CERTUS TECHNOLOGY ASSOCIATES LIMITED

TACTIC- Demand and capacity management.

TACTIC Demand and Capacity is a cloud-based service providing rolling forecasts of demand, capacity, and waiting lists for NHS diagnostic services. It replaces spreadsheet planning with standardised modelling, workforce-aligned capacity forecasting, and scenario analysis to support operational control and strategic planning. In Endoscopy, it supports JAG-aligned reporting and training coordination.

Features

• Cloud-based demand, capacity and waitlist forecasting platform.
• Multi-user scheduling replacing manual planning spreadsheets.
• Rolling horizon forecasts using historic and live service data.
• Regional demand models broken down to organisational levels.
• Procedure-specific capacity modelling including DNA and ROTT.
• Scenario planning for service configuration and redesign options.
• Workforce planning with role-based career pathway modelling.
• Training list management integrated into service scheduling.
• Facility and room databases linked to capacity planning.
• Local and regional business intelligence dashboards.

Benefits

• Replaces spreadsheet risk with reliable, shared planning intelligence.
• Improves visibility of future pressures across services and regions.
• Supports proactive decisions through accurate waitlist forecasting.
• Aligns capacity planning with real workforce availability.
• Targets training investment where it most impacts capacity.
• Enables coordinated planning across organisations and sites.
• Reduces administrative burden through automated data aggregation.
• Improves service resilience with scenario-based planning tools.
• Supports compliance through structured, standards-aligned reporting.
• Delivers actionable insights for operational and strategic leaders.

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at david.whitehouse@certus-tech.com. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 15

Service ID

166037364511505

Contact

David Whitehouse
07775978087
david.whitehouse@certus-tech.com

About your service

• Service categories:

  Applications

  Enterprise resource management

  • Enterprise performance management

  Human capital management

  • Core Human Resources Applications
  • Talent Management Applications
• Multi cloud support: Yes

Service scope

• Software add-on or extension: No
• Cloud deployment model: Private cloud
• Service constraints: TACTIC has no technical constraints as long as the user is on a current browser (the two latest versions).
• System requirements:
  • Browser access: Latest two versions of major browsers are supported
  • To work online: internet access

User support

• Email or online ticketing support: Yes
• Support response times: 24hrs
• User can manage status and priority of support tickets: Yes
• Online ticketing support accessibility: None or don’t know
• Phone support: Yes
• Phone support availability: 9 to 5 (UK time), Monday to Friday
• Web chat support: No
• Onsite support: Yes
• Support levels: The Company provides professional support services inclusive of our software pricing, ensuring effective and reliable performance through a scope that covers access, configuration, troubleshooting, and guidance on standard workflows. These services, coordinated by the Product Owner in alignment with our Terms and Conditions, proactively manage incidents and service disruptions while maintaining transparent communication regarding known issues and planned maintenance to assist users with all technical and operational needs.
• Support available to third parties: No

Onboarding and offboarding

• Getting started: Online training
• Service documentation: Yes
• Documentation formats:
  • HTML
  • PDF
• End-of-contract data extraction: Customers own their content at all times. Customers can download copies of their content stored in TACTIC at any time during their subscription period.
• End-of-contract process: For 30 days following the expiration of the Termination of; the Agreement and/or applicable Subscription Period, a customer may request from Certus, limited access to the TACTIC Platform solely for; purposes of Customer’s retrieval of the Content.
• Documentation accessibility standard: None or don’t know
• How the documentation is accessible: On-line

Using the service

• Web browser interface: Yes
• Supported browsers:
  • Firefox
  • Chrome
  • Safari
• Application to install: No
• Designed for use on mobile devices: No
• Service interface: No
• User support accessibility: None or don’t know
• API: Yes
• What users can and can't do using the API: TACTIC includes an API toolkit that will allow integrations to be; created and maintained. Although the system has API’s, each integration would still require scoping. The Web Service APIs support HTTPS based protocols.
• API documentation: Yes
• API documentation formats: Open API (also known as Swagger)
• API sandbox or test environment: Yes
• Customisation available: Yes
• Description of customisation: API Customisation can be undertaken through the TACTIC support services available under Lot 3.

Scaling

• Independence of resources: Systems are auto-scaled to match computing capacity with; demand.

Analytics

• Service usage metrics: Yes
• Metrics types: Metrics types, User Session logons/offs (where Audit logging feature has been enabled) and system availability.
• Reporting types: Reports on request
• Resource tagging: No
• FOCUS resource tagging: No

Resellers

• Supplier type: Not a reseller

Staff security

• Staff security clearance: Conforms to BS7858:2019
• Government security clearance: None

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations: United Kingdom
• User control over data storage and processing locations: No
• Datacentre security standards: Complies with a recognised standard (for example CSA CCM version 4.0)
• Penetration testing frequency: At least every 6 months
• Penetration testing approach: ‘IT Health Check’ performed by a CHECK service provider
• Protecting data at rest:
  • Physical access control, complying with CSA CCM v4.0
  • Encryption of all physical media
• Data sanitisation process: Yes
• Equipment disposal approach: A third-party destruction service
• Data sanitisation type:
  • Data Erasure
  • Explicit overwriting of storage before reallocation / Secure Erase
  • Physical Destruction / Hardware containing data is completely destroyed

