LEARNPRO EFIRESERVICE LIMITED

Assurance Monitoring System (AMS )

AMS is a cloud-hosted organisational learning and operational assurance platform for Fire & Rescue and similar services. It centralises debriefs, learning outcomes and actions, providing dashboards, audit trails and reporting to support continuous improvement, accountability and HMICFRS inspection readiness.

Features

• Central platform for incident debriefs and organisational learning records
• End-to-end task allocation, tracking and completion workflows
• Configurable sources, themes, departments and categories to match service
• Dashboards and reports for trends, themes and open actions
• Secure browser-based access; no local server installation required
• REST API for data export and integration with other systems
• Daily automated backups with quick restoration and short retention
• Role-based access control and multi-factor authentication for all users
• Hosted on AWS UK data centres (eu-west-2, London)
• Online knowledgebase and email/ticket support with defined SLAs

Benefits

• Replace spreadsheets and ad-hoc tools with one auditable system
• Demonstrate clear learning loop and HMICFRS readiness with evidence
• Improve accountability by assigning, monitoring and closing actions transparently
• Provide leadership with real-time oversight of risks and learning themes
• Reduce administrative burden of collating debriefs and action tracking reports
• Support culture of continuous learning across stations, departments and functions
• Protect sensitive data using industry-standard encryption and AWS controls
• Minimise downtime with resilient, multi-AZ AWS architecture and backups
• Integrate with HR and BI systems for richer insights
• Enable remote, browser-based access for distributed and on-call teams

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at jadep@learnprogroup.com. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 15

Service ID

413666176968361

Contact

Jade Pullan
07474377366
jadep@learnprogroup.com

About the service

• Service categories:
  • Applications
    • Enterprise resource management
      • Enterprise performance management
        • Enterprise performance management
• Multi cloud support: No

Service scope

• Software add-on or extension: No
• Cloud deployment model: Public cloud
• Service constraints: AMS is delivered as a multi-tenant SaaS service hosted in AWS UK (eu-west-2). Planned maintenance is normally performed outside core UK business hours and, where disruptive, is notified in advance via the support portal. The service depends on customers providing reliable internet connectivity and a modern, supported web browser. Significant configuration changes (for example new forms or taxonomies) may require coordination with LearnPro to ensure reporting remains consistent. No customer-managed server components are supported.
• System requirements:
  • Modern HTML5-compliant web browser (Edge, Chrome, Firefox, Safari)
  • Reliable internet connection to reach AWS UK region
  • JavaScript and cookies enabled in the browser
  • Email access for account invitations and notifications
  • Screen resolution suitable for web applications (e.g. 1366x768+)

User support

• Email or online ticketing support: Yes
• Support response times: Support is provided via our helpdesk and email ticketing portal. Customers can submit, track and update tickets online, including setting priority and viewing status. PHA support operates during UK business hours with SLAs for first response and resolution; details are published on our support portal. Response times may be slower outside working hours and on UK public holidays.
• User can manage status and priority of support tickets: Yes
• Online ticketing support accessibility: WCAG 2.2 AA
• Phone support: No
• Web chat support: No
• Onsite support: No
• Support levels: Email support via the help desk.; ; We provide a standard support service for all PHA customers via our online helpdesk. Users can raise incidents, service requests and questions, which are triaged and handled by the product and operations team. Support is available during UK business hours, with published SLAs for initial response and resolution by priority, documented on the LearnPro support portal. ; ; PHA licensing is typically all-inclusive, so there are no per-user support charges. Enhanced support (for example, additional consultancy, on-site workshops or out-of-hours cover) can be scoped and priced separately if required. A named contact in our team provides continuity for onboarding, configuration and roadmap discussions; for most customers this acts as a virtual technical account manager.
• Support available to third parties: Yes

