Pi Ltd

Price Benchmarking

Without the transparency of sharing market knowledge within different sectors, organisations will not know how they are performing against their sector peers. PI is at the forefront of providing benchmarking solutions and has extensive experience helping a range of organisations benchmark delivering quick-win savings.

Features

• Ability to view price movements over time
• Round robin, ad hoc information sought anonymously
• Ability to measure the value of price improvement opportunities
• Ability to assess the impact of spec changes on cost

Benefits

• Greater understanding of how your supplier prices compare with others
• Identification of improvement opportunities
• Optimisation of the sourcing process, ensuring best deals are achieved
• Deal performance a and monitoring
• Networking opportunities with similar buying organisations

£750 to £22,000 a unit a year

Service documents

• Pricing document

  PDF

• Skills Framework for the Information Age rate card

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at info@predictx.com. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 14

Service ID

401322592216274

Contact

Keesup Choe
+44 (0)808 204 0344
info@predictx.com

Service scope

• Software add-on or extension: No
• Cloud deployment model:
  • Private cloud
  • Hybrid cloud
• Service constraints: None
• System requirements: We deliver Software-as-service so clients only need a browser

User support

• Email or online ticketing support: Email or online ticketing
• Support response times: We have the ability to use E-mails, we use sales force to support the system. Users can manage status and priority of support tickets.
• User can manage status and priority of support tickets: Yes
• Online ticketing support accessibility: WCAG 2.1 AA or EN 301 549
• Phone support: Yes
• Phone support availability: 9 to 5 (UK time), Monday to Friday
• Web chat support: No
• Onsite support: Yes, at extra cost
• Support levels: We provide 3 levels: ; 1) Help desk support via online or phone; 2) Part-time analyst support to assist clients with functions periodically; 3) Full-time dedicated analyst support to assist clients with functions periodically
• Support available to third parties: No

Onboarding and offboarding

• Getting started: We provide a range of training services including onsite, online dedicated sessions, and open regular client webinars.; ; We typically do initial training as part of our implementation program with a client.
• Service documentation: Yes
• Documentation formats: PDF
• End-of-contract data extraction: They can download their files.
• End-of-contract process: At the end of a contract we typically have a renewal and expansion of services. If a customer is leaving then we help them extract their data. ; ; What is included in the price is access to the analytics software and any services to enable it.

Using the service

• Web browser interface: Yes
• Supported browsers:
  • Internet Explorer 11
  • Microsoft Edge
  • Firefox
  • Chrome
  • Safari
• Application to install: No
• Designed for use on mobile devices: Yes
• Differences between the mobile and desktop service: None
• Service interface: No
• User support accessibility: None or don’t know
• API: Yes
• What users can and can't do using the API: Can be made available on request
• API documentation: Yes
• API documentation formats: Other
• API sandbox or test environment: Yes
• Customisation available: Yes
• Description of customisation: Buyers can, with training, create their own reports to visualise data.

Scaling

• Independence of resources: We have independent multi-tenant data base structure that enables us to scale easily and without risk of impact across customers.

Analytics

• Service usage metrics: Yes
• Metrics types: Our metrics focus mainly on user counts and activity to share with our customers how much they are using the service.
• Reporting types: Regular reports

Resellers

• Supplier type: Not a reseller

Staff security

• Staff security clearance: Other security clearance
• Government security clearance: Up to Baseline Personnel Security Standard (BPSS)

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations: United Kingdom
• User control over data storage and processing locations: No
• Datacentre security standards: Complies with a recognised standard (for example CSA CCM version 3.0)
• Penetration testing frequency: At least once a year
• Penetration testing approach: Another external penetration testing organisation
• Protecting data at rest:
  • Physical access control, complying with SSAE-16 / ISAE 3402
  • Physical access control, complying with another standard
  • Encryption of all physical media
• Data sanitisation process: No
• Equipment disposal approach: A third-party destruction service

Data importing and exporting

• Data export approach: Download to CSV
• Data export formats: CSV
• Data import formats: CSV

Data-in-transit protection

• Data protection between buyer and supplier networks:
  • Private network or public sector network
  • TLS (version 1.2 or above)
• Data protection within supplier network: TLS (version 1.2 or above)

Availability and resilience

• Guaranteed availability: SLA agreements with 97% uptime. The DR is completely developed, managed, and executed by Pi. In terms of RTO, this is virtually instantaneous, thus the RPO concerns are not applicable as the user will not be aware that DR has been invoked and the service has shifted to the DR location. As described above Pi has build a dynamic DR environment that automatically and virtually instantly shifts service provision to DR if service at the primary facility is disrupted. Users are refunded based on the agreement outlined in the individual contracts
• Approach to resilience: In the event of failures any one of the website stacks can operate independently providing the full service with the current state of all data. Cluster replication ensures that all servers are kept up to date so all servers have current data and documents. Clients will usually be configured with two servers at the primary site, Equinix LD5 datacentre. These will provide the service under normal operation. In addition we will run a single server at Equinix LD3 datacentre to act as a live offsite standby. Any one of these servers is capable of providing the full service. All servers are kept fully up to date via the clustering capabilities of Galera and Gluster. Access to the primary servers is via our main load balancer in LD5. This load balancer will normally direct traffic at the primary servers in LD5. If none of these servers are available then traffic will be directed to the offsite standby in LD3. An alternate web address will be allocated on the standby load balancer in LD3 to provide access to the same backend servers in the unlikely event of loss of communication to LD5.
• Outage reporting: Resilience is configured on all Pi equipment - dual Internet connections, Dual Cisco F/W, dual core S/W, dual network S/W dual load balancers, dual servers, in the event of any outage or unavailabity of services the users are informed by email alerts and web based dashboards

