BCN GROUP LTD.

Microsoft Fabric Services

BCN Group delivers comprehensive Microsoft Fabric services, enhancing operations for organisations across the UK public sector, including central and local government, NHS and health bodies, education institutions, emergency services, and arm’s-length bodies

Features

Tailored Microsoft Fabric Solutions for the entire public sector
Unified data platform connecting disparate data sources
Data Ingestion: Seamless integration from diverse data sources
OneLake: Centralised SaaS Data Lake for robust data processing
Data warehouse: Structured data processing and management
Data Engineering: Organisation and analysis of large data sets
Data science: AI-powered tools for enriched data and insights
Business intelligence: Transform data into actionable decisions with Power BI
Deep public sector knowledge with comprehensive managed services

Benefits

BCN professionals skilled in all Fabric components
Data-services expertise across the public sector
From data ingestion to insightful analytics
Simplified model for Fabric Services
Enhanced efficiency across public sector operations
Data-driven decision-making capabilities
Fostering a data-informed public sector culture
Optimising allocation and future planning
Operational savings through increased efficiency
Continuous improvement with adaptable solutions

Service documents

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at mark.day@bcn.co.uk. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 15

Service ID

Contact

BCN GROUP LTD. Mr Ric Kelly
Telephone: 0345 095 7000
Email: mark.day@bcn.co.uk

About your service

Service categories

PaaS

Analytics and Business Intelligence

Business Intelligence
Advanced Predictive Analytics

Service scope

Service constraints: Services are constrained only by the limitations of the Azure Platform & the associated services
System requirements: Suitable internet connectivity
Cloud deployment model: Private cloud

User support

Email or online ticketing support: Yes
Support response times: Priority 1 - Working Hours or Extended Working Hours- Response Time within 60 Minutes
Priority 2 - Working Hours or Extended Working Hours - Response Time within 2 Hours
Priority 3 or 4 - Working Hours or Extended Working Hours - Response Time within 4 Hours
Priority 5 - Working Hours or Extended Working Hours - Response Time within 8 Hours
User can manage status and priority of support tickets: Yes
Online ticketing support accessibility: None or don’t know
Phone support: Yes
Phone support availability: 24 hours, 7 days a week
Web chat support: Yes
Web chat support availability: 24 hours, 7 days a week
Web chat support accessibility standard: None or don’t know
How the web chat support is accessible: Web chat support is delivered via a reputable third-party service management platform with integrated web chat functionality. Accessibility requirements are considered when selecting and managing third-party suppliers. The web chat interface is designed to support accessibility in line with recognised standards and broadly aligns with WCAG 2.1 AA where applicable; however, full technical compliance is dependent on the supplier’s implementation.

Where users are unable to access web chat due to accessibility needs, alternative support channels are available, including email and telephone support. Reasonable adjustments will be made where required to ensure users can access support. Accessibility considerations are kept under ongoing review, and suppliers are engaged through regular reviews to ensure accessibility improvements are identified, prioritised, and adopted as they become available.
Web chat accessibility testing: The web chat functionality is delivered via a reputable third-party service management platform. While the platform is designed to support accessibility in line with recognised standards and broadly aligns with WCAG 2.1 AA where applicable, full technical compliance is dependent on the supplier’s implementation.
Accessibility requirements are considered when selecting and managing third-party suppliers. Alternative support channels, including email and telephone, are available where web chat cannot be accessed due to accessibility needs. Accessibility considerations are reviewed on an ongoing basis, and suppliers are engaged through regular reviews to ensure any improvements are identified, prioritised, and adopted as they become available.
Onsite support: Yes, at extra cost
Support levels: Comprehensive Account Management & Support options
Availability of the Azure Platform is inherited via Microsoft Support Hours 50+ dedicated support engineers across 3 UK offices provide technical support 24 hours a day, 7 days a week, 365 days a year. * This includes proactive monitoring and alerting of core services. *Waking Hours = 7am to 7pm Monday to Friday (from manned helpdesk) Ticket Severity All tickets logged to the Service Desk will be allocated a severity level based on the following methodology. This will ensure that reporting on service levels may be achieved to the optimum format. 1 - Catastrophic business disruption 2 - Severe business disruption or user critical issue 3 - Business disruption or multiple user issue 4 - Minor business disruption or user issue 5 - Job or Task Service Desk Staff will evaluate the Incident and allocate a priority level after which it will be assigned to the appropriate staff. This will be based on the required skill set to resolve the incident in a timely manner.
As a Microsoft Tier-1 CSP BCN will escalate issues to Microsoft as required for additional support.
Support available to third parties: No
AI chatbot: No