Onboarding and offboarding

• Getting started: We provide online training via teams and also provide resources via our knowledge base. We provide a structured onboarding process for AMS. Following contract signature, we schedule a kick-off meeting to confirm objectives, scope and timelines. Configuration workshops are held (typically via Microsoft Teams) to agree departments, sources, themes and key workflows, and then AMS is configured accordingly. ; ; Named administrators receive training on user management, configuration and reporting, followed by end-user training sessions for debrief leads and managers. Training is delivered online and supported by our knowledgebase and support portal, which provide step-by-step guides, FAQs and release notes. Further refresher training can be arranged as needed, and early adopter customers are invited to input into the roadmap and feature design.
• Service documentation: Yes
• Documentation formats: HTML
• Documentation accessibility standard: WCAG 2.2 AA
• End-of-contract data extraction: Via API if required. Or we can provide CSV. At the end of the contract, customers can extract their data directly via the AMS API or, on request, receive a structured export (typically CSV files) covering relevant datasets such as debriefs, actions and reference data. ; ; We will work with the customer to agree scope and format so that the data can be imported into successor systems or archives. Standard API and CSV exports are included in the service price; any bespoke formats or complex transformation work can be scoped separately if required.
• End-of-contract process: On expiry or termination, user access to AMS is disabled following completion of any agreed data extraction. As part of off-boarding, we confirm the timing of deactivation, data exports and any required transition support. Standard API and CSV exports are included; additional consultancy (for example, data mapping to a new solution) may be charged separately. ; ; After data has been returned or exported, we remove or anonymise Customer Data in accordance with its data retention and disposal processes and any statutory requirements, using AWS mechanisms and best practice for data deletion. No further processing is performed after the contract ends.

Using the service

• Web browser interface: Yes
• Supported browsers:
  • Microsoft Edge
  • Firefox
  • Chrome
  • Safari
  • Other
• Application to install: No
• Designed for use on mobile devices: No
• Service interface: Yes
• Description of service interface: AMS is delivered as a web-based user interface with secure login. Users access dashboards, lists and forms for debriefs, learning records, actions and reports. Navigation is organised by modules (for example debriefs, actions, reports, configuration) with search and filtering tools. Role-based permissions control what each user can see and do, such as creating debriefs, assigning actions or running exports. The interface follows common web application patterns (forms, tables, buttons, headings) and is compatible with modern browsers on desktop and mobile.
• Accessibility standards: WCAG 2.2 AA
• Accessibility testing: Formal WCAG conformance testing with users of assistive technologies has not yet been completed. However, AMS benefits from browser-level accessibility features such as zoom, high-contrast modes and screen-reader support where provided by the user’s operating system and browser. Accessibility improvements are made iteratively as part of the product roadmap and can be prioritised in collaboration with customers where specific needs are identified.
• User support accessibility: WCAG 2.2 AA
• API: Yes
• What users can and can't do using the API: AMS provides a RESTful API secured over TLS 1.2+ with bearer-token authentication. Customers can use the API to read and, where authorised, write data such as debrief records, actions and reference data. Typical uses include exporting data into BI tools and integrating with HR or incident systems. ; ; Administrative configuration (for example feature flags and system-wide settings) is normally managed within the AMS UI rather than directly through the API to maintain consistency and auditability. ; ; API documentation is provided (HTML and/or PDF) and can be shared with technical teams. A sandbox or test environment is available to support development and integration testing before changes are applied to production.
• API documentation: Yes
• API documentation formats:
  • HTML
  • PDF
• API sandbox or test environment: Yes
• Customisation available: Yes
• Description of customisation: AMS is configurable so that it reflects each service’s structure and terminology. Authorised administrators can configure departments, sources, themes and other taxonomies used to categorise debriefs and learning. They can also manage user roles and permissions, and in some cases tailor forms and workflows to local processes, working with LearnPro where deeper changes are required. ; ; Configuration is performed through the AMS administration screens, with support from our team during onboarding and as requirements evolve. This approach allows services to align AMS with their own organisational learning framework without needing to maintain their own infrastructure or perform code-level changes.

