Qodea

Chrome Enterprise: Secure Web Browser and Chrome Operating System Management

Google Chrome Enterprise delivers secure, cloud-native infrastructure management. Chrome Enterprise Core provides unified browser visibility across operating systems. ChromeOS Flex revitalises legacy hardware into secure endpoints, reducing e-waste. Chrome Enterprise Premium adds advanced Zero Trust security, Data Loss Prevention (DLP), and deep threat scanning for hybrid public sector workforces.

Features

• Centralised cloud management for mixed-OS browser fleets
• Revitalise legacy PCs and Macs with secure cloud-first OS.
• Advanced security including deep scanning and data loss prevention.
• Enforce Zero Trust access controls for web applications.
• Prevent sensitive data exfiltration via Chrome browser transfers.
• Instant scanning and blocking of malware and phishing sites.
• Granular reporting on browser events and high-risk user activity.
• Remotely wipe, disable, and configure ChromeOS devices centrally.
• Control browser extension permissions and installation across the fleet.
• Seamless federation with Microsoft Entra ID and Okta.

Benefits

• Extend hardware life and reduce e-waste with ChromeOS Flex.
• Delay hardware refresh cycles by repurposing existing devices.
• Reduce attack surface with read-only OS and sandboxing.
• Centralised management reduces IT administration overhead and complexity.
• Rapid deployment with zero-touch enrollment for ChromeOS devices.
• Unified view of browser security posture across all operating systems.
• Granular controls to meet data protection and residency standards.
• Fast boot times and background updates minimise user downtime.
• Secure access to corporate apps from any device or location.
• Works seamlessly with existing identity and endpoint management tools.

• Education pricing available
• Free trial available

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at publicsector@qodea.com. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 15

Service ID

271963065883180

Contact

Gemma Whitley
07568 115709
publicsector@qodea.com

About your service

• Service categories:

  Systems Infrastructure Software

  Endpoint management

  Client endpoint management

  • Unified Endpoint Management
• Multi cloud support: Yes

Service scope

• Software add-on or extension: Yes, but can also be used as a standalone service
• What software services is the service an extension to: Google Workspace, Microsoft Entra ID (Azure AD), Okta, Ping Identity, VMware Workspace ONE, BlackBerry UEM, Citrix Endpoint Management, Cisco Meraki, Jamf Pro.
• Cloud deployment model: Public cloud
• Service constraints: Updates occur automatically on a rapid cycle (approx. 4 weeks) for security; however, a Long-term Support (LTS) channel is available for organisations requiring managed stability.; ; Centralised management and Chrome Enterprise Premium features require a Google Workspace or Cloud Identity account.; ; Full policy enforcement and real-time reporting require an active internet connection.; ; Legacy Windows-native applications require Virtual Desktop Infrastructure (VDI) or virtualisation solutions (e.g., Citrix, VMware, Cameyo) to function on ChromeOS.; ; ChromeOS Flex requires 64-bit x86 hardware; use of certified models is recommended to guarantee full peripheral stability.
• System requirements:
  • Google Workspace or Cloud Identity account for management console.
  • Active internet connection (HTTPS port 443) for policy updates.
  • Chrome Browser (stable version) for Enterprise Core management features.
  • Chrome Enterprise Premium licence required for advanced security features.
  • Virtual Desktop Infrastructure (VDI) for legacy Windows application access.
  • Verified domain ownership for Google Admin Console setup.
  • Supported OS (Windows, macOS, Linux) for Chrome Enterprise Core.
  • 8GB USB drive for creating ChromeOS Flex bootable media.
  • Administrator access to BIOS/UEFI to boot ChromeOS Flex.
  • Intel or AMD x86-64 compatible device with 4GB RAM.

