SAPPHIRE TECHNOLOGIES LIMITED

NodeZero - Autonomous Penetration Testing

NodeZero is an autonomous penetration testing service that continuously assesses your security posture by safely emulating real-world attacker tactics to identify exploitable weaknesses before an attacker can. Going beyond vulnerability scanning it finds and prioritises security gaps across: external/internal networks, cloud services, IDAM systems and IoT devices.

Features

• Autonomus penetration testing
• Designed to run in live systems
• Simple and easy to use dashboards
• Displays the complete attack path proof for every exploitation
• Fix actions for each exploit integrated with remediation workflow
• One click verify of proven exploit post-remediation
• Unlimited scope and number of tests
• Autonomus cyber deception TripWires mapped to proven attack paths
• Rapid response
• Phishing Test extension

Benefits

• Executes 50x faster than a qualified human penetration tester
• Identifes exploits vulnerability scanning misses such as credential mis-use
• Low training burden and clear results, link exploits to impacts
• Finds and proves security problems that actually matter
• Quickly and effectively remediate proven exploits
• Have absolute confidence exploits are resolved
• Continual and proactively evaluate your security posture
• Delivers precise alerts and warnings in areas of proven exposure
• Uniquely curated penetration tests for Zero and N-day threats
• Proves the impacts of phished credentials not just likelihood

• Free trial available

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at info@sapphire.net. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 15

Service ID

369980163713136

Contact

Katie Smith
0845 58 27001
info@sapphire.net

About your service

• Service categories:

  Applications

  Production and operations

  Service industry and public sector operations

  • Healthcare
  • Education
  • Public Order and Safety
  • Police
  • Defence
  • Social Security Administration
  • Adult Social Care
  • Children's Social Care
  • Other
• Multi cloud support: Yes

Service scope

• Software add-on or extension: Yes, but can also be used as a standalone service
• What software services is the service an extension to: Security Operations Centre (SOC) vulnerability and threat services as tool to verify defence and alert effectiveness. It serves as an extension to IT Service Management (ITSM) to identify the execution of policy, mis-configuration and system operation.
• Cloud deployment model:
  • Public cloud
  • Private cloud
  • Community cloud
  • Hybrid cloud
• Service constraints: No
• System requirements:
  • Host a light-weight Linux Virtual Machine with 40GB storage
  • Stable outbound HTTPS (443) access to Horizon3.ai SaaS endpoints
  • Correct internal DNS resolution
  • Reasonably accurate system time
  • Inbound access to common service ports on the host

User support

• Email or online ticketing support: Yes
• Support response times: Our Helpdesk is open for In-hours support from 08:30 till 17:00 Monday to Friday, excluding UK public holidays (England and Wales). Customers with Out-of-hours support contracts may raise Priority 1 calls only, outside these times.
• User can manage status and priority of support tickets: No
• Phone support: Yes
• Phone support availability: 9 to 5 (UK time), Monday to Friday
• Web chat support: No
• Onsite support: No
• Support levels: Level 1 - Sapphire Help Desk The first point of escalation should always be the Sapphire Help Desk and escalation must be separate from the initial call to log the fault. The Cloud customer must obtain a case reference number for the fault. Level 2 - Sapphire Professional Services Manager This is the second point of escalation in the event of the Help Desk being uncontactable or an increase in call priority being required. The Cloud customer should quote the case reference number provided. Level 3 - Head of Security Consultancy This is the third point of escalation in the event of the Manager being uncontactable or a further increase in call priority being required.
• Support available to third parties: Yes

