INFORMATION SERVICES GROUP EUROPE LIMITED

ISG GovernX®

ISG GovernX® is a digital supplier and contract management platform. It automates the entire end-to-end contract lifecycle enabling strategic third-party supplier relationships by providing a complete, customised view of users’ contract and supplier ecosystem. ISG GovernX® improves supplier performance and collaboration, decreases spend, ensures regulatory compliance and mitigates third-party risk.

Features

• GovernX® is a platform to manage third-party service providers
• Track deliverables and obligations on both sides (Client and Provider)
• Monitor spend, verify invoice accuracy, and automatically calculate service credits
• Administer contract change and maintain document and clause library
• Assess/address service performance via workflows and tactical automation
• Operate governance meetings and keep minutes, actions and artefacts centrally
• Dashboards deliver all relevant information in one accessible place
• Perform analysis on real-time governance data through interactive dashboards
• Interactive dashboards drill directly down into transactional data
• Monitor financial viability, delivery capability, regulatory compliance, partner ecosystem changes

Benefits

• Embedded workflows ensure compliance with supplier management best practices
• Maintain value from relationships through contract compliance and financial controls
• Automation, artificial intelligence and workflow reduce workload for team
• Cognitive extract of meta-data from contracts is quick and simple
• Administer contract build, change, renewal, termination workflows to enforce standards
• A rapid way to implement a third-party risk management framework
• Easy access via web-based interface for alerts, workflows, intelligent dashboards
• Identify and manage risks from selection to exit, reducing risk
• Track deliverables and obligations on both sides, ensuring contract compliance
• A central tool eliminates need for spreadsheets, trackers and email

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at anthony.drake@isg-one.com. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 15

Service ID

953651889738162

Contact

Ant Drake
07827950275
anthony.drake@isg-one.com

About your service

• Service categories:

  Application Development and Deployment

  Analytics and business intelligence

  • Business Intelligence
• Multi cloud support: No

Service scope

• Software add-on or extension: No
• Cloud deployment model: Private cloud
• Service constraints: Licence pool assigned should have named users for access i.e. same licenses cannot be multiple individuals at the same time; ; Maximum storage on the dedicated instance is 4 TB for the base price and any incremental storage is available on request (quote to be shared basis the requirement); ; The technology pool hours assigned as a part of base subscription needs to be consumed within the month and no roll over is applicable; ; Helpdesk is virtual and email only
• System requirements:
  • No specific anti virus or software licenses are recommended
  • Browser-based access - most common browsers can be used

User support

• Email or online ticketing support: Yes
• Support response times: Response times are 60 minutes and Resolution time is 16 hours (business hours)
• User can manage status and priority of support tickets: No
• Phone support: Yes
• Phone support availability: 9 to 5 (UK time), Monday to Friday
• Web chat support: No
• Onsite support: Yes, at extra cost
• Support levels: 24x5 helpdesk support (email support) is available as a part of base subscription.; ; Common support for the base subscription.; ; Account Manager is assigned for escalations , while requests & tickets are managed via helpdesk.
• Support available to third parties: Yes

Onboarding and offboarding

• Getting started: User documentation and onsite training is provided for the different user groups, This is recorded for future training / audit needs.; We can create a bespoke training schedule to suit client needs.
• Service documentation: No
• End-of-contract data extraction: System data can be provided as a flat file if required.; Following the end of the contract, all relevant data will be deleted in accordance with contractual client terms (GDPR)
• End-of-contract process: The client instance is decommissioned, and data is returned in machine readable formats (.xls) along with copies of documents and all data purged

Using the service

• Web browser interface: Yes
• Supported browsers:
  • Microsoft Edge
  • Chrome
  • Safari
• Application to install: No
• Designed for use on mobile devices: No
• Service interface: No
• User support accessibility: None or don’t know
• API: Yes
• What users can and can't do using the API: ISG GovernX® platform is built on Service Now Run time platform and leverages Service Now API Bus for integrations. Users can set up services via API through a request to helpdesk for configuration and appropriate services will be enabled. APIs can be leveraged to ingest data from source , push data to target systems, implement workflows as a part of client ecosystem. Any new APIs that require to be developed & is not available as a part of Service Now API bus will be a dedicated build and needs to go through design workshops.
• API documentation: Yes
• API documentation formats: Open API (also known as Swagger)
• API sandbox or test environment: Yes
• Customisation available: Yes
• Description of customisation: ISG GovernX® is built on ISG best practice from sourcing deals that are in excess of $450 bn and 30 years of on ground Practitioner experience. ISG GovernX® is recommended to be used with configuration changes like changes to dashboards, picklists, field labels, etc. for continuous upgrades. Customisation like new report/ dashboard design, changes to workflows, business rules (automation), etc. can be made via helpdesk. Any customisation that can be accommodated within the support hours will be deployed free of cost and any major enhancements will be reviewed and jointly agreed for deployment at a cost.

