CYMBALSTREAM SOLUTIONS LIMITED

Contract Management Software

Contract management software is used to create and manage all your supplier and contracts in one easy to use platform.

Features

• Project planning tool with Gantt chart and resource search availability.
• Dynamic resource planning and management tool. (Up to enterprise class).
• Repository (built in) for all Contract related documents
• Configurable workflows to suit the way your organisation runs projects.
• Configurable Approval flows and Checkpoints to control Projects PMO /Sponsor
• In-built configurable wizards to provide help and training and support.
• Control and reporting at Projects, Programs and Portfolio level.
• Project Charter, project sizing and templating tools for PMO/Managers.
• Easy browser based remote access including a mobile application version
• License and IT asset management

Benefits

• Improve real-time reporting and business intelligence
• Enhanced business management
• Streamlined task management
• Cloud based solution facilitates access anywhere with any device
• Standardised methodology and governance
• Elimination of manual processes and workflows
• Integration with Microsoft Office 365
• Business transformation and organisational change management
• Project collaboration
• Time and expense tracking

• Education pricing available

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at info@cymbalstream.com. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 15

Service ID

371663576171950

Contact

Rico Martin
0333 006 4741
info@cymbalstream.com

About your service

• Service categories:

  Applications

  Enterprise resource management

  • Procurement
• Multi cloud support: Yes

Service scope

• Software add-on or extension: No
• Cloud deployment model:
  • Public cloud
  • Private cloud
• Service constraints: Monthly updates to the platform that are; completed out of hours. Duration of updates; takes no more than 1 hour.
• System requirements:
  • Any web browser
  • Any PC or mobile device with internet access

User support

• Email or online ticketing support: Yes
• Support response times: Support response times; Standard business support provides a 4 hour; response to issues. Next business day response; for general questions. Any questions sent on; weekends or statutory holidays will be responded; to on the next working business day. Uplift of; support is available to cover weekends and; Public holidays.
• User can manage status and priority of support tickets: Yes
• Online ticketing support accessibility: WCAG 2.2 A
• Phone support: Yes
• Phone support availability: 9 to 5 (UK time), Monday to Friday
• Web chat support: No
• Onsite support: Yes, at extra cost
• Support levels: We offer 2 support levels. Standard, Enhanced. All support offerings have a dedicated Technical Account Manager. ; ; Standard provides standard support from 9-5, 5 days a week excluding public holidays and weekends. Standard support is the default option included with all Cloud licencing subscriptions. Enhanced support; provides 9-5, 7 days a week excluding public holidays. ; ; Enhanced support is available as an optional uplift and is dependent on the number of licence subscriptions. In addition to these 2 levels of support a custom option is also available. This option is tailored to meet client needs and is all dependent on number of licenses purchased. All on-premise deployments will have to procure a Custom Support package.
• Support available to third parties: Yes

Onboarding and offboarding

• Getting started: We provide comprehensive training for all user; types within our system. Our on-boarding training; is delivered online via live workshops and is; supplied Free of Charge to ensure the best; possible experience when utilising our system.; On site training is also available on request.; Training videos and user documentation are also; provided to clients as part of on-boarding.
• Service documentation: Yes
• Documentation formats:
  • HTML
  • PDF
  • Other
• Other documentation formats: Dedicated online Platform for Help notes and FAQ's
• End-of-contract data extraction: Counterpart provides clients the ability to extract; data from the system using our export features.; These can be downloaded in to various formats.
• End-of-contract process: At the end of the contract, clients have the ability; to extract all their data. Counterpart will then; archive the client's data for a period of 3 months.; If clients wants data archived for a longer period; then additional costs may be incurred. No other; costs are incurred at the contract end date.
• Documentation accessibility standard: None or don’t know
• How the documentation is accessible: Our documentation is delivered online via in app; links and via website links. PDFs are also; available via email.