Onboarding and offboarding

• Getting started: Horizon3.ai helps users start using NodeZero through a mix of structured documentation, guided onboarding, and live support. The Quickstart guide walks new users step‑by‑step: log in or register, check network prerequisites, set up a NodeZero host, and run the first internal pentest to get immediate findings. New users are guided through trial registration, email verification, MFA setup, and first login to the NodeZero portal. The docs site provides a central Documentation Home with Quickstart, portal guides, API/CLI references, release notes, and a knowledge base to troubleshoot and optimise use of the platform. Once a customer signs on, they are assigned a Customer Success Manager who runs onboarding calls, helps validate deployment plans (host placement, scope, deployment strategy), and ensures the account is correctly set up. Horizon3.ai also provides regular training / office‑hours‑style sessions so users can go deeper into features such as Insights, Tripwires and advanced use cases. In addition, an integrated web chat and extensive online documentation are available directly from the portal, so users can get contextual help while they configure their first tests and interpret results.
• Service documentation: Yes
• Documentation formats:
  • HTML
  • Other
• Other documentation formats: Xx
• End-of-contract data extraction: Customers can download the results of their penetration tests at any time. At contract termination, customer data will be deleted within 30 days at the customer's request.
• End-of-contract process: At the end of a NodeZero contract, customers retain control over their data and have several options. Throughout the contract and up to termination, customers can export pentest data directly from the NodeZero portal, typically in open formats such as CSV/ODF, with PDF available for reports and documentation. This allows them to take copies of all relevant results, evidence, and reports before any deletion occurs. By default, when a contract expires, the tenant will typically move into an inactive / read‑only state: users can no longer run new tests, but historic results may remain viewable unless the customer chooses a stronger offboarding option. Customers can instead ask Horizon3.ai to deactivate the tenant, which removes account‑specific data from the live portal but allows potential future restoration if they later renew. If a customer wants full removal, they can formally request GDPR‑style erasure. Horizon3.ai then runs a comprehensive process to scrub the company’s data from systems in line with the DPA and GDPR commitments. In our G‑Cloud statement, we commit that, upon the customer’s request at contract termination, customer data will be deleted within 30 days.
• Documentation accessibility standard: WCAG 2.2 AA

Using the service

• Web browser interface: Yes
• Supported browsers:
  • Microsoft Edge
  • Firefox
  • Chrome
  • Safari
  • Opera
• Application to install: No
• Designed for use on mobile devices: No
• Service interface: Yes
• User support accessibility: WCAG 2.2 AA
• Description of service interface: Web GUI
• Accessibility standards: WCAG 2.2 AA
• Accessibility testing: Horizon3 AI has not completed any web chat testing with assistive technology users.
• API: Yes
• What users can and can't do using the API: Users interact with NodeZero programmatically via a GraphQL API. To set up the service, they obtain a bearer token from the auth endpoint and call the GraphQL endpoint with Authorisation and Content-Type headers. Using setup mutations, they define pentest configuration (scope, operation type, feature flags, credentials, runtime limits), create reusable operation templates and external asset groups, install NodeZero Runners on internal Docker hosts or Kubernetes clusters via returned install commands, and configure recurring tests through schedules and scheduled actions. They then use update and control mutations to make changes: patch templates and asset groups, adjust or delete scheduled actions, authorise or deauthorise domains and IPs for external testing, and create, rerun, rename, archive/delete, cancel, pause and resume operations entirely via API. Admin mutations allow management of customer accounts, users and API keys. Limitations: paginated queries are capped at 100 items per page; Runner installation still requires executing the provided commands in the customer environment; scheduled actions support hourly (not per‑minute) granularity and run in UTC; and most findings objects (pentests, weaknesses, attack paths, credentials, data stores, logs, Vulnerability Management Hub series) are read‑only—customers can query and export these but cannot modify the scan results via the API.
• API documentation: Yes
• API documentation formats: HTML
• API sandbox or test environment: Yes
• Customisation available: Yes
• Description of customisation: NodeZero is customised primarily through configuration, not code changes. Customers can tailor what is tested, how tests run, and how often, using a combination of portal UI and APIs. Users configure pentests by choosing operation type (internal, external, cloud, AD Password Audit, Kubernetes, phishing, insider threat), defining network or web scope (min/max IP ranges, blacklists, Intelligent Scope, application URLs, OSINT domains), and selecting attack configuration options (“feature flags”) that control which techniques run, their disruption risk, and supporting parameters such as minimum runtime and password spray lists. They can also inject credentials, specify Git and cloud accounts, enable tripwires, and choose K8s namespaces or service accounts. Reusable OpTemplates encode standard configurations per environment or use case. Asset Groups define and maintain external attack surfaces (domains and IP ranges), including which assets are authorised for testing. Runners define where internal tests are launched from, and Schedules automate recurring tests, including paired pause/resume/cancel actions for maintenance windows. Tenant‑level settings allow branding, client account structure, and user/role management. Customisation is done via the NodeZero portal or the documented GraphQL API. In practice, security and platform engineers with administrative or operator roles perform most customisation; read‑only users consume results but cannot change configuration.