Data importing and exporting

• Data export approach: Certus would work with Customers to extract their data according to the Term and Conditions.
• Data export formats: CSV
• Data import formats: CSV

Data-in-transit protection

• Data protection between buyer and supplier networks:
  • TLS (version 1.2 or above)
  • IPsec or TLS VPN gateway
• Data protection within supplier network: TLS (version 1.2 or above)

Availability and resilience

• Guaranteed availability: The Company commits to a minimum Service Availability of 99.5% during each calendar month, calculated as:; ; Service Availability % = ((Service Minutes - Downtime) / Service Minutes) × 100; ; Full details of this guarantee are set out in the Terms and Conditions.
• Approach to resilience: Approach to Asset Protection and Resilience; ; Our approach to asset protection and resilience aligns with the NCSC Cloud Security Principles and ensures that customer data, including credentials, configuration data, metadata and logs, is protected throughout its lifecycle.; ; Customer data is hosted in UK-based cloud regions by default, unless otherwise agreed. We maintain clear knowledge of where data is stored, processed, and supported from, and ensure data is subject to UK legal jurisdiction and the Data Protection Act 2018. Customer data remains the property of the customer and is not used for secondary purposes such as marketing or machine learning.; ; Services are hosted in professionally managed data centres with strong physical security controls, independently certified against recognised standards such as ISO/IEC 27001 and CSA Cloud Controls Matrix.; ; All data is encrypted at rest and in transit using industry-standard algorithms and managed key services. Encryption extends to backups, logs, and derived data.; ; Data is securely sanitised through logical deletion and encryption key disposal. Services are designed for high availability, with redundancy, automated monitoring, regular backups, and tested recovery processes to protect against outages and data loss, including ransomware.
• Outage reporting: Service availability is continuously monitored using automated health checks and alerting across all core components of the service.; ; In the event of an outage or service degradation:; ; - Operational alerts are raised immediately to on-call support staff.; ; - Incidents are logged and tracked through a managed incident process.; ; - Customers are informed of outages and significant service issues through:; ; - A service status page showing current availability and known incidents, and/or; ; - Direct customer notifications (email or agreed support channels) for material incidents affecting service availability or data access.; ; Notifications include:; ; - Confirmation that an incident is under investigation; ; - The scope and impact of the issue; ; - Updates as remediation progresses; ; - Confirmation of service restoration; ; Post-incident, a summary or incident report can be provided on request, outlining cause, resolution, and any corrective actions taken to reduce recurrence.; ; Planned maintenance and changes with potential service impact are communicated in advance where possible, with expected timescales and impact clearly described.

Identity and authentication

• User authentication needed: Yes
• User authentication:
  • Multi-Factor Authentication (MFA)
  • Username or password
• Access restrictions in management interfaces and support channels: Management Interface Access:; ; Root/administrator access is restricted to the Technical Director, with auditable procedures for emergency access. Production servers are hosted in secure data centres with no routine network access from outside or within office networks. Privileged users access systems only via VPN, with all access logged.; ; Support Channel Controls:; ; Users authenticate via unique accounts with role-based privileges assigned through group membership. Access to customer confidential data requires specific task authorisation. Sensitive system access triggers alerts to the Information Asset Owner.; ; Network Segregation:; ; Firewalls and VPNs segregate networks. No unauthorised devices may connect; visitors receive WiFi with no LAN access.
• Access restriction testing frequency: At least once a year
• Management access authentication:
  • Multi-Factor Authentication (MFA)
  • Username or password

Audit information for users

• Access to user activity audit information: Users have access to real-time audit information
• How long user audit data is stored for: User-defined
• Access to supplier activity audit information: Users have access to real-time audit information
• How long supplier audit data is stored for: User-defined
• How long system logs are stored for: User-defined

Security governance

• Named board-level person responsible for service security: Yes
• Security governance certified: Yes
• Security governance standards: ISO/IEC 27001
• Information security policies and processes: Certus operates an Information Security Management System (ISMS) aligned with ISO 27001:2022, supported by Cyber Essentials Plus certification and NHS Data Security and Protection Toolkit (DSPT) compliance with 'Standards Met' status.; ; Reporting Structure:; ; Our Managing Director serves as Senior Information Risk Owner (SIRO), accountable for overall information security governance. The Information Systems Director acts as Information Asset Owner, monitoring policy compliance and managing incidents. The Technical Director serves as Information Asset Administrator, implementing technical controls and maintaining business continuity plans.; ; Policy Framework:; ; Our policies address confidentiality, integrity and availability of information throughout its lifecycle. We implement risk-based controls through regular risk assessments, maintaining a risk register evaluated using a traffic-light severity system. All policies apply to employees, contractors, and third parties accessing our systems.; ; Compliance Assurance:; ; - Policy adherence is ensured through:; - Annual mandatory training via our online learning system; - Internal audits and management reviews; - Daily stand-ups addressing security issues; - Incident reporting and investigation procedures; - Continuous improvement cycles updating our Statement of Applicability and Risk Treatment Plan; - Our certifications and compliance status are publicly verifiable through the NCSC Cyber Essentials search and DSPT toolkit.
• Software Security Code of Practice: Yes