User support

• Email or online ticketing support: Yes, at extra cost
• Support response times: Our Service Level Agreements (SLAs) ensure timely support tailored to issue severity. P1 production outages receive a 30-minute response with 24/7 availability. For P2 severe issues, we respond within two business hours, while P3 minor issues are addressed within one business day. General P4 service requests or queries have a two-business-day response time. Aside from P1 emergencies, support is provided during UK business hours (9 am – 5 pm). This tiered structure prioritises critical production incidents while maintaining consistent progress on routine requests and non-production tasks.
• User can manage status and priority of support tickets: Yes
• Online ticketing support accessibility: WCAG 2.2 AA
• Phone support: No
• Web chat support: No
• Onsite support: Yes, at extra cost
• Support levels: TBC
• Support available to third parties: No

Onboarding and offboarding

• Getting started: Admins can begin immediately via the web-based Google Admin Console.; ; Deployment Resources:; ; ChromeOS Flex: Administrators can download the Chromebook Recovery Utility to create bootable USB drives or utilize ChromeOS Flex remote deployment to mass-convert legacy Windows devices over the network.; ; Chrome Enterprise Core: Browser enrollment is streamlined via a simple token generation process within the Admin Console, compatible with Jamf, SCCM, and Group Policy.; ; Training & Documentation:; ; Chrome Enterprise Academy: Free, self-paced online training paths and "ChromeOS Administrator" certification for IT staff.; ; Help Center: Extensive, searchable documentation covering Zero-Touch Enrollment, VDI configuration (Citrix/VMware), and policy best practices.; ; Migration Guides: Dedicated step-by-step resources for transitioning from Active Directory to cloud-based management.
• Service documentation: Yes
• Documentation formats:
  • HTML
  • PDF
• End-of-contract data extraction: Google ensures users retain full ownership of their data. Extraction can be performed self-service at any time during the contract or prior to termination.; ; Export Methods:; ; Admin Console: Administrators can export device fleets, user lists, and activity reports directly to Google Sheets or CSV format via the dashboard.; ; Data Export Tool: For a comprehensive extraction, the enterprise 'Data Export' feature initiates a secure bulk download of all organisational data in standard, open formats (JSON, HTML).; ; APIs: The Reports API allows automated extraction of historical audit logs, threat events, and system telemetry into third-party archival systems (e.g., Splunk, SIEMs).; ; Post-Contract: Once the contract ends and the account is deleted, all data is securely erased from Google's active servers and backup systems in accordance with ISO 27001 and GDPR standards. Users are advised to complete data extraction before the subscription expires.
• End-of-contract process: Devices: ChromeOS devices and browsers will cease to receive enterprise policies, Wi-Fi configurations, and security updates. Devices will revert to an unmanaged, consumer-state (standalone) or retain their last known policy until manually power-washed, depending on configuration.; ; Data: Administrators are responsible for extracting all reporting and audit data prior to the termination date. After a standard grace period, the cloud instance and associated data are permanently deleted in line with GDPR.; ; Administrators have access to self-service data export tools (CSV/JSON) via the Admin Console until the contract end date.
• Documentation accessibility standard: WCAG 2.2 AA