Scaling

• Independence of resources: Our service runs on AWS serverless infrastructure (Lambda, API Gateway, DynamoDB/RDS). Serverless automatically isolates workloads and scales capacity, so one customer’s demand cannot reduce performance for others. AWS provides automatic scaling, strong tenant isolation and provisioned/autoscaling data capacity. We add rate-limiting, monitoring and alerts to prevent any single user or organisation from overloading the system. This ensures consistent performance for all users.

Analytics

• Service usage metrics: Yes
• Metrics types: AMS provides reporting on organisational learning activity, including counts of debriefs, actions raised and closed, themes, sources and timelines. Dashboards and exports can be used to understand workload, completion rates and trends over time. Environment-level usage metrics (for example, high-level performance and availability) are monitored by LearnPro and summary information can be shared on request.
• Reporting types:
  • Real-time dashboards
  • Regular reports
  • Reports on request
• Resource tagging: Yes
• FOCUS resource tagging: No

Supplier type

• Supplier type: Not a reseller

Staff security

• Staff security clearance: Other security clearance
• Government security clearance: Baseline Personnel Security Standard (BPSS)

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations: United Kingdom
• User control over data storage and processing locations: No
• Datacentre security standards: Complies with a recognised standard (for example CSA CCM version 4.0)
• Penetration testing frequency: At least once a year
• Penetration testing approach: Another external penetration testing organisation
• Protecting data at rest:
  • Encryption of all physical media
  • Other
• Other data at rest protection approach: Plus strong physical controls via AWS as per their certifications; AMS encrypts databases and disks with AES-256.
• Data sanitisation process: Yes
• Data sanitisation type: Deleted data can’t be directly accessed / Cryptographic Erasure
• Equipment disposal approach: A third-party destruction service

Data importing and exporting

• Data export approach: Via API
• Data export formats: Other
• Other data export formats: API
• Data import formats: Other
• Other data import formats: API

Data-in-transit protection

• Data protection between buyer and supplier networks: TLS (version 1.2 or above)
• Data protection within supplier network: TLS (version 1.2 or above)

Availability and resilience

• Guaranteed availability: AMS is designed as a highly available SaaS service hosted on AWS UK (eu-west-2). Components are deployed across multiple Availability Zones to protect against localised failures, and AWS provides resilient power, cooling and connectivity. We target at least 99% monthly availability for the AMS web application, excluding scheduled maintenance windows which are planned outside core business hours wherever possible. Availability is monitored using automated checks and AWS CloudWatch alerts. If AMS availability falls below agreed levels, we will investigate the root cause and may, by agreement, provide service credits on a case-by-case basis as set out in the customer’s contract or SLA.
• Approach to resilience: AMS follows a cloud-native resilience approach based on AWS best practice. The application and database tiers are deployed across multiple Availability Zones within the UK region, so that if one zone becomes unavailable the service can continue running in others. AWS managed services and auto-scaling features are used where appropriate to absorb variations in load. Daily automated backups, including transaction logs, allow rapid restoration of the database in the event of data corruption or accidental deletion, typically within minutes. Backups are retained for a short, defined period only, in line with data protection principles. Monitoring and alerting detect performance or availability issues so that our team can intervene quickly. This overall design aligns with the NCSC cloud security principle on asset protection and resilience and is documented further in our Cloud Service Security and Resilience paper.
• Outage reporting: Email alerts. If a significant outage occurs, we will communicate with named customer contacts via email, providing details of the impact, likely cause and expected resolution timescales. Updates are issued as more information becomes available and following restoration, a short summary of cause and corrective actions can be supplied on request. ; ; For some customers, outage and maintenance information can also be shared via the support portal or change notifications. There is currently no public dashboard or API for availability events; communication is via direct customer channels.

