Support Point
Support Point is designed to assist people in vulnerable situations, by them asking relevant questions about their circumstances and compiling a tailored list of support options from government, charities and community groups to help them address their vulnerability and build their up longer term financial, health and emotional resilience.
Features
- Digital self-service tool to support vulnerable customers or colleagues
- Walks customers through series of questions to understand their circumstances
- Production of a personalised support pack based on their responses
- Support Packs are real-time, tailored and interactive
- Signposts customers to appropriate support organisations basis their circumstances
- Provides businesses with daily, monthly, quarterly MI and analytics
- Configurable to meet requirements of any customer/workforce population
- Secure and inclusive by design
- All customer/employee data anonymised and not stored
- The platform is continuously improved based on real-life use cases
Benefits
- Allows organisations to better support customers/colleagues in vulnerable situations
- Gather valuable data to inform future services or HR policies
- A single source for all support options available to customers/colleagues
- Ability to report the nature, scale, impact of vulnerability
- Better equip staff to help customers requiring additional support
- Promote colleague or customer well-being and resilience
- Delivers an accessible and inclusive user experience
- Demonstrate to customers or colleagues how you reflect your values
- Improve customer retention rates and/or reduce absenteeism
- Comfort of a GDPR compliant service
Pricing
£2,500 to £12,500 a transaction a month
Service documents
Request an accessible format
Framework
G-Cloud 14
Service ID
3 7 1 3 0 0 6 6 3 9 8 4 8 4 0
Contact
Sopra Steria Ltd
Sopra Steria G-Cloud Team
Telephone: 0370 600 4466
Email: soprasteria-gcloud@soprasteria.com
Service scope
- Software add-on or extension
- No
- Cloud deployment model
- Private cloud
- Service constraints
-
The service is constraint to a Software as a Service offering. There is no ability to self-host the service.
The Support Point application is available 24x7, excluding:
a) scheduled Routine Maintenance (typically undertaken outside normal business hours)
b) essential maintenance in order to prevent or resolve an Incident;
c) unexpected failure due to a P1 or P2 Incident; or
d) any downtime as a result of Microsoft being unable to provide their Azure cloud hosting service. - System requirements
-
- To connect- Authenticate customers/colleagues within their own platform/website
- Enable access Support Point from client website/platform via APIs
- Integrate to Support Point via standard APIs
- Be responsible for GDPR compliance
- Have secure GDPR compliant communications to customers/colleagues
- To access Support Point end-users must have internet access
- Chromium based browser (Chrome, Edge) on Windows OS
User support
- Email or online ticketing support
- Email or online ticketing
- Support response times
-
Sopra Steria support team would acknowledge any support issues and will resolve it as soon as possible.
The target application availability is 24x7, excluding scheduled maintenance windows planned during non-core availability periods. Application availability will be calculated based on core service hours only which are 08:00 to 18:00 (UK Time) excluding bank holidays. Weekend support will not be available.
Buyers are responsible for handling calls/emails from end users re: technical or usability issues.
Buyer representatives can report issues to the Support Point support team via email and support tickets will be created. Buyer will be updated on progress via email. - User can manage status and priority of support tickets
- No
- Phone support
- No
- Web chat support
- No
- Onsite support
- Yes, at extra cost
- Support levels
-
Sopra Steria support team would acknowledge any application and infrastructure support issues and intend to resolve it as soon as possible. The SLAs applicable to resolution times are shown below based on assessed impact.
Service penalties are not applicable to incident resolution and acknowledgement.
Resolution is defined as the point at which an incident is fixed, or normal service restored via an acceptable workaround (workarounds can be used for P4-P5 only).
Please note offshore technical team will provide support during UK Business hours from Monday to Friday excluding UK Bank holidays.
Incident Resolution Target Timeframe Service Levels are as follows;
P1 – Major Impact - Within 8 hours within Support Hours
P2 – Serious Impact - Within 2 working days
P3 - Medium Impact - Within 3 working days
P4 - Low Impact - Within 4 working days
P5 - Cosmetic Only - No Service Level - Support available to third parties
- No
Onboarding and offboarding
- Getting started
-
Support Point has an accessible, intuitive user interface for it to be used by customers/colleagues without any training.