Using the service

• Web browser interface: Yes
• Supported browsers: Chrome
• Application to install: Yes
• Compatible operating systems:
  • Android
  • IOS
  • Linux or Unix
  • MacOS
  • Windows
  • ChromeOS
• Designed for use on mobile devices: Yes
• Differences between the mobile and desktop service: Chrome Enterprise Core and Premium extend management and security to Android and iOS devices.; ; Key differences include:; ; Extensions: Mobile Chrome does not support the full extension ecosystem available on desktop.; ; DLP/Scanning: While Context-Aware Access applies to mobile, deep content scanning and local file integration are more limited than desktop capabilities.; ; Administration: The Google Admin mobile app allows basic triage (alerts, resets), but full policy configuration is optimised for desktop web interfaces.
• Service interface: Yes
• User support accessibility: WCAG 2.2 AA
• Description of service interface: The primary interface is the Google Admin Console, a secure, web-based portal accessible via any modern browser. It provides a unified dashboard for configuring 1,000+ policies, managing ChromeOS fleets, and viewing security insights (DLP/threat reporting).; ; For end-users, the interface is the familiar Google Chrome browser or ChromeOS desktop, ensuring intuitive use with minimal training required.; ; Additionally, the Chrome Policy API and Reporting API provide a programmatic interface, allowing integration with third-party tools (e.g., Splunk, ServiceNow) for automated management and monitoring.
• Accessibility standards: WCAG 2.2 AA
• Accessibility testing: Google adheres to a guiding principle of focusing on the user, maintaining active partnerships with advocacy groups and people with disabilities to gather direct input and feedback on interface design. An internal Accessibility team, comprising a diverse group of experts, serves as consultants to product teams, developing comprehensive frameworks that underpin the design process. This ensures accessibility is integrated from the start rather than retrofitted. Testing involves rigorous engagement with users of assistive technologies to validate these frameworks, ensuring the service effectively supports diverse needs and aligns with accessibility standards. Further information https://support.google.com/a/answer/1631886
• API: Yes
• What users can and can't do using the API: Administrators can utilise the Chrome Policy API and Admin SDK to programmatically manage their environment.; ; While initial device enrollment requires manual action or Zero-Touch Enrollment, users can use the Directory API to pre-configure the organisational structure (creating Organisational Units and Groups) before devices join. The Chrome Policy API allows administrators to define and upload complex policy configurations (JSON format) to these units instantly, ensuring devices are secured immediately upon enrollment.; Using the Chrome Policy API to push configuration updates, security patches, and extension allow-lists to thousands of devices simultaneously.; ; Using the Directory API to move devices between Organisational Units (e.g., from "Testing" to "Production"), automatically triggering new policy application.; ; The API cannot "install" the OS or enrol a device; the device must physically contact the server first.; ; Policy changes pushed via API may take up to 24 hours to propagate to all endpoints, though typically occur faster.; ; Standard Google API rate limits apply (e.g., queries per 100 seconds).
• API documentation: Yes
• API documentation formats:
  • Open API (also known as Swagger)
  • HTML
• API sandbox or test environment: Yes
• Customisation available: Yes
• Description of customisation: Buyers can extensively customise the user experience, security posture, and device behaviour.; ; What can be customised:; ; User Experience: Configure over 1,000 granular policies, including managed bookmarks, startup pages, and extension allow/block lists.; ; Branding: Apply organisational branding, custom wallpapers, and login screen messages.; ; Security: Define custom Data Loss Prevention (DLP) rules, Context-Aware Access levels, and OS update schedules.; ; Kiosk Mode: Transform devices into locked-down, single-app kiosks for public-facing terminals.; ; How users can customise: Customisation is managed via the Google Admin Console. Settings are applied hierarchically using Organisational Units (OUs), allowing different configurations for different departments (e.g., 'Finance' vs. 'Public Access'). Advanced users can also push configurations programmatically using the Chrome Policy API.; ; Who can customise: Customisation is restricted to designated Administrators. Role-Based Access Control (RBAC) allows the creation of 'Delegated Admin' roles, enabling specific staff to customise settings for their own departments without affecting the wider organisation.

Scaling

• Independence of resources: Google’s services are architected to support billions of users simultaneously, ensuring that individual performance remains unaffected by the demand of others.

Analytics

• Service usage metrics: Yes
• Metrics types: The Google Admin Console provides comprehensive fleet visibility and usage insights.; ; Key Metrics:; ; Device Activity: Track 7-day, 14-day, and 30-day active device counts to identify underutilised hardware.; ; Security Posture: Monitor OS version compliance, varying from auto-update policies, and failed boot attempts.; ; User Activity: Report on active Chrome profile usage and installed extensions across the estate.; ; Peripherals: Monitor utilisation of connected peripherals (headsets, cameras) to assist with inventory management.; ; Network: Visualise connectivity health and bandwidth usage trends for troubleshooting.
• Reporting types:
  • API access
  • Real-time dashboards
  • Regular reports
  • Reports on request
• Resource tagging: Yes
• FOCUS resource tagging: No

Resellers

• Supplier type: Reseller providing extra features and support
• Organisation whose services are being resold: Google Cloud

Staff security

• Staff security clearance: Conforms to BS7858:2019
• Government security clearance: Developed Vetting (DV)

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations:
  • United Kingdom
  • European Economic Area (EEA)
  • Other locations
• User control over data storage and processing locations: Yes
• Datacentre security standards: Complies with a recognised standard (for example CSA CCM version 4.0)
• Penetration testing frequency: At least every 6 months
• Penetration testing approach: In-house
• Protecting data at rest: Other
• Other data at rest protection approach: Google uses a combination of encryption, sharding, and obfuscation
• Data sanitisation process: Yes
• Equipment disposal approach: In-house destruction process
• Data sanitisation type:
  • Deleted data can’t be directly accessed / Cryptographic Erasure
  • Explicit overwriting of storage before reallocation / Secure Erase