Using the service

• Web browser interface: Yes
• Supported browsers:
  • Microsoft Edge
  • Firefox
  • Chrome
  • Safari
• Application to install: No
• Designed for use on mobile devices: Yes
• Differences between the mobile and desktop service: For Laptops and Tablets our full range of product; features are available. For mobiles it is possible; to use the full app but due to real estate of the; screen there is a lot more scrolling. A native; mobile app is also available that provides; selected functionality.
• Service interface: No
• User support accessibility: WCAG 2.2 A
• API: Yes
• What users can and can't do using the API: We provide a rest API which allows hooks to be; developed to interface with all aspects of our; solution.
• API documentation: Yes
• API documentation formats:
  • PDF
  • Other
• API sandbox or test environment: Yes
• Customisation available: Yes
• Description of customisation: The service offers customers a comprehensive level of self configuration. Configuration to align the service with Organisational, business and Portfolio structures/naming schemes and working; practices such as Org /department/team names. Functional roles, Project Workflow. Users can create custom plans, templates, forms and custom reports. Anyone with the appropriate security privileges can configure the system.

Scaling

• Independence of resources: We have on-demand scaling that caters for all; client needs as required.

Analytics

• Service usage metrics: Yes
• Metrics types: We audit and capture full user activity in the; system.
• Reporting types: Reports on request
• Resource tagging: Yes
• FOCUS resource tagging: No

Resellers

• Supplier type: Reseller (no extras)
• Organisation whose services are being resold: Counterpart Solutions Ltd

Staff security

• Staff security clearance: Other security clearance
• Government security clearance: Baseline Personnel Security Standard (BPSS)

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations: United Kingdom
• User control over data storage and processing locations: Yes
• Datacentre security standards: Managed by a third party
• Penetration testing frequency: At least once a year
• Penetration testing approach: ‘IT Health Check’ performed by a CREST-approved service provider
• Protecting data at rest:
  • Physical access control, complying with CSA CCM v4.0
  • Physical access control, complying with SSAE-18 / ISAE 3402
  • Physical access control, complying with another standard
  • Encryption of all physical media
  • Scale, obfuscating techniques, or data storage sharding
• Data sanitisation process: Yes
• Equipment disposal approach: Complying with a recognised standard, for example CSA CCM v4.0, CAS (Sanitisation) or ISO/IEC 27001
• Data sanitisation type:
  • Deleted data can’t be directly accessed / Cryptographic Erasure
  • Explicit overwriting of storage before reallocation / Secure Erase

Data importing and exporting

• Data export approach: We provide buttons within the tool to export data; from the system via various formats. XML, Excel,; CSV and PDF
• Data export formats:
  • CSV
  • Other
• Other data export formats:
  • XLSX
  • PDF
• Data import formats:
  • CSV
  • Other
• Other data import formats:
  • XML
  • Excel

Data-in-transit protection

• Data protection between buyer and supplier networks: TLS (version 1.2 or above)
• Data protection within supplier network: TLS (version 1.2 or above)

Availability and resilience

• Guaranteed availability: Since our cloud service runs on Microsoft's Azure; platform we are able to offer 99.9% availability.; We typically take our cloud service offline once; per quarter to perform updates and; enhancements. This outage lasts less than an; hour.
• Approach to resilience: Available on request.
• Outage reporting: Clients are alerted by email in the unlikely event; of an outage.

Identity and authentication

• User authentication needed: Yes
• User authentication:
  • Multi-Factor Authentication (MFA)
  • Public key authentication (including by TLS client certificate)
  • Identity federation with existing provider (for example Google Apps)
  • Username or password
• Access restrictions in management interfaces and support channels: RBAC (Role based access security is a default).; Security permissions are also on an individual; level and based on the lowest level required to; perform your duties. Use of dedicated admin; accounts with restricted access to authorised; personnel.
• Access restriction testing frequency: At least every 6 months
• Management access authentication:
  • Multi-Factor Authentication (MFA)
  • Public key authentication (including by TLS client certificate)
  • Identity federation with existing provider (for example Google Apps)
  • Username or password

Audit information for users

• Access to user activity audit information: Users have access to real-time audit information
• How long user audit data is stored for: At least 12 months
• Access to supplier activity audit information: Users have access to real-time audit information
• How long supplier audit data is stored for: At least 12 months
• How long system logs are stored for: At least 12 months

