CORNERSTONE ONDEMAND LIMITED

Cornerstone Recruit - Recruiting, Applicant Tracking (ATS)

Cornerstone Recruit is a configurable SaaS applicant tracking and onboarding solution for Public Sector organisations. Streamlining hiring with requisition management, job posting, talent pools, interviews, assessments, offers, and preboarding. Features include accessible career sites, robust analytics, role-based workflows, and GDPR compliance. Integrates with Cornerstone, HRIS/ERP, background checks, and e-signature tools.

Features

• End-to-end ATS: requisitions, posting, sourcing, screening, onboarding.
• AI skills matching from CVs, summaries, risk flags.
• Branded career sites with mobile apply and candidate portals.
• Job board distribution and social posting automation.
• Structured interviews, scheduling, feedback capture, scoring.
• Assessment workflows, test integrations, results management.
• Offer management with approvals, e-signature, preboarding tasks.
• Talent pools, pipelines, CRM campaigns for nurturing.
• Diversity reporting and anonymised screening options.
• Integrations with HRIS, ERP, background checks, calendars.

Benefits

• Accelerates recruitment with streamlined, configurable applicant tracking workflows.
• Improves candidate experience from application through onboarding stages.
• Reduces time-to-hire by automating key recruitment processes.
• Supports compliance and audit readiness for Public Sector hiring standards.
• Enhances workforce diversity through fair, transparent recruitment practices.
• Optimises talent selection with data-driven insights and assessments.
• Increases retention by enabling effective onboarding and engagement strategies.
• Minimises administrative burden with integrated communication and scheduling tools.
• Strengthens employer branding with customisable career sites and messages.
• Facilitates workforce planning by linking hiring data to strategic goals.

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at acarlton@csod.com. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 15

Service ID

124722993182243

Contact

Alex Carlton
07534853811
acarlton@csod.com

About your service

• Service categories:

  Applications

  Enterprise resource management

  Human capital management

  • Talent Management Applications
• Multi cloud support: No

Service scope

• Software add-on or extension: Yes, but can also be used as a standalone service
• What software services is the service an extension to: Cornerstone Galaxy
• Cloud deployment model: Public cloud
• Service constraints: None
• System requirements:
  • As a SaaS Service - there are no hardware requirements.
  • There are no software maintenance, and no network administration requirements

User support

• Email or online ticketing support: Yes
• Support response times: Our global support operates 24 hours, 7 days a week. Response times will vary based on priority set by customers
• User can manage status and priority of support tickets: Yes
• Online ticketing support accessibility: WCAG 2.2 AA
• Phone support: Yes
• Phone support availability: 24 hours, 7 days a week
• Web chat support: No
• Onsite support: Yes, at extra cost
• Support levels: All support options include: ; ; - Self Service Resources through the Customer Success Centre which is available 24/7 inclusive of case management tools and admin learning. ; ; - Live emergency phone support 24/7 for high impacting emergency support.; ; A higher level of support is possible at extra cost including:; - Additional named admins; - Named support contact; - Weekly support calls; - Enhanced release management support; - Ongoing Admin Support / delivery service
• Support available to third parties: Yes

Onboarding and offboarding

• Getting started: Once the contract has been executed, Cornerstone will assign the client a dedicated Implementation Consultant. The Implementation Consultant will be the primary point of contact during implementation. In addition, they will be supported by a project team that includes a Program Sponsor, Engagement Manager, Integration Consultant, and Training Consultant.; ; We deploy our solution in significantly less time than required for similar deployments of legacy software. Our SaaS model eliminates the need for complex technical requirements such as code customisation, equipment deployment, and unique delivery models.; ; A typical implementation takes approximately 6-8 weeks for an initial module based on scope and complexity.; ; With years of experience and hundreds of deliveries across various industries, we’ve learned what it takes to ensure our clients can make a successful leap to impact.; ; Our Cornerstone University Services team provides consulting, training, and performance support tools to enable clients to learn and use our talent management solutions successfully. We offer a blended training approach to accommodate different learning styles.; ; This approach is designed to meet individual learning needs, whether the trainee has five minutes or five days. The self-regulated learning approach supports heavy interaction or independent learning.
• Service documentation: Yes
• Documentation formats:
  • HTML
  • PDF
• End-of-contract data extraction: In the event that a client does not renew their contract, customers can extract their data via our built in reporting functionality or via API if setup. In some instances which is pre-agreed, Cornerstone will return the client’s data via their secure FTP site in the same format in which the data was originally inputted into the software. Alternatively, the client’s data can be returned in a mutually agreed format at a scope and price to be agreed. Cornerstone will maintain a copy of the client data for no more than six months following termination of the agreement, after which time any client data not retrieved will be destroyed.
• End-of-contract process: Our agreements are for a term lease period, and software fees are paid in annual installments over that period, during which time Cornerstone recovers costs. Accordingly, during that lease period (as with, say, a rental or car lease), there can be no termination for convenience. Effect of Termination. Immediately following termination of this Agreement, Client shall cease using all Products. Client may retrieve Client Data any time prior to termination or expiration of the Agreement. If requested, Cornerstone will assist with such data retrieval at a scope and price to be agreed.
• Documentation accessibility standard: WCAG 2.2 AA

