Energy and Compliance Technology Ltd

C365Cloud Compliance Management System for Local Authorities

C365Cloud is designed to support organisations audit, manage, and improve their level of statutory compliance and FM inspections.

The document repository can be accessed for all compliance certificates, reports, policies, procedure, CAD plans, O&M Manuals and lease documents, allowing organisations to proactively manage compliance and subsequent actions.

Features

• Real-time, RAG compliance dashboards to determine compliance status.
• Scheduled and bespoke management reports.
• Full audit trail to see who viewed/downloaded documents.
• Unique extractor tool automatically extracts actions from electronic survey reports.
• Unlimited browser-based users.
• Mobile working offers cross platform support across IOS/Android/Windows.
• Modular Design with over 100 distinct modules.
• Quickly upload and categorise thousands of historic electronic reports.
• Bespoke and unlimited forms, configurable for any survey type.
• Provides management of all third-party suppliers and internal operatives.

Benefits

• Manage by Exception with automated alerts and scheduled reporting.
• Reduce administration errors, cost & time by automating workflows.
• Make compliance management more efficient with improved auditability.
• Highlight/manage actions derived from compliance and PPM inspections.
• One system for all compliance areas.
• Drive improvement in Supply Chain SLA and KPI Performance.
• Identity staff/contractor workload – scheduled inspections and subsequent actions.
• Improve regional operatives' productivity and quality through mobile working.
• Save time by promoting a supply chain “self-service” methodology.
• ‘Legally defensible position’ - All data evidence based and auditable.

£66.00 a unit a month

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at sales@compliance365.co.uk. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 14

Service ID

425509943277935

Contact

Dominic Bateman
01924 669940
sales@compliance365.co.uk

Service scope

• Software add-on or extension: Yes, but can also be used as a standalone service
• What software services is the service an extension to: C365Cloud is a modular software. This means each C365Cloud module can work as a standalone module but can be seamlessly integrated with others to provide organisations with one system for compliance management.
• Cloud deployment model: Public cloud
• Service constraints: Access to the internet and a modern internet browser.
• System requirements: Internet access 1Mbps minimum

User support

• Email or online ticketing support: Email or online ticketing
• Support response times: Client specfic SLA timescales are applied
• User can manage status and priority of support tickets: Yes
• Online ticketing support accessibility: None or don’t know
• Phone support: Yes
• Phone support availability: 9 to 5 (UK time), Monday to Friday
• Web chat support: No
• Onsite support: Yes, at extra cost
• Support levels: Once the system has implemented the C365Cloud Help Desk manage in accordance with the following Key Performance Indicators;; ; Priority 1 – Core System Critical: downtime affecting all C365Cloud service users; Response time: Respond within 2 hours and recover within 4 working hours (During normal working hours) – 95%; ; Priority 2 – Incidents which result in an interruption to business performance but not causing major disruption; Response time: Respond within 8 hours and recover within 24 hours – 95%; ; Priority 3 – Bug Fix – Incident causing an individual disruption without a suitable work around and being available; Response time: 2 working days – 95%; ; Priority 4 – Minor Bug – Incident causing an individual disruption without a suitable work around being available; Response time: Next feature release
• Support available to third parties: Yes

Onboarding and offboarding

• Getting started: All clients receive direct support in on-boarding specific to their requirements.; ; We apply a “Just in Time” Training methodology to ensure maximum effectiveness in line with roles and responsibilities and relevant areas of C365Cloud. Our usual approach is train-the-trainer, which is typically the preferred approach of our clients. ; ; User manual PDFs covering all functions are also issued at mobilisation and re-issued by automated email ahead of new version releases. Role Specific User Manuals and ‘how to’ guides are also available to individual Users based on their level of access and/or responsibility via their various dashboards.
• Service documentation: Yes
• Documentation formats: PDF
• End-of-contract data extraction: All data is provided back to the client in a pre-agreed secure format.
• End-of-contract process: The end of contract process is agreed with the client at the start of the service.

Using the service

• Web browser interface: Yes
• Supported browsers:
  • Internet Explorer 11
  • Microsoft Edge
  • Firefox
  • Chrome
  • Safari
  • Opera
• Application to install: No
• Designed for use on mobile devices: Yes
• Differences between the mobile and desktop service: None
• Service interface: No
• User support accessibility: WCAG 2.1 A
• API: No
• Customisation available: Yes
• Description of customisation: C365Cloud has an outstanding level of customisation available to customers – permissions, forms, reports, dashboards, branding etc.

