WPC Software Ltd

WPC Core-Vet - Vetting Management

Core-Vet is a web-based system designed to manage the entire vetting process, from notification that vetting is required; to the receipt of an application; to the checking process; through to the post-clearance after-care. Core-Vet provides an efficient and streamlined approach, ensuring that vital vetting data is available and managed appropriately.

Features

• Record and manage all vetting and clearance information
• Web Forms module allows applicants to enter vetting information online
• Online applications notifies applicant if information is missed or incorrect
• Provides a comprehensive search engine and tasking facility
• MIS feature produces a range of reports and statistics
• System overview screen alerts users to applications/renewals that need attention
• Generates letters, forms, certificates and other documentation as required
• Traffic light system to easily identify status of applications
• Restricted access for other staff such as front-desk and HR
• Provides a full audit trail of application history

Benefits

• Core-Vet easily and simply guides users through the vetting process
• Online applications saves time and resources by reducing office-based administration
• Automatic validation of data provides efficiency savings
• Search and tasking facilities make system navigation quick and easy
• Reduces bureaucracy by removing the need to re-type data
• Provides comprehensive statistics for easy reporting, analysis and review
• Manages after-care process by prompting when review/renewal information is due
• 24/7 access to contractor clearance levels for front desk staff
• Enables multi-force collaboration and data sharing
• Customisable letters, forms, certificates and other documentation are easily generated

£850 a unit a month

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at g.bewes@wpcsoft.com. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 14

Service ID

398472268282678

Contact

Glenn Bewes
0117 908 1484
g.bewes@wpcsoft.com

Service scope

• Software add-on or extension: No
• Cloud deployment model: Public cloud
• Service constraints: Core-Vet - Vetting Management solution is offered as Cloud software with WPC Software utilising Microsoft Azure to provide cloud-based delivery of the Core-Vet software. An full outline of the standard offering is outlined in the Service Description.
• System requirements: Up-to-date/modern browser (e.g. Latest version of Microsoft Edge)

User support

• Email or online ticketing support: Email or online ticketing
• Support response times: Support is available 8:30am to 5:30pm Monday to Friday excluding English Public Holidays. Responses are provided in line with our SLA with all queries responded to within a maximum of 4 hours. Major and Critical issues should be reported by telephone to the Service Desk to ensure a timely response.
• User can manage status and priority of support tickets: No
• Phone support: Yes
• Phone support availability: 9 to 5 (UK time), Monday to Friday
• Web chat support: No
• Onsite support: Yes, at extra cost
• Support levels: WPC Software operates a standard support level which is fully outlined within our Support Issue Management Process (which is available upon request).; ; This document provides an outline of our incident management process including escalation points; roles and responsibilities; Incident Categorisation, Target Times, Prioritisation and Escalation; and Service Levels.; ; WPC Software operate a Service Desk between 08:30 to 17:30 Monday to Friday excluding English bank holidays. WPC Software has its own in-house written Service Desk management toolset which is used to log, monitor and manage Incidents and Service Requests through to resolution and closure. Each customer is assigned a dedicated Business Manager.; ; A brief summary of our standard support target times are:; ; Critical (system unavailable to users); 4 working hours to respond and fix.; Major (many users affected but limited impact); 4 working hours to respond; 8 working hours to fix.; Minor (few users affected with little impact); 8 working hours to respond; 2 working days to fix; Cosmetic (no impact on functionality); 2 working days to respond; Next release or earlier by agreement to fix.
• Support available to third parties: Yes

Onboarding and offboarding

• Getting started: As part of the set-up process WPC will work closely with the customer to customise and set-up the solution to fit your working practices. This is normally in the form of a kick-off meeting, followed by a period of system configuration. This is normally included as standard as part of our implementation package. In addition to the system configuration, we normally offer a 1 day training course for users, although this can be customised depending on individual customer requirements. Training can be delivered as both onsite or online training depending on customer requirements. We also offer a full set of user documentation including training and administration guides as part of our standard implementation package.
• Service documentation: Yes
• Documentation formats: PDF
• End-of-contract data extraction: WPC is committed to working with the user and providing a complete data extract of all data upon termination of the contract.; ; When a termination date has been agreed, WPC Software will back up the data and provide this to the customer in an agreed format. This data will be sent to the customer in a secure manner. WPC can make this data available via its SFTP server (depending on size). If the WPC Software SFTP server is selected as the method of transfer, the customer will be informed when the data is available to download. The data will remain available for 24 hours before access to the SFTP server is revoked. Alternative methods of delivery can be agreed with the customer.; ; This exit plan allows for the customer’s data to be backed up and sent to the customer immediately before the service is switched off. This return of data service is part of the contract and will not attract any additional charge.; ; Throughout the contract, users with appropriate permissions can export data and reports to csv files directly from the system itself.
• End-of-contract process: The provision of data back to the customer at the end of the contract is included in the contract.; ; At the end of the contract a date for termination will be agreed with the customer. When a termination date has been agreed, WPC Software will back up the data and provide this to the customer in an agreed format. This data will be sent to the customer in a secure manner.; ; At the agreed date and time of the service termination, WPC will block all access to the system and the database will be securely deleted. It should be noted that once the data has been deleted there will be no backup copies of the data retained and WPC will have no access to the customers data after this point.; ; This exit plan allows for the customer’s data to be backed up and sent to the customer immediately before the service is switched off. This return of data service is part of the contract and will not attract any additional charge. The above outlines a standard Exit Plan from the Service, but WPC would be happy to discuss individual customer needs and requirements at the point of termination.