Identity and authentication

• User authentication needed: Yes
• User authentication:
  • Multi-Factor Authentication (MFA)
  • Username or password
  • Other
• Other user authentication: SSO / SAML can be supported where available; base stack is username/password plus OTP and account lockout
• Access restrictions in management interfaces and support channels: Management access to AWS and AMS administration interfaces is restricted to a small number of authorised staff, using least-privilege role-based access, MFA and unique accounts. Support tools (for example, ticketing, monitoring dashboards) are also role-based, so only specific team members can view or change customer configurations. ; ; Customer support channels never request user passwords, and any temporary access (for example, screen-sharing) is time-limited and under customer control.
• Access restriction testing frequency: At least once a year
• Management access authentication:
  • Multi-Factor Authentication (MFA)
  • Other
• Description of management access authentication: Backed by role-based permissions and AWS/Azure-style admin controls

Audit information for users

• Access to user activity audit information: Users contact the support team to get audit information
• How long user audit data is stored for: At least 12 months
• Access to supplier activity audit information: Users contact the support team to get audit information
• How long supplier audit data is stored for: At least 12 months
• How long system logs are stored for: At least 12 months

Security governance

• Named board-level person responsible for service security: Yes
• Software Security Code of Practice: Yes
• Security governance certified: Yes
• Security governance standards: ISO/IEC 27001
• Information security policies and processes: We maintain information security policies covering areas such as access control, acceptable use, incident management, data protection, secure development, supplier management and business continuity. Policies are approved by senior management and reviewed regularly. Staff receive induction training and periodic refreshers, and access to systems is granted on a least-privilege basis, aligned to job role. ; ; Security responsibilities are incorporated into employment documents and the employee handbook. Incidents and potential vulnerabilities are logged and reviewed; corrective actions are tracked to completion. External partners provide penetration testing and security consultancy, and we use NCSC tools and AWS security services to support monitoring and compliance. Customers can request further details of our policies under NDA where necessary.

Operational security

• Configuration and change management standard: Supplier-defined controls
• Configuration and change management approach: We maintain infrastructure and application configuration in version-controlled repositories, with changes progressing through development, staging and pre-production environments before release to production. Each change is reviewed for security and operational impact and approved by a product owner or senior developer. ; ; AWS configuration follows best practice (for example, least-privilege IAM roles, security groups, encryption settings) and is periodically reviewed. Release notes are produced for material changes, and configuration baselines are documented to support troubleshooting and rollback if required.
• Vulnerability management type: Supplier-defined controls
• Vulnerability management approach: We use a combination of automated vulnerability scanning, external security consultancy and vendor advisories to identify potential threats. Monthly scans are performed across the stack, with additional scans following significant changes. ; ; Critical issues are prioritised for remediation as quickly as practicable; lower-severity items are addressed in planned maintenance windows. We monitor security bulletins from AWS, framework vendors and the wider industry to ensure our patching schedule reflects emerging risks.
• Protective monitoring type: Supplier-defined controls
• Protective monitoring approach: We collect logs from application components and AWS services (for example, CloudWatch, load balancers, databases) and monitor for unusual patterns such as repeated failed logins or abnormal traffic. Alerts are configured for key events and thresholds so the team can respond quickly. ; ; On identification of a potential compromise, access can be restricted or suspended while investigation occurs. Incident response processes guide containment, eradication and recovery, with lessons captured for future improvements.
• Incident management type: Supplier-defined controls
• Post-quantum cryptography secure: No
• Incident management approach: We maintain defined processes for common security and service incidents, including suspected data breaches, availability issues and performance degradation. Incidents can be reported by customers via the helpdesk or directly to named contacts. On receipt, we assess impact, prioritise response and allocate an incident owner. Actions focus on containment, investigation and recovery, with communication to affected customers where appropriate. Incident reports can be provided on request, summarising cause, impact and corrective actions. Lessons learned feed into improvements to controls, monitoring and training.