Scaling

• Independence of resources: NodeZero ensures users aren’t affected by demand from other users through resource‑utilisation monitoring and load balancing. In practice, this means: Horizon3.ai continuously monitors service resource usage (e.g. compute, memory, network, database) across the multi‑tenant SaaS platform. Load is balanced across the underlying cloud infrastructure so that spikes from one tenant are spread and capacity can be adjusted, rather than degrading performance for others. This approach, combined with standard cloud scaling and operations practices, is what we formally state in G‑Cloud as the way we protect users from noisy neighbours.

Analytics

• Service usage metrics: Yes
• Metrics types: NodeZero exposes service usage metrics through the portal and the public GraphQL API so customers can track how they use the platform and how coverage evolves. Typical metrics include: number and type of tests run (internal, external, cloud, AD Password Audit, etc.), test frequency and outcomes; coverage/utilisation such as unique assets/hosts assessed and license utilisation; operational metrics like run durations and scheduling success; and security outcomes such as counts and trends of validated weaknesses, retests/1‑Click Verify activity, and time from discovery to verified fix (exposure window). These can be pulled into customer BI tools via API.
• Reporting types: API access
• Resource tagging: No
• FOCUS resource tagging: No

Resellers

• Supplier type: Reseller providing extra support
• Organisation whose services are being resold: Horizon3.ai

Staff security

• Staff security clearance: Conforms to BS7858:2019
• Government security clearance: Developed Vetting (DV)

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations:
  • United Kingdom
  • European Economic Area (EEA)
• User control over data storage and processing locations: Yes
• Datacentre security standards: Managed by a third party
• Penetration testing frequency: At least once a year
• Penetration testing approach: Another external penetration testing organisation
• Protecting data at rest:
  • Physical access control, complying with SSAE-18 / ISAE 3402
  • Scale, obfuscating techniques, or data storage sharding
• Data sanitisation process: Yes
• Equipment disposal approach: Complying with a recognised standard, for example CSA CCM v4.0, CAS (Sanitisation) or ISO/IEC 27001
• Data sanitisation type: Data Erasure

Data importing and exporting

• Data export approach: From within the product platform.
• Data export formats:
  • CSV
  • Other
• Other data export formats: PDF
• Data import formats: CSV

Data-in-transit protection

• Data protection between buyer and supplier networks: TLS (version 1.2 or above)
• Data protection within supplier network:
  • TLS (version 1.2 or above)
  • Other
• Other protection within supplier network: Inside NodeZero's host environment, data is protected by multiple layers beyond TLS 1.2. Data at rest in AWS services is encrypted using AES‑256 server‑side encryption. Internally, we apply resource hardening and strict role‑based access control (RBAC) so only authorised services and users can access sensitive data. Where additional in‑network protection is needed, we can also use IPsec/TLS VPN between internal components. For data lifecycle and deletion, we support cryptographic erasure/data erasure and secure wipe/physical destruction patterns to ensure customer data is fully sanitised when removed.

Availability and resilience

• Guaranteed availability: Standard SLA commits to availability of 99.95% per calendar month. If the availability falls below 99.95% in a month, customers may apply for a Service Credit within thirty days following the calendar month. To apply, Customer will provide a detailed description of the incident in a customer support case. This is the only remedy for our failure to meet the Cloud Service availability standard; credits are not available for amounts that exceed 100% of Customer’s monthly Cloud Service fee. Once validated, Service Credit will be applied to Customer’s next payment period.
• Approach to resilience: Available on request. Fully remote company leveraging cloud services and native cloud functionality for high availability.
• Outage reporting: NodeZero reports outages to users primarily via a public status page. This is published at https://status.horizon3.ai. The status page is the authoritative source for: Current service status / ongoing incidents, scheduled maintenance, historical uptime/availability information. The status page also lets users subscribe to outage and incident updates via email.

