DNAnexus

DNAnexus Trusted Regulatory Space

Trusted Regulatory Spaces (TRS), which enables Dynamic Submission Management (DSM). This offering marries cloud technology and AI for regulatory collaboration in TRS Network. The audience is regulatory leaders, IT system architects, and risk management in the health agency industries. TRSnet enables distributed regulatory object management and reporting the submission process.

Features

• Secure Collaboration
• Data Access Management & Governance
• Secure Internal & External Data Sharing
• Data Visualisation & Cohort Analysis
• Multimodal Data Analysis
• AI/ML Algorithms and Bioinformatics Tools
• Data Management
• Metadata Capture & Data Catalog
• GxP customers with specific components that support regulatory submissions/processes

Benefits

• Data Ingestion and Harmonization
• User-Friendly Interface
• Secure, Collaborative Data Cloud Workspaces
• Interoperability with Organizational Software
• 21 CFR§11 components, including electronic records, human-readable Audit Trail
• Provides a human-readable Audit Trail, produced every 24 hours
• Assistance with the Customer's internal and external audits
• 21CFR820 and ISO/IEC13485:2016 for Quality of medical device and CE
• Computer System Validation Documentation (CSV)
• Access to preRelease (Staging) environment to allow Performance Qualification testing

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at emea_tenders@dnanexus.com. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 15

Service ID

151459108612708

Contact

Chadia Toukoki
+49 175 2583337
emea_tenders@dnanexus.com

About your service

• Service categories:

  Application Development and Deployment

  Data management

  Database management systems

  • Relational Database Management Systems
  • Low-Code Database Management Systems
  • Navigational Database Management Systems
  • Fixed Record Database Management Systems
  • Object-Oriented Database Management Systems
  • Multivalue Database Management Systems
  • Non-Schematic Database Management Systems
  • Document-Oriented Database Systems
  • Key-Accessible Database Systems
  • Graph Database Management Systems
  • In-Memory Shared Data Managers
  • Data Lake Management Systems

  Database administration and development

  • Database Administration
  • Database Replication
  • Data Modelling
  • Database Development and Optimization

  Data integration and intelligence

  • Data Ingestion and Transformation Software
  • Dynamic Data Movement Software
  • Data Quality Software
  • Data Access Infrastructure Software
  • Composite Data Framework Software
  • Master Data Intelligence Software
  • Metadata Management Software
  • Data Archiving and Information LifD-Cycle Management
• Multi cloud support: Yes

Service scope

• Software add-on or extension: Yes
• What software services is the service an extension to: DNAnexus Titan
• Cloud deployment model: Private cloud
• Service constraints: The platform is cloud-only
• System requirements: Browser-accessible

User support

• Email or online ticketing support: Yes
• Support response times: DNAnexus offers – Dedicated global support – Availability: 24x7, 365 days – Contact us: support@dnanexus.com – Quick response (average first response time <2 hours)
• User can manage status and priority of support tickets: No
• Phone support: No
• Web chat support: No
• Onsite support: No
• Support levels: DNAnexus offers three (3) support packages: Standard, Professional, and Enterprise. Target response times for each package are based on the incident type reported: Production, Platform, or Non-critical Support Incident. Support Package Options Standard Support - Incident Type / Target Response Times - Production Support Incident / 24 Hours - Platform Support Incident / 24 Hours - Non-Critical Support Incident / 36 Hours Professional Support - Incident Type / Target Response Times - Production Support Incident / 8 Hours - Platform Support Incident / 8 Hours - Non-Critical Support Incident / 24 Hours Enterprise Support - Incident Type / Target Response Times - Production Support Incident / 4 Hours - Platform Support Incident / 4 Hours - Non-Critical Support Incident / 8 Hours
• Support available to third parties: Yes