Scaling

• Independence of resources: Every client gets a dedicated instance with 24x5 Helpdesk support (email) and dedicated support hours as a part of subscription that is for their consumption. Any customisation / configuration changes within the same is dedicated to the client and not subject external demands. Account Manager is assigned for escalation and relationship management. He/ she will co-ordinate with the client and ensure continued services and improvements.

Analytics

• Service usage metrics: Yes
• Metrics types: Helpdesk will provide metrics on; • Usage of licenses; • User login report; • Helpdesk SLA
• Reporting types: Real-time dashboards
• Resource tagging: No
• FOCUS resource tagging: No

Resellers

• Supplier type: Not a reseller

Staff security

• Staff security clearance: Conforms to BS7858:2019
• Government security clearance: Developed Vetting (DV)

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations: United Kingdom
• User control over data storage and processing locations: Yes
• Datacentre security standards: Managed by a third party
• Penetration testing frequency: At least once a year
• Penetration testing approach: Another external penetration testing organisation
• Protecting data at rest: Encryption of all physical media
• Data sanitisation process: Yes
• Equipment disposal approach: Complying with a recognised standard, for example CSA CCM v4.0, CAS (Sanitisation) or ISO/IEC 27001
• Data sanitisation type: Deleted data can’t be directly accessed / Cryptographic Erasure

Data importing and exporting

• Data export approach: Export to csv, xls and pdf is available as a part of the platform and users have access for download basis access control profiles
• Data export formats:
  • CSV
  • Other
• Data import formats:
  • CSV
  • Other

Data-in-transit protection

• Data protection between buyer and supplier networks: TLS (version 1.2 or above)
• Data protection within supplier network: TLS (version 1.2 or above)

Availability and resilience

• Guaranteed availability: 95%; Refunds will be determined on a case by case merit
• Approach to resilience: ServiceNow is a platform that ISG GovernX® is hosted on; ServiceNow is divided into two distinct environments for the purposes of business continuity (BC) and disaster recovery (DR). ServiceNow’s corporate IT environment and its cloud data centers are physically and logically isolated from each other. A disaster in ServiceNow’s corporate environment could occur with little or no impact on the ability for the data centers within the private cloud to continue to operate.; In both cases, the BC and the DR are supported by a series of tested processes, automations, and supporting documentation, allowing ServiceNow to quickly and effectively take action when availability of its cloud or critical supporting services are affected.; ServiceNow formally tests its recovery processes on an annual basis and can produce reports relating to this for client review. ServiceNow also uses the process of transferring instances for maintenance purposes on a daily basis. As a result, ServiceNow is very well practiced at the process of “failing over” or transferring client instances.
• Outage reporting: ServiceNow operate a public dashboard on service availability

Identity and authentication

• User authentication needed: Yes
• User authentication:
  • Multi-Factor Authentication (MFA)
  • Public key authentication (including by TLS client certificate)
  • Username or password
• Access restrictions in management interfaces and support channels: System access to restricted by role based access (RBAC) and the users are authorised by client contact only. The Helpdesk would manage user access, deactivation and changes basis pre approved client requests and reports of same will be available.
• Access restriction testing frequency: At least once a year
• Management access authentication:
  • Multi-Factor Authentication (MFA)
  • Public key authentication (including by TLS client certificate)
  • Username or password

Audit information for users

• Access to user activity audit information: Users contact the support team to get audit information
• How long user audit data is stored for: User-defined
• Access to supplier activity audit information: You control when users can access audit information
• How long supplier audit data is stored for: User-defined
• How long system logs are stored for: User-defined

