THE GORDIAN GROUP LIMITED

MTC QS

MTC QS is a software solution for managing Measured Term Contracts, enabling efficient handling of maintenance and minor works for organisations like local authorities and housing associations. It streamlines processes with pre-agreed rates, eliminating frequent tendering, and facilitates instant valuations and estimates, speeding up contract execution.

Features

• User Authentication/Security
• Online access
• Reporting Facilities
• Financial tracking
• Asset management
• Cost data access

Benefits

• Real-time project View: full project tracking and control
• Service Availability: hosted on UK approved data centres
• Project Support: 9-5 help desk & dedicated Account Manager/Customer Success
• Industry Recognition for Cost control for Maintenance works
• Tracking maintenance and minor works valuing
• Track job orders through to completion

• Education pricing available
• Free trial available

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at owainjames.page@gordian.com. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 15

Service ID

167643531215225

Contact

Owain Page
0800 066 8060
owainjames.page@gordian.com

About the service

• Service categories:

  Application Development and Deployment

  Software quality and life cycle

  • Automated software quality
  • Software change, configuration and process management
• Multi cloud support: Yes

Service scope

• Software add-on or extension: Yes, but can also be used as a standalone service
• What software services is the service an extension to: The NSR Schedule of Rates cost data
• Cloud deployment model: Private cloud
• Service constraints: There are no constraints to use the service
• System requirements: Secure Internet Access/4G or 5G

User support

• Email or online ticketing support: Yes
• Support response times: Average response time is less than 4 hours from Monday to Friday, although we strive to respond within an hour. We do not provide MTC QS support on weekends, but do commit to responding first thing Monday morning if a request is submitted over the weekend
• User can manage status and priority of support tickets: Yes
• Online ticketing support accessibility: None or don’t know
• Phone support: Yes
• Phone support availability: 9 to 5 (UK time), Monday to Friday
• Web chat support: No
• Onsite support: Yes, at extra cost
• Support levels: Urgent calls: Application issue affecting all users; the system is inoperable. - Response within 30 minutes. - Escalation: Immediately to technical ; Notification to senior management­ immediately; Account Manager informed. High calls: Bug affecting key functionality and limiting ; the available functionality of the system. - Response within 1 hour - Escalation: Immediate notification to Help Desk Supervisor; Notification to helpdesk manager if SLA not met. Normal calls: A specific functional area is inoperable while other areas of the system are functioning normally. - Response within 4 hours - Escalation: Notification to helpdesk manager if SLA not met. Low calls: Advice, "how to" calls. Reports of less critical errors. - Response within 24 hours - Escalation: Notification to helpdesk manager if SLA not met. Request for Change: Request for new feature; feedback on a usability issue. - Acknowledged within 1 working day
• Support available to third parties: Yes

Onboarding and offboarding

• Getting started: Our Quantity surveyors will work with the customer and contractors to ensure set up is correct for them. ; We can provide onsite/online training at an additional cost.
• Service documentation: No
• End-of-contract data extraction: A formal request to the customers Account manager to start the process of data extraction using Gordians Support & Cloud teams.
• End-of-contract process: A request to terminate, or at the end of the contract, a request to end is controlled by the assigned Account Manager. Outstanding costs will be settled.

Using the service

• Web browser interface: Yes
• Supported browsers:
  • Microsoft Edge
  • Firefox
  • Chrome
  • Safari
  • Opera
• Application to install: No
• Designed for use on mobile devices: No
• Service interface: No
• User support accessibility: None or don’t know
• API: No
• Customisation available: Yes
• Description of customisation: The user can customise every contract added. ; They are also able to create custom codes for rates.

Scaling

• Independence of resources: Gordian continually monitors our environments for usage and performance impacts and adjusts our size based on the findings to ensure an enhanced experience for our customers.