Onboarding and offboarding

Getting started: For all services BCN will engage with the customer to identify business requirements & the optimal solution required. Whether that is a migration from other systems or enhancement of an existing solution, BCN will guide from start to finish.
BCN follow the below methodology for delivering projects: Define The first step is always information. We take the time to understand your business. Build We build on our research. Your solution is designed to leverage the insights we learn. Deliver We only ever deliver once we're completely happy and fully tested. Evolve Digital solutions don't stop, they evolve. Metrics & analytics keep pushing you forward.
Service documentation: Yes
Documentation formats: PDF
End-of-contract data extraction: Continuity of service is important to us for our customers. All customer data is hosted in the customer's tenant & therefore is fully owned by the customer. At the end of any contracted engagement the customer will control the data within purchased resources & BCN access will be removed as necessary. BCN can support extraction from systems via multiple methods if required depending on the customer needs.
End-of-contract process: At the end of any contracted engagement BCN will support handover of any solution to the customer. BCN will remove access to all systems as necessary & terminate any support for services.
Documentation accessibility standard: WCAG 2.2 AA

Using the service

Web browser interface: Yes
Using the web interface: Users can provision, manage and remove resources/services from their subscription.
Web interface accessibility standard: WCAG 2.2 AA
Web interface accessibility testing: Interface testing are managed by 3rd party providers (such as Microsoft).
API: No
Command line interface: No

Scaling

Independence of resources: Independence of resources is provided by Microsoft using logical tenant isolation. Multiple forms of protection have been implemented throughout Microsoft services to prevent customers from compromising Microsoft services or applications or gaining unauthorized access to the information of other tenants or the Microsoft system itself, including: Logical isolation of customer content within each tenant for Microsoft services is achieved through Microsoft Entra authorization and role-based access control.
Usage notifications: Yes
Usage reporting: Email
Optimising consumption: Yes
Automatic scaling: Yes

Analytics

Infrastructure or application metrics: Yes
Metrics types: CPU

Disk

HTTP request and response status

Memory

Network

Number of active instances
Reporting types: Reports on request
Resource tagging: Yes
FOCUS resource tagging: Yes

Resellers

Supplier type: Not a reseller

Staff security

Staff security clearance: Other security clearance
Government security clearance: Security Clearance (SC)

Asset protection

Knowledge of data storage and processing locations: Yes
Data storage and processing locations: United Kingdom

European Economic Area (EEA)
User control over data storage and processing locations: Yes
Datacentre security standards: Complies with a recognised standard (for example CSA CCM version 4.0)
Penetration testing frequency: At least once a year
Penetration testing approach: ‘IT Health Check’ performed by a CREST-approved service provider
Protecting data at rest: Physical access control, complying with CSA CCM v4.0

Physical access control, complying with SSAE-18 / ISAE 3402

Encryption of all physical media
Data sanitisation process: Yes
Equipment disposal approach: A third-party destruction service
Data sanitisation type: Deleted data can’t be directly accessed / Cryptographic Erasure

Explicit overwriting of storage before reallocation / Secure Erase

Backup and recovery

What’s backed up: Backups will be identified as part of the solution
Backup controls: Resources backed up will be identified as part of the solution
Datacentre setup: Multiple datacentres with disaster recovery
Scheduling backups: Users contact the support team to schedule backups
Backup recovery: Users can recover backups themselves, for example through a web interface

Users contact the support team
Backup and recovery: Yes
RPO/RTO: No

Data-in-transit protection

Data protection between buyer and supplier networks: TLS (version 1.2 or above)

IPsec or TLS VPN gateway
Data protection within supplier network: TLS (version 1.2 or above)

IPsec or TLS VPN gateway

Availability and resilience

Guaranteed availability: SLA's are varied and dependent on the resources deployed and subject to the services provided. Refunds will be subject to contract terms.
Approach to resilience: Resilience is subject to requirements and supported by BCN.
Outage reporting: A public dashboard and email alerts.