A user manual, FAQs and supporting documentation will be provided to the Buyer. This will outline the benefits, objectives of the tool and also will include the API technical specifications to launch Support Point from the Buyer’s website.
We will provide support during onboarding to ensure Support Point is being correctly launched and Users have access to the tool.
Sopra Steria can also provide the following value-add services (at additional cost);
- Work with the Buyer to map out various ‘user journeys’, trigger events, specific campaigns to enable better take-up of the tool, understand customer motivation to engage with the tool and breakdown any barriers for entry.
- Training workshop to your internal colleagues/contact centre staff to support understanding and roll out.
- Technical assistance to help build the integration from your website to call the Support Point APIs.
Our team will provide your organisations with access to our API alongside documentation with specific instructions on integration requirements.
Organisations are required to provide their own customer/colleague authentication, however, should you need support, we can discuss options as part of the bespoke service. - Service documentation
- Yes
- Documentation formats
-
- HTML
- End-of-contract data extraction
-
The User-related data held in Support Point is anonymised and Sopra Steria cannot identify individuals from the data held in the system (either directly or through reverse engineering from the anonymised data held).
Sopra Steria can identify those anonymised vulnerability profiles related to the Buyer. On request Buyers can request Sopra Steria to perform an extract of the profiles related their Users (customers / employees) and request the is either deleted and/or sent to the Buyer (as an encrypted file via email). - End-of-contract process
-
The end of contract process is very simple for Support Point;
- Three months before end of contract we will contact the Buyer re: contract extension.
- If the Buyer does not wish to extend, one month before end of contract we will notify the buyer the Support Point service will be disabled at the end of contract.
- At the end of the contract we will disable the service for that Buyer. At this point any Users attempting to access Support Point from the Buyer’s website/platform will be directed to a web page notifying the User that Support Point is no longer available for Customers /Employees of that Buyer
On request we will delete all anonymised profiles stored in Support Point related to that Buyer and/or provide the raw data to the Buyer – there is no additional charge for this.
Using the service
- Web browser interface
- Yes
- Supported browsers
-
- Internet Explorer 11
- Microsoft Edge
- Firefox
- Chrome
- Application to install
- No
- Designed for use on mobile devices
- Yes
- Differences between the mobile and desktop service
- No difference
- Service interface
- Yes
- User support accessibility
- WCAG 2.1 AAA
- Description of service interface
-
Organisations are provided with a digital self-directed triage tool. The interface meets WCAG2.1 AAA accessibility standards and was inclusively designed with people with lived experience of vulnerability.
The interface can also be used by agents in a contact centre or on the front line who can walk customers / colleagues through the tool, either over the phone / chat or face to face.
White labelling is available and the interface can be customised should that be a requirement. - Accessibility standards
- WCAG 2.1 AAA
- Accessibility testing
-
The service was built collaboratively, using inclusive design, with people with ‘lived experience’ of vulnerability for people who are in or about to be in a vulnerable situation. The objective of the tool in itself is to identify support needs of individuals in vulnerable situations.
This included people with mobility, visual, hearing, cognitive and learning difficulties. - API
- Yes
- What users can and can't do using the API
-
Buyers connect Users to Support Point from their customer or employee website via a unique hyperlink for that user. Buyers will be responsible for authenticating the user as a valid customer / employee with the relevant access rights to the website/platform.
Users will launch Support Point via the hyperlink and will be guided through the interactive Q&A session to self-identify vulnerabilities and needs. Users can save a session and come back to complete the assessment at a later time. At the end of the session Users will be provided information on support assets and services (relevant to their needs and location) and can opt to be emailed a personalised support pack. - API documentation
- Yes
- API documentation formats
- Other
- API sandbox or test environment
- No
- Customisation available
- Yes
- Description of customisation
-
Support Point can be either co-branded or completely white labelled.
Support Point provides a ‘standard service’ off the shelf which incorporates tailored support across a wide range of vulnerable situations. These cover health, mind and body, life events, communication and everyday skills.
Organisations can customise the standard service by adding additional vulnerable situations which are specific to their working environment or customer scenario. The Support Point bespoke service includes:
• Customise workflows to incorporate vulnerabilities wider than standard service
• Customise support options to address vulnerabilities wider than standard service
• Integrate existing support already provided by Organisation, partners or affiliated Unions / Federations etc.