Security governance

• Named board-level person responsible for service security: Yes
• Security governance certified: Yes
• Security governance standards: ISO/IEC 27001
• Information security policies and processes: ServiceNow are responsible for the core platform - they are ISO 27001 certified.; ISG is responsible for the GovernX configuration and administration and support of the application- we operate an ISMS which conforms to ISO 27001 standards.
• Software Security Code of Practice: Yes

Operational security

• Configuration and change management standard: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Configuration and change management approach: As part of our ISMS we operate a secure development process ISGs development team and Project Managers ensure adequate security measures have been considered for all phases of the system life-cycle. All development follows best practice guidance following The Open Web Application Security Project (OWASP) standard
• Vulnerability management type: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Vulnerability management approach: ISG contracts with a security provider to perform monthly vulnerability scanning to identify any potential threats. We deploy patches on a monthly basis (or sooner for critical patches) We do not solely rely on information about potential threats - we perform our vulnerability scanning which identifies any potential threats.
• Protective monitoring type: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Protective monitoring approach: ISG utilises an intrusion detection system to monitor the application in real time. Any events are investigated by a third party security operations centre who will respond and remediate as necessary, normally within 4-6 hours If there is an identified breach, the client is notified within 48 hours (maximum time)
• Incident management type: Complies with a recognised standard, for example, CSA CCM v4.0 or ISO/IEC 27035:2011 or SSAE-18 / ISAE 3402
• Incident management approach: ISG follow a standard ITIL based Incident Management Process.
• Post-quantum cryptography secure: No

Secure development

• Approach to secure software development best practice: Independent review of processes (for example CESG CPA Build Standard, ISO/IEC 27034, ISO/IEC 27001 or CSA CCM v4.0)

Public sector networks

• Connection to public sector networks: No

Pricing

• Discount for educational organisations: No
• Free trial available: No

Discount percentage by annual call-off contract value (excluding VAT)

• Less than £250,000: 0%
• Between £250,000 and £500,000: 0%
• Between £500,001 and £1,000,000: 5%
• Between £1,000,001 and £2,500,000: 10%
• Between £2,500,001 and £5,000,000: 12.5%
• Over £5,000,001: 15%

Non-mandatory Standards and certifications

• ISO/IEC 27001 certification: Yes
• Who accredited the ISO/IEC 27001: BSI Assurance UK Ltd
• ISO/IEC 27001 accreditation date: Monday 14 July 2025
• What the ISO/IEC 27001 doesn’t cover: The management of Information Security protecting client data across ISG's global advisory, Research, Managed Services and Platforms including all Global ISG staff and locations are in scope for the ISO27001 certification - so all service ARE covered by this certifications.
• ISO 28000:2022 certification: No
• ISO 9001 certification: No
• Quality management systems (QMS): No
• CSA STAR certification: No
• PCI certification: No
• Cyber essentials: Yes
• Please provide your Cyber Essentials Certificate Number: D3c935da-5d9f-43d7-9d3b-103014ed7c66
• Cyber essentials plus: No
• Cyber Essentials Alternative: You do not have a current and valid Cyber Essentials Plus certificate, or will not have in place within 12 months of the date of award but have an IASME certified equivalent.
• Other security certifications: Yes
• Any other security certifications:
  • SOC2 Type 2 for GovernX
  • TISAX (Trusted Information Security Assessment Exhcange)

Social value

• Section B - Commitment for Future: Delivery:

  • Mission: Kick start economic growth. To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

    Policy Outcome 1: Fair work: That offers fair wages and good working conditions. Help people get a job, stay in work, and progress in their careers, with good employment opportunities across the country. Notes: Where there is a large proportion of labour costs in the contract, commercial teams should consider MAC in Outcome 1 as a priority