Using the service

• Web browser interface: Yes
• Supported browsers:
  • Internet Explorer 11
  • Microsoft Edge
  • Firefox
  • Chrome
  • Safari
• Application to install: No
• Designed for use on mobile devices: Yes
• Differences between the mobile and desktop service: The application is a mobile-friendly browser-based solution that has been designed to work on desktops and a variety of mobile devices.
• Service interface: Yes
• User support accessibility: WCAG 2.1 AA or EN 301 549
• Description of service interface: The solution is delivered as a web-based solution, through a browser.
• Accessibility standards: WCAG 2.1 AA or EN 301 549
• Accessibility testing: Testing is conducted in line with WPC's Testing Procedure and working directly with client where required.
• API: No
• Customisation available: Yes
• Description of customisation: There is an element of customisation available within the Core-Vet solution. This allows the end user organisation to configure their own system settings such as drop-down lists, user group profiles and document templates.

Scaling

• Independence of resources: The standard Core-Vet Cloud Software is offered as a multi-tenanted server environment within Microsoft Azure. Separation between customers is ensured with completely individual databases dedicated to the customer along with dedicated credentials. Demand on the service is carefully monitored with additional multi-tenanted environments created to guarantee users are not affected by other usage.; ; If a multi-tenanted environment is not acceptable, then we can provide a completely dedicated/separate environment for customers, although this is not part of our standard offering.

Analytics

• Service usage metrics: Yes
• Metrics types: WPC can provide service metrics upon request. Users are able to review their own metrics around user licensing and user access through the system itself. WPC can provide further metrics such as capacity and system availability statistics upon request.
• Reporting types: Reports on request

Resellers

• Supplier type: Not a reseller

Staff security

• Staff security clearance: Conforms to BS7858:2019
• Government security clearance: Up to Security Clearance (SC)

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations: United Kingdom
• User control over data storage and processing locations: No
• Datacentre security standards: Managed by a third party
• Penetration testing frequency: At least every 6 months
• Penetration testing approach: In-house
• Protecting data at rest:
  • Physical access control, complying with another standard
  • Encryption of all physical media
  • Other
• Other data at rest protection approach: In addition to the physical access control security as offered by our datacentre partner, Microsoft Azure, all WPC cloud deployed applications utilise Transparent Database Encryption as standard.
• Data sanitisation process: Yes
• Data sanitisation type: Deleted data can’t be directly accessed
• Equipment disposal approach: A third-party destruction service

Data importing and exporting

• Data export approach: Data can be exported from the application in a variety of formats depending on user access and privileges. Data can be exported via document templates (MS Word) or via an export to CSV. This can be done via searches and reports within the system or from individual areas of the system.
• Data export formats: CSV
• Data import formats: CSV

Data-in-transit protection

• Data protection between buyer and supplier networks: TLS (version 1.2 or above)
• Data protection within supplier network:
  • TLS (version 1.2 or above)
  • IPsec or TLS VPN gateway

Availability and resilience

• Guaranteed availability: Core-Vet as cloud software is delivered through the Microsoft Azure platform. Through our standard service we offer a service level of 99.95% availability. Availability indication is based on an average 730 hours per month. This excludes planned & emergency maintenance. Unavailability applies to solutions where the system becomes unresponsive due to a fault which is under the control of WPC or partners Microsoft Azure, which has not been notified to the customer in advance.
• Approach to resilience: WPC Software utilise Microsoft Azure as our data centre partner, and definitions on the data centre resiliency is available through our cloud security principles and their website. WPC can provide more details on this upon request.; ; In addition, to the data centre assurance information on resiliency, a range of back-up and restore facilities can be offered. As standard, our service includes transaction log backups every 5 to 10 minutes, with all back-ups retained for a seven-day period. All data is stored in georedundant storage blobs with replication only in UK data centres. This allows for a point in time restore of an existing database and the ability to restore the database to the other datacentre. This enables WPC to offer an RPO of “up to” 60 minutes with an RTO of one working day.
• Outage reporting: Outage reporting is provided to WPC through an online dashboard and email alerts. This is managed by WPC Software as part of the service offering, with any interruption to the software service notified to customers at the earliest available opportunity by email.