Data importing and exporting

• Data export approach: Users can export data securely using self-service tools within the Google Admin Console or programmatically via APIs.; ; Admin Console: Administrators can filter and download device inventories, user lists, and fleet activity reports directly to CSV or Google Sheets for analysis.; ; Data Export Tool: A dedicated feature allows the bulk export of all organisational data in standard formats (JSON/HTML).; ; APIs: The Reports API enables automated, real-time extraction of system logs, audit trails, and security alerts into external SIEM or BI tools (e.g., Splunk, BigQuery).; ; No proprietary formats are used, ensuring full data portability.
• Data export formats:
  • CSV
  • Other
• Other data export formats:
  • JSON
  • HTML
  • XLSX
• Data import formats:
  • CSV
  • Other
• Other data import formats:
  • JSON
  • XML

Data-in-transit protection

• Data protection between buyer and supplier networks: TLS (version 1.2 or above)
• Data protection within supplier network: TLS (version 1.2 or above)

Availability and resilience

• Guaranteed availability: Guaranteed Availability: Google guarantees a Monthly Uptime Percentage of at least 99.9% for the Google Admin Console and associated Chrome Enterprise services.; ; Resilience: Uniquely, ChromeOS devices operate independently of the cloud. If the management service is unavailable, devices continue to function fully (enforcing the last known policy), ensuring zero downtime for end-users at the edge.; ; Service Level Agreement (SLA) & Refunds: If Google fails to meet the 99.9% uptime guarantee, customers can be eligible for Service Credits.
• Approach to resilience: Google services are built on a proprietary, globally distributed infrastructure designed for maximum reliability and uptime.; ; Datacentre Architecture: Data is automatically sharded and replicated across multiple active servers and geographically diverse data centres. This architecture eliminates single points of failure (N+1 redundancy). If a hardware component, rack, or entire facility fails, traffic is instantly and transparently rerouted to a functioning location without user disruption.; ; Service Design: The management platform utilises automated load balancing to handle demand spikes. Updates are applied via progressive rollouts to ensure stability before reaching the wider fleet.; ; Endpoint Resilience: Crucially, Chrome Enterprise resilience extends to the device. ChromeOS caches policies locally. If the cloud management service becomes unreachable, the device enforces the last known security state and remains fully functional for the end-user.; ; Compliance: This approach supports NCSC Cloud Security Principle 2, ensuring assets are protected against physical failure, environmental threats, and demand surges.
• Outage reporting: Google employs a transparent, multi-layered approach to outage reporting.; ; Public Dashboard: The Google Workspace Status Dashboard is publicly accessible and provides real-time visibility into the health of the Google Admin Console and Chrome Enterprise services. It displays current status and historical data using a traffic-light system (Available, Service Disruption, Service Outage).; ; Email Alerts: Administrators can configure 'System Rules' within the Admin Console to receive immediate email notifications regarding service health or critical updates affecting their specific tenant.; ; Programmatic Access: While there is no direct "Status API" for the public dashboard, an RSS feed is available. This allows organisations to programmatically ingest status updates into internal monitoring tools or ticketing systems (e.g., ServiceNow) to trigger automated workflows during disruptions.

Identity and authentication

• User authentication needed: Yes
• User authentication:
  • Multi-Factor Authentication (MFA)
  • Public key authentication (including by TLS client certificate)
  • Identity federation with existing provider (for example Google Apps)
  • Username or password
• Access restrictions in management interfaces and support channels: Management interfaces are secured using Role-Based Access Control (RBAC), ensuring administrators only hold privileges necessary for their specific role (Least Privilege). Access is enforced via mandatory Multi-Factor Authentication (MFA), including support for FIDO2 security keys. Administrators can further restrict access using Context-Aware Access, blocking logins from unauthorized IPs or unmanaged devices. Support channels are restricted to authorised Designated Support Contacts. Authentication requires a unique, rotating Customer PIN generated within the Admin Console. Additionally, Access Approval allows customers to explicitly approve or deny Google support personnel access to data during troubleshooting.
• Access restriction testing frequency: At least every 6 months
• Management access authentication:
  • Multi-Factor Authentication (MFA)
  • Public key authentication (including by TLS client certificate)