Onboarding and offboarding

• Getting started: At DNAnexus, a positive and productive customer experience is our goal. The DNAnexus Academy is a service option to enable and empower customers to utilize their products to their utmost capability. At the enterprise level, teams of users of the DNAnexus platform can participate in multi-day courses and learn a standardized and proven set of practices from the DNAnexus experts. The courses are led by DNAnexus trainers who provide core concepts and hands-on sessions. They leverage the platform via the web user interface and command line, and introduce many other skills, such as workflows and apps. Customers benefit from access to best practice recommendations and answers to their complex questions, as they develop their bioinformatics skills. The Academy has developed a catalogue of courses that extends beyond training for initial use of the platform. Additional courses can be scheduled after discussion with the Academy, your Customer Success contact or other DNAnexus contact. DNAnexus appreciates users have different styles of learning and our Academy team has solutions for all types of learners. In addition to live, guided, hands-on learning modalities, DNAnexus has a full suite of publicly available basic and advanced learning modules documented here - https://academy.dnanexus.com/
• Service documentation: Yes
• Documentation formats: HTML
• End-of-contract data extraction: Users can extract their data when contract ends
• End-of-contract process: At contract end the customer is given a negotiated period of time to extract the data
• Documentation accessibility standard: None or don’t know
• How the documentation is accessible: At DNAnexus, a positive and productive customer experience is our goal. The DNAnexus Academy is a service option to enable and empower customers to utilize their products to their utmost capability. At the enterprise level, teams of users of the DNAnexus platform can participate in multi-day courses and learn a standardized and proven set of practices from the DNAnexus experts. The courses are led by DNAnexus trainers who provide core concepts and hands-on sessions. They leverage the platform via the web user interface and command line, and introduce many other skills, such as workflows and apps. Customers benefit from access to best practice recommendations and answers to their complex questions, as they develop their bioinformatics skills. The Academy has developed a catalogue of courses that extends beyond training for initial use of the platform. Additional courses can be scheduled after discussion with the Academy, your Customer Success contact or other DNAnexus contact. DNAnexus appreciates users have different styles of learning and our Academy team has solutions for all types of learners. In addition to live, guided, hands-on learning modalities, DNAnexus has a full suite of publicly available basic and advanced learning modules documented here - https://academy.dnanexus.com/

Using the service

• Web browser interface: Yes
• Supported browsers:
  • Microsoft Edge
  • Firefox
  • Chrome
  • Safari
  • Opera
  • Other
• Application to install: No
• Designed for use on mobile devices: No
• Service interface: No
• User support accessibility: None or don’t know
• API: Yes
• What users can and can't do using the API: The DNAnexus Platform can be accessed programmatically via an API using HTTP requests to the DNAnexus API servers. Each API method may receive zero or more arguments as fields in a JSON string, and may return some results, always as a JSON string.; ; Any timestamps that appear in the response from or as input for an API method are always given as numbers signifying the millisecond count since the Unix Epoch. ; ; Each API method has a distinct corresponding URL. Calls to this URL are made with HTTP POST. The body of the message must contain valid JSON (as described in RFC4627). The Content-Type must either be absent or set to application/json, or a MalformedJSON (400) error occurs. Query parameters in the URL are ignored.; ; Successful results are always returned as JSON in the response body, with response code 200. All responses are UTF-8 encoded. A header called "DNAnexus-API" is also provided with value equal to the version number of the API used to fulfill the query.; ; Each request receives an HTTP response code from the server. Some responses indicate that the request should be retried. ; ; For further information, please visit https://documentation.dnanexus.com/developer/api/protocols
• API documentation: Yes
• API documentation formats: Other
• API sandbox or test environment: Yes
• Customisation available: Yes
• Description of customisation: Users can customise the appearance and the behaviour of the platform.

Scaling

• Independence of resources: We leverage scalable cloud infrastructure to accommodate the exponential growth of genomic data while facilitating enhanced efficiency, cost savings and robust information security. DNAnexus has the potential to enable seamless collaboration with other players in the UK health data space to further grow the volume and value of the available cohorts and data assets.