Using the service

• Web browser interface: Yes
• Supported browsers:
  • Microsoft Edge
  • Firefox
  • Chrome
  • Safari
• Application to install: No
• Designed for use on mobile devices: Yes
• Differences between the mobile and desktop service: Cornerstone Galaxy is a unified mobile app that centralises access to Cornerstone learning and talent experiences. ; ; Employees can discover content, enrol and complete training, track progress and certifications, and receive push notifications, all with secure sign-on. The app supports offline access, accessibility standards, iOS and Android availability, optional white-labelling, and seamless integration with Cornerstone Learning and Performance functionality.; ; Our offline player allows users to complete online courses on their phones and tablets while not connected to the internet.
• Service interface: No
• User support accessibility: WCAG 2.2 AA
• API: Yes
• What users can and can't do using the API: Through our Edge API Explorer, customers can browse and learn about product specific APIs (web services) to easily help connect their systems to Cornerstone and design data driven applications and external reports. Client developers have access to a code repository and all the API technical documentation needed to create custom integrations. Cornerstone’s API was designed to simplify how clients can connect their applications with our system. With ease in mind, Cornerstone has developed our API based on the REST protocol. Our library of web services can be reviewed online: https://csod.dev/
• API documentation: Yes
• API documentation formats:
  • HTML
  • PDF
  • Other
• API sandbox or test environment: Yes
• Customisation available: Yes
• Description of customisation: Cornerstone provides unique flexibility in how G Cloud clients can deploy the system to different groups of users. Customisation in the form of different branding, business rules, and functionality can be established for any Organisational Unit (such as Division, Location, Position, custom group of individuals, etc.). The end result is an unparalleled level of personalisation for the user.; ; Cornerstone was designed to be administered by the client and not the vendor. G Cloud Clients have complete control to configure the look and feel of the application to your specific business units with specific functionality and branding. Client administrators are presented with an extensive set of web-based controls which enable them to easily configure graphics, colours, key words, layout, and business rules.; ; Clients can make configuration changes on their own without any assistance from Cornerstone or for any additional costs. Not all vendors can make this claim. The high configurability of the Cornerstone system is one of the distinct advantages that we offer to our customers.

Scaling

• Independence of resources: The Cornerstone application, as per the Software as a Service model, is designed to scale horizontally. It is multi-tenant-efficient, offering a load balanced farm of identical instances known as swim lanes. When additional server equipment is added, the application capacity scales to fill the available hardware.This allows virtually unlimited growth capacity.; ; As opposed to a classical behind the firewall or hosted architecture, our application and our hardware platforms are designed to:; ; • Efficiently support a high number of users and customers; • Redistribute load easily; • Add additional capacity easily and quickly

Analytics

• Service usage metrics: Yes
• Metrics types: Clients can leverage the Cornerstone’s Trust Site, a client-facing dashboard that provides system status by swim lane. It contains both live and historical information on server operations and system availability. The site is accessible to clients via the Cornerstone Success Center.; ; Cornerstone provides an SLA for all clients that guarantees initial response and resolution in regards to defined priority and severity levels.; ; Cornerstone’s SLA also guarantees 99.5% uptime (excluding reasonable and scheduled maintenance periods) per month.
• Reporting types: Real-time dashboards
• Resource tagging: No
• FOCUS resource tagging: No

Resellers

• Supplier type: Not a reseller

Staff security

• Staff security clearance: Conforms to BS7858:2019
• Government security clearance: Baseline Personnel Security Standard (BPSS)