Identity and authentication

• User authentication needed: Yes
• User authentication:
  • Multi-Factor Authentication (MFA)
  • Username or password
• Access restrictions in management interfaces and support channels: Horizon3.ai restricts access to management interfaces and support channels through policy‑enforced RBAC integrated with identity providers and IAM solutions. Administrative and privileged identities are managed centrally using cloud IdPs (e.g. Cognito/Auth0/Okta) with role‑based access, so only authorised personnel can administer customer environments or internal systems. Access to sensitive tools (admin portal, production consoles, support systems) requires corporate credentials, MFA, and assignment to appropriate roles or groups; end users cannot self‑elevate. Administrative and support actions are logged via AWS logging services and other monitoring tools, enabling review of activity and enforcement of least‑privilege and segregation‑of‑duties requirements.
• Access restriction testing frequency: At least every 6 months
• Management access authentication: Multi-Factor Authentication (MFA)

Audit information for users

• Access to user activity audit information: Users contact the support team to get audit information
• How long user audit data is stored for: At least 12 months
• Access to supplier activity audit information: Users contact the support team to get audit information
• How long supplier audit data is stored for: At least 12 months
• How long system logs are stored for: At least 12 months

Security governance

• Named board-level person responsible for service security: Yes
• Security governance certified: Yes
• Security governance standards: Other
• Other security governance standards: SSAE-18 (SOC2), FEDRamp
• Information security policies and processes: Horizon3.ai’s information security program is policy‑driven, standards‑aligned, and centrally governed. Policies & standards: We maintain documented information‑security policies (covering areas such as access control, operations, vulnerability management, and incident management) aligned to CSA CCM v4.0, ISO/IEC 27001, and SSAE‑18 (SOC 2), with details published in the Trust Centre (trust.horizon3.ai). Reporting structure: A named board‑level (or equivalent) security owner is responsible for the security of all services, with security governance and operations reporting into that function. How policies are enforced: Employees must sign and acknowledge security policies as part of employment, and day‑to‑day adherence is enforced through the documented operational security, vulnerability management, and incident‑management processes referenced in our G‑Cloud and Trust Centre materials.
• Software Security Code of Practice: Yes

Operational security

• Configuration and change management standard: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Configuration and change management approach: Horizon3.ai uses a standards-based configuration and change‑management process governed by its Operational Security Policy, available via the Trust Center (trust.horizon3.ai). The program aligns to recognised frameworks such as CSA CCM v4.0 and SSAE‑18 / ISAE 3402 rather than ad‑hoc controls. Service components are tracked through their lifecycle using structured change procedures, CI/CD and infrastructure‑as‑code practices; proposed changes go through impact and risk assessment, including security considerations, before deployment. Post‑deployment, monitoring and vulnerability‑management processes verify that changes behave as expected and do not degrade the security posture, with results feeding back into governance and audit evidence.
• Vulnerability management type: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Vulnerability management approach: Horizon3.ai runs a risk‑based vulnerability management program governed by a formal Vulnerability Management Policy available via our Trust Center (trust.horizon3.ai). We assess potential threats using continuous monitoring of our stack plus industry sources and our own attack research, including NodeZero Rapid Response and Vulnerability Management Hub, which track emerging CVEs/KEVs and exploitability in real environments. Patches are delivered through immutable images and CI/CD: each new NodeZero operation runs on the latest, patched image, and its supporting infrastructure is destroyed after the test, ensuring outdated components are not reused. Critical issues are prioritised for rapid remediation under this program.
• Protective monitoring type: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Protective monitoring approach: Horizon3.ai’s protective monitoring combines cloud‑native logging with automated alerting and defined response playbooks. We use AWS CloudWatch, CloudTrail, GuardDuty and Datadog to monitor infrastructure, application logs, and data‑store actions, generating automated alerts on suspicious activity and configuration changes.; ; Alerts are sent to dedicated Slack channels and email for the security team, and all alerts are investigated immediately. Where an event affects the live service, customer‑facing incident handling follows our support/SLA model, with critical (Severity 1) outages responded to within 1 business hour, and lower‑severity issues handled within defined timeframes while we contain, analyse, and remediate the issue.
• Incident management type: Supplier-defined controls
• Incident management approach: Horizon3.ai operates a formal Incident Management Policy aligned to recognised standards, published via our Trust Center (trust.horizon3.ai).; ; We maintain pre‑defined runbooks for common events (for example service degradation, security alerts from monitoring, and availability incidents), which guide triage, escalation, containment, and recovery. Customers report incidents via 24/7 website or in‑product chat, or by emailing support@horizon3.ai; critical (Severity 1) issues receive a response within 1 business hour, with defined targets for lower severities. Incident reports (root cause, timeline, and corrective actions) are provided to affected customers via the support case and, where appropriate, formal post‑incident summaries.
• Post-quantum cryptography secure: No

Secure development

• Approach to secure software development best practice: Conforms to a recognised standard, but self-assessed