Audit information for users

• Access to user activity audit information: Users have access to real-time audit information
• How long user audit data is stored for: Between 1 month and 6 months
• Access to supplier activity audit information: Users have access to real-time audit information
• How long supplier audit data is stored for: Between 1 month and 6 months
• How long system logs are stored for: Between 1 month and 6 months

Security governance

• Named board-level person responsible for service security: Yes
• Security governance certified: Yes
• Security governance standards: ISO/IEC 27001
• Information security policies and processes: Our Integrated Management System details the information security and quality policies, incorporating the requirements of ISO 27001:2022 and ISO 9001:2015.; The IMS is designed to ensure the efficiency, security, and reliability of operations.; A Risk Management framework, based on ISO 31000, is used company-wide to identify, assess, evaluate, and mitigate risks.; Changes to the IMS follow a formal Change Management process: submission, documentation in Jira, analysis by the IMS Board, and review/approval by the Compliance Team and IMS Board.; Internal and external Audit and Assurance frameworks are maintained for continuous improvement and regulatory alignment.; ; Governance and Reporting Structures; The Governance and Integration Lead holds the overarching responsibility for the IMS. The Board of Directors approves the IMS Policy and delegates its implementation to the Compliance Team.; The IMS Board meets at least quarterly for governance and to discuss issues and updates.; The Compliance Team ensures compliance with the ISO standards, oversees IMS implementation, and manages incidents and risks.; The reporting structure involves the Compliance Manager reporting on Risk Management, Audit Results, Incidents, and Business Improvement Actions to the IMS Board quarterly or as needed. Progress on Objectives and Key Results (OKRs) is also monitored and reported to the IMS Board.
• Software Security Code of Practice: Yes

Operational security

• Configuration and change management standard: Supplier-defined controls
• Configuration and change management approach: Configuration and Change Management Processes; ; The process uses a structured, formal approach for additions, modifications, or removals, formally initiated by a Request for Change (RFC) (Standard, Normal, Emergency).; ; Tracking: Service components are tracked through the controlled RFC process, which provides a complete audit log of all modifications. A Backout Plan is mandatory to ensure rollback capability.; ; Security Assessment: All changes are assessed for potential security and PII (Personally Identifiable Information) impact. Approvers confirm an adequate and auditable level of testing before deployment.
• Vulnerability management type: Supplier-defined controls
• Vulnerability management approach: Vulnerability Management (VM) is a risk-based process blending proactive scanning, vendor alerts, and structured patching.; ; Assessment: Threats are assessed via internal vulnerability scanning (e.g., 10 IP addresses), firewall scanning with Forseti, and formal risk assessments for unsupported software. Security impact is a required consideration in the Change Management process.; ; Threat Sources: Information comes from vendor security alerts (e.g., GitLab) and critical patch notifications from Google, which trigger ad hoc responses.; ; Patch Deployment: Standard vulnerability checks are performed quarterly. Critical patches are deployed via an ad hoc process. All patching requires customer approval with a 72-hour notice before production deployment.
• Protective monitoring type: Supplier-defined controls
• Protective monitoring approach: Protective Monitoring identifies compromises via Automated Systems (SIEM/EDR) and User Reports. All events are logged and triaged by the Service Desk.; ; The response follows a structured, six-stage procedure:; Assessment: A severity score is assigned; critical incidents trigger immediate escalation to the Incident Response Team (IRT).; Containment: The threat is stopped using measures like network isolation and firewall blocks.; Eradication/Recovery: This involves Root Cause Analysis (RCA), threat removal, and system restoration.; The process prioritises rapid response, with a sample timeline showing containment actions implemented within 1 hour 30 minutes of detection.
• Incident management type: Supplier-defined controls
• Incident management approach: We have a formal, six-stage Internal Security Incident Management Procedure. The process applies across all locations to ensure a structured response to security events. The stages are:; 1,Reporting & Detection by the Service Desk and/or technical solutions.; 2. Analysis and Assessment, where impact is scored, and the Incident Response Team (IRT) is mobilised.; 3. Containment, through isolation and data preservation.; 4. Eradication and Recovery, involving Root Cause Analysis (RCA), permanent threat removal, and system restoration.; 5. Post Incident Review (PIR) to document the timeline and findings.; 6. Lessons Learned & Process Improvement for ongoing security resilience.
• Post-quantum cryptography secure: No