Analytics

• Service usage metrics: No

Supplier type

• Supplier type: Not a reseller

Staff security

• Staff security clearance: Conforms to BS7858:2019
• Government security clearance: Security Clearance (SC)

Asset protection

• Knowledge of data storage and processing locations: No
• Datacentre security standards: Complies with a recognised standard (for example CSA CCM version 4.0)
• Penetration testing frequency: At least once a year
• Penetration testing approach: ‘IT Health Check’ performed by a CHECK service provider
• Protecting data at rest:
  • Physical access control, complying with another standard
  • Encryption of all physical media
• Data sanitisation process: No
• Equipment disposal approach: Complying with a recognised standard, for example CSA CCM v4.0, CAS (Sanitisation) or ISO/IEC 27001

Data importing and exporting

• Data export approach: Depending on the products data export is via reports using Excel, PDF & CSV
• Data export formats: CSV
• Data import formats: CSV

Data-in-transit protection

• Data protection between buyer and supplier networks: Private network or public sector network
• Data protection within supplier network: TLS (version 1.2 or above)

Availability and resilience

• Guaranteed availability: Gordian will use commercially reasonable efforts to ensure the Saas Product is available twenty-four hours per day, seven days, per week. Additionally, during Business Hours, excluding any Excused Downtime, (referred to as the "Availability Period”), Gordian commits to providing a 99.5% availability rate during the Availability Period each calendar month for the SaaS Product offered during the term.
• Approach to resilience: Information provided on request with an NDA in place
• Outage reporting: Outages will be reported by email alerts; such occurrences will be continually monitored by the Support Desk who will keep users informed of any adverse status by means of regular email bulletins.

Identity and authentication

• User authentication needed: Yes
• User authentication:
  • Multi-Factor Authentication (MFA)
  • Identity federation with existing provider (for example Google Apps)
  • Dedicated link (for example VPN)
  • Username or password
• Access restrictions in management interfaces and support channels: Access restrictions are independently validated and include, but not limited to, the following processes: ISP 03: Access Control and Account Management
• Access restriction testing frequency: At least every 6 months
• Management access authentication:
  • Dedicated link (for example VPN)
  • Username or password
  • Other
• Description of management access authentication: Description of management access authentication; If this pertains to system administrator access to the underlying server/network environment, then it would be username and password. If this is referring to the management of system administrators that administer sites/portals through a browser for customers / it's administrator level access to the underlying network/servers, this would also require a VPN connection too. Only authorised administrators with UK security clearance are allowed this access.

Audit information for users

• Access to user activity audit information: Users contact the support team to get audit information
• How long user audit data is stored for: Between 6 months and 12 months
• Access to supplier activity audit information: Users contact the support team to get audit information
• How long supplier audit data is stored for: Between 6 months and 12 months
• How long system logs are stored for: Between 6 months and 12 months

Security governance

• Named board-level person responsible for service security: Yes
• Security governance certified: Yes
• Security governance standards:
  • ISO/IEC 27001
  • Other
• Other security governance standards: Other security governance standards; ISO 9001:2015 MoD DART Accreditation Cyber Essentials Part 1 and Part 2 PCI DSS
• Information security policies and processes: Compliance to the following Security Policies is ; enforced through internal process improvement ; processes and by external certification audits: ISP 02 Risk Management and Assessment ISP 03 Access Control and Account Management ISP 04 Security Incident Management ISP 05 Asset ; Management and Information Classification ISP 06 Acceptable Use ISP 07 System Security and ; Network Access ISP 08 Business Continuity Plan; ISP 10 Security Patching ISP 11 Information Media Mobility, Storage and Disposal ISP 12 Physical Security and Access ISP 13 Systems Usage Logging and Audit ISP14 Staff recruitment, changes and leaving
• Software Security Code of Practice: Yes

