Change Advisory Board. If approved, the change enters the Development Phase, covering planning, development, and handover for release. Finally, the Change Deployment and Review processes confirm successful implementation and completion, ensuring changes are managed consistently, with minimal risk and clear accountability throughout the process.
• Vulnerability management type: Supplier-defined controls
• Vulnerability management approach: ServiceNow conducts vulnerability management of their cloud. Where required Synechron also has its own Vulnerability Assessment and Penetration Testing (VAPT) process that identifies vulnerabilities. Vulnerability intelligence is sourced from NVDs, CERTs, government agencies, security forums, and internal reporting. Identified vulnerabilities are assessed for criticality, and the SOC notifies ISMS, IT, and business teams. Immediate mitigations may include service blocking, instance shutdowns, or firewall controls. Threat detection tools are continuously updated to ensure effective monitoring and response.
• Protective monitoring type: Supplier-defined controls
• Protective monitoring approach: ServiceNow provide protective monitoring.
• Incident management type: Supplier-defined controls
• Post-quantum cryptography secure: No
• Incident management approach: An operational incident handling capability spans both ServiceNow and Synechron. For Synechron controlled information the incident response capability includes a defined plan and addresses the five stages of incident response across. ; - Detection and Analysis including user Service Desk.; - Containment.; - Eradication. ; - Recovery and Review.; - Post Incident Activity and Reporting.

Secure development

• Approach to secure software development best practice: Independent review of processes (for example CESG CPA Build Standard, ISO/IEC 27034, ISO/IEC 27001 or CSA CCM v4.0)

Public sector networks

• Connection to public sector networks: No

Pricing

• Discount for educational organisations: No
• Free trial available: No

Discount percentage by annual call-off contract value (excluding VAT)

• Less than £250,000: 0.5%
• Between £250,000 and £500,000: 1%
• Between £500,001 and £1,000,000: 1.5%
• Between £1,000,001 and £2,500,000: 2%
• Between £2,500,001 and £5,000,000: 3%
• Over £5,000,001: 4%

Standards and certifications

• ISO/IEC 27001 certification: Yes
• ISO/IEC 27001 accredited by: DNV - Business Assurance
• ISO/IEC 27001 accreditation date: Friday 10 October 2025
• What the ISO/IEC 27001 doesn’t cover: All our services are covered by the certification
• ISO 28000:2022 certification: No
• ISO 9001 certification: Yes
• ISO 9001 certification accredited by: Alcumus ISOQAR
• ISO 9001 accreditation date: Friday 6 June 2025
• What the ISO 9001 doesn’t cover: All our services are covered by the certification
• Quality management systems (QMS): Yes
• CSA STAR certification: No
• PCI certification: Yes
• PCI DSS certification accredited by: SISA Information Security Worldwide
• PCI DSS accreditation date: Monday 27 January 2025
• What the PCI DSS doesn’t cover: All our services are covered by the certification
• Cyber essentials: No
• Cyber Essentials Alternative: None of the criteria
• Cyber essentials plus: No
• Cyber Essentials Alternative: None of the criteria
• Other security certifications: No

Social value

• Mission: Kick start economic growth:

  To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

  Policy Outcome 1: Fair work: That offers fair wages and good working conditions. Help people get a job, stay in work, and progress in their careers, with good employment opportunities across the country. Notes: Where there is a large proportion of labour costs in the contract, commercial teams should consider MAC in Outcome 1 as a priority