Public sector networks

• Connection to public sector networks: No

Pricing

• Discount for educational organisations: No
• Free trial available: Yes
• Description of free trial: A NodeZero proof of value is a time‑limited (typically 1–2‑week) engagement including internal pentests, optional external/cloud/AD assessments, exploit-path discovery, prioritised fix actions, 1‑Click Verify retesting, and executive/technical reporting. It excludes ongoing managed services, broad multi‑tenant rollout, and long‑term licensing; scope is limited to agreed environments and features for evaluation.
• Link to free trial: https://portal.horizon3ai.com/?freeTrial=true

Discount percentage by annual call-off contract value (excluding VAT)

• Less than £250,000: 0%
• Between £250,000 and £500,000: 3%
• Between £500,001 and £1,000,000: 7%
• Between £1,000,001 and £2,500,000: 10%
• Between £2,500,001 and £5,000,000: 10%
• Over £5,000,001: 10%

Non-mandatory Standards and certifications

• ISO/IEC 27001 certification: Yes
• Who accredited the ISO/IEC 27001: SGS
• ISO/IEC 27001 accreditation date: Tuesday 1 October 2024
• What the ISO/IEC 27001 doesn’t cover: Our ISO27001:2022 covers our whole company.
• ISO 28000:2022 certification: No
• ISO 9001 certification: No
• Quality management systems (QMS): Yes
• CSA STAR certification: No
• PCI certification: No
• Cyber essentials: Yes
• Please provide your Cyber Essentials Certificate Number: 5ae27f6b-8428-42c7-ba13-f02e45285b41
• Cyber essentials plus: Yes
• Please provide your Cyber Essentials Plus Certificate Number: Fb1d4ea6-8ee1-402c-8629-70c0dd6767f3
• Other security certifications: Yes
• Any other security certifications: CREST SOC/Penetration Testing

Social value

• Section B - Commitment for Future: Delivery:

  • Mission: Kick start economic growth. To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

    Policy Outcome 1: Fair work: That offers fair wages and good working conditions. Help people get a job, stay in work, and progress in their careers, with good employment opportunities across the country. Notes: Where there is a large proportion of labour costs in the contract, commercial teams should consider MAC in Outcome 1 as a priority

    • New or retained jobs on the contract workforce in the relevant area that meet the criteria set out in MAC 1b, 1c and 1d
    • New apprenticeships on the contract workforce in the relevant area that meet the criteria set out in MAC 1b
    • Providing opportunities for, and measuring and monitoring of, staff workforce conditions over time, including employee engagement, involvement in decision-making and satisfaction and adapting to any changes in the results, with clear processes for acting on issues identified
    • Plans to engage the contract workforce in deciding the most important workplace issues to address
    • Ensuring new workers are informed of their right to join a trade union
    • Monitoring of employee engagement rates (by protected characteristic) and, where necessary, the development of actions to ensure all voices are heard across the diversity of the workforce
    • Employment contracts that reflect actual hours worked; steps taken to ensure employees understand their contracts and have the ability to review and adjust them if actual hours regularly exceed contracted hours
    • Activities that support an environment where staff are educated about, and feel empowered to, address their physical wellbeing
    • Activities that support an environment where staff are educated about and feel empowered to report and address bullying and harassment
    • Activities to cascade good practice on fair working conditions throughout the supply chain
    • Offer a pay and leave entitlement to all eligible staff who become kinship carers, ideally equivalent to statutory adoption pay and leave
    • Payment of more than the National Minimum Wage or National Living Wage (as appropriate) to the contract workforce
    • Monitoring and reporting of gender and ethnicity pay gaps and plans to address them where necessary
    • Entitlement to sick pay for the contract workforce, with provision in place for any staff who do not meet the earnings threshold for statutory sick pay, payment of sick pay from day one of absence and payment of staff on the contract workforce who are off sick a replacement income of 100% of their usual earnings for as long as possible
    • Plans for an appropriate income replacement policy for staff who are required to spend time away from work to care for a sick dependent or close relative
    • Understanding of in-work progression issues affecting the market, industry or sector relevant to the contract, and in the supplier’s own organisation and those of its key sub-contractors
    • Measures to support in-work progression to help people in the contract workforce, to move into higher paid work by developing new skills relevant to the contract
    • Support for the contract workforce by providing career advice, and providing opportunities for staff working on the contract with in-work progression career development into known skills shortages or high growth areas
    • Support for educational attainment relevant to the contract, including training schemes that address skills gaps and result in recognised qualifications
    • Volunteering opportunities for staff
    • Understanding of the modern slavery risks and issues affecting the market, industry, sector or country (of origin or of source) relevant to the contract, and the workforce in the supplier’s own organisation and those of its key subcontractors
    • Measures to identify, mitigate and manage modern slavery risks relating to the contract and how these will be implemented
    • Outline policies and practices to be applied to or put in place for the contract to mitigate and manage modern slavery risks, including: Pre-employment checks, recruitment practices. Workplace conditions, safeguarding plans and processes in place and regular monitoring with relevant groups considered, which may include sampling
    • How these flow down the supply chain and are monitored Illustrative examples include reporting, site visits, audits, etc.
    • How to ensure business decisions re: price/cost, short lead times, payment timescales do not create modern slavery risks in the supply chain
    • How the supplier will work with NGOs, trade unions or other businesses to address modern slavery risk
    • Means of influencing staff, suppliers, customers, communities and/or any other appropriate stakeholders with respect to modern slavery risks relating to the contract