Identity and authentication

• User authentication needed: Yes
• User authentication: 2-factor authentication
• Access restrictions in management interfaces and support channels: Access rights & Access control policy enforced - Access rights for PI staff members are controlled by the systems support team. Final authority lies with the Head of IT. Access to technical resources such as drive shares, e-mail etc. is also controlled by the systems support team. PI staff members do not have administrative rights on their machines to install unauthorised software. Access to various areas of the PI software suite is allocated by a role based access mechanism.
• Access restriction testing frequency: At least every 6 months
• Management access authentication:
  • 2-factor authentication
  • Public key authentication (including by TLS client certificate)
  • Identity federation with existing provider (for example Google Apps)
  • Dedicated link (for example VPN)
  • Username or password

Audit information for users

• Access to user activity audit information: Users contact the support team to get audit information
• How long user audit data is stored for: At least 12 months
• Access to supplier activity audit information: Users receive audit information on a regular basis
• How long supplier audit data is stored for: User-defined
• How long system logs are stored for: At least 12 months

Standards and certifications

• ISO/IEC 27001 certification: Yes
• Who accredited the ISO/IEC 27001: BSI
• ISO/IEC 27001 accreditation date: 24/07/2020
• What the ISO/IEC 27001 doesn’t cover: .
• ISO 28000:2007 certification: No
• CSA STAR certification: No
• PCI certification: No
• Cyber essentials: Yes
• Cyber essentials plus: No
• Other security certifications: Yes
• Any other security certifications:
  • PCI/DSS compliance
  • QMS ISO27001:2013

Security governance

• Named board-level person responsible for service security: Yes
• Security governance certified: Yes
• Security governance standards: ISO/IEC 27001
• Information security policies and processes: ISO 27001/27002/31000 (ISMS), DPA, recent implementation ongoing with Cyber Essentials and EU GDPR.; ; Information Governance Security Policy - this is the documented information that is shared across the organisation that covers the security requirements and the procedures.; ; Confidentiality disclosure agreement, ; ISO 27001:2013 Certification, ; EU GDPR & Data Protection Registration, ; NHS Information Governance Toolkit, ; HR Procedure for PI staff, ; Staff Clearance, ; IT Policy and Procedure, ; Patient/Customer level Datasets, ; Client Data, ; Network & Servers Security plus Monitoring, ; Secure configuration & Removable Media control, ; Data Security , ; Data Disposal, Backup and Business Continuity, ; Server Hosting at Equinix Data Centre, ; User Access Rights, ; Malware prevention, ; User education and awareness, ; Incident management, ; Patch management, ; Home & Mobile working, ; Enforced Policies, ; Care and HealthTrak, ; ; Pi carried out internal IT Awareness training programme on quarterly or on ad hoc basis to ensure employees are competence in their role and security aware and adhere to company policies and GPG. (Good practice guidelines)

Operational security

• Configuration and change management standard: Supplier-defined controls
• Configuration and change management approach: Change control policy enforced that defines and outlines the change management process where Information technology systems are subject to formal change control procedures. Such procedures provide a managed and orderly method by which changes are requested, tested, approved, communicated prior to implementation and logged and assessed for security impacts with defined change control process.
• Vulnerability management type: Supplier-defined controls
• Vulnerability management approach: Network / Application vulnerabilities by Third party PEN Testers & QualysGuard, Vulnerabilities detection through service monitoring & Nagios Monitoring. Linux servers are protected by Selinux security patch updates and Fail2ban process running in realtime. Additionally the server internal firewalls are configured for required services - network, protocols and ports. Information on threats through security information web sites and by proprietary vendors
• Protective monitoring type: Supplier-defined controls
• Protective monitoring approach: This is automated within Nagios - Nagios monitoring tool has a plugin for Cisco, Servers, Networks and Applications for realtime monitoring of any changes and is configured to send out alerts/warnings. Any failing services are detected and are picked up instantaneously Additionally, Cisco Firewall, Systems, Application logs are centralized on the log server for any forensic processes and requirements
• Incident management type: Supplier-defined controls
• Incident management approach: Change control policy is enforced and is managed through Jira, an internal web base DB application. Information technology systems are subject to formal change control procedures. Such procedures provide a managed and orderly method by which changes are requested, tested, approved, communicated prior to implementation and logged. All Incidents are recorded in a central document that is web based for data gathering that provides incident reports

Secure development

• Approach to secure software development best practice: Independent review of processes (for example CESG CPA Build Standard, ISO/IEC 27034, ISO/IEC 27001 or CSA CCM v3.0)

Public sector networks

• Connection to public sector networks: Yes
• Connected networks: Public Services Network (PSN)

Social Value

• Social Value:

  Social Value

  Tackling economic inequality

  Tackling economic inequality

  Data integration and Pricing benchmarking can help in tackling economic inequality by providing access to information that can drive better decision-making and resource allocation. It can enable businesses, governments, and non-profits to identify and address economic disparities, create targeted programs, and measure the impact of their initiatives.

Pricing

• Price: £750 to £22,000 a unit a year
• Discount for educational organisations: No
• Free trial available: No

Service documents

• Pricing document

  PDF

• Skills Framework for the Information Age rate card

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at info@predictx.com. Tell them what format you need. It will help if you say what assistive technology you use.