Secure development

• Approach to secure software development best practice: Conforms to a recognised standard, but self-assessed

Public sector networks

• Connection to public sector networks: No

Pricing

• Discount for educational organisations: Yes
• Free trial available: Yes
• Description of free trial: Chrome Enterprise Core is permanently free, offering unified browser management. ChromeOS Flex is free to download for modernising hardware.; ; A 30-day free trial (50 licenses) is available for Chrome Enterprise Upgrade and Premium, enabling advanced security (DLP), 24/7 support, and full device management capabilities.
• Link to free trial: https://chromeenterprise.google/

Discount percentage by annual call-off contract value (excluding VAT)

• Less than £250,000: 0%
• Between £250,000 and £500,000: 0%
• Between £500,001 and £1,000,000: 0%
• Between £1,000,001 and £2,500,000: 0%
• Between £2,500,001 and £5,000,000: 0%
• Over £5,000,001: 0%

Non-mandatory Standards and certifications

• ISO/IEC 27001 certification: Yes
• Who accredited the ISO/IEC 27001: Bsi
• ISO/IEC 27001 accreditation date: Wednesday 1 March 2023
• What the ISO/IEC 27001 doesn’t cover: N/A
• ISO 28000:2022 certification: No
• ISO 9001 certification: Yes
• Who accredited the ISO 9001 certification: Bsi
• ISO 9001 accreditation date: Monday 20 May 2024
• What the ISO 9001 doesn’t cover: N/A
• Quality management systems (QMS): Yes
• CSA STAR certification: No
• PCI certification: No
• Cyber essentials: Yes
• Please provide your Cyber Essentials Certificate Number: 59bced93-b8a9-43b3-867f-fabbda9c23ec
• Cyber essentials plus: Yes
• Please provide your Cyber Essentials Plus Certificate Number: B254f77e-c3bb-4d91-99f9-d8092a0c8195
• Other security certifications: No

Social value

• Section B - Commitment for Future: Delivery:

  • Mission: Kick start economic growth. To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

    Policy Outcome 1: Fair work: That offers fair wages and good working conditions. Help people get a job, stay in work, and progress in their careers, with good employment opportunities across the country. Notes: Where there is a large proportion of labour costs in the contract, commercial teams should consider MAC in Outcome 1 as a priority

    • New or retained jobs on the contract workforce in the relevant area that meet the criteria set out in MAC 1b, 1c and 1d
    • Providing opportunities for, and measuring and monitoring of, staff workforce conditions over time, including employee engagement, involvement in decision-making and satisfaction and adapting to any changes in the results, with clear processes for acting on issues identified
    • Plans to engage the contract workforce in deciding the most important workplace issues to address
    • Activities that support an environment where staff are educated about, and feel empowered to, address their physical wellbeing
    • Activities that support an environment where staff are educated about and feel empowered to report and address bullying and harassment
    • Activities to cascade good practice on fair working conditions throughout the supply chain
    • Payment of more than the National Minimum Wage or National Living Wage (as appropriate) to the contract workforce
    • Entitlement to sick pay for the contract workforce, with provision in place for any staff who do not meet the earnings threshold for statutory sick pay, payment of sick pay from day one of absence and payment of staff on the contract workforce who are off sick a replacement income of 100% of their usual earnings for as long as possible
    • Understanding of in-work progression issues affecting the market, industry or sector relevant to the contract, and in the supplier’s own organisation and those of its key sub-contractors
    • Measures to support in-work progression to help people in the contract workforce, to move into higher paid work by developing new skills relevant to the contract
    • Support for educational attainment relevant to the contract, including training schemes that address skills gaps and result in recognised qualifications
    • Volunteering opportunities for staff
    • Understanding of the modern slavery risks and issues affecting the market, industry, sector or country (of origin or of source) relevant to the contract, and the workforce in the supplier’s own organisation and those of its key subcontractors
    • Outline policies and practices to be applied to or put in place for the contract to mitigate and manage modern slavery risks, including: Pre-employment checks, recruitment practices. Workplace conditions, safeguarding plans and processes in place and regular monitoring with relevant groups considered, which may include sampling

  • Mission: Kick start economic growth. To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

    Policy Outcome 2: Skills for growth: Supporting growth sectors and addressing skills gaps.