Identity and authentication

User authentication needed: Yes
User authentication: Multi-Factor Authentication (MFA)

Dedicated link (for example VPN)
Access restrictions in management interfaces and support channels: Entra ID provides RBAC controls into customer Fabric environments to restrict access to named resources. Following a least-privilege principle access is controlled via the Entra ID of the customer & other network restrictions based on the solution.
Access restriction testing frequency: At least once a year
Management access authentication: Multi-Factor Authentication (MFA)
Devices users manage the service through: Any device but through a bastion host (a bastion host is a server that provides access to a private network from an external network such as the internet)

Directly from any device which may also be used for normal business (for example web browsing or viewing external email)

Audit information for users

Access to user activity audit information: Users have access to real-time audit information
How long user audit data is stored for: Between 1 month and 6 months
Access to supplier activity audit information: Users have access to real-time audit information
How long supplier audit data is stored for: Between 1 month and 6 months
How long system logs are stored for: Between 1 month and 6 months

Security governance

Named board-level person responsible for service security: Yes
Security governance certified: Yes
Security governance standards: ISO/IEC 27001
Information security policies and processes: BCN Group are certified as compliant with ISO27001 by a UKAS accredited certifying body.

Operational security

Configuration and change management standard: Supplier-defined controls
Configuration and change management approach: Change requests are raised by the customer or on their behalf by our support team. These are submitted to the change team for review and what-if analysis, the results of which are communicated back to the change owner for review of potential impacts and technical feedback before authorising and scheduling in the work. Upon completion and validation that the change has been successful, relevant documentation and parties are updated accordingly. The Change Advisory Board meet regularly to assess the whole change life-cycle to ensure that safeguards and security remain at the forefront of any changes made.
Vulnerability management type: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
Vulnerability management approach: Approach Production assets are scheduled for daily, automatic scans with the most recent vulnerability signatures. The results of these scans are collected in a secure, central storage service, and automated reporting makes results available to service teams.
Service teams review scan results that report aggregate scan results to provide comprehensive reporting and trend analysis. When vulnerability scans indicate missing patches, security misconfigurations, or other vulnerabilities in the environment, service teams use these reports to target the affected components for remediation. Vulnerabilities discovered through scanning are prioritized for remediation based on their (CVSS) scores and other relevant risk factors - https://learn.microsoft.com/en-us/compliance/assurance/assurance-vulnerability-management
Protective monitoring type: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
Protective monitoring approach: Protective Monitoring is provided by Microsoft for Fabric Services.
"Microsoft cloud services are continuously monitored for signs of compromise. In addition to automated security monitoring and alerting, all employees receive annual training to recognize and report signs of potential security incidents.
When suspicious activity is detected and escalated, Service-specific Security Response teams initiate a process of analysis, containment, eradication, and recovery"
More information can be found here https://learn.microsoft.com/en-us/compliance/assurance/assurance-incident-management
Incident management type: Complies with a recognised standard, for example, CSA CCM v4.0 or ISO/IEC 27035:2011 or SSAE-18 / ISAE 3402
Incident management approach: Incidents are managed through a structured process aligned with ISO/IEC 27035 and ITIL principles. The approach includes preparation, rapid detection, classification, and escalation based on severity. Incidents are logged and tracked with full audit trails, ensuring timely communication to stakeholders. Major incidents invoke dedicated escalation teams for containment, investigation, and resolution. Root cause analysis and lessons learned feed continuous improvement. The process prioritises minimising business impact, maintaining confidentiality, integrity, and availability, and complies with regulatory and security standards, including NCSC guidance for UK Government cloud services
Post-quantum cryptography secure: Yes

Secure development

Approach to secure software development best practice: Conforms to a recognised standard, but self-assessed

Separation between users

Virtualisation technology used to keep applications and users sharing the same infrastructure apart: Yes
Who implements virtualisation: Third-party
Third-party virtualisation provider: Microsoft
How shared infrastructure is kept separate: Microsoft separates client data into organisational structures such as tenants and subscriptions that are only visible to the client in question. Microsoft are responsible for the hyperscale platform that ensures memory and process separation between clients/users.