These bespoke services are available at additional cost.
Scaling
- Independence of resources
- Support Point is a highly extensible multi-tenant cloud-based platform using serverless Azure technology to deliver a scalable service. Our Support Team continually monitor Performance of the service is continuously monitored and action taken to increase capacity if performance degrades.
Analytics
- Service usage metrics
- Yes
- Metrics types
- Real-time reporting & dashboard will be setup for each G-Cloud framework buyer. We will monitor entire helpdesk’s performance & KPIs. With customisable team dashboards for the overall service along with for a particular buyer, the overall service experience will be enabled. Supervisor will monitor the team performance, manage the ticket flow & measure team productivity. We will measure the service against various service metrics like Resolution time, Acknowledgement time, Total ticket count, unresolved ticket volume, tickets by buyers, tickets in queue by L1, L2, L3 and L4 etc., More service metrics will be added as we mature in the service.
- Reporting types
-
- API access
- Real-time dashboards
- Regular reports
Resellers
- Supplier type
- Not a reseller
Staff security
- Staff security clearance
- Other security clearance
- Government security clearance
- Up to Baseline Personnel Security Standard (BPSS)
Asset protection
- Knowledge of data storage and processing locations
- Yes
- Data storage and processing locations
- United Kingdom
- User control over data storage and processing locations
- No
- Datacentre security standards
- Complies with a recognised standard (for example CSA CCM version 3.0)
- Penetration testing frequency
- At least once a year
- Penetration testing approach
- In-house
- Protecting data at rest
-
- Physical access control, complying with another standard
- Encryption of all physical media
- Data sanitisation process
- Yes
- Data sanitisation type
- Deleted data can’t be directly accessed
- Equipment disposal approach
- Complying with a recognised standard, for example CSA CCM v.30, CAS (Sanitisation) or ISO/IEC 27001
Data importing and exporting
- Data export approach
-
Functionality in Support Point will trigger the creation of daily summary details and stores these within an MS Excel spreadsheet.
This Excel is sent to the Buyer’s email address. - Data export formats
- Other
- Other data export formats
- Microsoft Excel
- Data import formats
- Other
- Other data import formats
- Not applicable–client data cannot be uploaded to Support Point.
Data-in-transit protection
- Data protection between buyer and supplier networks
- TLS (version 1.2 or above)
- Data protection within supplier network
- TLS (version 1.2 or above)
Availability and resilience
- Guaranteed availability
-
The Support Point target application availability is 24x7 within the Azure cloud environment. However, service support hours are Monday to Friday 8AM to 6PM (excluding England & Wales Bank Holidays). Sopra Steria support team would acknowledge any application and infrastructure support issues and will resolve as soon as possible.
Incident Resolution Target Timeframe Service Levels are as follows;
P1 – Major Impact - Within 8 hours within Support Hours
P2 – Serious Impact - Within 2 working days
P3 - Medium Impact - Within 3 working days
P4 - Low Impact - Within 4 working days
P5 - Cosmetic Only - No Service Level - Approach to resilience
- Service resiliency approach will be made available on request.
- Outage reporting
-
Email alerts will be sent in case of outage reporting.
Emails will typically be issued within X minutes of Sopra Steria being aware of the outage via our Azure monitoring capability with an assessment of the severity and expected resolution time (on reasonable endeavours basis).
Emails will be sent to notify Buyers when the service is resumed.
Identity and authentication
- User authentication needed
- Yes
- User authentication
- Other
- Other user authentication
-
Identity management will be controlled by the Buyer via the linkage of Customer User Id and Support Point User Id, The Buyer’s users access the Support Point application if the user is an authenticated by the Buyer user in line with the Buyer’s security policies.
• Support Point uses a random unique psuedonymised user id (SP userid), linked to a unique signed URL for each individual user.
• The Buyer will need to store the mapping of their user id with pseudonymised SP userid, within their database. Support point will not store any user identification data at its end. - Access restrictions in management interfaces and support channels
- Internal management interfaces are only accessible from within the Sopra Steria private cloud environment. Access to the environment is via a bastion approach. Access to the Support Point management portal is restricted to a limited IP range.