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations:
  • United Kingdom
  • European Economic Area (EEA)
  • Other locations
• User control over data storage and processing locations: Yes
• Datacentre security standards: Complies with a recognised standard (for example CSA CCM version 4.0)
• Penetration testing frequency: At least every 6 months
• Penetration testing approach: ‘IT Health Check’ performed by a CREST-approved service provider
• Protecting data at rest: Physical access control, complying with CSA CCM v4.0
• Data sanitisation process: Yes
• Equipment disposal approach: Complying with a recognised standard, for example CSA CCM v4.0, CAS (Sanitisation) or ISO/IEC 27001
• Data sanitisation type:
  • Deleted data can’t be directly accessed / Cryptographic Erasure
  • Explicit overwriting of storage before reallocation / Secure Erase

Data importing and exporting

• Data export approach: In the event that a client does not renew their contract, customers can extract their data via our built in reporting functionality or via API if setup. In some instances which is pre-agreed, Cornerstone will return the client’s data via secure FTP site. Alternatively, the client’s data can be returned in a mutually agreed format at a scope and price to be agreed. Cornerstone will maintain a copy of the client data for no more than six months following termination of the agreement, after which time any client data not retrieved will be destroyed.
• Data export formats:
  • CSV
  • ODF
• Data import formats:
  • CSV
  • ODF

Data-in-transit protection

• Data protection between buyer and supplier networks: TLS (version 1.2 or above)
• Data protection within supplier network: TLS (version 1.2 or above)

Availability and resilience

• Guaranteed availability: Cornerstone provides an SLA for all clients that guarantees initial response and resolution in regards to defined priority and severity levels.; ; Cornerstone’s SLA also guarantees 99.5% uptime (excluding reasonable and scheduled maintenance periods) per month.; ; In the event that Cornerstone has not complied with its "Resolution" obligations set forth above, then, for each calendar day (or portion thereof) that Cornerstone has not so complied, Client shall be entitled, as its sole and exclusive remedy therefor, to a credit against Client's next invoice equal to 1/365th of the annual fees for Software set forth in the Agreement.
• Approach to resilience: Cornerstone’s Disaster Recovery/Business Continuity Plan defines plans, procedures, and guidelines for the Company in the event of disaster. Specifically, this document establishes procedures for recovering business operations, internal data; systems, and critical internal functions to maintain Cornerstone as an on-going concern in the face of unexpected events.; ; The plan has the following primary objectives:; ; •Identify critical systems, services, and staff necessary to maintain and/or restore Cornerstone business operations and internal functions.; ; •Provide guidelines for the communication of activities and status to both Cornerstone staff and client personnel during the recovery period.; ; •Present an orderly course of action for restoring critical computing capability to Cornerstone and for maintaining and/or restoring client service and support.; ; Cornerstone performs site-to-site replication of data to protect client data in the event of a disaster. There are two dedicated disaster recovery sites distant from each of the production data centres. Disaster recovery testing is performed semi-annually at each DR site.
• Outage reporting: Outages occur during scheduled maintenance/releases. Otherwise, the system is not likely to experience any outages, however in the unlikely event of an unexpected outage, clients will receive email alerts.; ; Downtime is scheduled for planned quarterly releases at least 4 months in advance and deployed during off-peak hours, typically 8:30PM EST Fridays to 1AM EST Saturday (4.5 hours). Patch fixes typically occur every two weeks between 8:30PM EST and 12:00AM EST. The typical downtime for a patch deployment is approximately 10 minutes.

Identity and authentication

• User authentication needed: Yes
• User authentication:
  • Multi-Factor Authentication (MFA)
  • Username or password
  • Other
• Other user authentication: Users need a unique username, password to access the application. Alternatively, clients can be authenticated using security tokens, utilising a symmetric algorithm, passed by the client’s local authenticator for Single Sign-On functionality.; ; Passwords represent a fundamental and significant security mechanism at Cornerstone. Passwords are required to access the production network (via Active Directory) and applications (SQL Server). User accounts are created that employ individual user ID and passwords to identify and authenticate a given user. Users cannot access any Cornerstone system without a valid user ID and password. The SQL server logon groups are each configured to use Windows authentication.
• Access restrictions in management interfaces and support channels: Username & Password
• Access restriction testing frequency: At least every 6 months
• Management access authentication:
  • Multi-Factor Authentication (MFA)
  • Username or password
  • Other
• Description of management access authentication: Users need a unique username, password to access the application. Alternatively, clients can be authenticated using security tokens, utilising a symmetric algorithm, passed by the client’s local authenticator for Single Sign-On functionality.; ; Passwords represent a fundamental and significant security mechanism at Cornerstone. Passwords are required to access the production network (via Active Directory) and applications (SQL Server). User accounts are created that employ individual user ID and passwords to identify and authenticate a given user. Users cannot access any Cornerstone system without a valid user ID and password. The SQL server logon groups are each configured to use Windows authentication.