Energy efficiency

Energy-efficient datacentres: Yes
Description of energy efficient datacentres: Microsoft datacentres actively comply with the EU Code of Conduct for Energy Efficiency in Data Centres, a voluntary initiative endorsed by the European Commission. This includes implementing recognised best practices such as optimised cooling systems, advanced power management, and continuous energy monitoring to reduce consumption and carbon footprint. Microsoft employs renewable energy sourcing, efficient hardware utilisation, and waste heat reuse strategies where feasible. Compliance is supported by ISO 50001-certified energy management systems and regular audits to ensure adherence to sustainability standards. These measures align with EU guidelines and contribute to meeting climate mitigation objectives under the Energy Efficiency Directive

Pricing

Discount for educational organisations: No
Free trial available: No

Discount

Provide your minimum discount applicable to your baseline prices: 0%

Formula for calculating price of your services

Which of the core deployment models you intend to offer

Public Cloud
Private Cloud

Public Cloud - Formula for calculating price of your services

Total Cost: The Total Cost for a buyer's call off requirement in a Public Cloud Deployment
=
Baseline Pricing: Available on request
Baseline Pricing - Web link: https://bcn.co.uk/contact/
-
Minimum Discounting: 0%
+
Onboarding Activity: Onboarding costs may vary based on your specific requirements, please confirm with suppliers during the clarification process
+
Additional sources of cost: Additional Licence Cost
-
Additional sources of cost reduction: Longer term contracts

Private Cloud - Formula for calculating price of your services

Total Cost: The Total Cost for a buyer's call off requirement in a Private Cloud Deployment
=
Baseline Pricing: G-Cloud Service Lines
-
Minimum Discounting: 0%
+
Onboarding Activity: Onboarding costs may vary based on your specific requirements, please confirm with suppliers during the clarification process
+
Additional sources of cost: Additional Licence Cost
-
Additional sources of cost reduction: Longer term contracts

Mandatory certifications

Are you are bidding to offer IaaS and/or PaaS as a reseller or are you in sole control of the infrastructure

Reseller

Cloud service suppliers you intend to resell with evidence

Organisation 1

Organisation name

Microsoft

Website address/upload for organisation

Website address

https://bcn.co.uk/our-partners/microsoft-partner/

ISO 9001 certification

Provided

ISO 27001 certification

Provided

ISO 20000-1 certification

Provided

Are you reliant on the Cloud Service Provider for some accreditations

Yes

Cyber Essentials

Do you have a Cyber Essentials Plus certificate?: Yes
Cyber Essentials Plus certificate Number: 63c519cc-b513-414c-937a-7be3f1156af7

Non-mandatory Standards and certifications

ISO 28000:2022 certification: No
Quality management systems (QMS): Yes
CSA STAR certification: No
PCI certification: No
Other security certifications: Yes
Any other security certifications: NHS DSPT

Section B - Commitment for Future: Delivery: Mission: Kick start economic growth. To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

Policy Outcome 1: Fair work: That offers fair wages and good working conditions. Help people get a job, stay in work, and progress in their careers, with good employment opportunities across the country. Notes: Where there is a large proportion of labour costs in the contract, commercial teams should consider MAC in Outcome 1 as a priority

New or retained jobs on the contract workforce in the relevant area that meet the criteria set out in MAC 1b, 1c and 1d

New apprenticeships on the contract workforce in the relevant area that meet the criteria set out in MAC 1b

Providing opportunities for, and measuring and monitoring of, staff workforce conditions over time, including employee engagement, involvement in decision-making and satisfaction and adapting to any changes in the results, with clear processes for acting on issues identified

Plans to engage the contract workforce in deciding the most important workplace issues to address

Ensuring new workers are informed of their right to join a trade union

Monitoring of employee engagement rates (by protected characteristic) and, where necessary, the development of actions to ensure all voices are heard across the diversity of the workforce

Employment contracts that reflect actual hours worked; steps taken to ensure employees understand their contracts and have the ability to review and adjust them if actual hours regularly exceed contracted hours

Activities that support an environment where staff are educated about, and feel empowered to, address their physical wellbeing

Activities that support an environment where staff are educated about and feel empowered to report and address bullying and harassment

Activities to cascade good practice on fair working conditions throughout the supply chain