Secure development

• Approach to secure software development best practice: Supplier-defined process

Public sector networks

• Connection to public sector networks: No

Pricing

• Discount for educational organisations: No
• Free trial available: No

Discount percentage by annual call-off contract value (excluding VAT)

• Less than £250,000: 0%
• Between £250,000 and £500,000: 0%
• Between £500,001 and £1,000,000: 0%
• Between £1,000,001 and £2,500,000: 0%
• Between £2,500,001 and £5,000,000: 0%
• Over £5,000,001: 0%

Standards and certifications

• ISO/IEC 27001 certification: Yes
• ISO/IEC 27001 accredited by: QMS International
• ISO/IEC 27001 accreditation date: Wednesday 1 November 2023
• What the ISO/IEC 27001 doesn’t cover: All security controls that are relevant for our software are included in the scope of the certification.
• ISO 28000:2022 certification: No
• ISO 9001 certification: No
• Quality management systems (QMS): Yes
• CSA STAR certification: No
• PCI certification: No
• Cyber essentials: No
• Cyber Essentials Alternative: In relation to the services you do not have a current and valid Cyber Essentials certificate which has been awarded by one of the government approved Cyber Essentials accreditation bodies but you are working towards gaining it, and will be in a position to confirm that you have been awarded a current and valid Cyber Essentials certificate by one of the government approved accreditation bodies within 12 months of the date of award.
• Cyber essentials plus: No
• Cyber Essentials Alternative: You do not have a current and valid Cyber Essentials Plus certificate, or will not have in place within 12 months of the date of award but have an IASME certified equivalent.
• Other security certifications: Yes
• Any other security certifications:
  • Hosting Partner (Strategies Limited) has ISO27001 certification
  • Datum UK (data centre used by Strategies) has ISO/EC27001 certification

Social value

• Mission: Kick start economic growth:

  To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

  Policy Outcome 1: Fair work: That offers fair wages and good working conditions. Help people get a job, stay in work, and progress in their careers, with good employment opportunities across the country. Notes: Where there is a large proportion of labour costs in the contract, commercial teams should consider MAC in Outcome 1 as a priority

  • New or retained jobs on the contract workforce in the relevant area that meet the criteria set out in MAC 1b, 1c and 1d
  • Providing opportunities for, and measuring and monitoring of, staff workforce conditions over time, including employee engagement, involvement in decision-making and satisfaction and adapting to any changes in the results, with clear processes for acting on issues identified
  • Plans to engage the contract workforce in deciding the most important workplace issues to address
  • Ensuring new workers are informed of their right to join a trade union
  • Monitoring of employee engagement rates (by protected characteristic) and, where necessary, the development of actions to ensure all voices are heard across the diversity of the workforce
  • Employment contracts that reflect actual hours worked; steps taken to ensure employees understand their contracts and have the ability to review and adjust them if actual hours regularly exceed contracted hours
  • Activities that support an environment where staff are educated about, and feel empowered to, address their physical wellbeing
  • Activities that support an environment where staff are educated about and feel empowered to report and address bullying and harassment
  • Offer a pay and leave entitlement to all eligible staff who become kinship carers, ideally equivalent to statutory adoption pay and leave
  • Payment of more than the National Minimum Wage or National Living Wage (as appropriate) to the contract workforce
  • Entitlement to sick pay for the contract workforce, with provision in place for any staff who do not meet the earnings threshold for statutory sick pay, payment of sick pay from day one of absence and payment of staff on the contract workforce who are off sick a replacement income of 100% of their usual earnings for as long as possible
  • Volunteering opportunities for staff
  • Understanding of the modern slavery risks and issues affecting the market, industry, sector or country (of origin or of source) relevant to the contract, and the workforce in the supplier’s own organisation and those of its key subcontractors

  Policy Outcome 2: Skills for growth: Supporting growth sectors and addressing skills gaps.