Analytics

• Service usage metrics: Yes
• Metrics types: System Administrators can set spend limits for projects to control storage, compute and egress costs. Each of these limits come with options on whether these limits only result in a notification or are enforced (e.g. by terminating job, when compute limit is reached). In addition, a notification threshold (e.g. 90%) can be set to inform project managers that the limit will be reached soon.
• Reporting types:
  • API access
  • Real-time dashboards
  • Regular reports
  • Reports on request
• Resource tagging: No
• FOCUS resource tagging: No

Resellers

• Supplier type: Not a reseller

Staff security

• Staff security clearance: Other security clearance
• Government security clearance: Baseline Personnel Security Standard (BPSS)

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations:
  • United Kingdom
  • European Economic Area (EEA)
  • Other locations
• User control over data storage and processing locations: Yes
• Datacentre security standards: Managed by a third party
• Penetration testing frequency: At least once a year
• Penetration testing approach: Another external penetration testing organisation
• Protecting data at rest:
  • Physical access control, complying with CSA CCM v4.0
  • Physical access control, complying with SSAE-18 / ISAE 3402
  • Physical access control, complying with another standard
  • Encryption of all physical media
  • Scale, obfuscating techniques, or data storage sharding
• Data sanitisation process: Yes
• Equipment disposal approach: Complying with a recognised standard, for example CSA CCM v4.0, CAS (Sanitisation) or ISO/IEC 27001
• Data sanitisation type:
  • Deleted data can’t be directly accessed / Cryptographic Erasure
  • Data Erasure

Data importing and exporting

• Data export approach: Offering provides simple downloading via your web browser or command line interface, subject to the download restrictions imposed by the Data Controller of the data in scope.
• Data export formats:
  • CSV
  • Other
• Other data export formats: Genomic data formats
• Data import formats:
  • CSV
  • Other
• Other data import formats: Genomic data formats

Data-in-transit protection

• Data protection between buyer and supplier networks: TLS (version 1.2 or above)
• Data protection within supplier network: TLS (version 1.2 or above)

Availability and resilience

• Guaranteed availability: 99.9% uptime for issues within the control of DNAnexus. Outages due to force majeure are out of scope of this percentage.
• Approach to resilience: Available upon request
• Outage reporting: Public dashboard: https://trust.dnanexus.com/

Identity and authentication

• User authentication needed: Yes
• User authentication: Username or password
• Access restrictions in management interfaces and support channels: Admin access is controlled by Single Sign On (SSO) and required use of DNAnexus' VPN.
• Access restriction testing frequency: At least every 6 months
• Management access authentication:
  • Multi-Factor Authentication (MFA)
  • Public key authentication (including by TLS client certificate)
  • Identity federation with existing provider (for example Google Apps)
  • Dedicated link (for example VPN)
  • Username or password

Audit information for users

• Access to user activity audit information: Users have access to real-time audit information
• How long user audit data is stored for: User-defined
• Access to supplier activity audit information: Users contact the support team to get audit information
• How long supplier audit data is stored for: User-defined
• How long system logs are stored for: User-defined

Security governance

• Named board-level person responsible for service security: Yes
• Security governance certified: Yes
• Security governance standards: ISO/IEC 27001
• Information security policies and processes: DNAnexus has put in measures to ensure the highest level of data security for both research and clinical use. These measures include high-end physical data centre security; reliable, replicated data storage; all data encrypted at rest and in transfer; and enterprise and user-controlled permissions for data, analysis tool, and workflow sharing. For compliance support, we enable data logging and audibility for six (6) years, versioned and reproducible analysis tools and results, and compliance with HIPAA, CLIA, 21 CFR Parts 11, 58, and 493, and European Data Privacy laws and regulations. DNAnexus ensures the security of data both at rest and in transit through robust encryption practices: – Data at Rest: All stored data is encrypted using the Advanced Encryption Standard (AES) with a 256-bit key (AES256), providing a high level of security for data storage. – Data in Transit: Data transmitted over networks is encrypted using Transport Layer Security (TLS) version 1.2 or higher, ensuring secure communication channels and protecting data from interception during transmission. These encryption practices ensure that all data managed by DNAnexus remains secure and compliant with modern security standards.
• Software Security Code of Practice: Yes