Payment of more than the National Minimum Wage or National Living Wage (as appropriate) to the contract workforce

Monitoring and reporting of gender and ethnicity pay gaps and plans to address them where necessary

Entitlement to sick pay for the contract workforce, with provision in place for any staff who do not meet the earnings threshold for statutory sick pay, payment of sick pay from day one of absence and payment of staff on the contract workforce who are off sick a replacement income of 100% of their usual earnings for as long as possible

Understanding of in-work progression issues affecting the market, industry or sector relevant to the contract, and in the supplier’s own organisation and those of its key sub-contractors

Measures to support in-work progression to help people in the contract workforce, to move into higher paid work by developing new skills relevant to the contract

Support for the contract workforce by providing career advice, and providing opportunities for staff working on the contract with in-work progression career development into known skills shortages or high growth areas

Support for educational attainment relevant to the contract, including training schemes that address skills gaps and result in recognised qualifications

Volunteering opportunities for staff

Understanding of the modern slavery risks and issues affecting the market, industry, sector or country (of origin or of source) relevant to the contract, and the workforce in the supplier’s own organisation and those of its key subcontractors

Measures to identify, mitigate and manage modern slavery risks relating to the contract and how these will be implemented

Outline policies and practices to be applied to or put in place for the contract to mitigate and manage modern slavery risks, including: Pre-employment checks, recruitment practices. Workplace conditions, safeguarding plans and processes in place and regular monitoring with relevant groups considered, which may include sampling

How these flow down the supply chain and are monitored Illustrative examples include reporting, site visits, audits, etc.

How to ensure business decisions re: price/cost, short lead times, payment timescales do not create modern slavery risks in the supply chain

How the supplier will work with NGOs, trade unions or other businesses to address modern slavery risk

Means of influencing staff, suppliers, customers, communities and/or any other appropriate stakeholders with respect to modern slavery risks relating to the contract

Mission: Kick start economic growth. To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

Policy Outcome 2: Skills for growth: Supporting growth sectors and addressing skills gaps.

Understanding of employment and relevant skills issues, and of the education and training issues relating to the contract. Illustrative examples: demographics, skills shortages, new opportunities in high growth sectors, geographic/local community and skills/employment challenges

Support for educational attainment relevant to the contract, including training schemes that address skills gaps and result in recognised qualifications

Activities to support relevant sector related skills growth and sustainability in the contract workforce. Illustrative examples: careers talks, curriculum support, literacy support, safety talks and volunteering

Delivery of apprenticeships, supported internships and T Level industry placement opportunities (Level 2, 3 and 4+) in relation to the contract

Mission: Make Britain a clean energy superpower: To cut bills, create jobs and deliver security with cheaper, zero-carbon electricity by 2030, accelerating to net zero

Policy Outcome 4: Sustainable procurement practices: Reducing carbon footprints, minimising waste, and promoting the use of clean energy and green technologies.

Activities to reconnect people with the environment and increase awareness of ways to protect and enhance it

Mission: Break down barriers to opportunity: By reforming our childcare and education systems, to make sure there is no class ceiling on the ambitions of young people in Britain

Policy Outcome 7: Creating a pipeline of opportunities: For the contract workforce, reducing barriers to entry for under-represented groups.

Understanding of the issues affecting the development of new skills by target cohort

Understanding of the underlying factors affecting improvements to reduce barriers to entry and training schemes for the target cohort(s) related to the contract workforce

Other measures to offer development opportunities for the target cohort(s) in the contract workforce

Understanding of issues relating to entering the contract workforce

Creation of outreach activities to create a pipeline of employees for the future contract delivery

Service documents

Request an accessible format

Cookies on Digital Marketplace

Microsoft Fabric Services

Features

Benefits

Pricing

Service documents

Framework

Service ID

Contact

About your service

Service scope

User support

Onboarding and offboarding

Using the service

Scaling

Analytics

Resellers

Staff security

Asset protection

Backup and recovery

Data-in-transit protection

Availability and resilience

Identity and authentication

Audit information for users

Security governance

Operational security

Secure development

Separation between users

Energy efficiency

Pricing

Discount

Formula for calculating price of your services

Mandatory certifications

Cyber Essentials

Non-mandatory Standards and certifications

Social value

Service documents