Operational security

• Configuration and change management standard: Supplier-defined controls
• Configuration and change management approach: Component Tracking:; ; All software assets are maintained under version control. Infrastructure configurations are centrally managed through Puppet, continuously verified against our configuration repository. Assets are documented in our Information Asset Register and monitored via automated dashboards.; ; Security Impact Assessment:; ; Changes follow Scrum methodology with mandatory peer review. No code is committed without passing tests and Technical Director approval. Our ISO 27005-aligned risk management process evaluates each change against documented assets, assessing likelihood and severity using a traffic-light system. Continuous Integration runs automated tests post-commit, with security issues tracked through Jira and raised at daily stand-ups.
• Vulnerability management type: Supplier-defined controls
• Vulnerability management approach: Vulnerability Management Approach; ; Threat Assessment:; ; We maintain a risk register evaluating threats against information assets, reinforced through regular penetration testing. Our build system references externally maintained vulnerability databases to identify outdated libraries.; ; Patch Deployment:; ; Operating systems are configured for automated patch management. Our Continuous Integration platform rebuilds and tests applications nightly, ensuring rapid deployment of security updates across all environments.; ; Threat Intelligence Sources:; ; We monitor NCSC guidance and CareCERT security advisories, responding immediately to alerts. Our Cyber Essentials Plus certification ensures alignment with proven cyber security frameworks, reviewed annually.
• Protective monitoring type: Supplier-defined controls
• Protective monitoring approach: Services are continuously monitored via automated dashboards. Application event logging captures errors and anomalies, triggering alert notifications to our support team. Staff report unexpected behaviour including access violations, uncontrolled changes, and physical security breaches.; ; Response to Potential Compromise:; ; Incidents are immediately triaged and classified by severity (Levels 1-3). A Director-led response team executes containment measures, investigates root cause, eradicates vulnerabilities, and recovers affected systems. All actions are tracked through our issue management system.; ; Response Timing:; ; Level 3 incidents: Director notified immediately; customer notification within 24 hours. All incidents reviewed at sprint retrospectives and management meetings for continuous improvement.
• Incident management type: Supplier-defined controls
• Incident management approach: Pre-defined Processes:; ; We maintain a baseline incident management procedure. Incidents are classified by type (Confidentiality, Integrity, Availability) and level (1-3), with predefined response actions. Our process covers: Triage, Analysis, Containment, Eradication, Recovery, and Review.; ; User Reporting:; ; Staff report incidents immediately to a Director via telephone/video call. Security issues are logged in Jira. Support staff identify incidents through incoming tickets. Classification tables guide escalation.; ; Incident Reports:; ; Customers receive Level 3 notification within 24 hours, detailing affected data subjects, consequences, and containment measures. Post-resolution reports document causes, actions, and prevention measures.
• Post-quantum cryptography secure: No

Secure development

• Approach to secure software development best practice: Conforms to a recognised standard, but self-assessed

Public sector networks

• Connection to public sector networks: No

Pricing

• Discount for educational organisations: No
• Free trial available: No

Discount percentage by annual call-off contract value (excluding VAT)

• Less than £250,000: 5.0%
• Between £250,000 and £500,000: 7.5%
• Between £500,001 and £1,000,000: 10.0%
• Between £1,000,001 and £2,500,000: 20.0%
• Between £2,500,001 and £5,000,000: 40.0%
• Over £5,000,001: 50.0%

Non-mandatory Standards and certifications

• ISO/IEC 27001 certification: No
• ISO 28000:2022 certification: No
• ISO 9001 certification: No
• Quality management systems (QMS): Yes
• CSA STAR certification: No
• PCI certification: No
• Cyber essentials: Yes
• Please provide your Cyber Essentials Certificate Number: A1d6ef83-c262-4b80-ad44-98f3979f507c
• Cyber essentials plus: Yes
• Please provide your Cyber Essentials Plus Certificate Number: A37f49ef-4f8d-4448-95ac-bd3c916ef863
• Other security certifications: No

Social value

• Section B - Commitment for Future: Delivery:

  • Mission: Kick start economic growth. To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

    Policy Outcome 1: Fair work: That offers fair wages and good working conditions. Help people get a job, stay in work, and progress in their careers, with good employment opportunities across the country. Notes: Where there is a large proportion of labour costs in the contract, commercial teams should consider MAC in Outcome 1 as a priority

    • Employment contracts that reflect actual hours worked; steps taken to ensure employees understand their contracts and have the ability to review and adjust them if actual hours regularly exceed contracted hours

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at david.whitehouse@certus-tech.com. Tell them what format you need. It will help if you say what assistive technology you use.