    • Understanding of employment and relevant skills issues, and of the education and training issues relating to the contract. Illustrative examples: demographics, skills shortages, new opportunities in high growth sectors, geographic/local community and skills/employment challenges
    • Support for educational attainment relevant to the contract, including training schemes that address skills gaps and result in recognised qualifications

  • Mission: Kick start economic growth. To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

    Policy Outcome 3: Resilient, innovative and flexible supply chains: Support economic growth through enabling resilient businesses, opportunities for small businesses and voluntary, community and social enterprises

    • Understanding of the types of businesses in the market and the level of participation by new businesses, entrepreneurs, start-ups, SMEs, VCSEs and mutuals
    • Activities to identify opportunities to open up sub-contracts under the prime contract to a diverse range of businesses, including new businesses, entrepreneurs, start-ups, SMEs, VCSEs and mutuals
    • Activities that demonstrate a collaborative way to work with a diverse range of businesses as part of the supply chain
    • Understanding of local demographics, needs and opportunities for the co-design of the goods, services and works to be delivered under the contract

  • Mission: Make Britain a clean energy superpower: To cut bills, create jobs and deliver security with cheaper, zero-carbon electricity by 2030, accelerating to net zero

    Policy Outcome 4: Sustainable procurement practices: Reducing carbon footprints, minimising waste, and promoting the use of clean energy and green technologies.

    • Understanding of opportunities for additional environmental benefits delivery in the performance of the contract, including working towards net zero carbon emissions and use of clean energy and green technologies
    • Delivery of additional environmental benefits through the performance of the contract, including working towards net zero carbon emissions and use of clean energy and green technologies
    • Understanding of how to influence staff, suppliers, customers, communities and/or any other appropriate stakeholders through the delivery of the contract to support climate and nature protection and improvement

  • Mission: Break down barriers to opportunity: By reforming our childcare and education systems, to make sure there is no class ceiling on the ambitions of young people in Britain

    Policy Outcome 6: Employment and training: For those who face barriers to employment

    • Understanding of employment and skills issues, and of the skills and employment shortages of high growth sectors relating to the contract
    • Creation of employment opportunities particularly for those who face barriers to employment, such as prison leavers, care leavers and/or who are located in deprived areas, and for people in industries with known skills shortages or in high growth sectors
    • Understanding of the issues affecting the representation of disabled people in the workforce in the market, industry or sector relevant to the contract, and in the supplier’s own organisation and those of its key sub-contractors
    • Inclusive and accessible recruitment practices, and retention-focused activities, including those provided in the Guide for line managers on recruiting, managing and developing people with a disability or health condition
    • Working conditions which promote an inclusive working environment and promote retention and progression
    • Understanding of the issues affecting inequality in employment, skills and pay in the market, industry or sector relevant to the contract, and in the supplier’s own organisation and those of its key sub-contractors. Measures to tackle inequality in employment, skills and pay in the contract workforce
    • Inclusive and accessible development practices, including guidance for line managers on recruiting, managing and developing people with a disability or health condition

  • Mission: Break down barriers to opportunity: By reforming our childcare and education systems, to make sure there is no class ceiling on the ambitions of young people in Britain

    Policy Outcome 7: Creating a pipeline of opportunities: For the contract workforce, reducing barriers to entry for under-represented groups.

    • Understanding of the issues affecting the development of new skills by target cohort
    • Understanding of issues relating to entering the contract workforce

  • Mission: Build an NHS fit for the future: That is there when people need it; with fewer lives lost to the biggest killers; in a fairer Britain, where everyone lives well for longer.

    Policy Outcome 8: Increasing productivity through physical and mental wellbeing: In the supply chain and communities in the relevant area.

    • Understanding of issues relating to health and wellbeing, including physical and mental health, in the contract workforce
    • Understanding barriers to access to health and social care services or employment opportunities e.g. digital inclusion
    • Inclusive and accessible recruitment practices, development practices and retention policies that support-focused activities including those provided in the Guide for line managers on recruiting, managing and developing which support people with a disability or health condition

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at publicsector@qodea.com. Tell them what format you need. It will help if you say what assistive technology you use.