- Access restriction testing frequency
- At least once a year
- Management access authentication
- Other
- Description of management access authentication
-
Support Platform allows Buyers’ end users to use the platform once they are registered and authenticated. Users log on to the Buyer’s website / Platform, in the normal way and can click on a Supporrt Point logo.
They will be forwarded to the Support Point portal. The Buyer also sends the pseudonymised user request to Support Point, and SP platform returns a unique URL for the user. In case of new users of Support Point, SP application will generate a new random pseudonymised SP User Id, which will be sent to the Buyer with the unique URL.
Audit information for users
- Access to user activity audit information
- No audit information available
- Access to supplier activity audit information
- No audit information available
- How long system logs are stored for
- Between 1 month and 6 months
Standards and certifications
- ISO/IEC 27001 certification
- Yes
- Who accredited the ISO/IEC 27001
- DNV Business Assurance, London, SE1 9LQ, United Kingdom
- ISO/IEC 27001 accreditation date
- Date of last re-certification: 01 December 2023
- What the ISO/IEC 27001 doesn’t cover
- N/A
- ISO 28000:2007 certification
- No
- CSA STAR certification
- No
- PCI certification
- No
- Cyber essentials
- Yes
- Cyber essentials plus
- Yes
- Other security certifications
- No
Security governance
- Named board-level person responsible for service security
- Yes
- Security governance certified
- Yes
- Security governance standards
- ISO/IEC 27001
- Information security policies and processes
-
Sopra Steria has a suite of information security and data protection policies, standards and procedures that are contained in the Sopra Steria Business Management System (BMS). These policies and procedures form the core implementation of the Information Security controls. Sopra Steria have an Information Risk Framework in place that uses the ISO27005 methodology and initiates frequent risk assessments.
Sopra Steria have obtained the following certifications and accreditations:
- ISO/IEC 27001
- UK Government Cyber Essentials Plus
- ISO/IEC 20000 IT Management
- ISO/IEC 22301 Business Continuity
Sopra Steria's Information Security Management capability is led by the Chief Information Security Officer (CISO), Phillip Yockney.
Employees are required to complete security awareness training upon starting with the company and must complete and pass refresher training modules throughout the year. These modules cover the corporate Information Security Policy, GDPR and other relevant topics. Company-wide communications create security-positive behaviours by circulating policy updates, providing best practise guidance and offering support through one-to-one drop-in sessions with domain experts.
Operational security
- Configuration and change management standard
- Supplier-defined controls
- Configuration and change management approach
-
The Sopra Steria BMS includes policies and procedures to ensure that accurate and reliable information about the configuration of services and the configuration items that support them is available.
This process has been designed to conform to ITIL and ISO 20000.
Support Point follows an Agile development approach with outcomes of several Sprints combined into a single release. Releases are subject integration and performance testing and once validated the release details are shared with customers and made available on the live service.
New releases are deployed to the live service automatically without the need for customers to request the change. - Vulnerability management type
- Conforms to a recognised standard, for example CSA CCM v3.0 or SSAE-16 / ISAE 3402
- Vulnerability management approach
-
The Support Point cloud provider (Microsoft Azure) follows CSA CCM V3 for the infrastructure and services.
The Support Point components are developed using modern CI/CD pipelines that include vulnerability checking tools as part of the standard build processes. The outcomes of these tools are reviewed as part of the release process and issues rectified before a release.
Any serious vulnerabilities that come to light after a release will trigger a high priority patch release.
The underlying cloud services are upgraded following the advice from the Azure maintenance schedule. - Protective monitoring type
- Conforms to a recognised standard, for example CSA CCM v3.0 or SSAE-16 / ISAE 3402
- Protective monitoring approach
-
The solution uses Azure services and tools to monitor the various components and deliver events into the Azure Sentinel SIEM service. This being monitored by a security team.
The live service components are serverless generating events and subsequence alarms for unexpected behaviour.
Virus scanning events are also delivered to the SIEM service.
Support Point leverages Microsoft Antimalware within the Azure security centre. This continuously monitors and defends resources. The Azure tools collect event log data from a range of sources, identifies activity that deviates from the norm with real-time analysis, and takes appropriate action. - Incident management type
- Supplier-defined controls
- Incident management approach
-
The Major Incident process is owned by IT Service Manager (ITSM) and the Sopra Steria Quality Gateway team (SSQG) during service hours. Any potential P1 or P2 alerts from the monitoring toolset will be assessed and formally validated by SSQG and the ITSM before invoking the process.