Scaling

• Independence of resources: Load balancing and automatic scaling of backend services are used to ensure demand is met for each client.

Analytics

• Service usage metrics: Yes
• Metrics types: Metrics supplied are based on client requirements.
• Reporting types: Reports on request

Resellers

• Supplier type: Not a reseller

Staff security

• Staff security clearance: Other security clearance
• Government security clearance: Up to Developed Vetting (DV)

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations: United Kingdom
• User control over data storage and processing locations: Yes
• Datacentre security standards: Complies with a recognised standard (for example CSA CCM version 3.0)
• Penetration testing frequency: At least once a year
• Penetration testing approach: ‘IT Health Check’ performed by a Tigerscheme qualified provider or a CREST-approved service provider
• Protecting data at rest:
  • Physical access control, complying with CSA CCM v3.0
  • Encryption of all physical media
• Data sanitisation process: Yes
• Data sanitisation type:
  • Explicit overwriting of storage before reallocation
  • Deleted data can’t be directly accessed
• Equipment disposal approach: Complying with a recognised standard, for example CSA CCM v.30, CAS (Sanitisation) or ISO/IEC 27001

Data importing and exporting

• Data export approach: Data can be exported directly from the website in a variety of formats.
• Data export formats:
  • CSV
  • Other
• Other data export formats:
  • PDF
  • Word
• Data import formats:
  • CSV
  • Other
• Other data import formats:
  • PDF
  • Word
  • Excel

Data-in-transit protection

• Data protection between buyer and supplier networks:
  • TLS (version 1.2 or above)
  • IPsec or TLS VPN gateway
  • Legacy SSL and TLS (under version 1.2)
• Data protection within supplier network:
  • TLS (version 1.2 or above)
  • IPsec or TLS VPN gateway

Availability and resilience

• Guaranteed availability: 99% System Availability
• Approach to resilience: Availability zones allow us to provide redundancy across 3 phisically separated loacations.
• Outage reporting: Email alerts

Identity and authentication

• User authentication needed: Yes
• User authentication:
  • 2-factor authentication
  • Identity federation with existing provider (for example Google Apps)
  • Username or password
• Access restrictions in management interfaces and support channels: Management access is limited based on client requirements using pre-defined roles based access.
• Access restriction testing frequency: At least every 6 months
• Management access authentication:
  • 2-factor authentication
  • Identity federation with existing provider (for example Google Apps)
  • Username or password

Audit information for users

• Access to user activity audit information: Users contact the support team to get audit information
• How long user audit data is stored for: At least 12 months
• Access to supplier activity audit information: Users contact the support team to get audit information
• How long supplier audit data is stored for: At least 12 months
• How long system logs are stored for: At least 12 months

Standards and certifications

• ISO/IEC 27001 certification: Yes
• Who accredited the ISO/IEC 27001: Simply Certification
• ISO/IEC 27001 accreditation date: 16/07/2021
• What the ISO/IEC 27001 doesn’t cover: N/A
• ISO 28000:2007 certification: No
• CSA STAR certification: No
• PCI certification: No
• Cyber essentials: Yes
• Cyber essentials plus: No
• Other security certifications: No

Security governance

• Named board-level person responsible for service security: Yes
• Security governance certified: No
• Security governance approach: We have a full Information Security Management System using ISO27001 Guidelines.
• Information security policies and processes: We have a full Information Security Management System using ISO27001 Guidelines.

Operational security

• Configuration and change management standard: Supplier-defined controls
• Configuration and change management approach: Our processes are aligned with ISO27001 and incorporate specific policies for change and release management.
• Vulnerability management type: Conforms to a recognised standard, for example CSA CCM v3.0 or SSAE-16 / ISAE 3402
• Vulnerability management approach: AWS Security Hub is used as a central point for internal vulnerability monitoring. This is composed of several additional services allowing for monitoring of Firewall, User and System configurations. In addition, AWS GuardDuty is utilised to monitor malicious activity and unauthorized behaviour.
• Protective monitoring type: Conforms to a recognised standard, for example CSA CCM v3.0 or SSAE-16 / ISAE 3402
• Protective monitoring approach: AWS GuardDuty is used to monitor malicious activity and unauthorized behaviour.
• Incident management type: Supplier-defined controls
• Incident management approach: Our incident management approach is aligned with ISO27001. Specific incident management policies are in place with named staff responsible for managing an incident. The policy is regularly reviewed.