Audit information for users

• Access to user activity audit information: Users have access to real-time audit information
• How long user audit data is stored for: User-defined
• Access to supplier activity audit information: Users have access to real-time audit information
• How long supplier audit data is stored for: User-defined
• How long system logs are stored for: User-defined

Security governance

• Named board-level person responsible for service security: Yes
• Security governance certified: Yes
• Security governance standards:
  • CSA CSM version 4.0
  • ISO/IEC 27001
• Information security policies and processes: Cornerstone’s security procedures and controls provide assurance that processes maintain the confidentiality, integrity and availability of data for our customers. The policies and procedures cover the breadth and depth of IT operations, and infusing security by design through these processes. The information security policy and procedures apply to all Cornerstone employees, consultants, and contractors; and is intended to safeguard data and information technology for Cornerstone. Cornerstone does not publish these documents. However we can provide a secure online account, where you can access and view. Upon joining Cornerstone, applicable security policies and procedures are assigned to personnel to complete within a period of time. In addition, personnel complete updated training every year to ensure they understand and review the policies.
• Software Security Code of Practice: Yes

Operational security

• Configuration and change management standard: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Configuration and change management approach: Cornerstone follows a defined SDLC that contains a number of important quality steps. The change management/application development process at Cornerstone is designed to ensure that standardized methods and procedures are used for handling all system changes and application development ("changes"). Changes are applied to production environment as either part of a "release", "patch", or “hot fix”. Formal quarterly release cycles are used for major enhancements: patches (bi-weekly) are utilized for mid-release updates. Unanticipated changes, “hot fixes”, follow the standard change control process. Using a planned release and patch schedule, minimizes impact of change-related incidents on service quality and day-to-day operations.
• Vulnerability management type: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Vulnerability management approach: Cornerstone contracts independent CREST-certified third parties to run external penetration tests on a quarterly basis. Additionally, monthly external vulnerability scans validate both the patch level and protection from known attacks. Results are provided to Cornerstone IT personnel for review and remediation. There are also various RSS feeds that Cornerstone is subscribed to, including US-CERT, the National Vulnerability Database (NVD), and vendor specific feeds for major software / hardware that Cornerstone uses within the environment. Clients can access the patch schedule at any time through our client portal, the Client Success Centre. Clients can request copies of penetration reports as needed.
• Protective monitoring type: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Protective monitoring approach: Quarterly application penetration tests are performed by independent third-party companies upon Cornerstone’s application. Cornerstone performs internal vulnerability scanning on a monthly basis. Internal and external penetration test is performed yearly by an independent third-party company.; ; Cornerstone has implemented a specific Data Breach Incident Management SOP which details the procedures to be followed in the event of a data breach.; ; Cornerstone has never had a security breach.
• Incident management type: Complies with a recognised standard, for example, CSA CCM v4.0 or ISO/IEC 27035:2011 or SSAE-18 / ISAE 3402
• Incident management approach: Cornerstone maintains a Security Incident Response Plan in order to organize resources to respond in an effective and efficient manner to an adverse event related to the safety and security of a computer resource under Cornerstone’s management. An adverse event may be malicious code attack, unauthorized access to Cornerstone managed networks or systems, unauthorized utilization of Cornerstone services, denial of service attack, or general misuse of systems. The plan clearly defines the appropriate steps and processes in communication. Clients will be notified within 24 hours of security incidents impacting their data.
• Post-quantum cryptography secure: Yes

Secure development

• Approach to secure software development best practice: Independent review of processes (for example CESG CPA Build Standard, ISO/IEC 27034, ISO/IEC 27001 or CSA CCM v4.0)

Public sector networks

• Connection to public sector networks: No

Pricing

• Discount for educational organisations: No
• Free trial available: No

Discount percentage by annual call-off contract value (excluding VAT)

• Less than £250,000: 10%
• Between £250,000 and £500,000: 15%
• Between £500,001 and £1,000,000: 15%
• Between £1,000,001 and £2,500,000: 20%
• Between £2,500,001 and £5,000,000: 20%
• Over £5,000,001: 25%