Identity and authentication

• User authentication needed: Yes
• User authentication:
  • 2-factor authentication
  • Username or password
• Access restrictions in management interfaces and support channels: Access to the solution is limited to named members of staff who are all vetted to NPPV Level 3, and have restricted access for maintenance of the system.; ; Access to support the infrastructure which the service runs on is restricted to WPC’s own network, accredited to Cyber Essentials Plus and managed in line with ISO27001 standards. Through Azure RBAC, only authorised, trained, competent and relevant members of staff are given access on a case by-case basis. In effect, this means that access to the cloud environment rests solely with named individuals ; within the infrastructure team headed by the Technical Director.
• Access restriction testing frequency: At least once a year
• Management access authentication:
  • 2-factor authentication
  • Dedicated link (for example VPN)
  • Username or password

Audit information for users

• Access to user activity audit information: Users have access to real-time audit information
• How long user audit data is stored for: At least 12 months
• Access to supplier activity audit information: Users contact the support team to get audit information
• How long supplier audit data is stored for: At least 12 months
• How long system logs are stored for: At least 12 months

Standards and certifications

• ISO/IEC 27001 certification: Yes
• Who accredited the ISO/IEC 27001: BSI
• ISO/IEC 27001 accreditation date: 24/07/2019
• What the ISO/IEC 27001 doesn’t cover: N/A - all WPC cloud services are covered by our IS027001 certification. Re-certification processes took place in April 2022, with recommendation for formal recertification from July 2022.
• ISO 28000:2007 certification: No
• CSA STAR certification: No
• PCI certification: No
• Cyber essentials: Yes
• Cyber essentials plus: Yes
• Other security certifications: Yes
• Any other security certifications: ISO9001:2015

Security governance

• Named board-level person responsible for service security: Yes
• Security governance certified: Yes
• Security governance standards: ISO/IEC 27001
• Information security policies and processes: WPC Software has a comprehensive Information Security Manual, which it is very difficult to summarise within the word limit. It is accredited to ISO27001. Microsoft Azure were carefully selected as our hosting partner due to their comprehensive policies detailing information security in line with ISO27001. A copy of our Information Security Policy can be made available upon request.

Operational security

• Configuration and change management standard: Supplier-defined controls
• Configuration and change management approach: Reviews and updates of configuration settings and baseline configurations of hardware, software, and network devices are performed at least annually. Changes are developed, tested, and approved prior to entering the production environment from a development and/or test environment. The baseline configurations that are required for Azure-based services are reviewed by the Azure security and compliance team and by service teams. A service team review is part of the testing that occurs before the deployment of their production service.
• Vulnerability management type: Supplier-defined controls
• Vulnerability management approach: As outlined through our Cyber Essentials Plus accreditation, WPC rapidly patches vulnerabilities in line with industry best-practice. All technical components used as part of the proposed service, or in the support of that service, are regularly patched and updated as soon as patches are made available. All applications are regularly tested for security flaws and subject to regular penetration tests. On WPC’s cloud environment, we deploy both Qualys and Microsoft-Defender-for-Cloud, to provide real-time security alerts/monitoring. Azure uses integrated deployment systems to manage the distribution and installation of security updates for Microsoft software.
• Protective monitoring type: Supplier-defined controls
• Protective monitoring approach: On WPC’s cloud environment, we deploy both Qualys and Microsoft Defender for Cloud, to provide real-time security alerts and monitoring. ; ; Microsoft has a global, 24x7 incident response service that works to ; mitigate the effects of attacks and malicious activity. The incident response team follows established procedures for incident management, communication, and recovery, and uses discoverable and predictable interfaces with internal and external partners alike. ; ; Azure security has defined requirements for active monitoring. Service teams configure active monitoring tools in accordance with these requirements. Active monitoring tools include the Microsoft Monitoring Agent (MMA) and System Centre Operations Manager.
• Incident management type: Supplier-defined controls
• Incident management approach: WPC Software and Microsoft Azure have formal policies and procedures for incident management activities, including specific activities for identifying, remediating and resolving security incidents.; ; All incidents should be reported by a customer to WPC, who will work with Microsoft Azure through their Incident Management Policy. WPC's documentation provide clear definitions of an incident. Any such reports received are logged through our comprehensive incident recording system and immediately forwarded to the relevant team for analysis and determination of an appropriate course of action. Customers are kept informed via email and telephone as described within our policy documentation and procedures.