  • New or retained jobs on the contract workforce in the relevant area that meet the criteria set out in MAC 1b, 1c and 1d
  • Providing opportunities for, and measuring and monitoring of, staff workforce conditions over time, including employee engagement, involvement in decision-making and satisfaction and adapting to any changes in the results, with clear processes for acting on issues identified
  • Plans to engage the contract workforce in deciding the most important workplace issues to address
  • Monitoring of employee engagement rates (by protected characteristic) and, where necessary, the development of actions to ensure all voices are heard across the diversity of the workforce
  • Activities that support an environment where staff are educated about, and feel empowered to, address their physical wellbeing
  • Activities that support an environment where staff are educated about and feel empowered to report and address bullying and harassment
  • Offer a pay and leave entitlement to all eligible staff who become kinship carers, ideally equivalent to statutory adoption pay and leave
  • Payment of more than the National Minimum Wage or National Living Wage (as appropriate) to the contract workforce
  • Monitoring and reporting of gender and ethnicity pay gaps and plans to address them where necessary
  • Entitlement to sick pay for the contract workforce, with provision in place for any staff who do not meet the earnings threshold for statutory sick pay, payment of sick pay from day one of absence and payment of staff on the contract workforce who are off sick a replacement income of 100% of their usual earnings for as long as possible
  • Plans for an appropriate income replacement policy for staff who are required to spend time away from work to care for a sick dependent or close relative
  • Understanding of in-work progression issues affecting the market, industry or sector relevant to the contract, and in the supplier’s own organisation and those of its key sub-contractors
  • Measures to support in-work progression to help people in the contract workforce, to move into higher paid work by developing new skills relevant to the contract
  • Volunteering opportunities for staff
  • Understanding of the modern slavery risks and issues affecting the market, industry, sector or country (of origin or of source) relevant to the contract, and the workforce in the supplier’s own organisation and those of its key subcontractors
  • Measures to identify, mitigate and manage modern slavery risks relating to the contract and how these will be implemented
  • Outline policies and practices to be applied to or put in place for the contract to mitigate and manage modern slavery risks, including: Pre-employment checks, recruitment practices. Workplace conditions, safeguarding plans and processes in place and regular monitoring with relevant groups considered, which may include sampling
  • Means of influencing staff, suppliers, customers, communities and/or any other appropriate stakeholders with respect to modern slavery risks relating to the contract

  Policy Outcome 2: Skills for growth: Supporting growth sectors and addressing skills gaps.

  • Understanding of employment and relevant skills issues, and of the education and training issues relating to the contract. Illustrative examples: demographics, skills shortages, new opportunities in high growth sectors, geographic/local community and skills/employment challenges
  • Support for educational attainment relevant to the contract, including training schemes that address skills gaps and result in recognised qualifications
• Mission: Make Britain a clean energy superpower:

  To cut bills, create jobs and deliver security with cheaper, zero-carbon electricity by 2030, accelerating to net zero

  Policy Outcome 4: Sustainable procurement practices: Reducing carbon footprints, minimising waste, and promoting the use of clean energy and green technologies.

  • Understanding of opportunities for additional environmental benefits delivery in the performance of the contract, including working towards net zero carbon emissions and use of clean energy and green technologies
  • Delivery of additional environmental benefits through the performance of the contract, including working towards net zero carbon emissions and use of clean energy and green technologies
  • Understanding of how to influence staff, suppliers, customers, communities and/or any other appropriate stakeholders through the delivery of the contract to support climate and nature protection and improvement
• Mission: Break down barriers to opportunity:

  By reforming our childcare and education systems, to make sure there is no class ceiling on the ambitions of young people in Britain

  Policy Outcome 6: Employment and training: For those who face barriers to employment

  • Understanding of the issues affecting the representation of disabled people in the workforce in the market, industry or sector relevant to the contract, and in the supplier’s own organisation and those of its key sub-contractors
  • Introducing transparency to pay and reward processes
  • Working conditions which promote an inclusive working environment and promote retention and progression
  • Understanding of the issues affecting inequality in employment, skills and pay in the market, industry or sector relevant to the contract, and in the supplier’s own organisation and those of its key sub-contractors. Measures to tackle inequality in employment, skills and pay in the contract workforce
  • Inclusive and accessible development practices, including guidance for line managers on recruiting, managing and developing people with a disability or health condition

  Policy Outcome 7: Creating a pipeline of opportunities: For the contract workforce, reducing barriers to entry for under-represented groups.

  • Other measures to offer development opportunities for the target cohort(s) in the contract workforce
  • Creation of outreach activities to create a pipeline of employees for the future contract delivery
  • Content of the outreach activity is designed to suit the target cohort

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at richard.hamstead@synechron.com. Tell them what format you need. It will help if you say what assistive technology you use.