  • Mission: Kick start economic growth. To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

    Policy Outcome 2: Skills for growth: Supporting growth sectors and addressing skills gaps.

    • Understanding of employment and relevant skills issues, and of the education and training issues relating to the contract. Illustrative examples: demographics, skills shortages, new opportunities in high growth sectors, geographic/local community and skills/employment challenges
    • Support for educational attainment relevant to the contract, including training schemes that address skills gaps and result in recognised qualifications
    • Activities to support relevant sector related skills growth and sustainability in the contract workforce. Illustrative examples: careers talks, curriculum support, literacy support, safety talks and volunteering
    • Delivery of apprenticeships, supported internships and T Level industry placement opportunities (Level 2, 3 and 4+) in relation to the contract

  • Mission: Kick start economic growth. To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

    Policy Outcome 3: Resilient, innovative and flexible supply chains: Support economic growth through enabling resilient businesses, opportunities for small businesses and voluntary, community and social enterprises

    • Understanding of the types of businesses in the market and the level of participation by new businesses, entrepreneurs, start-ups, SMEs, VCSEs and mutuals
    • Activities to identify opportunities to open up sub-contracts under the prime contract to a diverse range of businesses, including new businesses, entrepreneurs, start-ups, SMEs, VCSEs and mutuals
    • Plans for engaging a diverse range of businesses in engagement activities prior to appointing subcontractors (including activities prior to award of the main contract and during the contract term)
    • Activities that demonstrate a collaborative way to work with a diverse range of businesses as part of the supply chain
    • Advertising of supply chain opportunities openly and to ensure they are accessible to a diverse range of businesses, including advertising all subcontracting opportunities on Contracts Finder
    • Ensuring accessibility to contracting and subcontracting opportunities for disabled business owners and employees
    • Structuring of the supply chain selection process to ensure fairness (e.g. anti-corruption) and encourages participation by a diverse range of businesses, including with regard to new businesses, entrepreneurs, start-ups, SMEs, VCSEs and mutual
    • Understanding of local demographics, needs and opportunities for the co-design of the goods, services and works to be delivered under the contract
    • Methods for engaging with different parts of the community (including the education system and charities representing the community) and how communities come together to inform decisions, strategy and projects to leave a positive legacy for future generations
    • Measures to involve local stakeholders and/or users in design (e.g. in the design of services, systems, products or buildings)
    • Plans for positive actions with community groups.
    • Measures for making facilities used in the delivery of the contract available for community groups, education or training
    • Measures to engage users and communities and build relationships to increase community integration build trust and influence how the contract is delivered
    • Plans to respond flexibly and adapt approaches to community engagement and initiatives
    • Support for community-led initiatives relevant to the contract. Illustrative examples: improving transport links; reducing loneliness; helping with English language proficiency; and facilitating social mixing among people with different backgrounds
    • Collaborating with anchor institutions and community groups to make facilities available for education, training or community events

  • Mission: Make Britain a clean energy superpower: To cut bills, create jobs and deliver security with cheaper, zero-carbon electricity by 2030, accelerating to net zero

    Policy Outcome 4: Sustainable procurement practices: Reducing carbon footprints, minimising waste, and promoting the use of clean energy and green technologies.