    • New or retained jobs on the contract workforce in the relevant area that meet the criteria set out in MAC 1b, 1c and 1d
    • Providing opportunities for, and measuring and monitoring of, staff workforce conditions over time, including employee engagement, involvement in decision-making and satisfaction and adapting to any changes in the results, with clear processes for acting on issues identified
    • Plans to engage the contract workforce in deciding the most important workplace issues to address
    • Employment contracts that reflect actual hours worked; steps taken to ensure employees understand their contracts and have the ability to review and adjust them if actual hours regularly exceed contracted hours
    • Activities that support an environment where staff are educated about, and feel empowered to, address their physical wellbeing
    • Activities that support an environment where staff are educated about and feel empowered to report and address bullying and harassment
    • Payment of more than the National Minimum Wage or National Living Wage (as appropriate) to the contract workforce
    • Entitlement to sick pay for the contract workforce, with provision in place for any staff who do not meet the earnings threshold for statutory sick pay, payment of sick pay from day one of absence and payment of staff on the contract workforce who are off sick a replacement income of 100% of their usual earnings for as long as possible
    • Understanding of in-work progression issues affecting the market, industry or sector relevant to the contract, and in the supplier’s own organisation and those of its key sub-contractors
    • Measures to support in-work progression to help people in the contract workforce, to move into higher paid work by developing new skills relevant to the contract
    • Support for the contract workforce by providing career advice, and providing opportunities for staff working on the contract with in-work progression career development into known skills shortages or high growth areas
    • Support for educational attainment relevant to the contract, including training schemes that address skills gaps and result in recognised qualifications
    • Volunteering opportunities for staff
    • Understanding of the modern slavery risks and issues affecting the market, industry, sector or country (of origin or of source) relevant to the contract, and the workforce in the supplier’s own organisation and those of its key subcontractors
    • Measures to identify, mitigate and manage modern slavery risks relating to the contract and how these will be implemented
    • Outline policies and practices to be applied to or put in place for the contract to mitigate and manage modern slavery risks, including: Pre-employment checks, recruitment practices. Workplace conditions, safeguarding plans and processes in place and regular monitoring with relevant groups considered, which may include sampling

  • Mission: Kick start economic growth. To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

    Policy Outcome 2: Skills for growth: Supporting growth sectors and addressing skills gaps.

    • Understanding of employment and relevant skills issues, and of the education and training issues relating to the contract. Illustrative examples: demographics, skills shortages, new opportunities in high growth sectors, geographic/local community and skills/employment challenges

  • Mission: Kick start economic growth. To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

    Policy Outcome 3: Resilient, innovative and flexible supply chains: Support economic growth through enabling resilient businesses, opportunities for small businesses and voluntary, community and social enterprises

    • Understanding of the types of businesses in the market and the level of participation by new businesses, entrepreneurs, start-ups, SMEs, VCSEs and mutuals
    • Activities that demonstrate a collaborative way to work with a diverse range of businesses as part of the supply chain
    • Structuring of the supply chain selection process to ensure fairness (e.g. anti-corruption) and encourages participation by a diverse range of businesses, including with regard to new businesses, entrepreneurs, start-ups, SMEs, VCSEs and mutual

  • Mission: Break down barriers to opportunity: By reforming our childcare and education systems, to make sure there is no class ceiling on the ambitions of young people in Britain

    Policy Outcome 6: Employment and training: For those who face barriers to employment

    • Inclusive and accessible recruitment practices, and retention-focused activities, including those provided in the Guide for line managers on recruiting, managing and developing people with a disability or health condition
    • Working conditions which promote an inclusive working environment and promote retention and progression
    • Understanding of the issues affecting inequality in employment, skills and pay in the market, industry or sector relevant to the contract, and in the supplier’s own organisation and those of its key sub-contractors. Measures to tackle inequality in employment, skills and pay in the contract workforce
    • Inclusive and accessible development practices, including guidance for line managers on recruiting, managing and developing people with a disability or health condition

  • Mission: Break down barriers to opportunity: By reforming our childcare and education systems, to make sure there is no class ceiling on the ambitions of young people in Britain

    Policy Outcome 7: Creating a pipeline of opportunities: For the contract workforce, reducing barriers to entry for under-represented groups.

    • Understanding of the issues affecting the development of new skills by target cohort
    • Understanding of issues relating to entering the contract workforce
    • Creation of outreach activities to create a pipeline of employees for the future contract delivery
    • Content of the outreach activity is designed to suit the target cohort

  • Mission: Build an NHS fit for the future: That is there when people need it; with fewer lives lost to the biggest killers; in a fairer Britain, where everyone lives well for longer.

    Policy Outcome 8: Increasing productivity through physical and mental wellbeing: In the supply chain and communities in the relevant area.

    • Understanding of issues relating to health and wellbeing, including physical and mental health, in the contract workforce
    • Understanding barriers to access to health and social care services or employment opportunities e.g. digital inclusion

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at anthony.drake@isg-one.com. Tell them what format you need. It will help if you say what assistive technology you use.