Non-mandatory Standards and certifications

• ISO/IEC 27001 certification: Yes
• Who accredited the ISO/IEC 27001: UKAS -LRQA Limited
• ISO/IEC 27001 accreditation date: Friday 30 May 2025
• What the ISO/IEC 27001 doesn’t cover: Anything outside the Statement of applicability is NOT covered as published here https://trustcenter.cornerstoneondemand.com/
• ISO 28000:2022 certification: No
• ISO 9001 certification: No
• Quality management systems (QMS): No
• CSA STAR certification: Yes
• CSA STAR accreditation date: Wednesday 11 September 2024
• CSA STAR certification level: Level 1: CSA STAR Self-Assessment
• What the CSA STAR doesn’t cover: All Covered
• PCI certification: Yes
• Who accredited the PCI DSS certification: Ascend Security & Assessment, Inc
• PCI DSS accreditation date: Friday 24 January 2025
• What the PCI DSS doesn’t cover: Everything covered for PCI-DSS level one is covered on the documentation available here https://trustcenter.cornerstoneondemand.com/
• Cyber essentials: No
• Cyber Essentials Alternative: None of the criteria
• Cyber essentials plus: Yes
• Please provide your Cyber Essentials Plus Certificate Number: Fe7e35aa-aabf-4a72-b386-a8b75eea2a00
• Other security certifications: Yes
• Any other security certifications:
  • SSAE18-SOC2
  • ISO27701

Social value

• Section B - Commitment for Future: Delivery:

  • Mission: Kick start economic growth. To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

    Policy Outcome 1: Fair work: That offers fair wages and good working conditions. Help people get a job, stay in work, and progress in their careers, with good employment opportunities across the country. Notes: Where there is a large proportion of labour costs in the contract, commercial teams should consider MAC in Outcome 1 as a priority

    • Understanding of in-work progression issues affecting the market, industry or sector relevant to the contract, and in the supplier’s own organisation and those of its key sub-contractors

  • Mission: Kick start economic growth. To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

    Policy Outcome 2: Skills for growth: Supporting growth sectors and addressing skills gaps.

    • Understanding of employment and relevant skills issues, and of the education and training issues relating to the contract. Illustrative examples: demographics, skills shortages, new opportunities in high growth sectors, geographic/local community and skills/employment challenges

  • Mission: Kick start economic growth. To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

    Policy Outcome 3: Resilient, innovative and flexible supply chains: Support economic growth through enabling resilient businesses, opportunities for small businesses and voluntary, community and social enterprises

    • Understanding of local demographics, needs and opportunities for the co-design of the goods, services and works to be delivered under the contract

  • Mission: Make Britain a clean energy superpower: To cut bills, create jobs and deliver security with cheaper, zero-carbon electricity by 2030, accelerating to net zero

    Policy Outcome 4: Sustainable procurement practices: Reducing carbon footprints, minimising waste, and promoting the use of clean energy and green technologies.

    • Understanding of opportunities for additional environmental benefits delivery in the performance of the contract, including working towards net zero carbon emissions and use of clean energy and green technologies
    • Understanding of how to influence staff, suppliers, customers, communities and/or any other appropriate stakeholders through the delivery of the contract to support climate and nature protection and improvement

  • Mission: Break down barriers to opportunity: By reforming our childcare and education systems, to make sure there is no class ceiling on the ambitions of young people in Britain

    Policy Outcome 6: Employment and training: For those who face barriers to employment

    • Understanding of employment and skills issues, and of the skills and employment shortages of high growth sectors relating to the contract
    • Inclusive and accessible recruitment practices, and retention-focused activities, including those provided in the Guide for line managers on recruiting, managing and developing people with a disability or health condition
    • Understanding of the issues affecting inequality in employment, skills and pay in the market, industry or sector relevant to the contract, and in the supplier’s own organisation and those of its key sub-contractors. Measures to tackle inequality in employment, skills and pay in the contract workforce

  • Mission: Break down barriers to opportunity: By reforming our childcare and education systems, to make sure there is no class ceiling on the ambitions of young people in Britain

    Policy Outcome 7: Creating a pipeline of opportunities: For the contract workforce, reducing barriers to entry for under-represented groups.

    • Understanding of the issues affecting the development of new skills by target cohort
    • Understanding of issues relating to entering the contract workforce

  • Mission: Build an NHS fit for the future: That is there when people need it; with fewer lives lost to the biggest killers; in a fairer Britain, where everyone lives well for longer.

    Policy Outcome 8: Increasing productivity through physical and mental wellbeing: In the supply chain and communities in the relevant area.

    • Inclusive and accessible recruitment practices, development practices and retention policies that support-focused activities including those provided in the Guide for line managers on recruiting, managing and developing which support people with a disability or health condition

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at acarlton@csod.com. Tell them what format you need. It will help if you say what assistive technology you use.