    • Understanding of opportunities for additional environmental benefits delivery in the performance of the contract, including working towards net zero carbon emissions and use of clean energy and green technologies
    • Collaborative ways of working with the supply chain to deliver additional environmental benefits in the performance of the contract, including working towards net zero carbon emissions and use of clean energy and green technologies
    • Delivery of additional environmental benefits through the performance of the contract, including working towards net zero carbon emissions and use of clean energy and green technologies
    • Understanding of how to influence staff, suppliers, customers, communities and/or any other appropriate stakeholders through the delivery of the contract to support climate and nature protection and improvement
    • Activities to reconnect people with the environment and increase awareness of ways to protect and enhance it

  • Mission: Break down barriers to opportunity: By reforming our childcare and education systems, to make sure there is no class ceiling on the ambitions of young people in Britain

    Policy Outcome 6: Employment and training: For those who face barriers to employment

    • Understanding of employment and skills issues, and of the skills and employment shortages of high growth sectors relating to the contract
    • Creation of employment opportunities particularly for those who face barriers to employment, such as prison leavers, care leavers and/or who are located in deprived areas, and for people in industries with known skills shortages or in high growth sectors
    • Delivery of training schemes and programmes to address any identified skills gaps and under-representation in the workforce for the contract (e.g. prison leavers, care leavers, kinship carers, disabled people)
    • Advertising, promotional and outreach activities designed to raise awareness of the offer to reach the target cohort
    • Understanding of the issues affecting the representation of disabled people in the workforce in the market, industry or sector relevant to the contract, and in the supplier’s own organisation and those of its key sub-contractors
    • Collection of the views and expertise of disabled people and their representative organisations on successfully supporting disabled employees or applicants
    • Inclusive and accessible recruitment practices, and retention-focused activities, including those provided in the Guide for line managers on recruiting, managing and developing people with a disability or health condition
    • Introducing transparency to pay and reward processes
    • Offering a range of quality opportunities with routes of progression if appropriate, e.g. T Level industry placements, students supported into higher level apprenticeships.
    • Working conditions which promote an inclusive working environment and promote retention and progression
    • Other measures to provide equality of opportunity for disabled people and those with health conditions into employment, including becoming a Disability Confident employer and inclusion of supported businesses in the contract supply chain
    • Understanding of the issues affecting inequality in employment, skills and pay in the market, industry or sector relevant to the contract, and in the supplier’s own organisation and those of its key sub-contractors. Measures to tackle inequality in employment, skills and pay in the contract workforce
    • Inclusive and accessible development practices, including guidance for line managers on recruiting, managing and developing people with a disability or health condition

  • Mission: Break down barriers to opportunity: By reforming our childcare and education systems, to make sure there is no class ceiling on the ambitions of young people in Britain

    Policy Outcome 7: Creating a pipeline of opportunities: For the contract workforce, reducing barriers to entry for under-represented groups.

    • Understanding of the issues affecting the development of new skills by target cohort
    • Understanding of the underlying factors affecting improvements to reduce barriers to entry and training schemes for the target cohort(s) related to the contract workforce
    • Other measures to offer development opportunities for the target cohort(s) in the contract workforce
    • Advertising, promotional and outreach activities designed to raise awareness of the offer to reach the target cohort
    • Understanding of issues relating to entering the contract workforce
    • Creation of outreach activities to create a pipeline of employees for the future contract delivery
    • Content of the outreach activity is designed to suit the target cohort
    • Advertising, promotional and outreach activities designed to raise awareness of the offer to reach the target cohort

  • Mission: Build an NHS fit for the future: That is there when people need it; with fewer lives lost to the biggest killers; in a fairer Britain, where everyone lives well for longer.

    Policy Outcome 8: Increasing productivity through physical and mental wellbeing: In the supply chain and communities in the relevant area.

    • Understanding of issues relating to health and wellbeing, including physical and mental health, in the contract workforce
    • Understanding barriers to access to health and social care services or employment opportunities e.g. digital inclusion
    • Inclusive and accessible recruitment practices, development practices and retention policies that support-focused activities including those provided in the Guide for line managers on recruiting, managing and developing which support people with a disability or health condition
    • Actions to invest in the physical and mental health and wellbeing of the contract workforce

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at info@sapphire.net. Tell them what format you need. It will help if you say what assistive technology you use.