Operational security

• Configuration and change management standard: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Configuration and change management approach: Examples of how configuration and change impact assessments are independently validated would include, but not limited to, the following processes: DSP 01: Design and Development Methodology DSP 02: Change and Configuration Control
• Vulnerability management type: Supplier-defined controls
• Vulnerability management approach: Examples of how vulnerability management ; processes are deployed by independent validation ; would include, but not limited to, the following processes: ISP 02 Risk Management and; Assessment ISP 10 Security Patching ISP 13 Systems Usage Logging and Audit
• Protective monitoring type: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Protective monitoring approach: Examples of how actual and potential security; incidents are identified and managed in a; responsive and effective manner would include,; but not limited to, the following processes: ISP 04:; Security Incident Management
• Incident management type: Supplier-defined controls
• Incident management approach: To be confirmed ; Incidents are reported by users to a single source; at the Support Desk. SLA regulations are; then applied. A pre-defined process is; documented in ISP 04 - Security Incident; Management procedure that ensures all internal; and external incidents are promptly reported and; effectively managed.
• Post-quantum cryptography secure: Yes

Secure development

• Approach to secure software development best practice: Independent review of processes (for example CESG CPA Build Standard, ISO/IEC 27034, ISO/IEC 27001 or CSA CCM v4.0)

Public sector networks

• Connection to public sector networks: No

Pricing

• Discount for educational organisations: Yes
• Free trial available: Yes
• Description of free trial: Description of free trial; Full system features are made available for one month trial period to selected users.

Discount percentage by annual call-off contract value (excluding VAT)

• Less than £250,000: 2.5%
• Between £250,000 and £500,000: 5%
• Between £500,001 and £1,000,000: 7.5%
• Between £1,000,001 and £2,500,000: 10%
• Between £2,500,001 and £5,000,000: 12.5%
• Over £5,000,001: 15%

Standards and certifications

• ISO/IEC 27001 certification: Yes
• ISO/IEC 27001 accredited by: Amtivo Group Limited T/A British Assessment Bureau Ltd.
• ISO/IEC 27001 accreditation date: Tuesday 1 April 2025
• What the ISO/IEC 27001 doesn’t cover: Gordians NSR - National Schedule of Rates; MTC QS; Capital Planning on Gordian Cloud Platform
• ISO 28000:2022 certification: No
• ISO 9001 certification: Yes
• ISO 9001 certification accredited by: Amtivo Group Limited T/A British Assessment Bureau Ltd.
• ISO 9001 accreditation date: Tuesday 1 April 2025
• What the ISO 9001 doesn’t cover: Gordians NSR - National Schedule of Rates; MTC QS; Capital Planning on Gordian Cloud Platform
• Quality management systems (QMS): Yes
• CSA STAR certification: No
• PCI certification: No
• Cyber essentials: No
• Cyber Essentials Alternative: None of the criteria
• Cyber essentials plus: No
• Cyber Essentials Alternative: In relation to the services you do not have a current and valid Cyber Essentials Plus certificate which has been awarded by one of the government approved Cyber Essentials accreditation bodies but you are working towards gaining it, and will be in a position to confirm that you have been awarded a current and valid Cyber Essentials Plus certificate by one of the government approved accreditation bodies within 12 months of the date of award.
• Other security certifications: No

Social value

• Mission: Kick start economic growth:

  To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

  Policy Outcome 1: Fair work: That offers fair wages and good working conditions. Help people get a job, stay in work, and progress in their careers, with good employment opportunities across the country. Notes: Where there is a large proportion of labour costs in the contract, commercial teams should consider MAC in Outcome 1 as a priority

  • Payment of more than the National Minimum Wage or National Living Wage (as appropriate) to the contract workforce
  • Entitlement to sick pay for the contract workforce, with provision in place for any staff who do not meet the earnings threshold for statutory sick pay, payment of sick pay from day one of absence and payment of staff on the contract workforce who are off sick a replacement income of 100% of their usual earnings for as long as possible
  • Plans for an appropriate income replacement policy for staff who are required to spend time away from work to care for a sick dependent or close relative

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at owainjames.page@gordian.com. Tell them what format you need. It will help if you say what assistive technology you use.