Operational security

• Configuration and change management standard: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Configuration and change management approach: We adhere to the ISO/IEC 27001:2022 requirements. Configuration-as-code follow the standard SDLC.
• Vulnerability management type: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Vulnerability management approach: Continuously scan for vulnerabilities. Critical vulnerabilities are patched within a few hours (testing in Staging first), high=30 days, moderate=90 days and low=180 days. Sources include US CISA, Interpol, and the vendors of the vulnerability scanning software.
• Protective monitoring type: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Protective monitoring approach: Continuously monitor across the firewalls, system logs, etc and alerts via our SIEM. Internal response is < 1hr and notification of impacted users is within 72 hours.
• Incident management type: Complies with a recognised standard, for example, CSA CCM v4.0 or ISO/IEC 27035:2011 or SSAE-18 / ISAE 3402
• Incident management approach: We adhere to the ISO/IEC 27001:2022 requirements. Follow standard Incident Response processes, including annual desktop exercises, post-mortem reviews of actual and test incidents.
• Post-quantum cryptography secure: Yes

Secure development

• Approach to secure software development best practice: Independent review of processes (for example CESG CPA Build Standard, ISO/IEC 27034, ISO/IEC 27001 or CSA CCM v4.0)

Public sector networks

• Connection to public sector networks: No

Pricing

• Discount for educational organisations: No
• Free trial available: No

Discount percentage by annual call-off contract value (excluding VAT)

• Less than £250,000: 0%
• Between £250,000 and £500,000: 0%
• Between £500,001 and £1,000,000: 0%
• Between £1,000,001 and £2,500,000: 0%
• Between £2,500,001 and £5,000,000: 0%
• Over £5,000,001: 0%

Non-mandatory Standards and certifications

• ISO/IEC 27001 certification: No
• ISO 28000:2022 certification: No
• ISO 9001 certification: No
• Quality management systems (QMS): No
• CSA STAR certification: No
• PCI certification: Yes
• Who accredited the PCI DSS certification: Security Metrics
• PCI DSS accreditation date: Thursday 13 October 2022
• What the PCI DSS doesn’t cover: N/A
• Cyber essentials: Yes
• Please provide your Cyber Essentials Certificate Number: 2ca54370-5ba3-4c4c-8f11-4ce674c75b2f
• Cyber essentials plus: Yes
• Please provide your Cyber Essentials Plus Certificate Number: 0bbcc831-b68d-4be1-8d9b-600f7fde7cc4
• Other security certifications: Yes
• Any other security certifications:
  • HIPAA
  • FedRAMP
  • GovRAMP
  • DPS

Social value

• Section B - Commitment for Future: Delivery:

  • Mission: Build an NHS fit for the future: That is there when people need it; with fewer lives lost to the biggest killers; in a fairer Britain, where everyone lives well for longer.

    Policy Outcome 8: Increasing productivity through physical and mental wellbeing: In the supply chain and communities in the relevant area.

    • Understanding of issues relating to health and wellbeing, including physical and mental health, in the contract workforce
    • Understanding barriers to access to health and social care services or employment opportunities e.g. digital inclusion
    • Inclusive and accessible recruitment practices, development practices and retention policies that support-focused activities including those provided in the Guide for line managers on recruiting, managing and developing which support people with a disability or health condition
    • Actions to invest in the physical and mental health and wellbeing of the contract workforce

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at emea_tenders@dnanexus.com. Tell them what format you need. It will help if you say what assistive technology you use.