Secure development

• Approach to secure software development best practice: Conforms to a recognised standard, but self-assessed

Public sector networks

• Connection to public sector networks: No

Social Value

• Social Value:

  Social Value

  • Fighting climate change
  • Covid-19 recovery
  • Tackling economic inequality
  • Equal opportunity
  • Wellbeing

  Fighting climate change

  At C365 we take great care in ensuring we are sustainable and are always looking for new ways to reduce our carbon footprint through the delivery of any contracts we partake in. We have a documented Environmental Policy detailing the company’s commitment to minimising our impact on the environment and as such we have reviewed our own carbon emissions to ensure we are reducing our carbon footprint.; Firstly, we have identified within our office space areas in which can be energy efficient and helps to keep our own carbon emissions low. We installed low energy technologies and our office space has an Energy Performance Certificate Rating of a B50, and we are on a green energy supplier tariff to ensure all of the electricity we use is matched with renewable energy. We report our carbon footprint annually, and work to proactively reduce our emissions and reach a target of NetZero for our Scope 1 & 2 emissions by 2025. ; We recognise that business meetings can have a detrimental impact on the environment. As a responsible organisation, we have taken measures to help mitigate this impact. We offer virtual meetings via Video Conferencing to minimize the amount of CO2 being emitted into the atmosphere. In addition, for our account team that attend face-to-face meetings with customers, we encourage the use of car sharing and public transportation to lower their carbon footprint. We believe that these small steps can contribute towards the bigger picture of environmental impact. ; Our fleet of vehicles has also been reviewed to ensure that staff drive company vehicles that minimise CO2 emissions (<99kg CO2). At least 60% of our fleet are fully electric or hybrid vehicles, with the aim to switch the entire fleet to electric or hybrid by 2025.

  Covid-19 recovery

  As part of or our Business Continuity plan, we included Covid-19 as a new risk area. Due to this, we carried out a detailed risk assessment resulting in updating our cleanliness policy. Furthermore, processes such as working from home and video call meetings were introduced to minimise risks. ; ; In addition to this we also aim to support the physical and mental health of our staff that have been affected by COVID-19 by offering support at work. We extend this to our supply chain by ensuring that the impacts of COVID-19 are reduced where possible including managing the way services are delivered to our customers to ensure safe working practices are adhered to.

  Tackling economic inequality

  C365Cloud (C365) offer a breadth of added value to contracts. ; • We engage locally in our recruitment process, including working collaboratively with universities and colleges to employ students and young people from different social and economic backgrounds. We strive to provide opportunities to develop skills through mentorship and give training in specialist areas with the view to offer full-time employment following the completion of studies. ; • We strive to maintain equality and fairness with economic opportunities for all employees through structured training and development plans with the goal of career enhancement.

  Equal opportunity

  C365 values and actively strives to have a diverse and inclusive workplace in a working environment free from discrimination. This is outlined in our 'Equality, Diversity and Inclusion' policy which details the procedures we strictly follow to uphold our commitment to equality. ; ; • Job applicants are treated equally, with our recruitment and selection process based on merit against specific objective criteria, and free from bias on the ground of gender, disability and race. ; • New employees undergo a structured induction and are all provided with in depth job plans, as well as the same initial training in Health & Safety and Cyber Security. ; • We strive to provide career-development opportunities through regular review meetings and training programmes that are suitable to individual needs and areas of growth.

  Wellbeing

  C365 is focused on continuously finding ways to improve the wellbeing of all employees. We aim to encourage an environment where wellbeing is an open conversation between employees and managers. We strive to promote wellbeing and reduce sickness related absence. ; ; • We actively encourage employee voice through anonymous staff surveys, which allows the Senior Management Team to review and implement any necessary changes based on feedback received. Improvements made following our most recent survey include but are not limited to; the extension of break entitlement and providing free, readily available sanitary products in staff toilets. ; • We aim to host biannual company presentations comprised of updates, team recognition awards and individual appreciation, and information regarding how we strive to improve further. ; • We support employees in discussing any wellbeing needs with their line manager or the senior management team to ensure the workplace can be adapted to meet the needs of each employee.; • We also strive to engage employees with their physical wellbeing, through employee led initiatives such as the run-club, where we regularly participate in charity running events.

Pricing

• Price: £66.00 a unit a month
• Discount for educational organisations: No
• Free trial available: No

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at sales@compliance365.co.uk. Tell them what format you need. It will help if you say what assistive technology you use.