Ownership, monitoring, tracking and communication of Major Incidents will be in line with SLAs.
Once a Major Incident has been validated by the IT Service Manager, they will manage the process of communication and callouts. and establishing conference bridges.
Post Major Incident Review will be conducted as part of our continuous improvement process.
Secure development
- Approach to secure software development best practice
- Conforms to a recognised standard, but self-assessed
Public sector networks
- Connection to public sector networks
- No
Social Value
- Social Value
-
Social Value
- Fighting climate change
- Covid-19 recovery
- Tackling economic inequality
- Equal opportunity
- Wellbeing
Fighting climate change
Sopra Steria has committed to becoming Net Zero by 2028 and has been ranked in the top 1% of companies globally by CDP placing us on the A-list for our work tackling climate change over the past 5 years.
Our work has a direct positive impact on our client’s services, for example through lower emissions, reduced waste, and more sustainable supply chains.
Additional environmental benefits: We also provide contract-specific sustainability programmes for clients, which are designed & deployed by our team of Sustainability Consultants. During procurement, these experts will develop a sustainability programme based on a clients objectives, the material impacts, and opportunities within the service.
We have experience in…
• Undertaking service environmental impact assessments
• Measuring energy consumption, and emissions generated, required to deliver a particular service (e.g., office use, business travel, use of technology and supply chain)
• Evaluating the sustainability of technology products (e.g., GGICT, Energy Star, as well as product and service foot printing)
• Making business case-backed recommendations, implementation roadmaps for improvements
• Delivering improvement programmes
• Reporting performance, using recognised reporting standards, accounting methods
Influencing staff, suppliers, customers and communities: regarding our staff, we feature sustainability in our employee communications, and offer all employees paid volunteering time which can be used to support sustainability activities, such as beach cleans and climate hackathons.Covid-19 recovery
Employment, re-training and other opportunities: In the high-growth Digital sector, Sopra Steria is continually developing the skills of our workforce, including via upskilling and reskilling initiatives, e.g. via a new Career Coach, or by extending our apprenticeship programme.Through our ‘Tech for Good’ programme, and the various Social Value programmes we design and deliver for our customers, we focus on jobs and skills for disadvantaged and under-represented groups, including those disproportionately affected by Covid.
People and communities: Our ‘Tech for Good’ programme is designed to provide people, small businesses and VCSEs with skills they need to thrive and is focused on those from disadvantaged or under-represented communities. Since the beginning of the pandemic, we have transitioned to a hybrid-virtual programme to ensure continued accessibility. For example, we worked with ELATT, a digital skills charity, to create hybrid learning, ensuring those who were shielding or otherwise unable to access classroom learning, as well as those who most needed to be in a classroom to support their learning, could still participate.
Organisations and businesses: In the first year of the pandemic, we ran free training courses for charities and SME’s – offering Microsoft Teams training and modules on cyber security and resilience. We continue to offer pro-bono consulting for charities to help them use technology to better serve their communities.
Physical and mental health needs: Since the pandemic, we have put in place measures to prevent and manage risks to employee wellbeing – including the wellbeing of contracted staff – together with appropriate training and individual support, and initiatives to raise awareness of mental health issues at work. We have also trained ca. 60 Mental Health First Aiders.
Workplace conditions: All our office locations have strict Covid safety protocols, with considerations for cleaning, ventilation, and occupancy.Tackling economic inequality
1) New businesses, jobs, and skills
Entrepreneurship and SMEs: Sopra Steria adheres to the Prompt Payment Code. SMEs provide us with innovative and agile solutions and deliver 50% of our work.
Barriers to employment: We provide education, skills training and employment opportunities, such as mentoring, for those facing barriers to employment.
Skills shortages: We address the digital skills gap inside and outside of our business through in-work and community learning opportunities.
Educational attainment: We offer a number of skills development programmes, including apprenticeships.
Influence: Staff are encouraged to use paid volunteer time to support our community innovation, entrepreneurship and employability initiatives.
Suppliers must comply with our Supplier Code of Conduct, which requires workforce skills development.
Our customer social value programmes include business competitions and work experience placements.
We work with community organisations such as Villiers Park and Career Ready to deliver business, jobs, and skills programmes.