  • Understanding of employment and relevant skills issues, and of the education and training issues relating to the contract. Illustrative examples: demographics, skills shortages, new opportunities in high growth sectors, geographic/local community and skills/employment challenges

  Policy Outcome 3: Resilient, innovative and flexible supply chains: Support economic growth through enabling resilient businesses, opportunities for small businesses and voluntary, community and social enterprises

  • Understanding of the types of businesses in the market and the level of participation by new businesses, entrepreneurs, start-ups, SMEs, VCSEs and mutuals
  • Activities to identify opportunities to open up sub-contracts under the prime contract to a diverse range of businesses, including new businesses, entrepreneurs, start-ups, SMEs, VCSEs and mutuals
  • Plans for engaging a diverse range of businesses in engagement activities prior to appointing subcontractors (including activities prior to award of the main contract and during the contract term)
  • Ensuring accessibility to contracting and subcontracting opportunities for disabled business owners and employees
  • Structuring of the supply chain selection process to ensure fairness (e.g. anti-corruption) and encourages participation by a diverse range of businesses, including with regard to new businesses, entrepreneurs, start-ups, SMEs, VCSEs and mutual
  • Understanding of local demographics, needs and opportunities for the co-design of the goods, services and works to be delivered under the contract
  • Methods for engaging with different parts of the community (including the education system and charities representing the community) and how communities come together to inform decisions, strategy and projects to leave a positive legacy for future generations
• Mission: Make Britain a clean energy superpower:

  To cut bills, create jobs and deliver security with cheaper, zero-carbon electricity by 2030, accelerating to net zero

  Policy Outcome 4: Sustainable procurement practices: Reducing carbon footprints, minimising waste, and promoting the use of clean energy and green technologies.

  • Understanding of opportunities for additional environmental benefits delivery in the performance of the contract, including working towards net zero carbon emissions and use of clean energy and green technologies
  • Understanding of how to influence staff, suppliers, customers, communities and/or any other appropriate stakeholders through the delivery of the contract to support climate and nature protection and improvement
  • Activities to reconnect people with the environment and increase awareness of ways to protect and enhance it
• Mission: Break down barriers to opportunity:

  By reforming our childcare and education systems, to make sure there is no class ceiling on the ambitions of young people in Britain

  Policy Outcome 6: Employment and training: For those who face barriers to employment

  • Understanding of employment and skills issues, and of the skills and employment shortages of high growth sectors relating to the contract
  • Understanding of the issues affecting the representation of disabled people in the workforce in the market, industry or sector relevant to the contract, and in the supplier’s own organisation and those of its key sub-contractors
  • Collection of the views and expertise of disabled people and their representative organisations on successfully supporting disabled employees or applicants
  • Inclusive and accessible recruitment practices, and retention-focused activities, including those provided in the Guide for line managers on recruiting, managing and developing people with a disability or health condition
  • Introducing transparency to pay and reward processes
  • Working conditions which promote an inclusive working environment and promote retention and progression
  • Understanding of the issues affecting inequality in employment, skills and pay in the market, industry or sector relevant to the contract, and in the supplier’s own organisation and those of its key sub-contractors. Measures to tackle inequality in employment, skills and pay in the contract workforce
  • Inclusive and accessible development practices, including guidance for line managers on recruiting, managing and developing people with a disability or health condition

  Policy Outcome 7: Creating a pipeline of opportunities: For the contract workforce, reducing barriers to entry for under-represented groups.

  • Understanding of the issues affecting the development of new skills by target cohort
  • Understanding of the underlying factors affecting improvements to reduce barriers to entry and training schemes for the target cohort(s) related to the contract workforce
  • Understanding of issues relating to entering the contract workforce
  • Advertising, promotional and outreach activities designed to raise awareness of the offer to reach the target cohort
• Mission: Build an NHS fit for the future:

  That is there when people need it; with fewer lives lost to the biggest killers; in a fairer Britain, where everyone lives well for longer.

  Policy Outcome 8: Increasing productivity through physical and mental wellbeing: In the supply chain and communities in the relevant area.

  • Understanding of issues relating to health and wellbeing, including physical and mental health, in the contract workforce
  • Understanding barriers to access to health and social care services or employment opportunities e.g. digital inclusion
  • Inclusive and accessible recruitment practices, development practices and retention policies that support-focused activities including those provided in the Guide for line managers on recruiting, managing and developing which support people with a disability or health condition

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at jadep@learnprogroup.com. Tell them what format you need. It will help if you say what assistive technology you use.