Secure development

• Approach to secure software development best practice: Supplier-defined process

Public sector networks

• Connection to public sector networks: No

Social Value

• Social Value:

  Social Value

  • Fighting climate change
  • Covid-19 recovery
  • Tackling economic inequality
  • Equal opportunity
  • Wellbeing

  Fighting climate change

  WPC Software has a number of initiatives that look to fight climate change, improve the environment, and reduce waste. One of the main areas includes reducing emissions. This is done in a number of ways including offering flexible working practises, allowing staff to work from home, reducing travel and emissions on commuting. This has reduced staff emissions by 78%. Another way WPC has reduced emissions is through the use of more economical and environmentally friendly company cars, such as electric and plug in hybrid cars. WPC has also joined the cycle to work scheme to encourage staff to travel by bicycle, reducing emissions. Another way WPC is helping the environment is by reducing waste. This is done by digitising internal processes (such as HR processes) which has allowed us reduced the need for paper, printing, and other waste. We also reduced waste and maximised value by using resources more efficiently. We recycle all appropriate office waste and old tech/hardware where possible as well as refurbish our applicable tech and hardware and donate it to worthy causes where possible. WPC also promotes the ethical and sustainable procurement of resources.

  Covid-19 recovery

  WPC has a number of initiatives that help in the COVID-19 recovery initiative. One of the main areas includes paying our fair share. This includes paying our fair share in tax and offering competitive salaries. WPC also looks to hire local people, with most new starters coming from the Bath/Bristol Area. We also offer paid work placement programmes to students and do not outsource any development or work processes overseas. Another way in which we help with COVID-19 recovery is by only procuring goods and services from local suppliers wherever possible and using local traders and SMEs as a core part of our supply chain. WPC also offer a strong graduate programme which includes over 4 months of paid training and personal development. All graduates are then offered full time employment on successful completion. We also create employment opportunities within the communities we work and have increased our staff size by 20% during pandemic.

  Tackling economic inequality

  WPC has a number of initiatives that help tackle economic inequality. One of the main areas includes paying our fair share. This includes paying our fair share in tax and offering competitive salaries. WPC also looks to hire local people, with most new starters coming from the Bath/Bristol Area. We also offer paid work placement programmes to students and do not outsource any development or work processes overseas. Another way in which we help to tackle economic inequality is by only procuring goods and services from local suppliers wherever possible and using local traders and SMEs as a core part of our supply chain. WPC also offer a strong graduate programme which includes over 4 months of paid training and personal development. All graduates are then offered full time employment on successful completion.

  Equal opportunity

  WPC Software is committed to providing equal opportunities and a great work environment. WPC is an equal opportunity company, ensuring recruitment encourages diverse workforces from a range of backgrounds. WPC does not outsource work overseas, only hiring locally based on skills and ability. We also offer fully remote jobs to allow any person of disability to work in their preferred environment. We offer a structed pay scale, ensuring equal opportunity and pay.

  Wellbeing

  WPC Software is committed to providing a great work environment and to continue invest in our staff. WPC is recognised as an Investor In People, a national framework that helps companies achieve success through their employees. One of the main areas we invest in our staff is training and progression within the company. WPC predominantly hire graduates and enrol them into our graduate training programme. This programme includes an initial training and personal development period of 4 months. All graduates are then offered full time employment on successful completion. WPC also provides continual training and ongoing development for all staff members. Staff are encouraged to participate Microsoft development exams as well as other job specific training programmes. WPC tries wherever possible to promote from within the business, with 92% of middle and senior management being promoted from within the company. In addition to development and training, WPC invest heavily in staff wellbeing. This includes paying above the real living wage for all employees and does not offer any zero hours’ contracts. WPC also offer flexible working, allowing staff to work from home with flexible start/end times. WPC offer various free outings and socials for the staff. In addition to staff wages, WPC also offer a bonus scheme to all staff members which provides fair reward for effort and success. WPC also promotes staff health with various initiatives including access to private health insurance, routine health checks for staff members, free access to sports, such as Football and Badminton, cycle to work scheme.

Pricing

• Price: £850 a unit a month
• Discount for educational organisations: No
• Free trial available: No

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at g.bewes@wpcsoft.com. Tell them what format you need. It will help if you say what assistive technology you use.