2) Supply chain resilience and capacity
Diverse supply chain: We work to improve supplier diversity by…
• Making it easier to do business with us
• Measuring current supply chain diversity
• Creating new VCSE partnerships
Innovation & new methods: Through horizon-scanning, supplier & industry collaboration, we support development of new technologies that improve public services, like our ethical data-driven approaches to serving vulnerable citizens.
Collaboration: We have obtained the ISO44001 Collaborative Business certification.
Cyber security: We are certified to Cyber Essentials Plus and ISO27001 standards. We require our suppliers to have resilient information security processes, and flow down necessary cyber standards.
Influence: Staff undertake cyber security training, and participate in our innovation processes.
Suppliers are engaged through our Collaborative Business approach and must adhere to strict security requirements.
We share knowledge with customers via our social value programmes, continual service improvement, industry engagements.
We participate in community resilience, innovation forums such as techUK.Equal opportunity
Sopra Steria’s vision is to create an inclusive culture that embraces difference as a source of creativity, innovation, and competitive advantage. Our Equality, Diversity & Inclusion (EDI) strategy, overseen by a dedicated EDI Manager, applies to contract workforces.
1) Disability employment gap
Representation: We are a Disability Confident Committed Employer. Our partnership with Vercida helps us improve diversity through recruitment.
Skills development: All employees are given access to on-and-off-the-job development. We also have initiatives such as our Disability Network, and also our partnership with Business Disability Forum which supports disabled employees in their skills development.
Staff, suppliers, customers and communities:
Staff - all employees can join our Disability Network. Our Disability Steering Group has employee representation and executive-level sponsorship.
Suppliers - our Supplier Code of Conduct requires all suppliers to maintain high standards of EDI in their workforces.
Customers - we regularly work with clients to improve accessibility in digital services. Example, we are providing insight to a client on the effects of digital transformation on accessibility.
Communities - we work with community representatives in the design and delivery of our disability work.
2) Workforce inequality
Identify and tackle inequality: We have a range of initiatives to identify, tackle inequality in our workforce, e.g.:
• Diversity data dashboards help us understand EDI indicators and inform our programmes.
• Employee inclusion networks give employees in under-represented groups a voice in our EDI strategy.
• We are working to recruit more people from under-represented groups.
In-work progression: We offer opportunities for people from under-represented groups, such as our Female and Black and Ethnic Minority Employee mentoring programmes.
Modern Slavery: as signatories to the UN Global Compact, we actively work to prevent human trafficking through pre-employment checks and transparent recruitment practices. Our Supplier Code of Conduct includes requirements for demonstrably preventing modern slavery.Wellbeing
Sopra Steria is fostering a workplace where our people are actively supported to be healthy & well, and can talk openly about their mental health.
1) Improve health and wellbeing: Our company-wide health and wellbeing programme is for all our employees, including contracted staff, and includes…
• Work-life balance policy providing flexible and remote working options
• Extensive employee assistance programme
• Range of healthcare benefits
• Employee Trust, providing financial support in times of hardship
• Mental Health First Aiders, now with 60 trained staff
• Calendar of virtual classes, including fitness, meditation, stress management, nutrition, and resilience
2) Improve community integration:
Our outcomes-focused, and user-centred approach to Social Value means that in creating programmes for our clients, we engage community representatives by conducting user research and needs analysis.
Health, wellbeing & community integration: influence staff, suppliers, customers, and communities: We engage all stakeholders in our Social Value work on Wellbeing, for example…
Staff - in addition to the staff support described, we also equip our people to support others’ wellbeing, for example by ensuring people managers have additional wellbeing training and objectives.
Suppliers - our Supplier Code of Conduct requires all suppliers to support the health and wellbeing of their workforce.
Customers - our Social Value consulting team designs Social Value programmes tailored to clients’ Social Value priorities, including Health & Wellbeing. For example, we are providing pro-bono consulting to a national mental health charity to help them identify how to use technology to improve outcomes for service users.
Communities - To play a positive role in all our communities, all employees are given 3 days paid volunteering annually, and we offer matched funding to support charitable fundraising.
Pricing
- Price
- £2,500 to £12,500 a transaction a month
- Discount for educational organisations
- No
- Free trial available
- No