Security governance

• Named board-level person responsible for service security: Yes
• Security governance certified: No
• Security governance approach: Security governance approach; We are compliant with ISO/IEC 27001 and are in; the process of obtaining certification.
• Information security policies and processes: We adhere to ISO27001. Our internal security; officer ensures processes and procedures are; strictly adhered to. We follow and adhere to; GDPR regulations and have a designated DPO; officer. Our security officer is a member of the; management board.
• Software Security Code of Practice: Yes

Operational security

• Configuration and change management standard: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Configuration and change management approach: We follow best practices for configuration and; change management based on ITIL. Our internal; software tracks all services through their lifecycle; and changes are reviewed by our change control; board.
• Vulnerability management type: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Vulnerability management approach: Internal Vulnerability Assessment tools are used; to identify and assess potential threats. Patches; are automatically deployed to our services.; Potential threats are identified from continuous; scanning as well as third party security partners; and sources.
• Protective monitoring type: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Protective monitoring approach: Ongoing monitoring and scanning identifies; potential compromises which are referred to our; security officer for evaluation and action. We; strive to respond and resolve incidents as quickly; as possible typically within 4 hours. Where; resolution will take considerable time, our; security officer will disable certain services to; protect clients.
• Incident management type: Complies with a recognised standard, for example, CSA CCM v4.0 or ISO/IEC 27035:2011 or SSAE-18 / ISAE 3402
• Incident management approach: Yes defined approach and process. From a; customer perspective it starts with Telephone; /email or direct in-app alerting. Reports are; provided by email.
• Post-quantum cryptography secure: No

Secure development

• Approach to secure software development best practice: Conforms to a recognised standard, but self-assessed

Public sector networks

• Connection to public sector networks: No

Pricing

• Discount for educational organisations: Yes
• Free trial available: No

Discount percentage by annual call-off contract value (excluding VAT)

• Less than £250,000: 2%
• Between £250,000 and £500,000: 5%
• Between £500,001 and £1,000,000: 7.5%
• Between £1,000,001 and £2,500,000: 10%
• Between £2,500,001 and £5,000,000: 12.5%
• Over £5,000,001: 15%

Non-mandatory Standards and certifications

• ISO/IEC 27001 certification: No
• ISO 28000:2022 certification: No
• ISO 9001 certification: No
• Quality management systems (QMS): No
• CSA STAR certification: No
• PCI certification: No
• Cyber essentials: Yes
• Please provide your Cyber Essentials Certificate Number: A72c9e9c-e158-4cb6-adfc-e539c2fff737
• Cyber essentials plus: Yes
• Please provide your Cyber Essentials Plus Certificate Number: 96481515-1e00-455d-8e87-3b0b54e5d051
• Other security certifications: Yes
• Any other security certifications: GDPR Practitioner

Social value

• Section B - Commitment for Future: Delivery:

  • Mission: Kick start economic growth. To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

    Policy Outcome 1: Fair work: That offers fair wages and good working conditions. Help people get a job, stay in work, and progress in their careers, with good employment opportunities across the country. Notes: Where there is a large proportion of labour costs in the contract, commercial teams should consider MAC in Outcome 1 as a priority

    • Providing opportunities for, and measuring and monitoring of, staff workforce conditions over time, including employee engagement, involvement in decision-making and satisfaction and adapting to any changes in the results, with clear processes for acting on issues identified
    • Measures to support in-work progression to help people in the contract workforce, to move into higher paid work by developing new skills relevant to the contract
    • Support for educational attainment relevant to the contract, including training schemes that address skills gaps and result in recognised qualifications

  • Mission: Kick start economic growth. To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

    Policy Outcome 2: Skills for growth: Supporting growth sectors and addressing skills gaps.

    • Support for educational attainment relevant to the contract, including training schemes that address skills gaps and result in recognised qualifications

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at info@cymbalstream.com. Tell them what format you need. It will help if you say what assistive technology you use.